Changing Math.random to crypto.getRandomValues in bundle

[poi-son-ivy]

Hi friends,

I'm catching the following warning:

• Math.random was detected in the Snap bundle. This is not a secure source of randomness, and should not be used in a secure context. Use crypto.getRandomValues instead.

Does anyone have a step by step for getting webpack not to Math. and use crypto. instead? The only place it's used is in dist/bundle.js so I'm assuming there's a config process to tell webpack to use the more cryptographically secure option.

[t-vila]

Hey, I guess you're talking about this one ? https://docs.metamask.io/snaps/reference/cli/options/#customizewebpackconfig

[ziad-saab]

@poi-son-ivy if Math.random is detected in the bundle but it's not in your own code, then it must be in one of your dependencies. First, identify the dependency or dependencies that use Math.random. It could be that the usage of Math.random is completely unrelated to your code paths, and was just bundled as part of some dependencies without being used. If it turns out that your code is using Math.random through a dependency, you can then patch the dependency using the instructions here:

https://docs.metamask.io/snaps/how-to/debug-a-snap/common-issues/#patch-dependencies