SDK v0.47.13 upgrade (v047) — release candidate

Warning

Superseded by sdk-v0.47-rc.2. Do not use this binary.
It was built with CometBFT v0.37.5, which is vulnerable to Tachyon / CSA-2026-001 (GHSA-c32p-wcqj-j677). It also predates the on-chain upgrade rename to 3.0.0. Use rc.2.

---

Release candidate for the Passage Cosmos SDK v0.45.16 → v0.47.13 upgrade. Pre-release on the Ninjaxan fork for review/testing — see PR envadiv#204. Passage cuts the official version tag on merge.

What this is

• Built from commit 65f61ff on branch feat/sdk-v0.47-from-v2.6.0, on top of the v2.6.0 mainnet tag (the binary self-reports version: 2.6.0-2-g65f61ff — accurate: v2.6.0 + the 2 migration commits).
• cosmos-sdk v0.47.13, cometbft 0.37, ibc-go/v7, wasmd 0.45.0 with wasmvm pinned at 1.5.7 (no downgrade — existing contract state stays readable).
• On-chain upgrade name (for the gov software-upgrade proposal): v047.

Validation

Real-state fork-test against a passage-2 export (height 19527283: 11,201 accounts, 79 contracts, 136 validators): v047 applied, blocks produced past the upgrade height, 33/33 wasm code hashes bit-identical, 79/79 contracts + state preserved, gov → v1, x/consensus created. go build, make build, go vet, go test ./... all green.

Asset

File	sha256
passage_sdk-v0.47-rc.1_linux_amd64	fcbfd85734b8b4142e6133c834ef4fe5a1cd35f09b176e5e1487d7e151b357fa

linux/amd64, dynamically links libwasmvm 1.5.7 (CGO).

Validator build-from-source requirements

• Go 1.21+
• CGO enabled; libwasmvm 1.5.7 must be resolvable (make build / make install injects version ldflags)
• Linux build host

Upgrade procedure (no cosmovisor)

At the upgrade height the chain halts; then on each validator: stop the service, replace the passage binary with this one, restart. (Cosmovisor users: drop it in upgrades/v047/bin/.)

Operational note

CometBFT 0.37 renamed fast_sync → block_sync in config.toml; this binary ignores the old fast_sync key.