The straight-line reading of a body: coverage once a guard has run on the path, pending
while a delegated mint has run with no guard before or after it yet, failed once a path
may leave the function successfully with such a mint standing, escaped once one may leave
before any guard ran.
Reads a body in statement order and judges the delegated mints against the guards for
recipient and token. A code-less proof may cover a later delegation, but a callback must
run after ownership is established to match _safeMint: the receiver can inspect ownerOf,
balances, or reenter during the hook. Such a callback covers delegations still pending, the
revert undoing them, unless a statement in between may leave the function successfully,
keeping the unacknowledged token: super._mint(to, id); if (id == 0) return; require(hook...)
walks out with token zero standing.
An unsafe mint target and whether every recursive hop preserves the recipient and token it
receives. A callback guard needs both guarantees, while a code-less-recipient proof needs
only the first.
How a path established that the recipient can receive the mint. Callback evidence remains
valid when summarizing a guard helper, while a code-less proof must be retired once a call
could deploy code at the recipient address. Whether the evidence can cover a future mint is
tracked separately by GuardWalk::future_coverage.
The OpenZeppelin contracts whose _mint skips the receiver check. ERC721 and
ERC721Upgradeable declare the unchecked _mint; in the v4 line, ERC721Consecutive and
ERC721ConsecutiveUpgradeable override it with a construction guard that forwards to the
base through super._mint, still without a receiver check. In v5 the Consecutive extension
overrides _update instead, and the two extra names match nothing.
Whether the variable cannot change between the delegation and the callback guard. An
intervening call can reenter and mutate a state variable after the mint reads it but before
the guard does. A local, a parameter, a constant or an immutable cannot be moved that way.
The statements before and after a modifierβs single top-level placeholder. More complicated
expansion shapes are left uncredited rather than guessing which paths execute the body.