Use of cryptographically insecure PRNG
SecurityDat opened this issue · 0 comments
SecurityDat commented
Hello，I found that the nonce is generated by "ethash.rand.Int63()". This random number generation is actually pseudo-random. Using the nonce as a seed in the "mine" function may result in insufficient randomness and may be cracked by traversal.
Location: https://github.com/bitindi/blockchain-core/blob/main/consensus/ethash/sealer.go#L100