Issues

• Critical Implementation Flaw: Non-Uniform Coefficient Generation Breaks Information-Theoretic Security

  bitaps-com/jsbtc#75 · Filter by author adamnoks opened on Sep 6, 2026

• [Bug Bounty] Biased Polynomial Coefficients Due to indexOf-Based Evaluation in __shamirFn

  bitaps-com/jsbtc#73 · Filter by author malldean opened on Aug 27, 2026
  2

• [Bug Bounty] Silent Incorrect Recovery When Fewer Than Threshold Shares Are Provided

  bitaps-com/jsbtc#70 · Filter by author malldean opened on Aug 20, 2026
  1

• Shamir coefficients are rejection-sampled against the secret byte, breaking uniformity (separate from pybtc#23, still unfixed)

  bitaps-com/jsbtc#69 · Filter by author 0xrlawrence opened on Aug 17, 2026
  1

• Security audit.

  bitaps-com/jsbtc#68 · Filter by author polymathdanny opened on Aug 16, 2026

• Biased coefficient generation in Shamir SSS: secret/coefficients forced pairwise-distinct

  bitaps-com/jsbtc#65 · Filter by author nitinkansal30 opened on Jul 16, 2026

• Coefficient-uniqueness constraint in __shamirFn leaks ~0.27 bits of secret entropy (indirect via q.indexOf)

  bitaps-com/jsbtc#64 · Filter by author KOFACY opened on Jul 3, 2026
  1

• Security Disclosure: Biased Polynomial Coefficients and Missing Share Integrity Verification in Shamir Secret Sharing

  bitaps-com/jsbtc#63 · Filter by author zinke1924 opened on Jun 17, 2026
  1

• Bug: indexBits=8 default causes silent wallet loss for 12-word mnemonics

  bitaps-com/jsbtc#55 · Filter by author mfdevolpe opened on May 11, 2026
  3

• # Shamir Mnemonic Reconstruction Accepts Invalid Share Sets → Silent Wrong Secret (Loss of Funds)

  bitaps-com/jsbtc#52 · Filter by author angus14 opened on Apr 17, 2026

• Title: Invalid threshold input (“$ of X”) triggers fallback mode that duplicates entropy and leaks checksum-index hiding mechanism (significant implementation bug)

  bitaps-com/jsbtc#48 · Filter by author yatescleta-afk opened on Mar 16, 2026
  8

• Security Vulnerability: Implementation bias in __split_secret via rejection sampling (Entropy reduction)

  bitaps-com/jsbtc#47 · Filter by author Pastorjetu opened on Mar 11, 2026
  1

• Bounty Challenge - Critical SSS Implementation Vulnerability - FULL Data Leakage

  bitaps-com/jsbtc#46 · Filter by author ChrisYatesUK opened on Mar 10, 2026
  4

• [Security] Leading coefficient can be zero in shamir_secret_sharing.js (degree-drop vulnerability) (bounty program)

  bitaps-com/jsbtc#45 · Filter by author rohanstake opened on Feb 18, 2026
  1

• VULNERABILITY REPORT FOR BITAPS SHAMIR'S SECRET SHARING IMPLEMENTATION

  bitaps-com/jsbtc#44 · Filter by author fabdevil opened on Feb 1, 2026

• Information Leakage via Non-Uniform Coefficient Generation

  bitaps-com/jsbtc#43 · Filter by author ThewsyRum opened on Jan 24, 2026

• SHORT SECURITY AUDIT REPORT Shamir Secret Sharing Implementation Bitaps JsBTC / PyBTC A. Modulo 255 Defect (“Never 255 Bug”) Polynomial coefficients never take the value 255 (0xFF) due to generator constraints (e.g., modulo 255 arithmetic or specific GF table usage). Impact: 1. The coefficient space is reduced from 256 to 255 possible values 2. Entropy reduction is extremely small Risk Assessment: 1. Severity: Low 2. Status: Non-fatal and does not reduce the Shamir threshold B. Global Polynomial Coefficients (Static Across Bytes) The polynomial coefficients (a₁, a₂, etc.) are generated once and reused across all bytes of the mnemonic entropy, instead of being regenerated independently per byte. Impact: 1. Secret bytes become correlated 2. Polynomials are no longer independent per byte 3. Shamir Secret Sharing security is significantly degraded Status: Design-level fatal flaw My addres BTC 18FXF47XcP52vhdbjimQ3CvD93NnHTPF73 Thankyou

  bitaps-com/jsbtc#42 · Filter by author moetneos-maker opened on Jan 22, 2026

• Design Flaw: Per-Byte Shamir Splitting of BIP-39 Mnemonics Causes Entropy Collapse and Non-Unique Reconstruction

  bitaps-com/jsbtc#41 · Filter by author Petah0411 opened on Dec 13, 2025
  1

• Title*: Exploring Shamir (3-of-5) with 2 Shares - ZeroNights X Bounty (PyBTC & JsBTC) - *Body*: Hi @bitaps-com team, exploring *PyBTC* and *JsBTC* for the ZeroNights X Shamir Secret Backup Scheme bounty. Given 2/3 shares: - Share 1: session cigar grape merry useful churn fatal thought very any arm unaware - Share 2: clock fresh security field caution effort gorilla speed plastic common tomato echo Tested recover_secret in both repos—fails as expected (needs 3 shares). No critical flaws yet. Suggestions: - Sanitize logs for invalid shares. - Test edge cases with manipulated inputs. - Document partial-share handling.

  bitaps-com/jsbtc#40 · Filter by author BTRMMD opened on Dec 7, 2025

• Shamir challenge: published zpub does not derive target address; no 2-of-5 threshold downgrade found

  bitaps-com/jsbtc#39 · Filter by author matuta99 opened on Nov 11, 2025

• btc

  bitaps-com/jsbtc#38 · Filter by author datis56 opened on Oct 19, 2025
  1

• dependabot/npm_and_yarn/webpack-5.94.0

  bitaps-com/jsbtc#37 · Filter by author Mainnet7m1 opened on Aug 24, 2025

• Here's a structured breakdown of potential flaws, concerns, and improvements in the code.

  bitaps-com/jsbtc#36 · Filter by author coryscotthodson-png opened on Aug 2, 2025

• Javascript Bugs

  bitaps-com/jsbtc#35 · Filter by author Coolgamerburst opened on Jun 29, 2025
  1

• Error Retrieving Original Mnemonics From 2 Shares whith a Threshold Of 3 Out Of 5.

  bitaps-com/jsbtc#29 · Filter by author Illuvelijah2004 opened on Mar 25, 2023
  1