[woahwhattheheck]

Summary of the change

Adds a shared checks-effects-interactions model and a default CEI detector for the three related issues below. The model separates conditional paths, records bounded loop paths, and reports an interaction that precedes a storage effect on the same syntactic path. Token/SAC client calls are included alongside host contract calls.

The existing contribution now includes the detector index, differential rule mapping, and golden snapshot coverage, across twelve files.

Fixes / Closes

Closes #336
Closes #310
Closes #325

/claim #336
/claim #310
/claim #325

Motivation and context

• [DETECTOR] Analysis pass: checks-effects-interactions ordering model #336 provides the reusable CeiModel API with ordered effects and interactions.
• [DETECTOR] Cross-contract call before state write (CEI violation / reentrancy) #310 registers the high-severity SANCT_CEI finding and its remediation documentation.
• [DETECTOR] Reentrancy via SAC / token transfer callbacks #325 extends interaction recognition to token/SAC clients, including transfer and transfer_from.

This is bounded syntactic analysis. Closures, cross-function effects, dynamic dispatch, and unrecognized storage aliases are outside its scope; it is not a whole-program proof.

Dependencies

No new runtime dependency. Retained validation used the repository-pinned Rust 1.85.0 with default features disabled. The SMT/all-features configuration, full crate suite, and CLI remain unverified by that validation.

Type of change

• New feature (non-breaking change which adds functionality)
• Documentation and regression coverage

How Has This Been Tested?

The retained validation handoff reports:

• 9 CEI unit cases and 6 finding-code/registry checks passed.
• 3 detector-documentation checks, 5 differential checks, and 20 gallery checks passed.
• The CEI golden snapshot check passed.
• Formatting and Clippy checks passed with --no-default-features.

These are the prior implementation/validation results. Publication verified the existing branch and its twelve-file diff; no tests or builds were rerun during submission. No all-features, full-suite, or hosted-CI success is asserted.

Checklist

• Documentation for the detector and finding code is included.
• Focused tests and a golden snapshot are included.
• Source formatting and warning checks are recorded in the retained validation handoff.
• Full all-features and CLI validation remains pending.

GrantFox compensation request

I request sponsor review, acceptance, and applicable GrantFox OSS / Official Campaign bounty compensation for #336, #310, and #325 as the original @woahwhattheheck contributor. Please apply the sponsor/platform rules for per-issue eligibility and allocation, and process the reward payment for each accepted eligible issue to @woahwhattheheck. Please let me know if additional payout registration is required.

All three issues are labeled Maybe Rewarded; this affirmative payment request does not assume a fixed amount or an already granted award.

Source carrier: woahwhattheheck#15