monogame-0001: IntermediateWriter.WriteSharedResources writtenSharedResources
List<string>.Contains in while loop O(R^2), fix: HashSet<string> MEDIUM
monogame-0002: IntermediateSerializer._scannedObjects List<object>.Contains
per object during scan O(N^2), fix: HashSet<object> MEDIUM
monogame-0003: OpenAssetImporter._bones List<Node>.Contains in recursive
tree import O(N*B), fix: HashSet<Node> MEDIUM
MOAD-0002 through 0005: CLEAN (single-threaded game framework, no secrets,
no leaked context, no thundering herd)
sparrow-0001: WalletUtxosEntry.updateUtxos() ArrayList.removeAll O(N^2)
UTXO diff uses List.removeAll which is O(current * previous).
Fix: Set-based diff via Sets.difference (same pattern already used
in WalletTransactionsEntry). MEDIUM, 250x at N=1000 UTXOs.
sparrow-0002: UtxoEntry.recountMixesDone stream().anyMatch O(M*I*T)
Whirlpool mix chain walk streams all wallet TXOs per input per mix.
Fix: HashMap<Sha256Hash, Set<Long>> index for O(1) lookup.
MEDIUM-HIGH, 50x at M=200 mixes, T=1000 TXOs.
MOAD-0002 (Intertangle): EventManager is a thin Guava EventBus singleton,
not a god object. Wallet/network/UI coupling is event-driven, acceptable.
MOAD-0003 (Leaked Context): CLEAN, no ThreadLocal usage found.
MOAD-0004 (Logged Secret): CLEAN, no private keys/mnemonics/passphrases
logged. SecureChannelSession has commented-out secret logging.
MOAD-0005 (Thundering Herd): CLEAN, no unsynchronized cache patterns.
4/4 unit tests PASS. UNDF-2026-000000931 through UNDF-2026-000000932.
CWE-407 array scans exist but bounded by Bitcoin consensus (p2ms max
n=20, taptree max depth 128). No adversarial scaling possible.
No intertangle, leaked context, logged secrets, or thundering herd.
wekan-0001: boards.js setNewLabelOrder indexOf in sort comparator O(L^2 logL) MEDIUM 808x
wekan-0002: cards.js moveToBoard filter+includes O(M*A) MEDIUM 58x
kodi: CLEAN for CWE-407 (proper maps/sets/contains throughout)
prusaslicer-0002: fix test N parameter for reasonable runtime
cleanup: remove .class artifacts from prusaslicer tests
gui_nicklist_add_nick calls gui_nicklist_search_nick which linearly
scans the nick linked list for each add. Joining a 2000-user IRC
channel causes O(N^2) work. Fix: hash table for O(1) dedup. 999x ratio.
Defect: export_amf.cc add_vertex() uses std::find on std::vector for every
vertex during AMF export. For meshes with V vertices, total cost is O(V²).
Fix: parallel unordered_map<vertex_str, size_t> for O(1) lookup.
Unit test: 5-16x ratio at V=500-5000, PASS.
openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects.
All targets use proper dict/set/frozenset for membership tests in hot paths.
litellm-0001: ProxyConfig._delete_deployment() checks model_id not in
combined_id_list (a plain Python list) for each router model ID during
config refresh. O(R*C) where R=router models, C=combined list. Fix:
convert to set before loop. MEDIUM severity, 6.5x at N=500. 1/1 PASS.
Haystack: no CWE-407 defects found. Uses dicts and sets throughout
for membership checks (scheduled_components set, storage dict, etc.).
vllm-0001: punica_wrapper/utils.py convert_mapping() calls
lora_index_to_id.index(x) per token in batch — O(B*L) where
B=batch_size, L=loaded_loras. Code has "TODO index can be slow"
comment. Fix: pre-build dict for O(1) lookup. 7x at B=2000/L=64.
Ollama: all slices.Contains on bounded slices (1-8 items).
LangChain: orchestration code, all membership bounded by k param.
