[Bug] Math.random() used for SIWE nonce in Wagmi setup example — not cryptographically secure
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript
- Domain
- documentation, security
Research direction
Find the Wagmi integration setup example containing the two Math.random() calls and compare it with the authenticate-users guide referenced in the issue. Replace the nonce generation with crypto.randomUUID(), then verify the example uses the secure approach consistently with that guide.
Written by the indexing model from the issue text.
Description
Description
The Wagmi integration setup example uses Math.random() to generate
a SIWE (Sign-In With Ethereum) nonce:
const clientNonce =
Math.random().toString(36).substring(2, 15) +
Math.random().toString(36).substring(2, 15);
Math.random() is not cryptographically secure and should never be
used for SIWE nonces. A predictable nonce can be exploited to perform
replay attacks.
Impact
- Developers copying this example will implement insecure SIWE flows
- Predictable nonces can be exploited for replay attacks
- Contradicts the
authenticate-usersguide which already uses
crypto.randomUUID()
Suggested Fix
Replace with crypto.randomUUID():
const clientNonce = crypto.randomUUID();
✅ Cryptographically secure (Web Crypto API)
✅ Available in all modern browsers and Node.js 14.17+
✅ Consistent with existing authenticate-users guide
References
- Related PR: https://github.com/base/docs/pull/1398
- Related issue: https://github.com/base/docs/issues/1390
- Dominant language
- JavaScript
- Stars
- 337
- Forks
- 798
- Avg merge
- 7h 24m
- Merged PRs (30d)
- 51
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from base/docs
-
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·