Skip to content

[TEST-2] [LOW] Manual private-key bounding duplicates boundPrivateKey from forge-std #420

@thedavidmeister

Description

@thedavidmeister

Manual private-key bounding duplicates boundPrivateKey from forge-std

The pattern (fuzzedKey % (SECP256K1_ORDER - 1)) + 1 appears 5 times across two test files:

  • test/src/concrete/Flow.expression.t.sol:59
  • test/src/concrete/Flow.signedContext.t.sol:27
  • test/src/concrete/Flow.signedContext.t.sol:28
  • test/src/concrete/Flow.signedContext.t.sol:60
  • test/src/concrete/Flow.signedContext.t.sol:61

forge-std's StdUtils (already inherited via TestFlowTest) exposes boundPrivateKey(uint256) which computes the same modular bound and is the canonical helper. Each manual occurrence carries an identical comment: // Ensure the fuzzed key is within the valid range for secp256k1.

Fix: replace (fuzzedKey % (SECP256K1_ORDER - 1)) + 1 with boundPrivateKey(fuzzedKey). The comment becomes redundant and can be deleted.

Metadata

Metadata

Assignees

No one assigned

    Labels

    auditAudit findinglowSeverity: lowpass4Audit Pass 4: Code Quality

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions