# CLEAN — libtorrent (C++ BitTorrent library)
Scanned 2026-03-29 for CWE-407 (algorithmic complexity / linear scan membership).

## Areas Checked

- `src/piece_picker.cpp` — piece selection: `have_peers` is `std::unordered_set` per
  piece_pos (O(1) count/insert). `m_recent_extents` is a `std::vector` capped at 5
  entries by design — the `contains()` scan is trivially O(1) in practice.
  `m_pieces` sorted vector uses `lower_bound` for O(log N) insert.
- `src/kademlia/traversal_algorithm.cpp` — DHT Kademlia traversal: `m_results` is a
  sorted vector; new entries use `std::lower_bound` for O(log N) insertion. Dedup
  is by node-ID comparison on the sorted prefix, not a full linear scan.
- `src/kademlia/routing_table.cpp` — routing table bucket management: `find_if` over
  per-bucket vectors (K=8 nodes per bucket by Kademlia protocol) — effectively O(1).
- `src/peer_list.cpp` — peer list: sorted multimap range lookups via
  `find_if(range.first, range.second, ...)` — O(k) over equal-range, not full list.
- `src/peer_connection.cpp` — `m_accept_fast` / `m_allowed_fast` / `m_suggested_pieces`
  scans: these lists are bounded by BitTorrent protocol constants
  (Fast Extension caps at 10 pieces, Suggest Piece typically ≤10).

**Result: No actionable CWE-407 defects found. libtorrent uses sorted vectors with
binary search, unordered sets, and protocol-bounded lists throughout.**