russell@unturf.com
a629bd0bbf
New defects (all PASS): - exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20 - minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24 - minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N) - minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N) - minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N) - mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000 - ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x - pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup, prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools, linux-kernel (pointer to linux/)
35 lines
1.7 KiB
Markdown
35 lines
1.7 KiB
Markdown
# Solana — CWE-407 Scan Result: CLEAN
|
|
|
|
**Scanned:** `runtime/src/bank.rs`, `runtime/src/bank_forks.rs`,
|
|
`core/src/banking_stage/`, `core/src/consensus.rs`,
|
|
`runtime/src/non_circulating_supply.rs`
|
|
|
|
## Findings
|
|
|
|
All `contains()` calls on hot paths use proper O(1) data structures:
|
|
|
|
| File | Collection | Type | Verdict |
|
|
|------|-----------|------|---------|
|
|
| `bank.rs:358` | `mentioned_addresses` | `HashSet<Pubkey>` | CLEAN |
|
|
| `bank.rs:5379` | `rent_paying_pubkeys` | `HashSet<Pubkey>` | CLEAN |
|
|
| `bank.rs:7335` | `new_feature_activations` | `HashSet<Pubkey>` | CLEAN |
|
|
| `bank_forks.rs:67` | `descendants` | `HashMap<Slot, HashSet<Slot>>` | CLEAN |
|
|
| `banking_stage/read_write_account_set.rs` | `read_set`, `write_set` | `HashSet<Pubkey>` | CLEAN |
|
|
| `consensus.rs:922` | `locked_out_vote_accounts` | `HashSet` | CLEAN |
|
|
| `consensus.rs:883` | `last_vote_ancestors` | `HashSet<Slot>` | CLEAN |
|
|
| `non_circulating_supply.rs:56` | `withdraw_authority_list` | `&[Pubkey]` (10 entries, cold path) | CLEAN |
|
|
|
|
The `non_circulating_supply.rs` uses `&[Pubkey].contains()` on a static list
|
|
of 10 entries. This is called only on RPC queries for supply calculation, not
|
|
on the transaction hot path. Bounded and cold — not a defect.
|
|
|
|
`consensus.rs` `descendants.iter().any()` iterates a `HashSet<u64>` (descendant
|
|
slots per fork). The outer loop is bounded by active fork count, and the inner
|
|
`HashSet` `.any()` is O(D) but D is small and the structure is unavoidably
|
|
linear — no algorithmic improvement possible without restructuring fork tracking.
|
|
Not a CWE-407 defect.
|
|
|
|
## Conclusion
|
|
|
|
Solana's banking and consensus hot paths are already using hash-based membership
|
|
structures throughout. No CWE-407 defects found.
|