1.7 KiB
Solana — CWE-407 Scan Result: CLEAN
Scanned: runtime/src/bank.rs, runtime/src/bank_forks.rs,
core/src/banking_stage/, core/src/consensus.rs,
runtime/src/non_circulating_supply.rs
Findings
All contains() calls on hot paths use proper O(1) data structures:
| File | Collection | Type | Verdict |
|---|---|---|---|
bank.rs:358 |
mentioned_addresses |
HashSet<Pubkey> |
CLEAN |
bank.rs:5379 |
rent_paying_pubkeys |
HashSet<Pubkey> |
CLEAN |
bank.rs:7335 |
new_feature_activations |
HashSet<Pubkey> |
CLEAN |
bank_forks.rs:67 |
descendants |
HashMap<Slot, HashSet<Slot>> |
CLEAN |
banking_stage/read_write_account_set.rs |
read_set, write_set |
HashSet<Pubkey> |
CLEAN |
consensus.rs:922 |
locked_out_vote_accounts |
HashSet |
CLEAN |
consensus.rs:883 |
last_vote_ancestors |
HashSet<Slot> |
CLEAN |
non_circulating_supply.rs:56 |
withdraw_authority_list |
&[Pubkey] (10 entries, cold path) |
CLEAN |
The non_circulating_supply.rs uses &[Pubkey].contains() on a static list
of 10 entries. This is called only on RPC queries for supply calculation, not
on the transaction hot path. Bounded and cold — not a defect.
consensus.rs descendants.iter().any() iterates a HashSet<u64> (descendant
slots per fork). The outer loop is bounded by active fork count, and the inner
HashSet .any() is O(D) but D is small and the structure is unavoidably
linear — no algorithmic improvement possible without restructuring fork tracking.
Not a CWE-407 defect.
Conclusion
Solana's banking and consensus hot paths are already using hash-based membership structures throughout. No CWE-407 defects found.