# dry (Urho3D fork) — CWE-407 Scan Result: CLEAN

**Scanned:** 2026-03-29
**Repo:** https://github.com/nikibobi/dry (Urho3D fork)

## Findings

All hot-path dedup structures in dry use `HashSet<T>` or `HashMap<K,V>`:

| Hot Path | Container | O() |
|----------|-----------|-----|
| `Renderer::DrawDebugGeometry` processedGeometries/processedLights | `HashSet<Drawable*>` / `HashSet<Light*>` | O(1) |
| `AnimationController::Update` processedAnimations | `HashSet<StringHash>` | O(1) |
| `PhysicsWorld` currentCollisions / previousCollisions | `HashMap<Pair<...>, ManifoldPair>` | O(1) |
| `Scene` node/component registries | `HashMap<unsigned, Node*>` | O(1) |

`PODVector<RigidBody*>::Contains` in `PhysicsQueryCallback::addSingleResult`
is O(R) per contact point, but R is bounded by the number of bodies in the
query volume (typically < 10 in practice) and the method is not called
per-frame unless the game explicitly issues repeated overlap queries.

Node tag lookup `HasTag()` uses `StringVector::Contains` (O(T)), but T (tags
per node) is typically 1-3. Scene-level `GetNodesWithTag()` is backed by
`HashMap<StringHash, PODVector<Node*>>` — O(1) tag lookup.

No qualifying O(N²) defects found in any hot path.

**Verdict: CLEAN**