russell@unturf.com
f92dc0f8aa
BTreeMap/BTreeSet throughout, sort+windows for dedup, stateless design. Rust type system prevents most MOAD patterns structurally.
11 lines
877 B
Text
11 lines
877 B
Text
CLEAN — all 5 MOADs scanned 2026-03-31
|
|
|
|
MOAD-0001 (CWE-407): CLEAN — no Vec linear search inside loops; BTreeMap/BTreeSet throughout; sort+windows for dedup
|
|
MOAD-0002 (Intertangle): CLEAN — no global mutable state; all statics are immutable constants
|
|
MOAD-0003 (Leaked Context): CLEAN — zero thread_local!; stateless library design
|
|
MOAD-0004 (Logged Secret): CLEAN — PrivateKey Debug redacted by secp256k1; no Display impl for raw keys
|
|
MOAD-0005 (Thundering Herd): CLEAN — SighashCache is local per-call; no shared caches
|
|
|
|
Source: https://github.com/rust-bitcoin/rust-bitcoin (depth=1 clone at ~/git/rust-bitcoin)
|
|
Scanned: bitcoin/src/, primitives/src/, p2p/src/, units/src/, hashes/, io/, base58/, bip158/, network/, crypto/
|
|
Key files examined: transaction.rs, psbt/mod.rs, taproot/mod.rs, bip158.rs, crypto/key.rs, bip32.rs, merkle_tree.rs, sighash.rs, bip152.rs
|