engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

distlib/luigi/zookeeper/mybatis/solc/solana/go-ethereum: CWE-407 patches + unit tests; solana CLEAN

Browse source
This commit is contained in:
russell@unturf.com 2026-03-30 07:06:26 -04:00
parent c9e86c450c
commit b4e2eda927
17 changed files with 2087 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

27
defects/solana/patch/CLEAN.md Normal file
View file

@ -0,0 +1,27 @@
# CLEAN — Solana
Scanned 2026-03-30 for CWE-407.
## Scope
- `runtime/src/bank.rs` — transaction processing, account key iteration
- `runtime/src/non_circulating_supply.rs` — stake account stake authority check
- `core/src/repair/repair_service.rs` — slot repair range
- `core/src/banking_stage/`, `core/src/consensus/` — deduplication paths
## Findings
| Location | Pattern | Data Structure | Result |
|----------|---------|----------------|--------|
| `bank.rs:4671` | `debug_keys.contains(key)` per account key | `HashSet<Pubkey>` | CLEAN |
| `bank.rs:4692` | `mentioned_addresses.contains(key)` per account key | `HashSet<Pubkey>` | CLEAN |
| `non_circulating_supply.rs:56` | `withdraw_authority_list.contains(addr)` in stake loop | `&[Pubkey]` slice, fixed N=10 | LOW — constant factor, not scaling |
| `repair_service.rs:1346` | `slots.contains(&slot_index)` in map closure | `Vec<u64>` | TEST CODE ONLY |
| `banking_stage/read_write_account_set.rs` | per-account contains | `HashSet<Pubkey>` | CLEAN |
| `consensus/vote_stake_tracker.rs` | voted.contains | `HashSet<Pubkey>` | CLEAN |
The `withdraw_authority_list` contains exactly 10 hard-coded program addresses (a fixed constant).
The per-stake-account linear scan is O(10) per account — effectively O(1), not a scaling defect.
The `repair_service.rs` instance is in a test helper, not production code.
**Result: No actionable CWE-407 defects.**