pub fn contract_hash(normal_form: &str) -> StringExpand description
FNV-1a (64-bit) over the canonical form, rendered as 16 lowercase hex chars.
Why not a cryptographic hash. Trust here is static and channel-based, and
this increment does not change that (ADR 0092): /_bynk/call/ is
platform-dispatched and not externally routable, every context in a
deployment is one trust domain, and a malicious first-party context is out of
the threat model. This is a skew detector, not a security control — an
accident detector. Forging it buys an attacker nothing they could not already
do, so sha2’s ~6-crate dependency tree would buy nothing either. A
collision degrades to today’s behaviour for that one pair (an undetected
skew), not to something worse, and at ~1e-14 for a 1000-contract project it
is not the risk worth engineering against.
Why hand-rolled. std::collections::hash_map::DefaultHasher is
explicitly not stable across Rust releases, so it cannot back a value that
crosses a wire or is compared between two separately-compiled binaries. FNV-1a
is fully specified, so two compilers agree forever.