Skip to content

2.4.1

Latest
Latest

Choose a tag to compare

View all tags
@v0d1ch v0d1ch released this 02 Sep 17:39
· 1 commit to master since this release
2.4.1
This tag was signed with the committer’s verified signature.
v0d1ch Sasha Bogicevic
GPG key ID: C574785FF89B8E25
Verified
Learn about vigilant mode.
099f5dd
This commit was signed with the committer’s verified signature.
v0d1ch Sasha Bogicevic
GPG key ID: C574785FF89B8E25
Verified
Learn about vigilant mode.

This is a security release fixing a critical vulnerability in hydra-node: GHSA-cg83-6w6r-6hx3 — an invalid transaction could be included in a confirmed snapshot, allowing a malicious head participant to steal funds.

Note

All operators running 2.3.0 or 2.4.0 must upgrade immediately. A malicious participant in your head could craft a layer 2 transaction spending your funds with an invalid signature (or a failing script) and trick honest nodes into signing a snapshot containing it. Upgrading your own node to 2.4.1 protects your funds, as confirming a snapshot requires every participant's signature.

When confirming a snapshot, hydra-node re-applied the requested transactions through an optimized path that skipped signature verification and Plutus script evaluation, on the assumption they had already been validated on receipt — but an unvalidated transaction could reach that path. 2.4.1 removes the optimization: transactions are now always fully validated, including signature and script checks, when processing a snapshot request.

Upgrade notes:

  • From 2.4.0: this is a drop-in replacement — no changes to the Hydra scripts, the snapshot signature, or the persisted hydra.db format.
  • From 2.3.0 or earlier: all breaking changes of 2.4.0 apply — in particular, close and fan out any open heads before upgrading.

Build artifacts

  • 📦 Binaries for Linux x86_64, Linux ARM64 and MacOS ARM64
  • 🐋 Docker images (multi-arch: linux/amd64 + linux/arm64)

Hydra Scripts

Unchanged from 2.4.0:

  • preview: 87c5cf15330f8a2988e2fa6d17868ed3b66791aa30537f54b109468062ca5c65,f517904ab1f6b1f9bf3c808e136dbf3577b20ead877f87d43332385aee9d6640
  • preprod: 984053a3a89480b7c929aa19136078f13b3cbc4db4fa21c4ea25fbbb164ba018,1c6c98c425fd160d787b924b63f32ab5af72c8cc0a42704b5753008757b5f86e
  • mainnet: 58ef9ea83415aacd5723879aa1353154c92c2f32127377dc5dfa744457ae33d5,78326683611fc1b90a52dd1bb062abf62979d9a3abdb45830af6b5f2e901bfd1

See also networks.json

Compatible / tested with

  • cardano-node: 11.0.1
  • cardano-cli: 11.0.0
  • mithril: 2630.0

Full Changelog: 2.4.0...2.4.1

Assets 2
Loading