style: enable gosec linter

.avalanche-golangci.yml

@@ -61,7 +61,7 @@ linters:
     - goconst
     - gocritic
     - goprintffuncname
-    # - gosec
+    - gosec
     - govet
     - importas
     - ineffassign

accounts/abi/bind/util_test.go

@@ -116,7 +116,7 @@ func TestWaitDeployed(t *testing.T) {
 func TestWaitDeployedCornerCases(t *testing.T) {
 	backend := simulated.NewBackend(
 		types.GenesisAlloc{
-			crypto.PubkeyToAddress(testKey.PublicKey): {Balance: big.NewInt(1000000000000000000)},
+			crypto.PubkeyToAddress(testKey.PublicKey): {Balance: big.NewInt(2000000000000000000)},
 		},
 	)
 	defer backend.Close()

cmd/simulator/metrics/metrics.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"time"
 
 	"github.com/ava-labs/libevm/log"
 	"github.com/prometheus/client_golang/prometheus"
@@ -66,7 +67,8 @@ func (m *Metrics) Serve(ctx context.Context, metricsPort string, metricsEndpoint
 	ctx, cancel := context.WithCancel(ctx)
 	// Create a prometheus server to expose individual tx metrics
 	server := &http.Server{
-		Addr: ":" + metricsPort,
+		Addr:              ":" + metricsPort,
+		ReadHeaderTimeout: 30 * time.Second,
 	}
 
 	// Start up go routine to listen for SIGINT notifications to gracefully shut down server

core/blockchain_ext_test.go

@@ -1886,7 +1886,9 @@ func ReexecCorruptedStateTest(t *testing.T, create ReexecTestFunc) {
 	}
 
 	// Simulate a crash by updating the acceptor tip
-	blockchain.writeBlockAcceptedIndices(chain[1])
+	if err := blockchain.writeBlockAcceptedIndices(chain[1]); err != nil {
+		t.Fatal(err)
+	}
 	blockchain.Stop()
 
 	// Restart blockchain with existing state

core/extstate/database_test.go

@@ -5,7 +5,6 @@ package extstate
 
 import (
 	"encoding/binary"
-	"math/rand"
 	"path/filepath"
 	"slices"
 	"testing"
@@ -23,6 +22,7 @@ import (
 
 	"github.com/ava-labs/coreth/triedb/firewood"
 	"github.com/ava-labs/coreth/triedb/hashdb"
+	"github.com/ava-labs/coreth/utils/rand"
 )
 
 const (
@@ -309,9 +309,8 @@ func (fs *fuzzState) deleteStorage(accountIndex int, storageIndexInput uint64) {
 }
 
 func FuzzTree(f *testing.F) {
-	f.Fuzz(func(t *testing.T, randSeed int64, byteSteps []byte) {
+	f.Fuzz(func(t *testing.T, byteSteps []byte) {
 		fuzzState := newFuzzState(t)
-		rand := rand.New(rand.NewSource(randSeed))
 
 		for range 10 {
 			fuzzState.createAccount()
@@ -333,23 +332,23 @@ func FuzzTree(f *testing.F) {
 				fuzzState.createAccount()
 			case updateAccount:
 				if len(fuzzState.currentAddrs) > 0 {
-					fuzzState.updateAccount(rand.Intn(len(fuzzState.currentAddrs)))
+					fuzzState.updateAccount(rand.SecureIntn(len(fuzzState.currentAddrs)))
 				}
 			case deleteAccount:
 				if len(fuzzState.currentAddrs) > 0 {
-					fuzzState.deleteAccount(rand.Intn(len(fuzzState.currentAddrs)))
+					fuzzState.deleteAccount(rand.SecureIntn(len(fuzzState.currentAddrs)))
 				}
 			case addStorage:
 				if len(fuzzState.currentAddrs) > 0 {
-					fuzzState.addStorage(rand.Intn(len(fuzzState.currentAddrs)))
+					fuzzState.addStorage(rand.SecureIntn(len(fuzzState.currentAddrs)))
 				}
 			case updateStorage:
 				if len(fuzzState.currentAddrs) > 0 {
-					fuzzState.updateStorage(rand.Intn(len(fuzzState.currentAddrs)), rand.Uint64())
+					fuzzState.updateStorage(rand.SecureIntn(len(fuzzState.currentAddrs)), rand.SecureUint64())
 				}
 			case deleteStorage:
 				if len(fuzzState.currentAddrs) > 0 {
-					fuzzState.deleteStorage(rand.Intn(len(fuzzState.currentAddrs)), rand.Uint64())
+					fuzzState.deleteStorage(rand.SecureIntn(len(fuzzState.currentAddrs)), rand.SecureUint64())
 				}
 			default:
 				t.Fatalf("unknown step: %d", step)

network/peer_tracker.go

@@ -5,7 +5,6 @@ package network
 
 import (
 	"math"
-	"math/rand"
 	"time"
 
 	"github.com/ava-labs/avalanchego/ids"
@@ -14,6 +13,8 @@ import (
 	"github.com/ava-labs/libevm/log"
 	"github.com/ava-labs/libevm/metrics"
 
+	"github.com/ava-labs/coreth/utils/rand"
+
 	safemath "github.com/ava-labs/avalanchego/utils/math"
 )
 
@@ -76,7 +77,7 @@ func (p *peerTracker) shouldTrackNewPeer() bool {
 		return false
 	}
 	newPeerProbability := math.Exp(-float64(numResponsivePeers) * newPeerConnectFactor)
-	return rand.Float64() < newPeerProbability
+	return rand.SecureFloat64() < newPeerProbability
 }
 
 // getResponsivePeer returns a random [ids.NodeID] of a peer that has responded
@@ -115,7 +116,7 @@ func (p *peerTracker) GetAnyPeer(minVersion *version.Application) (ids.NodeID, b
 		random   bool
 		averager safemath.Averager
 	)
-	if rand.Float64() < randomPeerProbability {
+	if rand.SecureFloat64() < randomPeerProbability {
 		random = true
 		nodeID, averager, ok = p.getResponsivePeer()
 	} else {

plugin/evm/atomic/atomictest/tx.go

@@ -4,8 +4,6 @@
 package atomictest
 
 import (
-	"math/rand"
-
 	"github.com/ava-labs/avalanchego/codec"
 	"github.com/ava-labs/avalanchego/codec/linearcodec"
 	"github.com/ava-labs/avalanchego/ids"
@@ -16,6 +14,7 @@ import (
 
 	"github.com/ava-labs/coreth/params/extras"
 	"github.com/ava-labs/coreth/plugin/evm/atomic"
+	"github.com/ava-labs/coreth/utils/rand"
 
 	avalancheatomic "github.com/ava-labs/avalanchego/chains/atomic"
 )
@@ -150,7 +149,7 @@ func GenerateTestExportTx() *atomic.Tx {
 }
 
 func NewTestTx() *atomic.Tx {
-	txType := rand.Intn(2)
+	txType := rand.SecureIntn(2)
 	switch txType {
 	case 0:
 		return GenerateTestImportTx()

plugin/evm/customtypes/header_ext_test.go

@@ -142,7 +142,7 @@ func allFieldsSet[T interface {
 				if fieldValue.Kind() == reflect.Ptr {
 					require.Falsef(t, fieldValue.IsNil(), "field %q is nil", field.Name)
 				}
-				fieldValue = reflect.NewAt(fieldValue.Type(), unsafe.Pointer(fieldValue.UnsafeAddr())).Elem() //nolint:gosec
+				fieldValue = reflect.NewAt(fieldValue.Type(), unsafe.Pointer(fieldValue.UnsafeAddr())).Elem()
 			}
 
 			switch f := fieldValue.Interface().(type) {

plugin/evm/message/block_request_test.go

@@ -5,7 +5,7 @@ package message
 
 import (
 	"encoding/base64"
-	"math/rand"
+	"fmt"
 	"testing"
 
 	"github.com/ava-labs/libevm/common"
@@ -38,25 +38,23 @@ func TestMarshalBlockRequest(t *testing.T) {
 // TestMarshalBlockResponse asserts that the structure or serialization logic hasn't changed, primarily to
 // ensure compatibility with the network.
 func TestMarshalBlockResponse(t *testing.T) {
-	// create some random bytes
-	// set seed to ensure deterministic random behaviour
-	rand.Seed(1)
 	blocksBytes := make([][]byte, 32)
 	for i := range blocksBytes {
-		blocksBytes[i] = make([]byte, rand.Intn(32)+32) // min 32 length, max 64
-		_, err := rand.Read(blocksBytes[i])
-		assert.NoError(t, err)
+		size := 32 + (i % 33)
+		blocksBytes[i] = deterministicBytes(fmt.Sprintf("block-%d", i), size)
 	}
 
 	blockResponse := BlockResponse{
 		Blocks: blocksBytes,
 	}
 
-	base64BlockResponse := "AAAAAAAgAAAAIU8WP18PmmIdcpVmx00QA3xNe7sEB9HixkmBhVrYaB0NhgAAADnR6ZTSxCKs0gigByk5SH9pmeudGKRHhARdh/PGfPInRumVr1olNnlRuqL/bNRxxIPxX7kLrbN8WCEAAAA6tmgLTnyLdjobHUnUlVyEhiFjJSU/7HON16nii/khEZwWDwcCRIYVu9oIMT9qjrZo0gv1BZh1kh5migAAACtb3yx/xIRo0tbFL1BU4tCDa/hMcXTLdHY2TMPb2Wiw9xcu2FeUuzWLDDtSAAAAO12heG+f69ehnQ97usvgJVqlt9RL7ED4TIkrm//UNimwIjvupfT3Q5H0RdFa/UKUBAN09pJLmMv4cT+NAAAAMpYtJOLK/Mrjph+1hrFDI6a8j5598dkpMz/5k5M76m9bOvbeA3Q2bEcZ5DobBn2JvH8BAAAAOfHxekxyFaO1OeseWEnGB327VyL1cXoomiZvl2R5gZmOvqicC0s3OXARXoLtb0ElyPpzEeTX3vqSLQAAACc2zU8kq/ffhmuqVgODZ61hRd4e6PSosJk+vfiIOgrYvpw5eLBIg+UAAAAkahVqnexqQOmh0AfwM8KCMGG90Oqln45NpkMBBSINCyloi3NLAAAAKI6gENd8luqAp6Zl9gb2pjt/Pf0lZ8GJeeTWDyZobZvy+ybJAf81TN4AAAA8FgfuKbpk+Eq0PKDG5rkcH9O+iZBDQXnTr0SRo2kBLbktGE/DnRc0/1cWQolTu2hl/PkrDDoXyQKL6ZFOAAAAMwl50YMDVvKlTD3qsqS0R11jr76PtWmHx39YGFJvGBS+gjNQ6rE5NfMdhEhFF+kkrveK4QAAADhRwAdVkgww7CmjcDk0v1CijaECl13tp351hXnqPf5BNqv3UrO4Jx0D6USzyds2a3UEX479adIq5QAAADpBGUfLVbzqQGsy1hCL1oWE9X43yqxuM/6qMmOjmUNwJLqcmxRniidPAakQrilfbvv+X1q/RMzeJjtWAAAAKAZjPn05Bp8BojnENlhUw69/a0HWMfkrmo0S9BJXMl//My91drBiBVYAAAAqMEo+Pq6QGlJyDahcoeSzjq8/RMbG74Ni8vVPwA4J1vwlZAhUwV38rKqKAAAAOyzszlo6lLTTOKUUPmNAjYcksM8/rhej95vhBy+2PDXWBCxBYPOO6eKp8/tP+wAZtFTVIrX/oXYEGT+4AAAAMpZnz1PD9SDIibeb9QTPtXx2ASMtWJuszqnW4mPiXCd0HT9sYsu7FdmvvL9/faQasECOAAAALzk4vxd0rOdwmk8JHpqD/erg7FXrIzqbU5TLPHhWtUbTE8ijtMHA4FRH9Lo3DrNtAAAAPLz97PUi4qbx7Qr+wfjiD6q+32sWLnF9OnSKWGd6DFY0j4khomaxHQ8zTGL+UrpTrxl3nLKUi2Vw/6C3cwAAADqWPBMK15dRJSEPDvHDFAkPB8eab1ccJG8+msC3QT7xEL1YsAznO/9wb3/0tvRAkKMnEfMgjk5LictRAAAAJ2XOZAA98kaJKNWiO5ynQPgMk4LZxgNK0pYMeWUD4c4iFyX1DK8fvwAAADtcR6U9v459yvyeE4ZHpLRO1LzpZO1H90qllEaM7TI8t28NP6xHbJ+wP8kij7roj9WAZjoEVLaDEiB/CgAAADc7WExi1QJ84VpPClglDY+1Dnfyv08BUuXUlDWAf51Ll75vt3lwRmpWJv4zQIz56I4seXQIoy0pAAAAKkFrryBqmDIJgsharXA4SFnAWksTodWy9b/vWm7ZLaSCyqlWjltv6dip3QAAAC7Z6wkne1AJRMvoAKCxUn6mRymoYdL2SXoyNcN/QZJ3nsHZazscVCT84LcnsDByAAAAI+ZAq8lEj93rIZHZRcBHZ6+Eev0O212IV7eZrLGOSv+r4wN/AAAAL/7MQW5zTTc8Xr68nNzFlbzOPHvT2N+T+rfhJd3rr+ZaMb1dQeLSzpwrF4kvD+oZAAAAMTGikNy/poQG6HcHP/CINOGXpANKpIr6P4W4picIyuu6yIC1uJuT2lOBAWRAIQTmSLYAAAA1ImobDzE6id38RUxfj3KsibOLGfU3hMGem+rAPIdaJ9sCneN643pCMYgTSHaFkpNZyoxeuU4AAAA9FS3Br0LquOKSXG2u5N5e+fnc8I38vQK4CAk5hYWSig995QvhptwdV2joU3mI/dzlYum5SMkYu6PpM+XEAAAAAC3Nrne6HSWbGIpLIchvvCPXKLRTR+raZQryTFbQgAqGkTMgiKgFvVXERuJesHU="
+	base64BlockResponse := "AAAAAAAgAAAAIJXQhORTgWBTfXlemdtD+WILBpBT9HRl4K4gkKPV3e7cAAAAITSqKPCBk5/JeIigWeT/uTMGKnp+b70MOZkCO44OafTtDAAAACIz36MP9anr3wQHtTwDH1L/LRrGt0Dko+VtN5NfTYAjT/cqAAAAIzJtugrOYhe1/exdrCHZBlzgjTdFkzHBhpWIGBlGCecgpEmfAAAAJAgHzYU7bXGtNNDimq+pGIDW/Q7XifI6C53PAdy+yW0jKK3K4wAAACWXBbY0Xw4Xn5+GiD4+UuSS9h/u4dhvl2+dR/qYw5yowxf8v7rrAAAAJgbEtOZxz7wY/8swLTgwT8ZJoqP1cnOd8r8/uoJti5XA7I/Bs3cpAAAAJwbHRvCpBTudXYFp+GNCXPEjXiCnA673BRlzvR0fvsNDr+ZVi/FmOwAAAChVr51EI/1LT5JJjD64zx6/xGOo3ktT6ptAFJlngOG8RSEI1Hk7qMQ5AAAAKRXsZvyQft8z6ZCPpFRQN6Zdg6rFHzsDqQsFf4eCpURKZZtFomM5JNmYAAAAKl6d4WIruiiDIHZ7dseGIZcaEoQRXWdRK7c8IO8HVMNTfIR1/8bXWEeMbgAAACubc16GHnZ7u/tKEm3F18oZxrUrz2TGfHuJmOn1yHx1YTJpn170QswnOqn+AAAALI7dyAVXVxQjUIP9JKasvXXiRYflJeplQqGu6WhYIQq/cCwBtoLQz94D/nrsAAAALSCmyIFlYyn8jduoslj6IW70ezrGgQWE/FbEsqa6Crjkf/Ci9Fp4urkcrCGTxgAAAC6QF6B7dJyQ0mlVaxgbE+dBm12WlNeZYVNbxdNlWCZnkoLJWXMiD0gABjgqD4zRAAAAL5DT05V8uD5ZqoRSWLRCjbDqRr4wW9oNt+UiSWPwsh/RwHaxr1D00uSWSAnrW33jAAAAMKDDLYG6JWq/150PtmKGZ+KebpFrZDyzACF0sSch+ZfJrwmSKqYloFsSAj9ZZ6rWWwAAADFuRPLOxsuXEJq5I0MT92meV6FFztZAA8bAd6E1+RZiA9teB5XnIxaBuoQ4I74AorZ0AAAAMl11T461BIn/K2/O58dsWcoxBp2wPoUesOhpwlOgxSWw6OUj1+mvuL8U/wVLpwqFfjMhAAAAM+JNWjXcfq5sj0blVFi0251wY2CrTQaHU61X3Tjhh2iLzorEswqjycNN1j42STcNFB7/wwAAADQ+pYColEuNMElZMv2/648HFk2jiSJIxcVi+JW+VtmcqeDPaPiPNYBfWO8P50jubILJN+r2AAAANfcHo+4FU3C3xThCTL2vba3yFp+ynhBh8DAjvvT07BNG3IWKQwDTIvISjAJIw8SHNTBQD7zKAAAANroqlZw6k0B2gNV6q8HNtswCukR462S1u5xnK69lXF9C4Qyj2P+RfM2EjfLPbNzMAEWo+R06YgAAADeTsj0gVOFrD02nXXDJDwt67nmirMSI8G3QvdI8iv9iNCLXmjJ3N4BDT8RUcUlk+bZbHQKm9P2kAAAAOAPHHBay0wMwsj8sW/Pb4vC/BwPOSLZP+xH7GKOa4103czceU/gINNA2r5/k6GTrPgpWpsVs0f+wAAAAObGDS7KL7rSBsW7VxLrYXYfWn04hF00J2hTve6aw8PWXzRqT5itfADIQWJc6AS7o7kggc0BqQ+3F2AAAADoMhdnwYBveRIyUENDTRGaPJlRY/QnNLXI0TOVjSi1QOHR2ml6DEYTwOmsNp5kFOwMKdmYiHm5rjf7jAAAAO+JSRtRVbNm6q0sKGGAi1A6wOnDuMAY6j1PIerFL81e60BhjQ2G/Am3jrh+uh5AayFzc3QYudUu/RJ6HAAAAPA4qo0PSD61pmiU/ychcyW/vZZYIF1rk1yP+JPlXBvFppmNnBL5DH8tDZp6YxRYnvfDHfAhdCqQvzwY+sQAAAD3PnXjnTaKHn6sMZvRxTt5laCWK4/doOa2JN9mjCYH44YUnVMs0mXsEqe33ojw5EdKwryrND0ysL0N116nrAAAAPkxMF2yo70lmkPsAJ/Iw/EDoUW3R7cDdOZ1qxoOPtVXXM7x9icZ3q9tS8VkRfUr+CCR2apvzjC9UhiqZT9UFAAAAP92eIg4gH91b38P/sO/ydSN6+Naec+wtcm7QwBkgkJB0Y6CNogSlk8ukn38Iiu4lOYNWql/M9fzjJJIMPKxhHA=="
 
 	blockResponseBytes, err := Codec.Marshal(Version, blockResponse)
 	assert.NoError(t, err)
-	assert.Equal(t, base64BlockResponse, base64.StdEncoding.EncodeToString(blockResponseBytes))
+	encoded := base64.StdEncoding.EncodeToString(blockResponseBytes)
+	t.Log("BlockResponse base64:", encoded)
+	assert.Equal(t, base64BlockResponse, encoded)
 
 	var b BlockResponse
 	_, err = Codec.Unmarshal(blockResponseBytes, &b)

plugin/evm/message/code_request_test.go

@@ -5,7 +5,6 @@ package message
 
 import (
 	"encoding/base64"
-	"math/rand"
 	"testing"
 
 	"github.com/ava-labs/libevm/common"
@@ -34,19 +33,12 @@ func TestMarshalCodeRequest(t *testing.T) {
 // TestMarshalCodeResponse asserts that the structure or serialization logic hasn't changed, primarily to
 // ensure compatibility with the network.
 func TestMarshalCodeResponse(t *testing.T) {
-	// generate some random code data
-	// set random seed for deterministic random
-	rand.Seed(1)
-	codeData := make([]byte, 50)
-	_, err := rand.Read(codeData)
-	assert.NoError(t, err)
-
+	codeData := deterministicBytes("code", 50)
 	codeResponse := CodeResponse{
 		Data: [][]byte{codeData},
 	}
 
-	base64CodeResponse := "AAAAAAABAAAAMlL9/AchgmVPFj9fD5piHXKVZsdNEAN8TXu7BAfR4sZJgYVa2GgdDYbR6R4AFnk5y2aU"
-
+	base64CodeResponse := "AAAAAAABAAAAMqWkzsbJB88MjA9jmA3E46NFQ4OcMsZ29w75hOzrBZKYUb1mOf7XwLSCavbAa/5PTM46"
 	codeResponseBytes, err := Codec.Marshal(Version, codeResponse)
 	assert.NoError(t, err)
 	assert.Equal(t, base64CodeResponse, base64.StdEncoding.EncodeToString(codeResponseBytes))

plugin/evm/message/helpers_test.go

@@ -0,0 +1,26 @@
+// Copyright (C) 2019-2025, Ava Labs, Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package message
+
+import (
+	"crypto/sha256"
+	"fmt"
+)
+
+func deterministicBytes(label string, n int) []byte {
+	buf := make([]byte, n)
+	off := 0
+	var ctr uint64
+	for off < n {
+		h := sha256.Sum256([]byte(fmt.Sprintf("%s-%d", label, ctr)))
+		toCopy := n - off
+		if toCopy > len(h) {
+			toCopy = len(h)
+		}
+		copy(buf[off:], h[:toCopy])
+		off += toCopy
+		ctr++
+	}
+	return buf
+}

plugin/evm/message/leafs_request_test.go

@@ -5,7 +5,7 @@ package message
 
 import (
 	"encoding/base64"
-	"math/rand"
+	"fmt"
 	"testing"
 
 	"github.com/ava-labs/libevm/common"
@@ -15,18 +15,11 @@ import (
 // TestMarshalLeafsRequest asserts that the structure or serialization logic hasn't changed, primarily to
 // ensure compatibility with the network.
 func TestMarshalLeafsRequest(t *testing.T) {
-	// generate some random code data
-	// set random seed for deterministic random
-	rand.Seed(1)
-
 	startBytes := make([]byte, common.HashLength)
 	endBytes := make([]byte, common.HashLength)
 
-	_, err := rand.Read(startBytes)
-	assert.NoError(t, err)
-
-	_, err = rand.Read(endBytes)
-	assert.NoError(t, err)
+	copy(startBytes, deterministicBytes("leafs-start", common.HashLength))
+	copy(endBytes, deterministicBytes("leafs-end", common.HashLength))
 
 	leafsRequest := LeafsRequest{
 		Root:     common.BytesToHash([]byte("im ROOTing for ya")),
@@ -36,11 +29,13 @@ func TestMarshalLeafsRequest(t *testing.T) {
 		NodeType: StateTrieNode,
 	}
 
-	base64LeafsRequest := "AAAAAAAAAAAAAAAAAAAAAABpbSBST09UaW5nIGZvciB5YQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIFL9/AchgmVPFj9fD5piHXKVZsdNEAN8TXu7BAfR4sZJAAAAIIGFWthoHQ2G0ekeABZ5OctmlNLEIqzSCKAHKTlIf2mZBAAB"
+	base64LeafsRequest := "AAAAAAAAAAAAAAAAAAAAAABpbSBST09UaW5nIGZvciB5YQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIJKwrrLuvEv+pCsRmxCs6C3pT+zQMou38OjnrYUylszpAAAAILaro5a21oPenq7+x6aZ3RSpIQkoga9KNpz82H8eyrV5BAAB"
 
 	leafsRequestBytes, err := Codec.Marshal(Version, leafsRequest)
 	assert.NoError(t, err)
-	assert.Equal(t, base64LeafsRequest, base64.StdEncoding.EncodeToString(leafsRequestBytes))
+	encoded := base64.StdEncoding.EncodeToString(leafsRequestBytes)
+	t.Log("LeafsRequest base64:", encoded)
+	assert.Equal(t, base64LeafsRequest, encoded)
 
 	var l LeafsRequest
 	_, err = Codec.Unmarshal(leafsRequestBytes, &l)
@@ -55,32 +50,26 @@ func TestMarshalLeafsRequest(t *testing.T) {
 // TestMarshalLeafsResponse asserts that the structure or serialization logic hasn't changed, primarily to
 // ensure compatibility with the network.
 func TestMarshalLeafsResponse(t *testing.T) {
-	// generate some random code data
-	// set random seed for deterministic random
-	rand.Seed(1)
-
 	keysBytes := make([][]byte, 16)
 	valsBytes := make([][]byte, 16)
 	for i := range keysBytes {
 		keysBytes[i] = make([]byte, common.HashLength)
-		valsBytes[i] = make([]byte, rand.Intn(8)+8) // min 8 bytes, max 16 bytes
+		size := 8 + (i % 9)
+		valsBytes[i] = make([]byte, size)
 
-		_, err := rand.Read(keysBytes[i])
-		assert.NoError(t, err)
-		_, err = rand.Read(valsBytes[i])
-		assert.NoError(t, err)
+		copy(keysBytes[i], deterministicBytes(fmt.Sprintf("leafs-key-%d", i), common.HashLength))
+		copy(valsBytes[i], deterministicBytes(fmt.Sprintf("leafs-val-%d", i), size))
 	}
 
 	nextKey := make([]byte, common.HashLength)
-	_, err := rand.Read(nextKey)
-	assert.NoError(t, err)
+	copy(nextKey, deterministicBytes("leafs-next-key", common.HashLength))
 
 	proofVals := make([][]byte, 4)
 	for i := range proofVals {
-		proofVals[i] = make([]byte, rand.Intn(8)+8) // min 8 bytes, max 16 bytes
+		size := 8 + (i % 9)
+		proofVals[i] = make([]byte, size)
 
-		_, err = rand.Read(proofVals[i])
-		assert.NoError(t, err)
+		copy(proofVals[i], deterministicBytes(fmt.Sprintf("leafs-proof-%d", i), size))
 	}
 
 	leafsResponse := LeafsResponse{
@@ -90,11 +79,13 @@ func TestMarshalLeafsResponse(t *testing.T) {
 		ProofVals: proofVals,
 	}
 
-	base64LeafsResponse := "AAAAAAAQAAAAIE8WP18PmmIdcpVmx00QA3xNe7sEB9HixkmBhVrYaB0NAAAAIGagByk5SH9pmeudGKRHhARdh/PGfPInRumVr1olNnlRAAAAIK2zfFghtmgLTnyLdjobHUnUlVyEhiFjJSU/7HON16niAAAAIIYVu9oIMfUFmHWSHmaKW98sf8SERZLSVyvNBmjS1sUvAAAAIHHb2Wiw9xcu2FeUuzWLDDtSXaF4b5//CUJ52xlE69ehAAAAIPhMiSs77qX090OR9EXRWv1ClAQDdPaSS5jL+HE/jZYtAAAAIMr8yuOmvI+effHZKTM/+ZOTO+pvWzr23gN0NmxHGeQ6AAAAIBZZpE856x5YScYHfbtXIvVxeiiaJm+XZHmBmY6+qJwLAAAAIHOq53hmZ/fpNs1PJKv334ZrqlYDg2etYUXeHuj0qLCZAAAAIHiN5WOvpGfUnexqQOmh0AfwM8KCMGG90Oqln45NpkMBAAAAIKAQ13yW6oCnpmX2BvamO389/SVnwYl55NYPJmhtm/L7AAAAIAfuKbpk+Eq0PKDG5rkcH9O+iZBDQXnTr0SRo2kBLbktAAAAILsXyQKL6ZFOt2ScbJNHgAl50YMDVvKlTD3qsqS0R11jAAAAIOqxOTXzHYRIRRfpJK73iuFRwAdVklg2twdYhWUMMOwpAAAAIHnqPf5BNqv3UrO4Jx0D6USzyds2a3UEX479adIq5UEZAAAAIDLWEMqsbjP+qjJjo5lDcCS6nJsUZ4onTwGpEK4pX277AAAAEAAAAAmG0ekeABZ5OcsAAAAMuqL/bNRxxIPxX7kLAAAACov5IRGcFg8HAkQAAAAIUFTi0INr+EwAAAAOnQ97usvgJVqlt9RL7EAAAAAJfI0BkZLCQiTiAAAACxsGfYm8fwHx9XOYAAAADUs3OXARXoLtb0ElyPoAAAAKPr34iDoK2L6cOQAAAAoFIg0LKWiLc0uOAAAACCbJAf81TN4WAAAADBhPw50XNP9XFkKJUwAAAAuvvo+1aYfHf1gYUgAAAAqjcDk0v1CijaECAAAADkfLVT12lCZ670686kBrAAAADf5fWr9EzN4mO1YGYz4AAAAEAAAADlcyXwVWMEo+Pq4Uwo0MAAAADeo50qHks46vP0TGxu8AAAAOg2Ly9WQIVMFd/KyqiiwAAAAL7M5aOpS00zilFD4="
+	base64LeafsResponse := "AAAAAAAQAAAAIHmj1vjEoZ0O4ePA2DhZKO+Ploa4q7gLlGaVGRnGiAr5AAAAIPlMwaMaBQeLkZP1M+KCqHN+KVIikeZA0b41XPhooHmOAAAAIG4lzYfLwAAcjQqoSKiyos2SbCuv9L6KJqkRd+sZWz4AAAAAIHzxct9NSipNR3HnZ8GG8tqPnfRdx0z5/sbbf7syDAuwAAAAINUOE8de3g9LiexMNfeGpq9fgWOLeR85nQfbce+/paipAAAAIGGVdxIl3EC71j8yrssykJj0aW2AzCGNllzGQiIUHVxUAAAAIM21WR+aC1oC/Y0aF7MtirZbCPHn6/E1Vc2SqdMetCkSAAAAIF0iMl4/jN1BZVWE2vhHPLhNf1GU7ZG3Ha/hRlfgKDEmAAAAINWU8iL34iUskB3aDoXzcFnIx+GC1dOaTb6U67yPDYvUAAAAIA3fhS/DRGIMmSipCgkPvsf9wWmmFdj/sqcuNTfbajgJAAAAIIgDEuKc5UMEOSk5EK1R5Cqb2ZSIeP0A3EwWRBLNyoUcAAAAIMc57Tz4uWzF/SNzh/Atj9mVgINDHNAtTI8q544m1X47AAAAIOMYINGZvfG5FkaMfFlmU9YH6iTkno0XYJRdzz5wmzvkAAAAIGxx030ahNis5MO4BKmrebrSM66owbYrvOh2aC4wXBHsAAAAIPy2H9p6M+09QiQ5LJEQ/t5aUiWu4JYay996TX970dbKAAAAICk/c3GuBZW6aaj1JOGJ0TV7XJlzyY5wdyRMph1Pvu88AAAAEAAAAAheRm4y4L4/egAAAAl4BX68DVmqf5oAAAAK28t5TDoKXe3mTwAAAAvU000vwEklyciOvwAAAAyMpkqLoo9xc7t3/c4AAAANkNAZCfHhlgAL7dUnAwAAAA5TIzp83z0wYkVwNOxi8QAAAA9+g6PBPoROJ4rj5NnchCgAAAAQDh3Z3uqi4VpY/dqO6Q4pRwAAAAjECTPaIxeFOgAAAAnol1UASNalh6AAAAAKxZ3p1yeNLQ875QAAAAsv1HBF3rWoiq5YYwAAAAyOBRehPDv4UGOK1cMAAAANqykJIIyZKGT8Ag2FTwAAAA4CEC5Xar3pHA0bb0cDCQAAAAQAAAAIOX+OwhaAm/YAAAAJ3JVfblHw6v/oAAAACp0GQdu6CmNquyYAAAAL/FNLguGJX8xGQ7Q="
 
 	leafsResponseBytes, err := Codec.Marshal(Version, leafsResponse)
 	assert.NoError(t, err)
-	assert.Equal(t, base64LeafsResponse, base64.StdEncoding.EncodeToString(leafsResponseBytes))
+	encoded := base64.StdEncoding.EncodeToString(leafsResponseBytes)
+	t.Log("LeafsResponse base64:", encoded)
+	assert.Equal(t, base64LeafsResponse, encoded)
 
 	var l LeafsResponse
 	_, err = Codec.Unmarshal(leafsResponseBytes, &l)

sync/handlers/leafs_request_test.go

@@ -6,7 +6,7 @@ package handlers
 import (
 	"bytes"
 	"context"
-	"math/rand"
+	"crypto/rand"
 	"testing"
 
 	"github.com/ava-labs/avalanchego/ids"
@@ -26,7 +26,6 @@ import (
 )
 
 func TestLeafsRequestHandler_OnLeafsRequest(t *testing.T) {
-	rand.Seed(1)
 	testHandlerStats := &statstest.TestHandlerStats{}
 	memdb := rawdb.NewMemoryDatabase()
 	trieDB := triedb.NewDatabase(memdb, nil)