QA-02: Deterministic RNG in BlockSync Peer Selection

monad-qa-02-deterministic-rng-in-blocksync

Summary

BlockSync initializes its peer-selection RNG with a fixed seed: ChaCha8Rng::seed_from_u64(123456).

Vulnerability details

1
pub fn new(override_peers: Vec<NodeId<CertificateSignaturePubKey<ST>>>) -> Self {
2
    Self {
3
        headers_requests: Default::default(),
4
        payload_requests: Default::default(),
5
        self_headers_requests: Default::default(),
6
        self_payload_requests: Default::default(),
7
        self_payload_requests_in_flight: 0,
8
        self_completed_headers_requests: Default::default(),
9
        self_request_mode: BlockSyncSelfRequester::StateSync,
10
        override_peers,
11
        rng: ChaCha8Rng::seed_from_u64(123456),
12
    }
13
}

Impact

Because every run begins with the same seed, peer selection follows a repeatable pattern across executions. That makes load distribution more predictable and can make targeted peer-pressure strategies easier.

Recommendation

Seed the RNG from real entropy instead of a hardcoded constant.