In object-oriented languages, constructors often have a combination of required and optional formal parameters. It is tedious and inconvenient for programmers to write a constructor by hand for each combination. The multitude of constructors is error-prone for clients, and client code is difficult to read due to the large number of constructor parameters. Therefore, programmers often use design patters that enable more flexible object construction - the builder pattern, dependency injection, or factory methods.

However, these design patterns can be \emph{too} flexible: not all combinations of logical parameters lead to the construction of well-formed objects. When a client uses the builder pattern to construct an object, the compiler does not check that a valid set of values was provided. Incorrect use of builders can cause security vulnerabilities, run-time crashes, and other problems.

This work shows how to statically verify uses of object construction, such as the builder pattern. Using a simple specification language, programmers specify which combinations of logical arguments are permitted. Our compile-time analysis detects client code that may construct objects unsafely. Our analysis is based on a special case of typestate checking that modularly reasons about accumulations of method calls. It scales to industrial programs. We evaluated it on over 9 million lines of code, discovering defects which include previously-unknown security vulnerabilities and potential null-pointer violations in heavily-used open-source codebases. It has a low false positive rate and low annotation burden.