A formula DSL is safe when there's nothing to escape into. In finmodel the tokeniser allows numbers, names, arithmetic, parens. No calls, attributes or subscripts. Cycles and unknown refs fail at construction. Division by zero returns NA with a reason, not a mid-model exception.
Was this useful?