Package launderrvictim is the /r/-DATA-DECLARED variant of the launder-game victim. Its Immutable type is declared HERE (in /r/), not in /p/launderpkg. This is the recommended inter-realm pattern: realms declare their own logic data types.
The hypothesis under test: with /r/-declared logic data, the Attack H/I/J/K/L laundering shapes are structurally impossible. Tests against this victim should all fail to mutate gImm.
ApplyHook dispatches a caller-supplied callback on gImm. The callback's parameter type is /r/launderrvictim-declared, so /p/ packages can't supply this hook — only /r/ realms can.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ApplyHook()"CallPDeferApply: multi-level defer chain. Victim invokes a /p/-method (DeferApply) on a victim-owned *launderpkg.Immutable; the /p/-method defers the attacker callback. Three frames at callback time: attacker.main → victim.CallPDeferApply → /p/.DeferApply (deferred fn dispatches here).
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.CallPDeferApply()"CallThenPanic invokes h synchronously and then panics. If h is attacker-supplied and writes via captured pointer, this is just a re-shape of ApplyHook.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.CallThenPanic()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ClearHooks()"DeferApplyHook defers an ApplyHook call. The deferred ApplyHook itself runs borrow rule #1 to /r/launderrvictim, and inside the callback runs as borrow rule #1 of the attacker's realm — the standard known-open Apply pattern, but now triggered via defer.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.DeferApplyHook()"DeferCallback installs h as a defer inside an /r/launderrvictim frame, then returns. h runs at frame pop. The question: at the time h is invoked, m.Realm has just been restored to caller's realm by PopFrameAndReturn — but wait, defers run BEFORE PopFrameAndReturn. So m.Realm should still be victim's. Does the deferred h then run under victim authority?
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.DeferCallback()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetBareArr()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetBareMap()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetBarePtrArr()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetBarePtrMap()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetBarePtrSlice()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetBareSlice()"MakeApplyTrampoline returns a closure that captures &gImm.Field indirectly: it captures *Immutable, and dispatches a caller-supplied callback fn on it. /r/-victim-declared body → borrow rule #1 → m.Realm = /r/-victim. If `fn` is /p/-declared (e.g. EvilWrite), it inherits victim authority. This is "victim returns a closure that's itself an Apply-style trampoline" — a packaged Apply.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.MakeApplyTrampoline()"MakeWriterClosure constructs a /r/-victim-declared closure that captures gImm and writes through it. The closure body is /r/-victim- declared, so borrow rule #1 fires at invocation → m.Realm = /r/-victim → write commits with victim authority. Returning this closure to an attacker is "consenting to write" by the victim.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.MakeWriterClosure()"PanicAfterPushDefer pushes a defer and then panics, so the defer runs as part of panic unwinding. Tests that m.Realm is correctly borrowed when the defer body invokes a foreign function.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.PanicAfterPushDefer()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBareArr0()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBareEmbed()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBareMapA()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBarePtr()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBarePtrArr0()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBarePtrMapA()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBarePtrSlice0()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBareSlice0()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBareSlice0Then1()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadBareVal()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadEmbed()"ReadImm reads the current field for after-attack verification.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadImm()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadPtr()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.ReadVal()"RecoverAndRetry: inside a victim method, defer a recover, write something to gImm, then panic. After the recover, the function returns normally. Tests that internal panic/recover doesn't leak state.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.RecoverAndRetry()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.RegisterHook()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.RegisterPlainHook()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.RunHooks()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.RunPlainHooks()"UseAnyMutator boxes gImm as any and dispatches a /p/-declared AnyMutator. This is the dangerous shape from Attack L: victim boxes its own /r/-declared data through a /p/-defined interface that the attacker can implement.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.UseAnyMutator()"GetImm hands out a pointer to gImm. Standard "victim exposes a pointer to its state" antipattern — but with /r/-declared data, the attacker should still be unable to write through it.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetImm()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetWithBareEmbed()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetWithBarePtr()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetWithBareVal()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetWithEmbed()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetWithPtr()"gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/launderrvictim.GetWithVal()"