charFromMask ignores the seed whenever mask bit 0 is set, and generally biases to the lowest reachable bit #52

Unit

src/lib/mut/LibConformString.sol:120-139 (probe start at :130).

Intent oracle

NatSpec: "Generates a single character from the given mask using the provided seed. This is useful for generating random characters that conform to a specific character set."

Violated property

The search starts at char = 0 and only consults the seed when the current char misses the mask. Therefore:

• If mask bit 0 is set, the result is "\x00" for EVERY seed — the seed is ignored entirely.
• Generally the first probe is always char 0, so the distribution is biased toward whichever set bit the keccak walk reaches first; it is not uniform over the mask.

Repro

charFromMask(anySeed, mask | 1) == bytes1(0) for all seeds. Pinned by testCharFromMaskBitZero (PR #37).

Triage framing

For a test-utility "give me some conforming char", determinism-per-seed plus conformance may be all that's wanted, and the existing fuzz test only asserts conformance. The doc's "random characters… using the provided seed" overpromises for bit-0 masks. Fix options: seed the initial char from the seed (behaviour change downstream), or narrow the doc.

🤖 Generated with Claude Code