WalletsIn seeds wallet ID generation with java.util.Random
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 90/100
Research direction
Start in src/main/java/io/zold/api/WalletsIn.java, especially the public constructor at lines 55-61 and create() near line 96. Verify that the default constructor uses a secure generator while the two-argument constructor still accepts an explicit Random. Run the existing tests to confirm deterministic generator injection remains unchanged and wallet creation still produces valid identifiers.
Written by the indexing model from the issue text.
Description
The public constructor WalletsIn(Path pth) at src/main/java/io/zold/api/WalletsIn.java:55-61 instantiates the inner randomizer with new Random(), and create() at line 96 derives every new wallet identifier from Long.toHexString(this.random.nextLong()). The default java.util.Random is a 48-bit linear congruential generator whose output sequence is recoverable from a handful of observed samples.
In a value-bearing system this is the wrong class of generator. A caller that hands fresh wallet IDs back to a network observer lets that observer enumerate the next few IDs in advance and race the existence check at WalletsIn.java:104, or pre-compute path collisions for wallets the same process is about to create.
The fix is one line: switch the default in WalletsIn(Path pth) to new java.security.SecureRandom(). The two-arg constructor that takes an explicit Random stays as it is, so tests that inject a deterministic generator for reproducibility keep working unchanged.
- Dominant language
- Java
- Stars
- 22
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from zold-io/java-api
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug good first issue
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
bug pdd
Difficulty 2/5 Under an hour Newbie friendliness 72/100
-
bug pdd
Difficulty 2/5 Under an hour Newbie friendliness 68/100
-
bug good first issue
Difficulty 4/5 3-5 days Newbie friendliness 45/100
All issues in zold-io/java-api
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
infinispan/infinispan#18150 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
opensearch-project/k-NN#3597 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100