# box2d — CWE-407 Scan Result: CLEAN

**Scanned:** 2026-03-29
**Repo:** https://github.com/erincatto/box2d (v3.x C rewrite)

## Findings

Box2D v3 is a complete rewrite in C. All membership / deduplication structures
use `b2HashSet` (open-addressing hash table defined in `src/table.h`):

- Broad-phase pair dedup: `b2HashSet` with `B2_SHAPE_PAIR_KEY(K1, K2)` — O(1)
- Island body/contact/joint tracking: array with direct ID indexing — O(1)
- Sensor overlap tracking: hash-set — O(1)

No `std::find`, no linear scan dedup loops found in any hot path.

**Verdict: CLEAN**