[UPGRADE] Mainnet upgrade to v1.6.3

Proposal

Network: tacchain_239-1
Current version: v1.6.2
Target version: v1.6.3
Upgrade name: v1.6.3

Overview

This proposal upgrades the TacChain mainnet from v1.6.2 to v1.6.3.

The upgrade runs a one-shot rescue migration and bumps the cosmos/evm fork to v0.6.0-tac.15, which carries the remaining security hardening deferred from v1.6.2.

The migration is time-critical. The self-unbonding stake of the six TOE validators, whose operator keys are compromised, matures on 2026-09-23 15:35 UTC. This upgrade redirects it to a TAC-controlled account before that happens, and releases every remaining delegation on those validators back to its own owner.

References:

• Changelog: https://github.com/TacBuild/tacchain/blob/main/docs/CHANGELOG-v162-v163.md

Release Artifacts

Artifact	Value
Git tag	v1.6.3
Commit	97cee07
GitHub release	v1.6.3

SHA-256:

17dc6b5d1b48c424b9fb5d777c6c8eba27c260d455a9217b628db0248b17f033  tacchaind-linux-amd64.tar.gz
9e09456ea397fefc86181b57bd091a4e79e50c1cd74c01c7632922bb39da9356  tacchaind-linux-arm64.tar.gz
c65b67076d4d1f483eb6beb29960860d7fb464fd17ee4d8939de6e55c5b8568f  tacchaind-linux-amd64
a380a925d5fe2225de0b17584682600eb1f841b7341fa2d887663f2566cd6cca  tacchaind-linux-arm64

Upgrade Timeline

This is an expedited proposal: the voting period is 3.5 days (302400s) with a 66.7% expedited threshold and a 50000000000000000utac (0.05 TAC) minimum deposit. The regular 7-day period would end after the required activation date.

Event	Date (UTC)	Block
Governance proposal submitted	September 9, 2026, 14:00 UTC	-
Voting period ends (expedited, +3.5 days)	September 13, 2026, 02:00 UTC	-
Upgrade activation height	~ September 14, 2026, 10:00 UTC	25,308,500
Node update deadline	after upgrade height	-

Updating Process

Validators should vote on the proposal during the voting period and prepare their nodes before the upgrade height.

At the upgrade height the chain will halt with the upgrade name v1.6.3. After the halt:

1. Stop tacchaind.
2. Back up the node home directory.
3. Replace the binary with the v1.6.3 binary.
4. Start tacchaind.

The upgrade handler runs automatically on the first block after restart. No manual state migration is required. Cosmovisor users need no action beyond the usual: plan.info carries the linux/amd64 and linux/arm64 .tar.gz binaries with sha256 checksums for auto-download.

Configuration Changes

None. No app.toml or config.toml change is required. No parameter change, no ConsensusVersion bump, no store migration.

Technical Implementation

Rescue Migration

The v1.6.3 upgrade handler performs a one-shot state migration, gated on chain-id tacchain_239-1. On any other network it runs the standard module migrations and returns.

Task	Action
A1	Repays the 19 in-flight-message recipients from the old OFT escrow — 34,354,103.50003 TAC, matching the escrow balance exactly
A2	Transfers 7,628,902.102546 TAC from the Foundation treasury multisig to the new OFT, to back the ETH-side supply
B	Redirects the six compromised validators' self-unbonding stake — 19,979,613.401007161764310628 TAC — to a TAC-controlled account. Completion times are unchanged: the stake still matures on its original 2026-09-23 schedule, only the recipient changes
C	Undelegates all 995 delegations on those validators in full, with the normal 21-day unbonding period, back to each delegator's own account. Nothing is redirected — these are third parties' funds, and vesting-locked stake returns still locked

All addresses and amounts are compiled-in absolute values, audited against mainnet state at height 24,993,121. Total supply is unchanged: the migration only transfers and unbonds, it never mints or burns.

Impact on delegators of the TOE validators. If you delegate to TOE 1–6, your stake is undelegated automatically at the upgrade height and returns to your own account after the standard 21-day unbonding period (around 2026-10-05). No action is required, and no funds are redirected. Consider re-delegating to another validator once it arrives.

Verification

The upgrade was rehearsed end to end against a mainnet snapshot, using the same halt-and-swap procedure described above, and the resulting state was verified in full.

cosmos/evm v0.6.0-tac.14 → v0.6.0-tac.15

Change
Bech32 address-length guard — skip non-20-byte addresses when mirroring balances, closing a double-credit path
Atomic StateDB.Commit — stage through a cache context and write only on success
Precompile out-of-gas semantics — return raw out-of-gas instead of a revert (upstream #1049)
Feemarket EndBlock — clamp gasWanted / gasUsed to MaxInt64 instead of failing the block (upstream #1259)