The Overflow Modulus Trap

A submission stores hashes in unsigned long long and never takes an explicit modulus, letting wraparound act as $m = 2^{64}$ . It gets hacked. The author's fix is to keep $2^{64}$ but pick the base p at random from a large set at program start, reasoning that an attacker cannot build a test against a base they do not know. Does that work?

It is moot, because unsigned integer overflow is undefined behaviour in C++, so the hash values were never meaningful to begin with.

No. There is a known construction that produces colliding strings for $2^{64}$ independently of the base, so randomizing p changes nothing. Move to a large prime modulus, where a random base does help.

Yes. The published attacks are built against p = 31, so any other base defeats them.

Yes. A base fixed only at run time cannot be precomputed against, which is the same defence that saves a randomized-seed hash table from flooding.