[peilun-conflux]

Update Tokio to 1.53.3 for RUSTSEC-2026-0386.

Add a temporary crypto-bigint exception for RUSTSEC-2026-0387, which concerns timing leaks from arithmetic on secret operands. The inspected node paths only verify signatures and recover public keys using public inputs. Neither private keys nor secret signing nonces enter these computations, so timing variations cannot reveal additional private-key information through these paths. Conflux secp256k1 signing and ECDH use libsecp256k1.

---

This change is 

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• .cargo/audit.toml
• Cargo.toml
• deny.toml

No high-confidence defects found in the changed configuration. The inspected signing and ECDH paths use libsecp256k1, while the REVM P-256 integration passes verification inputs only.

Generated files excluded from findings as requested: Cargo.lock, tools/consensus_bench/Cargo.lock, and tools/evm-spec-tester/Cargo.lock.

Validation was static and read-only; no builds, tests, or audit commands were executed. Upstream advisory details and dependency implementations were not independently verified.

---

_{Reviewed by gpt-6.1-sol · Input: 42 · Output: 3.5K · Cached: 522.5K}