Subject
tokio 1.52.3 is the dominant asynchronous runtime for Rust. It implements a multi-threaded work-stealing scheduler and a current-thread scheduler, an mio-based reactor (the I/O driver), a hierarchical timer wheel, asynchronous TCP/UDP/Unix-socket and filesystem types, child-process management, OS-signal handling, and a full set of async synchronization primitives (Mutex, RwLock, Semaphore, mpsc/oneshot/broadcast/watch channels, Notify, Barrier). The public surface is large and feature-gated; default = [], so a bare dependency pulls in no I/O. It is the foundation most of the async Rust ecosystem builds on.
Methodology
Tools: openvet 0.6.0, ripgrep, diff, git, cargo metadata. The source is roughly 104K lines across 373 .rs files with about 1,036 unsafe occurrences and 59 unsafe impl Send/Sync sites; there is no build.rs (build = false) and no proc-macro lib, no FFI extern blocks in contents/src (platform calls go through the optional libc/windows-sys dependencies).
VCS comparison: diff -rq contents vcs shows only the expected differences, Cargo.toml (cargo normalization) plus the publish-excluded CHANGELOG.md and the included Cargo.lock. No source file diverges between the published contents and the git checkout (head fd9e8e7).
I read the highest-risk unsafe surfaces in full: the work-stealing run queue (runtime/scheduler/multi_thread/queue.rs), the RawTask/Vtable type-erasure layer (runtime/task/raw.rs), the packed lifecycle-plus-refcount state machine (runtime/task/state.rs), and the loom UnsafeCell abstraction (loom/std/unsafe_cell.rs). I surveyed the capability surface, the dependency graph, and benign-code indicators (no base64 blobs, no obfuscation, no hardcoded network endpoints, no telemetry).
Scope. Given the size (about 104K LOC, ~1,036 unsafe occurrences across 373 files), the following claims were not evaluated and are left unasserted; they must not be read as either satisfied or violated: unsafe-safe, unsafe-documented, unsafe-minimal, and concurrency-impl-correct. Exhaustive loom/TSan model-checking of every primitive is out of scope. This audit verifies supply-chain integrity (VCS byte-equivalence), the capability surface (uses-*), the absence of build/install-time execution, the implementation categorization (impl-*), dependency enumeration, and the correctness and documentation of the representative high-risk unsafe surfaces it read.
Results
The published contents are byte-equivalent to the upstream git tree apart from cargo normalization, supporting is-benign. No build script and no proc-macro library exist, so the crate executes nothing at build or install time, supporting has-build-exec and has-install-exec; it ships no compiled artifacts, supporting has-binaries.
The runtime does real I/O, all of it feature-gated and off by default: TCP/UDP/Unix sockets via mio/socket2 (uses-network), async filesystem operations (uses-filesystem), child-process spawning (uses-exec), and reading of tuning environment variables such as RUST_MAX_BLOCKING_THREADS (uses-environment). It pervasively uses unsafe and concurrency (uses-unsafe, uses-concurrency). It performs no cryptography, no JIT, and no interpretation (uses-crypto, uses-jit, uses-interpreter).
tokio implements the synchronization primitives, the schedulers, intrusive linked lists, the bounded work-stealing deque, and the timer wheel itself, so impl-concurrency, impl-datastructure, and impl-algorithm hold; it is not a parser, interpreter, JIT, cryptography library, or network-protocol implementation, so impl-parser, impl-interpreter, impl-jit, impl-crypto, and impl-protocol are false.
The unsafe I read is sound and documented. The run queue is a single-producer multi-consumer ring buffer that coordinates the producer and stealers through one packed AtomicU64 head (a steal and a real cursor) with a claim-before-touch protocol; unsync_load of tail is justified because the producer is its sole writer, and unsafe impl Send/Sync for Inner rests on that atomic coordination. The RawTask vtable uses the std RawWaker manual-vtable idiom with per-monomorphization field offsets. The reference count uses the same relaxed-increment, isize::MAX overflow-abort pattern as std Arc. Interior mutability routes through a loom-swappable UnsafeCell, which is how tokio model-checks this code under loom. These observations support uses-unsafe and impl-concurrency.
Test coverage is extensive: 221 #[test]/#[cfg(test)] annotations in src (has-unit-tests), 171 integration-test files under tests/ (has-integration-tests), and proptest property tests in the timer-wheel and interval code (has-property-tests). There is no in-tree fuzz harness in the published crate, so has-fuzz-tests is false.
No findings were recorded.
Conclusion
The audit read tokio 1.52.3's highest-risk unsafe surfaces, the work-stealing run queue, the task vtable and reference-counting state machine, and the loom interior-mutability layer, and found them sound and documented, matching established lock-free patterns. The published contents are byte-equivalent to the upstream git tree, there is no build- or install-time code execution, and all network, filesystem, process, and signal capability is optional and disabled by default. Per the scope note, exhaustive unsafe-safe/unsafe-documented/unsafe-minimal review across all ~1,036 unsafe occurrences and full loom verification of every primitive were not performed and those claims are left unasserted. No security, safety, correctness, or quality findings were recorded.