Skip to content

fix: use cryptographic RNG for order salt#21

Closed
deipeypaanchal wants to merge 1 commit into
Polymarket:mainfrom
deipeypaanchal:fix/cryptographic-order-salt
Closed

fix: use cryptographic RNG for order salt#21
deipeypaanchal wants to merge 1 commit into
Polymarket:mainfrom
deipeypaanchal:fix/cryptographic-order-salt

Conversation

@deipeypaanchal

@deipeypaanchal deipeypaanchal commented Apr 17, 2026

Copy link
Copy Markdown

Summary

  • generate_order_salt was int(random.random() * current_ms_time):
    • random.random() is not cryptographic.
    • The result is always strictly less than current_ms_time, so the salt is not uniformly distributed.
    • Concurrent order creation in the same millisecond can produce duplicate salts, which the exchange rejects as duplicate orders.
  • Switch to secrets.randbits(64) — 64 bits of uniform cryptographic entropy, well within the uint256 salt field.

Test plan

  • Generate a few thousand salts back-to-back and confirm no duplicates.
  • End-to-end order placement still succeeds.

🤖 Generated with Claude Code


Note

Low Risk
Small, localized change to salt generation; low risk aside from potential downstream assumptions about salt format/range.

Overview
generate_order_salt now uses secrets.randbits(64) instead of a random.random() * time-based value, improving entropy, uniformity, and reducing collision risk during concurrent order creation.

Reviewed by Cursor Bugbot for commit 275f951. Bugbot is set up for automated code reviews on this repo. Configure here.

`generate_order_salt` used `int(random.random() * current_ms_time)`,
which has three problems:

  1. `random.random()` is not a cryptographic RNG.
  2. Because `random.random()` is in [0, 1), the salt is always strictly
     less than `current_ms_time` — not a full 64-bit uniform distribution.
  3. Concurrent order creation in the same millisecond can produce
     colliding salts, which the exchange rejects as duplicates.

Switch to `secrets.randbits(64)` for 64 bits of uniform, cryptographic
entropy — well within the uint256 salt field.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@deipeypaanchal deipeypaanchal closed this by deleting the head repository May 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants