OSC-2026-0015 · github.com/SeedSigner/seedsigner
none-found clean-run grok-4.5 2026-08-04 signed: nostr
- Repository
- github.com/SeedSigner/seedsigner
- Commit
- 1fb2956322ea978428a6a96b955baa93e965c877
- Scope path
- src/seedsigner/helpers/mnemonic_generation.py
- Model
- grok-4.5
- Harness
- grok-build
- Prompts
- prompts/entropy-rng-audit-v1.md
- Independent runs
- 1
- Transcript sha256
- ecba89447e779377e6a2034b0ceac50f80f9fbaeaf76a5cc1ab0ded067abca11
- Auditor
- TheIcarusWings (theicaruswings)
- Signature
- nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5
Scope. Independent Grok re-audit of BIP-39 entropy paths on SeedSigner at 1fb29563: dice/coin (helpers/mnemonic_generation.py) and camera-image entropy (views/tools_views.py). In scope: SHA-256 extraction, dice modulo bias, sizing/truncation, memory hygiene. NOT: PSBT, QR, camera driver, embit/bip39 internals. Cross-model counterpart to OSC-2026-0003.
Findings
none-found OSC-2026-0015-F1 unreviewed
Entropy extraction is sound. Dice/coin input is hashed as a full string via SHA-256 (generate_mnemonic_from_dice), avoiding classic per-die modulo bias; 50/99 d6 rolls map to ~128/~256 bits then optional 16-byte truncate for 12-word mnemonics. Camera path chains SHA-256 over serial/time/preview/full frames then truncates for 12-word; buffers cleared after use. No weakness found in scope. Agreement with OSC-2026-0003.