What the developer wrote
Authored by Tobin C. Harding
Do not enable secp rand feature
Patch f80cf2cb2aa318978da3a6c5df49d82c49344763 (PR #4154) somehow got
past review with a change that unconditionally enabled `rand` feature
for `secp256k1` - this is incorrect.
There is no mention of the change in the PR description or review
comments - review fail.
What changed, and why it matters
This commit removes an accidentally enabled 'rand' feature from a cryptographic dependency. The project did not intend to require randomness support from the secp256k1 library in its default build. Having it enabled could have forced extra code and dependencies into builds that were supposed to be deterministic or minimal, and could have subtly changed which APIs are available. It is a cleanup/revert of a mistaken change, not a fix for an active exploit.
Verify that downstream consumers and feature combinations still compile and that no code relied on the accidentally enabled secp256k1/rand APIs. Consider adding CI checks that fail when unexpected dependency features are enabled, to prevent similar review bypasses.
Security signals we found
Unintended feature enabled on cryptographic dependency
Revert/correction of prior change that bypassed review
Potential increase in dependency/attack surface from unused rand code paths
No explicit vulnerability or exploit code present in diff
Evidence from the diff
The patch changes bitcoin/Cargo.toml so that the secp256k1 dependency no longer lists ‘rand’ among its default-enabled features. The commit message states that a previous PR (f80cf2cb / PR #4154) unintentionally enabled ‘rand’ for secp256k1 without discussion or review. Removing it restores the intended feature set (‘hashes’, ‘alloc’ only). The security relevance is indirect: enabling an unneeded rand feature can pull in additional randomness-related code paths and dependencies, potentially increasing attack surface and affecting no-std or deterministic builds. There is no direct vulnerability shown in the diff.
Changed components
bitcoin/Cargo.tomlsecp256k1 dependency feature flagsInspect captured patch +1 / −1
diff --git a/bitcoin/Cargo.toml b/bitcoin/Cargo.toml
index 6a51f436..2785acf9 100644
--- a/bitcoin/Cargo.toml
+++ b/bitcoin/Cargo.toml
@@ -33,7 +33,7 @@ hex = { package = "hex-conservative", version = "0.3.0", default-features = fals
internals = { package = "bitcoin-internals", path = "../internals", features = ["alloc", "hex"] }
io = { package = "bitcoin-io", path = "../io", default-features = false, features = ["alloc", "hashes"] }
primitives = { package = "bitcoin-primitives", path = "../primitives", default-features = false, features = ["alloc", "hex"] }
-secp256k1 = { version = "0.30.0", default-features = false, features = ["hashes", "alloc", "rand"] }
+secp256k1 = { version = "0.30.0", default-features = false, features = ["hashes", "alloc"] }
units = { package = "bitcoin-units", path = "../units", default-features = false, features = ["alloc"] }
arbitrary = { version = "1.4.1", optional = true }
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.