java-topology/defects/solana/patch/CLEAN.md

CLEAN — Solana

Scanned 2026-03-30 for CWE-407.

Scope

• runtime/src/bank.rs — transaction processing, account key iteration
• runtime/src/non_circulating_supply.rs — stake account stake authority check
• core/src/repair/repair_service.rs — slot repair range
• core/src/banking_stage/, core/src/consensus/ — deduplication paths

Findings

Location	Pattern	Data Structure	Result
bank.rs:4671	debug_keys.contains(key) per account key	HashSet<Pubkey>	CLEAN
bank.rs:4692	mentioned_addresses.contains(key) per account key	HashSet<Pubkey>	CLEAN
non_circulating_supply.rs:56	withdraw_authority_list.contains(addr) in stake loop	&[Pubkey] slice, fixed N=10	LOW — constant factor, not scaling
repair_service.rs:1346	slots.contains(&slot_index) in map closure	Vec<u64>	TEST CODE ONLY
banking_stage/read_write_account_set.rs	per-account contains	HashSet<Pubkey>	CLEAN
consensus/vote_stake_tracker.rs	voted.contains	HashSet<Pubkey>	CLEAN

The withdraw_authority_list contains exactly 10 hard-coded program addresses (a fixed constant). The per-stake-account linear scan is O(10) per account — effectively O(1), not a scaling defect. The repair_service.rs instance is in a test helper, not production code.

Result: No actionable CWE-407 defects.