27 lines
1.4 KiB
Markdown
27 lines
1.4 KiB
Markdown
# CLEAN — Solana
|
|
|
|
Scanned 2026-03-30 for CWE-407.
|
|
|
|
## Scope
|
|
|
|
- `runtime/src/bank.rs` — transaction processing, account key iteration
|
|
- `runtime/src/non_circulating_supply.rs` — stake account stake authority check
|
|
- `core/src/repair/repair_service.rs` — slot repair range
|
|
- `core/src/banking_stage/`, `core/src/consensus/` — deduplication paths
|
|
|
|
## Findings
|
|
|
|
| Location | Pattern | Data Structure | Result |
|
|
|----------|---------|----------------|--------|
|
|
| `bank.rs:4671` | `debug_keys.contains(key)` per account key | `HashSet<Pubkey>` | CLEAN |
|
|
| `bank.rs:4692` | `mentioned_addresses.contains(key)` per account key | `HashSet<Pubkey>` | CLEAN |
|
|
| `non_circulating_supply.rs:56` | `withdraw_authority_list.contains(addr)` in stake loop | `&[Pubkey]` slice, fixed N=10 | LOW — constant factor, not scaling |
|
|
| `repair_service.rs:1346` | `slots.contains(&slot_index)` in map closure | `Vec<u64>` | TEST CODE ONLY |
|
|
| `banking_stage/read_write_account_set.rs` | per-account contains | `HashSet<Pubkey>` | CLEAN |
|
|
| `consensus/vote_stake_tracker.rs` | voted.contains | `HashSet<Pubkey>` | CLEAN |
|
|
|
|
The `withdraw_authority_list` contains exactly 10 hard-coded program addresses (a fixed constant).
|
|
The per-stake-account linear scan is O(10) per account — effectively O(1), not a scaling defect.
|
|
The `repair_service.rs` instance is in a test helper, not production code.
|
|
|
|
**Result: No actionable CWE-407 defects.**
|