[Bug Bounty] Biased polynomial coefficient generation in Shamir SSS – Afeta diretamente o Challenge de 1 BTC

[danmobile2023]

Summary:
The Shamir Secret Sharing Scheme implementation used in the official Bitaps Bug Bounty Challenge (https://bitaps.com/mnemonic/challenge) generates polynomial coefficients in a biased (non-uniform) manner over GF(256). This flaw reduces the effective entropy of the secret and enables practical statistical attacks using fewer shares than the declared threshold. The challenge specifically publishes only 2 out of 3 required shares (threshold 3-of-5), making this vulnerability directly exploitable against the live 1 BTC bounty. The same issue was previously referenced in issue #23 but remains unpatched in the code linked from the bounty page.
Affected Code:
The vulnerable logic is located in the official repositories referenced on the challenge page: https://github.com/bitaps-com/pybtc/blob/master/pybtc/functions/shamir.py (lines ~89–110)
https://github.com/bitaps-com/jsbtc/blob/master/src/functions/shamir_secret_sharing.js (equivalent section)

Relevant excerpt (Python version):

for i in range(threshold - 1):
if e_i < len(e):
a = e[e_i]
e_i += 1
else:
e = generate_entropy(hex=False)
a = e[0]
e_i = 1
q.append(a)

The underlying generate_entropy() function (and earlier versions using modular multiplication) does not produce a uniform distribution across all 256 possible field elements. Values near 255 are underrepresented, resulting in measurable statistical bias in the quadratic coefficient a₂.
Impact on the Challenge:
Threshold: 3 (degree-2 polynomial)
Only 2 shares published
The bias in a₂ significantly reduces the search space for the original 128-bit mnemonic
This directly contradicts the security claim that “any three shares are sufficient and fewer are mathematically impossible”

The 1 BTC reward address (bc1qyjwa0tf0en4x09magpuwmt2smpsrlaxwn85lh6) remains unspent since August 2021, confirming that the vulnerable implementation is still in production use for the bounty.
Bounty Classification:
This falls under the 0.1 BTC category stated on the challenge page: “0.1 BTC – Any bug in the implementation of the presented secret sharing scheme that can lead to loss of access and the inability to recover the original mnemonic phrase.”
Next Steps OfferedI am prepared to provide immediately: Full statistical analysis of the coefficient bias (with entropy measurements)
Proof-of-Concept script demonstrating the reduced search space
Optimized attack combining degree-drop analysis with probability ranking using the two published shares.

Reward Address 12QmzvUKqNcrXYvXw7oLywyfp9gTFgbNLJ

[juzigu40-ui]

Hi team, Juzi Valley Research Team is interested in this issue. We are reviewing the architecture and interface contracts now, and we will align the implementation with your contribution standards and test expectations. Could you please assign this to us so we can deliver a reviewable PR within 48 hours?

[chris7ph]

Hi bitaps team,

I've been working through your 1 tBTC ZeroNights mnemonic challenge at tbtc.bitaps.com/mnemonic/challenge and wanted to reach out directly.

I've done a fairly thorough cryptographic analysis:

• Decoded both published shares (x=3 and x=15) and confirmed their entropy values
• Investigated the Issue Generation of polynomial coefficients in Sharmir's secret sharing #23 coefficient bias in pybtc — ran full frequency analysis and confirmed the live challenge used a proper CSPRNG (flat 1.00x bias ratio), so that attack path is closed
• Verified there's no degree-reduction vulnerability exploitable with only 2 of 3 shares

The challenge is working exactly as intended — it's information-theoretically secure with 2 shares.

My question: Is the challenge still active? Is there any intention to ever release a third share, or is there a different intended solution path I'm missing?

I'm not asking for the answer handed to me — genuinely curious if there's a puzzle element I've overlooked, or if the challenge is purely a demonstration that proper SSS is unbreakable.

Thanks for building it — it's been a great deep-dive into GF(256) arithmetic.