CKB Dev Log 2026-07-22

[chenyukang]

Updates

The primary focus of this cycle is release stabilization and system hardening.

Over the past month, we shipped CKB v0.208.0, addressed security and dependency cleanup, improved RPC and mining-related operator behavior, and kept larger architecture work moving through review.

Across the wider stack, CKB-VM continued cleanup and compatibility work, alongside a few new educational deep-dives published. light client received another round of bounds and panic-path hardening. Tentacle released 0.7.6 and kept networking reliability/security follow-ups under review. CKB DAO treasury/voting research moved further from design into executable PoC work.

Several large pieces remain intentionally in pipeline, especially the tx-pool pipeline architecture, Guix reproducible release flow, QUIC ServiceBuilder integration, and additional network/VM hardening.

Releases & Features

CKB v0.208.0 release

Published on July 15, 2026, this regular minor release includes live-cell RPC response enhancement, signing key update, Tentacle dependency upgrade, dependency security updates, and Windows release packaging fixes.

• ckb v0.208.0 release
• feat(rpc): include block hash in live cell response
• Update CKB release signing key
• Upgrade tentacle dependencies
• chore(deps): update crossbeam-epoch for RustSec advisory
• Fix Windows release CRT dependency

Miner notify authentication

CKB added optional bearer-token authentication for miner notify mode. This allows nodes to send an authorization token with block-template notifications, and miners can reject requests with missing or incorrect tokens, while keeping backward compatibility when no token is configured.

• feat: add bearer token authentication for miner notify mode

CKB DAO treasury and voting PoC

The DAO treasury/voting research advanced into a public proof-of-concept phase. The ckb-treasury-lab includes the implementation of the vote-typescript contract, SDK, tools, and e2e tests.

For now, this remains research/PoC work rather than a confirmed CKB protocol change.

• feat: implement vote-type-script contract, SDK, tools, and e2e tests

Tentacle 0.7.6 release

Released on July 9, 2026, v0.7.6 includes QUIC groundwork from earlier PRs, plus reliability and hardening fixes around X25519 validation, yamux back pressure, secio logging, randomized yamux stream IDs, runtime compatibility, and half-close handling.

• Tentacle 0.7.6 release
• Bump tentacle to 0.7.6

Improvements & Fixes

CKB core

CKB continued public security and reliability hardening across relay, networking, tx-pool verification, workflow permissions, dependencies, test stability, and CI infrastructure.

• Fix some public security issues
• Fix(network): bound hole punching forward limiter keys
• chore: avoid stored renotify permits in verify queue
• Change break to continue in transaction input loop
• ci: limit scheduled audit app token permissions
• chore(deps): bump openssl from 0.10.77 to 0.10.81
• ci: migrate to blacksmith ci
• clippy: enable needless_lifetimes and extra_unused_lifetimes lints

CKB light client security and bounds checks

CKB light client received another batch of defensive fixes around checked arithmetic, block-filter indexing, relayer peer-id extraction, and reorg boundary handling.

• Use checked arithmetic in block filter processing
• Add bounds checks before indexing block filter hashes
• Fix relayer extract_peer_id unwrap and add bounds check in block filter processing
• Guard against oob range when reorg_count equals headers length

CKB-VM and script runtime

We continued cleaning up CKB-VM execution-path and improving decoder/trace correctness work, including AArch64 trace compatibility, RV32 illegal-shift decoding, slow-path removal, A-extension removal, and Rust version alignment.

• fix: aarch64 trace compatibility drops high pc bits
• fix: rv32 shift decoder rejects illegal shamt encodings
• Remove slow path
• Remove A extension
• Update rust-version to 1.95.0 in Cargo.toml files
• Update ckb-vm and remove isa_a from ckb-vm-test-suite

We expanded the educational materials. New notes published, explaining macro-ops fusion, the B extension, and CFI-related execution concepts.

• Deep Dive Into CKB-VM Macro-ops Fusion
• Deep Dive Into CKB-VM B Extension
• Deep Dive Into CKB-VM CFI Extension

Networking reliability and security

Tentacle stabilized several transport and stream-handling paths for the v0.7.6 release, including yamux delivery backpressure, secio logging, stream ID randomization, runtime compatibility, and half-close notification behavior.

• fix: Apply backpressure when yamux substream delivery is blocked
• fix: Avoid logging derived secio key material
• Use randomized HashMap for yamux stream IDs
• Fix ReadBuf initialization in runtime compatibility adapter
• Ensure yamux streams notify session after half-close FIN

Tooling and developer experience

CKB-CLI hardened H160 parsing by replacing an unwrap path with proper error handling.

• fix: replace H160::from_slice().unwrap() with proper error handling

In Pipeline

Tx-pool pipeline architecture

The tx-pool pipeline refactor remains in review with green CI as of July 22. It separates transaction processing into classify, pre-check, resolve, verify, and submit stages, preserves the legacy path behind a feature gate, and reports great benchmark gains for secp256k1 transaction throughput.

• Achieve 72% latency reduction and 3.6× throughput improvement for secp256k1 transactions (1-peer, 8 workers)
• refactor(tx-pool): introduce pipeline architecture for concurrent resolve and verify

Guix reproducible release flow

The Guix-based reproducible release flow remains under review. The PR adds pinned Guix build scripts, Cargo source materialization from Cargo.lock, path remapping for reproducibility, and multi-platform release build support.

• build: add Guix reproducible release flow for Linux, MacOS, Windows

CKB core follow-ups

Ongoing work includes: tx-pool pipeline review, onion dependency cleanup, JSONL import error propagation, workflow hardening, and dependency updates.

• refactor: replace torut with manual implementation
• Fix: harden build_ckb_image workflow against tag-name command injection
• fix: Propagate JSONL import parse and verify failures
• chore(deps): bump the all-dependencies group across 1 directory with 29 updates

CKB-VM and light-client follow-ups

Active reviews for the VM and light-client are focused on ensuring MOP fusion correctness, contributor documentation, and additional light-client message/checkpoint validation.

• LUI+JALR Mop fusion uses wrapping_add on i32 immediates
• docs: add contributing section and resources to README
• Validate v1 message field lengths and handle missing check points

Tentacle QUIC and network hardening

Tentacle’s review queue remains busy with ongoing work on the QUIC ServiceBuilder integration, connection limits, backpressure, yamux keepalive behavior, idle/session cleanup, and discovery-input validation.

• quic: ServiceBuilder integration
• fix: Enforce connection limits before inbound handshakes
• Restore yamux write-stall timeout
• Fix forged yamux ping ACKs bypassing keepalive timeouts
• Apply backpressure to high-priority substream buffers
• Validate peer-supplied discovery listen port before storing

Treasury and proposal-script research

The CKB DAO treasury and proposal-script works remain in the research/prototype stage. The current direction is to benchmark and refine proposal/voting scripts before making any protocol-level decision.

• ckb-treasury-lab vote type script PoC