Arbitrary call with user-controlled target

Evidence summary #

EVM arbitrary .call(target, data) pattern does not exist in Solana BPF. Anchor CPIs use explicit account constraints. Factor N/A.

Detail #

Solana programs cannot make arbitrary external calls to user-supplied addresses; CPIs are constrained by account validation at the runtime level.

Methodology #

Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.

See the full factor methodology and distribution across all protocols →