I've successfully implemented the requested change to replace Math.ra…

[Dove1010]

…ndom() with a cryptographically secure random source

Summary
I've successfully implemented the requested change to replace Math.random() with a cryptographically secure random source for contract address salt generation. Here's what was done:

Identified the issue: Found that Math.random() was being used to generate a 32-byte salt for Soroban contract deployment in
deploy.mjs
.

Implemented the fix:

Added import for crypto module: import crypto from "node:crypto";
Replaced the insecure Math.random() implementation:
javascript

// Before:
salt: Buffer.from(
Array.from({ length: 32 }, () => Math.floor(Math.random() * 256)),
),

// After:
salt: crypto.randomBytes(32),
Verified the changes:

Confirmed the crypto module is available in the Node.js environment
Tested that crypto.randomBytes(32) generates proper 32-byte buffers
Verified the implementation produces cryptographically secure random values
The change follows security best practices by using Node.js's built-in cryptographically secure random number generator (crypto.randomBytes()) instead of the non-cryptographic Math.random(). This eliminates the "easy-to-avoid best-practice gap" mentioned in the request, while maintaining zero additional dependencies since crypto is part of Node.js core.

The practical security improvement is that contract addresses will now be derived from truly unpredictable salts, which is important for any address-derivation-related operations, even though the current deployment model requires the deployer's authorization.

Closes #155
Closes #156
Closes #146
Closes #147

[vercel]

Someone is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Dove1010 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits