CLEAN — Mindustry (Anuken/Mindustry) — all 5 MOADs scanned 2026-03-31

Repository: https://github.com/Anuken/Mindustry
Version: HEAD (depth=1 clone)
Stars: 24.6k
Language: Java

## MOAD-0001 (CWE-407): CLEAN

Thorough scan of 817 Java source files across core/src/mindustry/.

Mindustry uses Arc library data structures throughout. Key findings:

- ObjectSet, IntSet, ObjectMap, ObjectIntMap used for all hot-path membership checks
- PowerGraph.reflow() uses IntSet closedSet for BFS visited tracking
- PayloadSeq uses ObjectIntMap internally (hash-based)
- BlockIndexer uses QuadTree for spatial queries, IntSet for position tracking
- Rules.objectiveFlags is ObjectSet<String>
- Mods.ModResolutionContext uses ObjectSet for visited, OrderedSet for ordered
- EntityGroup uses IntMap for entity ID mapping

Seq.contains() calls found but all are:
1. Predicate-based (lambda searching by property, not identity membership)
2. On small fixed-size collections (weapons, plans, requirements, block flags)
3. In non-hot paths (UI, connection-time, init, config changes)

Administration.bannedIPs/whitelist/subnetBans are Seq<String> with contains()
calls, but only checked per-connection (not per-tick). Typical N < 100.

BlockIndexer.IntSeq.addUnique() for ore quadrants is O(N) but N is bounded
by quadrant size (20x20 = 400 tiles max per quadrant per ore type).

No O(N^2) patterns found in game-tick paths, entity update loops,
pathfinding, power graph updates, or network sync code.

## MOAD-0002 (Intertangle): NOTED but not patchable

Vars.java is a classic god object with 40+ public static mutable fields
(state, world, net, content, mods, renderer, ui, pathfinder, indexer,
spawner, controlPath, fogControl, logic, control, player, etc.).

Every subsystem accesses every other subsystem through these globals.
This is a deliberate architectural choice common in game engines,
especially modding-friendly ones. Fixing would require massive
architectural refactoring, not a patch.

## MOAD-0003 (Leaked Context): CLEAN

ThreadLocal usage found in:
- ArcNetProvider: decompression buffers (infrastructure, not request-scoped identity)
- ModClassLoader.inChild: recursion guard Boolean

No request-scoped identity leaked through ThreadLocal.

## MOAD-0004 (Logged Secret): CLEAN

No secrets (passwords, tokens, API keys) found in Log.info/warn/err calls.
Network code does not log authentication headers or credentials.

## MOAD-0005 (Thundering Herd): CLEAN

Game is largely single-threaded (game loop on main thread).
No cache get+miss+compute+put patterns without synchronization found.
The synchronized block in ArcNetProvider.discoverServers is a simple
lock for foundAddresses deduplication, not a thundering herd.