v2.1.7

Install

To install Decrediton desktop wallet, download, uncompress, and run Decrediton Linux AppImage or Decrediton Linux tar or Decrediton macOS arm64 or Decrediton Windows.

To install the command-line tools, please see dcrinstall.

See decred-v2.1.7-manifest.txt and the other manifest files for SHA-256 hashes and the associated .asc signature files to confirm those hashes.

See README.md for more info on verifying the files.

Skip to downloads

Contents

• dcrd
• dcrwallet

dcrd v2.1.7 Release Notes

This is a patch release of dcrd that includes the following notable changes:

• Several fixes for network and mixing-related denial-of-service (DoS) attacks
• Improved mixing performance
• Resolves a memory leak that accumulates slowly over time
• Corrects the test network initial synchronization issue introduced in v2.1.6
• Adds extensive safeguards against unexpected transaction spends

Upgrade Highly Recommended

Miners, stakeholders, and anyone running a full node are strongly encouraged to upgrade to this release. It includes multiple fixes for potential denial-of-service (DoS) attacks that could disrupt node operation.

Miners, in particular, are at risk of having their template generation stalled.

Spend Safeguards

In response to the previous inflation bug, this release adds extensive safeguards designed to detect unexpected transaction spends that should not be possible. When these safeguards detect certain unexpected conditions, the affected node will shut down rather than continue operating in a potentially
unsafe state.

These safeguards would have prevented the previous inflation bug by causing all affected nodes to halt when they encountered the invalid spend. They are also designed to catch a broader range of potential problems that could otherwise go unnoticed.

Changelog

This patch release consists of 87 commits from 6 contributors which total to 161 files changed, 7389 additional lines of code, and 4543 deleted lines of code.

All commits since the last release may be viewed on GitHub here.

See dcrd's own release notes for a categorized breakdown of all commits since the last release.

Code Contributors (alphabetical order):

• Dave Collins
• Jamie Holdstock
• Josh Rickmar
• Iain
• LuaLighter
• yzxcj797

dcrwallet v2.1.7

This release focuses on performance improvements and bug fixes for mixing wallets. All users are recommended to update.

Bug fixes

• A harmless error logged during the publishing of confirmed mix transactions was fixed by removing an incorrect spend proof check on unmined mempool transactions (61ca8901).

• Change addresses (and the internal address branch index) are only derived and incremented when necessary (93fa7d44).

• A missing bounds check of the output index for the mixoutput JSON-RPC method was added (e7865552).

• A performance issue determining which peers were active in a mixing epoch was improved using a more efficient algorithm (decred/dcrd#3790).

• Multiple distinct mixing key exchange messages are no longer permitted by the same sender for the same session (decred/dcrd#3820).

• The permitted total number of mixing key exchange messages that may be publised by a single peer was reduced (decred/dcrd#3822).

• The lower limit of 64 maximum peers per mixing session was relaxed for key exchange messages, allowing up to the larger 512 limit of pair request messages to be referenced before an alternate session is formed. Following messages in a mix session must still not reference more than 64 total peers (decred/dcrd#3824).

• A shorter 10s mixclient stage timeout is being tested on testnet. Mainnet mixing wallets continue to use a 30s message timeout for each mixing stage (decred/dcrd#3826).

Changelog

• 599b5850: [release-v2.1] Bump version to 2.1.7+release.local.
• 4acbfa1c: [release-v2.1] Update minimum Go version described in README
• b9f31d72: [release-v2.1] Update CI to test with Go 1.26 and 1.27
• c9691d79: [release-v2.1] Update modules
• 93fa7d44: [release-v2.1] txauthor: Only get change address when needed.
• e7865552: [release-v2.1] mixing: add missing bounds check
• 61ca8901: [release-v2.1] wallet: Do not check ValueIn of announced mempool transactions

Code Contributors (alphabetical order)

• David Hill (@dajohi)
• Jamie Holdstock (@jholdstock)
• Josh Rickmar (@jrick)