Suggestion 4: Add Randomizer Sanity Check To Improve Robustness

[mpguerra]

Location

frost-client/src/args.rs#L173

Synopsis

The randomizer as an argument input to the command of the coordinator is implemented as a vector of strings. This vector should have the same length as the message vector, but no check is implemented in the code to verify this. However, since the code does not support signing multiple messages simultaneously, this does not result in a security-relevant issue.

Mitigation

We recommend changing the type to Option<Vec<String>> and adding a check to verify that if the option is SOME, the length of the randomizer matches the length of the messages passed in as an argument.