Struct GuardWalker 

struct GuardWalker<'a, 'gcx> {
    cx: Cx<'gcx>,
    recipient: VariableId,
    token: VariableId,
    delegations: &'a [FunctionId],
    unstable_code_delegations: &'a [FunctionId],
    seen: &'a mut Vec<FunctionId>,
}

Reads a body in statement order and judges the delegated mints against the guards for recipient and token. A code-less proof may cover a later delegation, but a callback must run after ownership is established to match _safeMint: the receiver can inspect ownerOf, balances, or reenter during the hook. Such a callback covers delegations still pending, the revert undoing them, unless a statement in between may leave the function successfully, keeping the unacknowledged token: super._mint(to, id); if (id == 0) return; require(hook...) walks out with token zero standing.

The recognized guard shapes are a closed set, because a hook call that merely appears inside a condition proves nothing about whether the revert depends on its answer. They are: require/assert on an acceptance condition, if (hook != selector) <exits>, if (hook == selector) {} else <exits>, and any of those reached through a function or modifier. A callback helper receives both identities, the way OpenZeppelin factors _checkOnERC721Received out of _safeMint; a code-less proof needs only the recipient.

Branches are read separately and merged. The branch a to.code.length test dedicates to accounts starts covered, an account always accepting the token. A loop body may run zero times, so nothing in one is credited, while the delegations and escapes it may hold still count.

Everything else reports, a try whose catch may swallow the refusal included, and so are an answer stored in a local and a helper returning it as a bool. Following the value across statements would take a dataflow analysis this detector does not run.

Fields

cx: Cx<'gcx>

recipient: VariableId

token: VariableId

delegations: &'a [FunctionId]

The callees that are unsafe mints, and those among them that may change account code.

unstable_code_delegations: &'a [FunctionId]

seen: &'a mut Vec<FunctionId>

Implementations

impl<'gcx> GuardWalker<'_, 'gcx>

fn walk(&mut self, stmts: &'gcx [Stmt<'gcx>], walk: &mut GuardWalk)

fn mutates(&self, stmt: &'gcx Stmt<'gcx>) -> bool

fn may_change_account_code( &self, stmts: &'gcx [Stmt<'gcx>], expr: Option<&'gcx Expr<'gcx>>, ) -> bool

Cx::stmts_may_change_account_code for the walked delegations, over a statement or only the given expression of it.

fn guard_expr_coverage(&mut self, expr: &'gcx Expr<'gcx>) -> GuardCoverage

A statement expression that guards the recipient and the token: require/assert on an acceptance condition, or an internal call handing both to a helper that does. Only the condition is read: a hook call sitting in the revert message decides nothing. An external helper would ask from a different contract and cannot establish that the recipient accepts the minting contract’s callback.

fn guard_extra_args_may_change_account_code( &self, expr: &'gcx Expr<'gcx>, ) -> bool

Whether a recognized require/assert has another argument that may change account code. The first argument is the closed-form acceptance condition itself; its receiver callback is part of the proof. Solidity does not guarantee that the other arguments run before the condition’s code-length snapshot.

fn acceptance_coverage(&self, cond: &'gcx Expr<'gcx>) -> GuardCoverage

The condition of a require/assert that passes only if the recipient can receive the token: the recipient is proven code-less, the hook comparison succeeds, or the short circuit to.code.length == 0 || hook == sel accepts either case.

fn is_hook_call_on(&self, expr: &'gcx Expr<'gcx>) -> bool

recipient.onERC721Received(..., token, ...): the hook, asked of the recipient itself and about the delegated token itself. An answer about a different id decides nothing for the minted one.

fn is_hook_comparison(&self, expr: &'gcx Expr<'gcx>, want: BinOpKind) -> bool

recipient.onERC721Received(...) <op> x, and nothing else. The comparison must be the whole expression: in to == trusted || hook(to) == selector the hook never runs for trusted. The other operand must be able to hold the accepting answer, and must not be a hook call itself, which would compare the recipient against itself.

fn is_code_length_test(&self, expr: &'gcx Expr<'gcx>, has_code: bool) -> bool

recipient.code.length compared against zero, for one polarity. Nothing else may ride along: in to.code.length > 0 && id == 5 the second operand decides whether the branch runs.

Layout

Note: Most layout information is completely unstable and may even differ between compilations. The only exception is types with certain repr(...) attributes. Please see the Rust Reference's “Type Layout” chapter for details on type layout guarantees.

Size: 56 bytes