pysec - pysec-2023-306

PYSEC-2023-306

Vulnerability from pysec - Published: 2023-09-18 21:16 - Updated: 2024-11-21 14:23

Details

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins raw_call, create_from_blueprint and create_copy_of can be corrupted. For raw_call, the argument buffer of the call can be corrupted, leading to incorrect calldata in the sub-context. For create_from_blueprint and create_copy_of, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.

Each builtin has conditions that must be fulfilled for the corruption to happen. For raw_call, the data argument of the builtin must be msg.data and the value or gas passed to the builtin must be some complex expression that results in writing to the memory. For create_copy_of, the value or salt passed to the builtin must be some complex expression that results in writing to the memory. For create_from_blueprint, either no constructor parameters should be passed to the builtin or raw_args should be set to True, and the value or salt passed to the builtin must be some complex expression that results in writing to the memory.

As of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an internal function F, the issue is not present provided that the function calling F wrote to memory before calling F. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin.

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Impacted products

Name	purl
vyper	pkg:pypi/vyper

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vyper",
        "purl": "pkg:pypi/vyper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0b1",
        "0.1.0b10",
        "0.1.0b11",
        "0.1.0b12",
        "0.1.0b13",
        "0.1.0b14",
        "0.1.0b15",
        "0.1.0b16",
        "0.1.0b17",
        "0.1.0b2",
        "0.1.0b3",
        "0.1.0b4",
        "0.1.0b5",
        "0.1.0b6",
        "0.1.0b7",
        "0.1.0b8",
        "0.1.0b9",
        "0.2.1",
        "0.2.10",
        "0.2.11",
        "0.2.12",
        "0.2.13",
        "0.2.14",
        "0.2.15",
        "0.2.16",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.2.6",
        "0.2.7",
        "0.2.8",
        "0.2.9",
        "0.3.0",
        "0.3.1",
        "0.3.10rc1",
        "0.3.10rc2",
        "0.3.10rc3",
        "0.3.10rc4",
        "0.3.10rc5",
        "0.3.2",
        "0.3.3",
        "0.3.4",
        "0.3.5",
        "0.3.6",
        "0.3.7",
        "0.3.8",
        "0.3.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-42443",
    "GHSA-c647-pxm2-c52w"
  ],
  "details": "Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.\n\nEach builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory.\n\nAs of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin.",
  "id": "PYSEC-2023-306",
  "modified": "2024-11-21T14:23:02.752932+00:00",
  "published": "2023-09-18T21:16:00+00:00",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/vyperlang/vyper/issues/3609"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vyperlang/vyper/issues/3609"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-42443 (GCVE-0-2023-42443)

Vulnerability from cvelistv5 – Published: 2023-09-18 20:52 – Updated: 2024-09-24 18:57

Summary

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode. Each builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. As of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M

References

URL

Tags

	https://github.com/vyperlang/vyper/security/advis…	x_refsource_CONFIRM
	https://github.com/vyperlang/vyper/issues/3609	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	vyperlang	vyper	Affected: <= 0.3.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:23:38.521Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w"
          },
          {
            "name": "https://github.com/vyperlang/vyper/issues/3609",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vyperlang/vyper/issues/3609"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "vyper",
            "vendor": "vyperlang",
            "versions": [
              {
                "lessThanOrEqual": "0.3.9",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-42443",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T18:49:35.863475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T18:57:14.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vyper",
          "vendor": "vyperlang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.3.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.\n\nEach builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory.\n\nAs of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-18T20:52:33.664Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w"
        },
        {
          "name": "https://github.com/vyperlang/vyper/issues/3609",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vyperlang/vyper/issues/3609"
        }
      ],
      "source": {
        "advisory": "GHSA-c647-pxm2-c52w",
        "discovery": "UNKNOWN"
      },
      "title": "Vyper vulnerable to memory corruption in certain builtins utilizing `msize`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-42443",
    "datePublished": "2023-09-18T20:52:33.664Z",
    "dateReserved": "2023-09-08T20:57:45.572Z",
    "dateUpdated": "2024-09-24T18:57:14.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-C647-PXM2-C52W

Vulnerability from github – Published: 2023-09-20 23:05 – Updated: 2024-11-22 20:40

Summary

Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

Details

Impact

In certain conditions, the memory used by the builtins raw_call, create_from_blueprint and create_copy_of can be corrupted.

For raw_call, the argument buffer of the call can be corrupted, leading to incorrect calldata in the sub-context.
For create_from_blueprint and create_copy_of, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.

Below are the conditions that must be fulfilled for the corruption to happen for each builtin:

`raw_call`

memory is not fully initialized, ex. all parameters to an external function live in calldata and
The data argument of the builtin is msg.data. and
The to, value or gas passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)

`create_copy_of`

memory is not fully initialized, ex. all parameters to an external function live in calldata and
The value or salt passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)

`create_from_blueprint`

memory is not fully initialized, ex. all parameters to an external function live in calldata and
Either no constructor parameters are passed to the builtin or raw_args is set to True. and
The value or salt passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)

Note: When the builtin is being called from an internal function f from a function g, the issue is not present provided that g has written to memory before calling f.

Examples

`raw_call`

In the following contract, calling bar(1,1) will return:

ae42e95100000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000001

instead of:

ae42e95100000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001

identity: constant(address) = 0x0000000000000000000000000000000000000004

@external
def foo():
    pass

@internal
@view
def get_address()->address:
    a:uint256 = max_value(uint256) # 0xfff...fff
    return identity
@external
def bar(f:uint256, u:uint256) -> Bytes[100]:
    a: Bytes[100] = raw_call(self.get_address(), msg.data, max_outsize=100)
    return a

`create_copy_of`

In the following contract, after calling test(), the code deployed at self.created_address does not match the bytecode at target.

created_address: public(address)

@external
def test(target: address) -> address:
    # The expression in salt= is complex and will require to store to memory
    self.created_address = create_copy_of(target, salt = keccak256(_abi_encode(target)))
    return self.created_address

`create_from_blueprint`

In the following contract, after calling test(), the init bytecode used to create the contract deployed at the address self.created_address will not match the blueprint bytecode stored at target.

created_address: public(address)

salt: constant(bytes32) = keccak256("kebab")

@external
@payable
def test(target: address):
    # The expression in salt= is complex and will require to store to memory
    self.created_address = create_from_blueprint(target, code_offset=0, salt=keccak256(_abi_encode(target)))

Patches

issue tracking in https://github.com/vyperlang/vyper/issues/3609, patched in #3610

Workarounds

The complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin. For the last example above, it would be:

created_address: public(address)

salt: constant(bytes32) = keccak256("kebab")

@external
@payable
def test(target: address):
    salt: bytes32 = keccak256(_abi_encode(target))
    self.created_address = create_from_blueprint(target, code_offset=0, salt=salt)

References

Are there any links users can visit to find out more?

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.9"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "vyper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.4"
            },
            {
              "fixed": "0.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-42443"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-20T23:05:35Z",
    "nvd_published_at": "2023-09-18T21:16:13Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nIn certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted.\n\n- For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context.\n- For  `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.\n\nBelow are the conditions that must be fulfilled for the corruption to happen for each builtin:\n\n#### `raw_call`\n- memory is not fully initialized, ex. all parameters to an external function live in calldata\nand\n- The `data` argument of the builtin is `msg.data`.\nand\n- The `to`, `value` or `gas` passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)\n\n#### `create_copy_of`\n- memory is not fully initialized, ex. all parameters to an external function live in calldata\nand\n- The `value` or `salt` passed to the builtin is some complex expression that results in writing to  uninitialized memory (e.g. calling an internal function)\n\n#### `create_from_blueprint`\n- memory is not fully initialized, ex. all parameters to an external function live in calldata\nand\n- Either no constructor parameters are passed to the builtin or `raw_args` is set to True.\nand\n- The `value` or `salt` passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)\n\nNote: When the builtin is being called from an `internal` function `f` from a function `g`, the issue is not present provided that `g` has written to memory before calling `f`.\n \n#### Examples\n\n\n##### `raw_call`\n\nIn the following contract, calling `bar(1,1)` will return:\n\n``` Python\nae42e95100000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000001\n```\ninstead of:\n``` Python\nae42e95100000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001\n```\n\n```Python\nidentity: constant(address) = 0x0000000000000000000000000000000000000004\n\n@external\ndef foo():\n    pass\n\n@internal\n@view\ndef get_address()-\u003eaddress:\n    a:uint256 = max_value(uint256) # 0xfff...fff\n    return identity\n@external\ndef bar(f:uint256, u:uint256) -\u003e Bytes[100]:\n    a: Bytes[100] = raw_call(self.get_address(), msg.data, max_outsize=100)\n    return a\n```\n\n##### `create_copy_of`\nIn the following contract, after calling `test()`, the code deployed at `self.created_address` does not match the bytecode at `target`.\n\n``` Vyper\ncreated_address: public(address)\n\n@external\ndef test(target: address) -\u003e address:\n    # The expression in salt= is complex and will require to store to memory\n    self.created_address = create_copy_of(target, salt = keccak256(_abi_encode(target)))\n    return self.created_address\n```\n\n##### `create_from_blueprint`\nIn the following contract, after calling `test()`, the init bytecode used to create the contract deployed at the address `self.created_address` will not match the blueprint bytecode stored at `target`.\n\n``` Vyper\ncreated_address: public(address)\n\nsalt: constant(bytes32) = keccak256(\"kebab\")\n\n@external\n@payable\ndef test(target: address):\n    # The expression in salt= is complex and will require to store to memory\n    self.created_address = create_from_blueprint(target, code_offset=0, salt=keccak256(_abi_encode(target)))\n```\n### Patches\nissue tracking in https://github.com/vyperlang/vyper/issues/3609, patched in #3610 \n\n### Workarounds\n\nThe complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin. For the last example above, it would be:\n\n``` Vyper\ncreated_address: public(address)\n\nsalt: constant(bytes32) = keccak256(\"kebab\")\n\n@external\n@payable\ndef test(target: address):\n    salt: bytes32 = keccak256(_abi_encode(target))\n    self.created_address = create_from_blueprint(target, code_offset=0, salt=salt)\n```\n### References\n_Are there any links users can visit to find out more?_\n",
  "id": "GHSA-c647-pxm2-c52w",
  "modified": "2024-11-22T20:40:47Z",
  "published": "2023-09-20T23:05:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42443"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/issues/3609"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/pull/3610"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/commit/79303fc4fcba06994ee5c6a7baef57bdb185006c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-306.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vyperlang/vyper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vyper vulnerable to memory corruption in certain builtins utilizing `msize`"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2023-306

CVE-2023-42443 (GCVE-0-2023-42443)

GHSA-C647-PXM2-C52W

Impact

raw_call

create_copy_of

create_from_blueprint

Examples

raw_call

create_copy_of

create_from_blueprint

Patches

Workarounds

References

Tags

Sightings

Nomenclature

`raw_call`

`create_copy_of`

`create_from_blueprint`

`raw_call`

`create_copy_of`

`create_from_blueprint`