Skip to content

v1.7.20 - CertiK Audit Remediation & Coordinated Security Release

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Jul 11:21
· 42 commits to develop since this release
v1.7.20
0b70b0f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes - v1.7.20

Overview

This release remediates the CertiK protocol audit findings (KLR series) together with seven coordinated-disclosure security advisories (one Critical, six High) spanning consensus signature validation, account permissions, the native marketplace, the KVM execution layer, the REST/WebSocket API, and the indexer. It also ships operator-tooling features, new network supply endpoints, and stability fixes.

⚠️ Consensus-affecting security release — upgrade all nodes. This release introduces a new fork flag, fixAuditChangesV3, which gates the consensus-affecting audit remediations. Every node MUST run a config whose fixAuditChangesV3 activation epoch matches the network, or it will diverge from consensus. On mainnet the fork is active as of epoch 5911 (2026-07-18 07:00 UTC).

🔒 Security & Hardening

This release closes seven GitHub Security Advisories reported through coordinated disclosure; all are fixed in v1.7.20, and CVE IDs populate on the advisories as they are assigned.

Consensus-affecting fixes below are gated behind the fixAuditChangesV3 fork flag, so pre-fork history reprocesses identically and replay stays deterministic. Validation-only fixes (e.g. the quorum bitmap check) apply immediately.

GHSA-97cv-x867-6xhm — Account takeover via spoofable RecipientAddr in permission updates (Critical)

kleverUpdateAccountPermission authorized the update against the attacker-controlled RecipientAddr instead of the authenticated caller, allowing an attacker to overwrite the permission set of an arbitrary account.

  • [KLC-2478] (CertiK KLR-05) Authorize permission updates against the caller, not the recipient.
  • [KLC-2475] (CertiK KLR-03) Bound the signer count in decodeSigners, rejecting oversized signer lists.
  • [KLC-2512] (CertiK KLR-09) Reject zero-weight listed signers and non-positive permission thresholds that let unauthorized signers satisfy protected operations.
  • [KLC-2545] Gate account-permission validation behind the fixAuditChangesV3 fork.
  • Reported by @mabdullah22.

GHSA-f9h7-4mmq-vgcq — Padding-bitmap bits can satisfy block-header quorum (High · CVE-2026-58262)

  • [KLC-2477] (CertiK KLR-04) Setting unused (padding) bits in PubKeysBitmap inflated the counted signer total, letting a block leader satisfy the aggregate-signature quorum with fewer real BLS signers than consensus requires. Bitmaps with non-zero padding bits are now rejected in the quorum check and final-info validation. No fork gating is required — honestly-produced historical blocks carry clean bitmaps, so replay is unaffected. Reported by @sondt99.

GHSA-26r5-4mm2-px5c — Zombie-order theft: Buy missing IsClaimed guard in the native marketplace (High)

  • Reject Buy on already-claimed sell orders; previously a stale (claimed) order could be bought again, redirecting payment against an NFT the seller no longer escrowed. Reported by @mabdullah22.

GHSA-9wh6-9hq7-9688 — Unvalidated BLS public key on validator registration (High)

  • Validate the BLS public key on validator register and update; a malformed key previously entered the validator set and broke aggregate-signature participation, a consensus-liveness DoS vector. Reported by @mabdullah22.

GHSA-7c7c-373r-gfjj — Elasticsearch bulk injection via on-chain account name (High)

  • Escape account names in Elasticsearch bulk serialization, closing an injection vector where a crafted on-chain account name could forge or corrupt indexed explorer data. Reported by @mabdullah22.

GHSA-9v8p-frvj-2pcm — Unauthenticated /log controls global node logging (High)

  • [KLC-2438] Require API authentication for the /log WebSocket endpoint and stop unauthenticated clients from mutating the node's global logger configuration. Reported by @maiiquynhh.

GHSA-4fwh-wrm6-97xm — Unauthenticated /subscribe WebSocket memory/goroutine exhaustion (High)

  • [KLC-2440] Bound /subscribe reads (read-size limit and connection lifetime deadline), cap per-connection subscription addresses, fix a subscription-map leak, add a configurable connection cap, and honor the secured flag. Reported by @ch4r0utf8 and @maiiquynhh.

CertiK audit remediations (KLR series)

Alongside KLR-03, KLR-04, KLR-05 and KLR-09 above, this release closes further findings from the CertiK protocol audit — consensus-affecting items gated behind fixAuditChangesV3:

  • [KLC-2473] (KLR-02) Reject oversized KDA/KLV transfer amounts that could present fake smart-contract call values.
  • [KLC-2479] (KLR-06) Bound the indirect-execution argument count and validate argument lengths in getArgumentsFromMemory, with overflow checks.
  • [KLC-2510] (KLR-07) Block indirect contract execution from invoking the protected upgrade lifecycle hook.
  • [KLC-2511] (KLR-08) Fix unstaked FPR buckets permanently losing pre-unstake rewards when claim maturity has not elapsed.
  • [KLC-2513] (KLR-10) Count KDA transfers only for transfer builtin functions, fixing incorrect usage-counter counting that could DoS contract calls.
  • [KLC-2517] (KLR-14) Stop timed-out slow VM hooks from continuing to run: bounded join with quarantine on timeout, entry checks across all VM hooks, and internal bounds in BigIntPow/BigFloatPow (zero-base gas handling, negative-exponent fault order).
  • [KLC-2523] (KLR-16) Copy managed-buffer storage keys before recording VM output and reject writes to protected storage keys, preventing protected KDA balance writes via mutated buffers.
  • [KLC-2534] (KLR-15) Reject non-canonical NFT transfer amounts (any amount other than 1) in KDA transfers.
  • [KLC-2457] Snapshot royalties at marketplace Sell time, a follow-up to GHSA-p7gw-2pcp-5pf8 (re-gated onto the V3 fork).

Supporting hardening

  • [KLC-2471] Fix a validator commission int64 overflow.
  • [KLC-2469] Reject non-positive kdaFeesPool FRatioKDA/FRatioKLV fee ratios and range-check the computed swap value (fork-gated). Setting these ratios is already restricted to the pool admin or asset owner, who can withdraw the same funds outright, so this is input-validation hardening rather than a privilege boundary.

✨ Features & Improvements

  • [KLC-2394] Operator: add ms sign subcommand to sign multisig transactions.
  • [KLC-2506] Add /network/economics and /network/account-totals supply endpoints.
  • [KLC-2448] Operator: check HTTP status codes in GetURL and PostURL instead of silently accepting error responses.
  • [KLC-2437] Connector: normalize the node address for both providers (ws/wss and http/https).

🧵 Stability & Concurrency

  • [KLC-2465] Avoid a permanent zombie process from the bugsnag panic monitor under --log-save.
  • [KLC-2430] Set the pubsub seen-messages TTL per instance, fixing a data race.

🔄 Upgrade Notes

This is a consensus-affecting security release.

  • Upgrade all nodes to v1.7.20.
  • Ensure your node config's enableEpochs.fixAuditChangesV3 matches the network's activation epoch. On mainnet the fork is active as of epoch 5911 (2026-07-18 07:00 UTC). A node running a different epoch for this flag will diverge from consensus.
  • The quorum padding-bitmap fix and API hardening are active immediately and require no configuration.
  • No data migration is required.

Migration Path

Update to v1.7.20, set/confirm fixAuditChangesV3 to the network activation epoch (mainnet: 5911), and restart nodes.

📦 What's Changed

The CertiK-audit and advisory remediations were developed under embargo in a private security fork and merged as a batch; public PRs are linked below.

  • [KLC-2394] feat: operator add ms sign subcommand to sign multisig by @n4t4l in #66
  • [KLC-2465] avoid permanent zombie from bugsnag panic monitor under --log-save by @fbsobreira in #72
  • [KLC-2471] Fix validator commission int64 overflow by @nickgs1337 in #78
  • [KLC-2469] Validate kdaFeesPool fee ratios by @nickgs1337 in #75
  • [KLC-2438] require auth for /log and stop unauthenticated logger mutation (GHSA-9v8p-frvj-2pcm) by @fbsobreira in #74
  • [KLC-2430] fix: set pubsub seen-messages TTL per instance to avoid data race by @fbsobreira in #77
  • [KLC-2440] Bound /subscribe WebSocket reads, connections, and subscriptions (GHSA-4fwh-wrm6-97xm) by @fbsobreira in #76
  • [KLC-2448] Check HTTP status in operator GetURL and PostURL by @nickgs1337 in #80
  • [KLC-2437] Normalize connector node address for both providers by @nickgs1337 in #81
  • [KLC-2506] feat: add /network/economics and /network/account-totals supply endpoints by @fbsobreira in #79
  • GHSA-97cv-x867-6xhm: [KLC-2478] authorize permission update against caller + [KLC-2475] bound signer count + [KLC-2512] reject zero-weight signers / non-positive thresholds + [KLC-2545] fork-gate permission validation
  • GHSA-f9h7-4mmq-vgcq (CVE-2026-58262): [KLC-2477] reject bitmap padding bits in quorum check and final-info validation
  • GHSA-26r5-4mm2-px5c: reject Buy on already-claimed marketplace orders
  • GHSA-9wh6-9hq7-9688: validate BLS public key on validator register and update
  • GHSA-7c7c-373r-gfjj: escape account name in Elasticsearch bulk serialization
  • CertiK KLR remediations: [KLC-2457], [KLC-2473], [KLC-2479], [KLC-2510], [KLC-2511], [KLC-2513], [KLC-2517], [KLC-2523], [KLC-2534]

New Contributors

  • @n4t4l made their first contribution in #66

👥 Contributors

Security researchers

Thanks to the researchers who contributed to these advisories through coordinated disclosure, and to CertiK for the protocol audit:

Full Changelog: v1.7.19...v1.7.20

Contributors

fbsobreira, n4t4l, and 7 other contributors
Assets 5
Loading