Subject
typenum is a Rust library for type-level numbers evaluated at compile time. It provides UInt/UTerm for unsigned integers, PInt/NInt/Z0 for signed integers, B0/B1 for bits, and a TArr/ATerm type-level array of typed numbers. Type operators (Add, Sub, Mul, Div, Rem, Shl, Shr, BitAnd, BitOr, BitXor, Pow, Cmp, Sqrt, Log2, Gcd, ...) are implemented via trait resolution so arithmetic happens during type-checking. The crate is widely depended on by the cryptography and embedded ecosystems (e.g. generic-array, digest, rand).
Methodology
The published crate archive was unpacked and compared against the upstream paholg/typenum repository at the commit recorded in .cargo_vcs_info.json. The src/ and tests/ trees match byte-for-byte; the only differences from VCS are files explicitly listed in the Cargo.toml exclude field (.github/, clippy.toml, flake.lock, flake.nix, justfile, .envrc) and the offline generate/ workspace member used to produce the checked-in generated code. The packaged Cargo.toml differs from Cargo.toml.orig only in cargo's standard normalisation.
Every source file under src/ was read in full. Three of the files (src/gen/consts.rs, src/gen/op.rs, src/gen/generic_const_mappings.rs) are marked // THIS IS GENERATED CODE and total ~12k lines; their producer (vcs-root/generate/src/main.rs) was inspected, and spot-checks of U6, U10, U12 confirm the encoding matches the generator. The 21k-line tests/generated.rs was sampled (1743 test functions) and its generator surveyed in vcs-root/generate/src/tests.rs. No CI run was performed locally; the upstream justfile runs cargo test --features strict plus clippy and doc builds as the maintainer's release gate.
Results
The crate has #![forbid(unsafe_code)] and #![no_std] at the top of src/lib.rs, which is a compiler-enforced ban on any unsafe block, unsafe fn, or unsafe impl anywhere in the codebase. A grep across the source tree confirms no occurrences of Mutex, RwLock, atomic::, Atomic, RefCell, thread_local!, spawn, or any std::{net,fs,env,process} use beyond doc examples. The crate depends only on core::ops, core::cmp, and core::marker. Justifies uses-crypto, uses-exec, uses-jit, uses-interpreter, uses-network, uses-filesystem, uses-environment, uses-concurrency, uses-unsafe, and impl-crypto, impl-parser, impl-interpreter, impl-jit, impl-protocol, impl-concurrency.
The crate ships no binary artefacts (justifying has-binaries), no build.rs (Cargo.toml declares build = false, and CHANGELOG entries for 1.18.0 and 1.20.0 record the build-script removal), and no procedural-macro components (no [lib] proc-macro = true, no #[proc_macro*] attributes). Justifies has-build-exec and has-install-exec.
The library implements a compile-time data structure (UInt/PInt/NInt/TArr) and the arithmetic algorithms over it (justifying impl-datastructure and impl-algorithm). Correctness is established by the 1743 generated integration tests in tests/generated.rs (justifying has-integration-tests; the crate ships no in-source #[cfg(test)] modules, no property-based tests, and no fuzz harness, justifying has-unit-tests, has-property-tests, and has-fuzz-tests as false) covering each operator across small operand combinations, by the doc-test examples in each operator module, and by the type-system itself: a wrong implementation would produce a wrong Output associated type that the tests immediately catch via the Same<expected> assertion pattern. The implementation has no notion of runtime time/space bounds — operations happen at compile time, and the recursion depth is bounded by the bit-width of the operand types, which is fixed per-type. Justifies datastructure-impl-safe, datastructure-impl-correct, datastructure-impl-tested, datastructure-impl-bounds, algorithm-impl-safe, algorithm-impl-correct, algorithm-impl-tested, algorithm-impl-bounds.
No findings were recorded. The package is benign: no malicious behaviour, no obfuscation, no targeted payloads. Justifies is-benign.
Conclusion
typenum is a low-risk, well-disciplined library. The #![forbid(unsafe_code)] declaration eliminates an entire class of memory-safety risk by compiler enforcement, the no_std posture limits the capability surface to pure computation, and the absence of a build script (since 1.18.0) eliminates the compile-time code-execution attack surface that previously existed. The bulk of the source is mechanically generated and exhaustively tested. Suitable for use in security-sensitive contexts.