fix(checks): avoid false positives for storage writes and admin guards

crates/checks/src/admin.rs

@@ -7,7 +7,7 @@ use crate::util::{
 use crate::{Check, Finding, Severity};
 use syn::spanned::Spanned;
 use syn::visit::{self, Visit};
-use syn::{Block, ExprIf, ExprMethodCall, File, Visibility};
+use syn::{Block, Expr, ExprIf, ExprMethodCall, File, Visibility};
 
 const CHECK_NAME: &str = "unprotected-admin";
 
@@ -131,7 +131,10 @@ fn expr_diverges(expr: &Expr) -> bool {
         Expr::Return(_) => true,
         Expr::Macro(expr) => expr.mac.path.is_ident("panic"),
         Expr::MethodCall(expr) => {
-            matches!(expr.method.to_string().as_str(), "require_auth" | "require_auth_for_args")
+            matches!(
+                expr.method.to_string().as_str(),
+                "require_auth" | "require_auth_for_args"
+            )
         }
         Expr::Block(expr) => block_diverges(&expr.block),
         Expr::If(expr) => {
@@ -197,7 +200,12 @@ impl<'ast> Visit<'ast> for AuthGateScan {
     fn visit_expr_if(&mut self, i: &'ast ExprIf) {
         let had_tracked_var = !self.storage_read_vars.is_empty();
         visit::visit_expr_if(self, i);
-        if had_tracked_var && !self.storage_read_and_conditional {
+        let branch_diverges = block_diverges(&i.then_branch)
+            || i
+                .else_branch
+                .as_ref()
+                .is_some_and(|(_, branch)| expr_diverges(branch));
+        if had_tracked_var && branch_diverges && !self.storage_read_and_conditional {
             let all_names: Vec<String> = self
                 .storage_read_vars
                 .iter()
@@ -230,7 +238,10 @@ fn expr_references_any(expr: &syn::Expr, names: &std::collections::HashSet<Strin
             visit::visit_expr_path(self, node);
         }
     }
-    let mut v = RefVisitor { names, found: false };
+    let mut v = RefVisitor {
+        names,
+        found: false,
+    };
     visit::visit_expr(&mut v, expr);
     v.found
 }

crates/checks/src/missing_nonce.rs

@@ -1,4 +1,4 @@
-use crate::util::{contractimpl_functions_excluding_test, receiver_chain_contains_storage};
+use crate::util::{contractimpl_functions_excluding_test, is_storage_mutation_call};
 use crate::{Check, Finding, Severity};
 use syn::visit::{self, Visit};
 use syn::FnArg;
@@ -61,11 +61,7 @@ struct StorageWriteVisitor {
 
 impl<'ast> Visit<'ast> for StorageWriteVisitor {
     fn visit_expr_method_call(&mut self, node: &'ast syn::ExprMethodCall) {
-        if matches!(
-            node.method.to_string().as_str(),
-            "set" | "remove" | "append" | "push" | "push_back"
-        ) && receiver_chain_contains_storage(&node.receiver)
-        {
+        if is_storage_mutation_call(node) {
             self.found_write = true;
         }
         visit::visit_expr_method_call(self, node);
@@ -273,7 +269,8 @@ impl C {
         let findings = check.run(&file, src);
         assert!(
             findings.is_empty(),
-            "tx_nonce should be recognised as nonce protection, got: {:?}", findings
+            "tx_nonce should be recognised as nonce protection, got: {:?}",
+            findings
         );
         Ok(())
     }

docs/checks.md

@@ -656,7 +656,7 @@ Soroban contracts run under a fixed compute-budget cap. An unbounded loop can ex
 Public methods in `#[contractimpl]` that:
 
 1. Accept at least one `Address` parameter, and
-2. Perform a storage write (`set`, `remove`, `append`, `push`, or `push_back`), and
+2. Perform a storage write (`set`, `remove`, or `append`), and
 3. Contain no reference to a nonce or replay-protection identifier — specifically, no identifier matching `nonce`, `sequence`, `seq_num`, or `replay` in the function body.
 
 **Why it matters**