This is an urgent release fixing a set of vulnerabilities that may affect the process of node functioning. It also contains a set of VM opcodes optimizations and other minor bug fixes.
No resync is required on upgrade, this release is fully compatible with v3.10.0 of the C# node. Default MaxRequestBodyBytes RPC server setting was decreased, consider updating the node configuration file if custom limit is needed.
Behaviour changes:
- decrease default
MaxRequestBodyBytesRPC server setting (#4308) - extend the list of forbidden IPs for Oracle service (#4310)
Improvements:
DUPVM opcode optimisation (#4264)NEWSTRUCTandNEWARRAYTVM opcodes optimisation (#4252)- global documentation format update (#4268)
- distinguish
NotYetValidtransaction verification result fromExpired(#4304) - check witness deserialization limits on the RPC server side (#4305)
- check block/transaction deserialization limits on the RPC server side (#4308)
- restrict the maximum MPT node depth on deserialization (#4309)
Bugs fixed:
- web-socket readers and writers are not awaited on RPC server shutdown (#4272)
- flaky unit-tests (#4266, #4275, #4278)
- execution state difference in a failed candidate registration process (#4273)
- invalid output hash endianness in
util canceltxCLI command (#4277) - duplicates of
Conflictsattribute are not prohibited (#4292) - prohibit an overflow of consumed gas on the VM side (#4306)
- invalid return type of
storage.LocalGetinterop wrapper (#4307) - difference in transaction mocking behaviour for
invoke*RPC calls (#4311)