russell@unturf.com a7b08c7e05 blockchain-p2p: solang/tor/bitcoin/transmission/libtorrent/solc CWE-407 scan

solang-0001: add_external_functions emits_events Vec::contains O(F×E²) MEDIUM
  src/sema/external_functions.rs:93-103 — dedup accumulator Vec uses linear scan
  for each event per function; fix: IndexSet (already a dependency) for O(1) dedup

tor/bitcoin/transmission/libtorrent/solc: CLEAN markers added after full scan
  Tor: nodes_have_common_family_id F=1-3 IDs, O(N×F²) ≈ O(9N), not scalable issue
  Bitcoin: TxGraph/sets throughout, no linear scan in hot paths
  Transmission: bitfields for piece tracking, sorted binary search for string table
  libtorrent: sorted vectors with lower_bound, DHT uses binary search on results
  solc: unordered_set/set throughout OverrideChecker, SMTEncoder, FunctionCallGraph

2026-03-29 19:49:57 -04:00

1.1 KiB

Raw Blame History

CLEAN — solc (Solidity compiler)

Scanned 2026-03-29 for CWE-407 (algorithmic complexity / linear scan membership).

Areas Checked

libsolidity/analysis/OverrideChecker.cpp — inheritance graph cut-vertex algorithm: uses std::vector<bool> as a bitset indexed by node number — O(1) per visited check.
libsolidity/analysis/FunctionCallGraph.cpp — call graph construction: no linear membership checks; uses sets and maps throughout.
libsolidity/ast/Types.cpp — type resolution: seen is std::unordered_set<std::string> at line 1522 — O(1) membership test. seenFunctions is std::set — O(log N).
libsolidity/formal/SMTEncoder.cpp — modifier visited tracking: std::set<ModifierDefinition const*> at line 3006 — O(log N) insert and lookup.
libsolidity/formal/CHC.cpp — error dedup: std::set<unsigned> — O(log N).
libsolidity/formal/Z3CHCSmtLib2Interface.cpp — visitedIds: hash-based, O(1).

Result: No actionable CWE-407 defects found. solc uses unordered_set and set consistently for membership tracking in all graph/traversal algorithms.

1.1 KiB Raw Blame History

CLEAN — solc (Solidity compiler)

Areas Checked

1.1 KiB

Raw Blame History