[ITSYABOINEUTRAL]

Summary

Add cross-contract-call-in-loop check

What was solved

#843 — checks: add cross-contract-call-in-loop — invoke_contract / token client calls inside a loop body

Add a new Medium-severity check cross-contract-call-in-loop that flags env.invoke_contract, try_invoke_contract, or token::Client method calls (e.g. transfer) inside for/while/loop bodies within #[contractimpl] public methods (excluding #[cfg(test)]), reusing util receiver-chain helpers and existing Env-parameter-name detection, and skipping literal ranges of 3 or fewer iterations. Register it in all_checks_base(), document it in docs/checks.md, add a fixture pair under test-contracts/, add an examples/all-findings entry, and cover positive/negative/renamed-Env unit tests.

Addressed:

• Changed: crates/checks/src/large_loop.rs
• Create new module under crates/checks/src/ implementing the cross-contract-call-in-loop check with severity Medium.
• Flag env.invoke_contract, try_invoke_contract, and token::Client method calls (e.g. transfer) when inside a for/while/loop body.
• Only report inside #[contractimpl] public methods; exclude #[cfg(test)] code.

Changes

• crates/checks/src/large_loop.rs (modify)

Approach

1. Create crates/checks/src/cross_contract_call_in_loop.rs implementing the Medium-severity check: detect env.invoke_contract/try_invoke_contract and token::Client method calls inside for/while/loop bodies within #[contractimpl] public methods, excluding #[cfg(test)], reusing util receiver-chain and Env-parameter-name helpers, and skipping literal ranges of 3 or fewer iterations.
2. Register the new check in all_checks_base() in crates/checks/src/lib.rs.
3. Add a docs/checks.md section for cross-contract-call-in-loop with rule_url and suggestion.
4. Add a fixture pair under test-contracts/ and an examples/all-findings entry to satisfy registry_consistency.rs.
5. Add unit tests in the new module covering positive, negative, and renamed-Env cases.

Issues

Closes #843

[drips-wave]

@ITSYABOINEUTRAL Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits