fix: replace random with secrets for cryptographically secure validator selection

[BossChaos]

Summary

Wallet: RTC6d1f27d28961279f1034d9561c2403697eb55602

Vulnerability Fixed

Non-Cryptographic Random in Validator Selection (HIGH)

File: rips/rustchain-core/consensus/poa.py, select_validator()

Bug: Uses random.uniform() and random.choice() for consensus validator selection. Python's random module is NOT cryptographically secure — the Mersenne Twister sequence is predictable after observing ~624 outputs.

Attack: An attacker monitoring block production can:

1. Observe validator selections over multiple blocks
2. Reconstruct the random seed/state
3. Predict which validator will be selected next
4. Target that validator for DoS, censorship, or MEV extraction

Fix: Replace random with secrets module (cryptographically secure):

• random.uniform(0, total_as) → secrets.randbelow(int(total_as * 1_000_000)) / 1_000_000
• random.choice(proofs) → proofs[secrets.randbelow(len(proofs))]

Local Testing

python test_poa_consensus_security.py
# PASS: Validator selection uses cryptographically secure randomness (secrets)

Related

• Bug Bounty [BOUNTY] RTC Reward Analytics Dashboard (#41) #71
• Bug feat: Add RTC Payment Widget - Embeddable Checkout Button (Bounty #48) #11 reported in [BOUNTY] RTC Reward Analytics Dashboard (#41) #71 comments

[Scottcjn]

Closing per first-poster ruling (2026-05-10).

@508704820 submitted the same finding class earlier today:

• FIX(#4182): UTXO Ledger - restore spent boxes on rollback + proper coin selection #4183 (UTXO rollback restore-spent-boxes) at 06:02 UTC — 1h17m before your fix: restore spent boxes and clean partial outputs on transaction rollback (#4182) #4184
• FIX(#4186): Replace predictable PRNG with crypto-safe secrets in PoA validator selection #4187 (crypto-safe PRNG validators) at 08:41 UTC — 46m before your fix: replace random with secrets for cryptographically secure validator selection #4189

Per the Self-Audit Credit Check policy, the earliest poster of a finding earns the bounty. @508704820 has been paid 40 RTC for both.

Your implementation work is real, but not first. If your fix is materially better (more complete, better tests, edge cases the first-poster missed), please comment on @508704820 PR with the specific delta — that earns review-credit if it adds value.

— auto-triage 2026-05-10