Skip to content

Quavence Core v15.1.2 — Security Advisories & Hard Fork (Protocol 70016)

Choose a tag to compare

View all tags
@dtd-tosh dtd-tosh released this 19 Sep 05:19
· 4 commits to main since this release
v15.1.2
c79c08c

Quavence Core v15.1.2 (Protocol 70016)

Quavence Core version 15.1.2 is a critical security, consensus, and P2P networking release for the desktop GUI wallet, node daemon, and AI Worker subsystems. It resolves verified security advisories QV-2026-001, QV-2026-002, and QV-2026-003, enforces strict PoUS consensus rules for all blocks from 600 onwards, activates native backward-compatible Tor v3 onion address gossip, resolves peer database (peers.dat) consistency checks, and bundles a self-contained portable AppImage for modern Linux distributions (Mint 22.3+, Ubuntu 24.04+).

⚠️ CRITICAL UPGRADE NOTICE: The network is currently operating at Block 4371+. PoUS v2 cryptographic verification rules are active for all blocks from 600 onwards. All node operators, validators, pool operators, and stakers MUST update to v15.1.2 immediately to ensure continuous synchronization and staking on the canonical chain.

🛡️ Security Advisories Resolved

1. QV-2026-001: PoUS Attestation Replay Protection & Signature Validation

  • Issue: Unchecked attestation submissions could theoretically allow replay attacks or unauthorized task credits across rolling windows.
  • Fix: Cryptographic nonce enforcement, worker signature verification against registered Base58 payout keys, and deduplication checks in src/pous.cpp.

2. QV-2026-002: PoUS Pool Authorization Hard-Fork & ECDSA Verification

  • Issue: Naive pubkey extraction in TxSpendsFromKeyID previously accepted scriptSig pushes without signature verification, allowing theoretical forgery of consensus boost markers.
  • Fix: Strict ECDSA signature verification (VerifyScript with SCRIPT_VERIFY_NULLFAIL | SCRIPT_VERIFY_DERSIG). Hard fork rule activation is gated at block nPoUSV2ActivationHeight = 600.
  • Mitigation: Fast pre-filter (scriptSig.size() < 70) mitigating potential mempool CPU exhaustion (W-DoS).

3. QV-2026-003: Tor v3 Serialization & Peer Database (peers.dat) Invariant Fix

  • Issue: 32-byte Ed25519 Tor v3 public keys were truncated to 16 bytes when relayed over legacy IPv6-mapped gossip. Additionally, reading legacy peers.dat files could cause address manager counter desync (assert(nIds != nNew) in src/addrman.h:312), crashing nodes on startup or shutdown.
  • Fix: Protocol upgraded to 70016 (TORV3_ADDR_VERSION). Added full 32-byte onion gossip serialization with safe legacy fallback. In src/addrman.h, nNew and nTried counters are automatically reconciled against actual in-memory entries, eliminating runtime assertion failures.

📦 Binaries & Checksums

🐧 Linux (x86_64)

  • quavence-qt-v15.1.2-x86_64.AppImage (37.0 MB) — (Recommended) Self-contained standalone AppImage with bundled Qt 5.15, Boost 1.74, and Protobuf 23. Runs out-of-the-box on Linux Mint 21/22.3, Ubuntu 20.04/22.04/24.04, Debian, and Fedora.
    • SHA-256: 8a9d783f40d06df5ac167658d5b036889e3cced0431125a7d16c21c0fd335dc8
  • quavence-qt-pous-allinone-v15.1.2-linux-x64.tar.gz (5.6 MB) — PoUS AI Worker GUI Wallet + PoUS Glyphs.
    • SHA-256: cf01a55ba1b20c3f1775f55016508ca9c431b539b0abee2e0c85a87fcf21f1e3
  • quavence-qt-standard-v15.1.2-linux-x64.tar.gz (5.6 MB) — Classic Qt GUI Wallet + PoUS Glyphs (No AI Worker).
    • SHA-256: b018fab06fb69c9113d138eea0e9d5d8d977b946b6bd8842dc9cbadd190eb282
  • quavenced-v15.1.2-linux-x64.tar.gz (2.0 MB) — Headless Node Daemon for servers, VPS, and Docker containers.
    • SHA-256: 77d3a27a203c06600bdb3085f5f71a5295c411db605d81963b22bf5a20727857
  • quavence-cli-v15.1.2-linux-x64.tar.gz (0.2 MB) — RPC Command-Line Interface.
    • SHA-256: be7b1aac8d3edd30537ce97ec3e8cd508ef2d2193587b8ca571ef8a2652cbbb8

🪟 Windows (x86_64)

  • quavence-qt-pous-allinone-v15.1.2.exe (46.9 MB) — (Flagship All-in-One) PoUS AI Worker GUI Wallet + Glyphs + Embedded Tor v3 Daemon.
    • SHA-256: 09120f6c27181dd513fc5aa29f1ce399fbdfacbc67cae795e2e5228f74046dae
  • quavence-qt-standard-v15.1.2.exe (45.0 MB) — (Recommended for Tor Users) Classic Qt GUI Wallet + PoUS Glyphs + Embedded Tor v3 Daemon (No AI Worker).
    • SHA-256: e50212cbc8a7baec92ff34a73975682a3aed63b22091771562947cbbb740cfd6
  • quavence-qt-clearnet-v15.1.2.exe (35.0 MB) — Classic Qt GUI Wallet + PoUS Glyphs (Clearnet, No Tor, No AI Worker).
    • SHA-256: 0335f1b7a8c3650114d0da90bec25fdd0e99b7c167731a8741a2db31f42e300c
  • quavence-qt-pous-worker-clearnet-v15.1.2.exe (35.0 MB) — PoUS AI Worker GUI Wallet + PoUS Glyphs (Clearnet, No Tor).
    • SHA-256: cee88d417610a5d28ecb6c773d335765584f872691013ce3f159a0b1aacb174e
  • quavenced-v15.1.2.exe (10.4 MB) — Headless Node Daemon.
    • SHA-256: e7b828381bf82074576ff40ac0b4b63bd39a98d7d191342bda6babb6609d5f29
  • quavence-cli-v15.1.2.exe (4.0 MB) — RPC Command-Line Interface.
    • SHA-256: 4c1e50c147cbed9cea02897474c77f115752f48fd965b7cd3a9f0888f9ce1c35

🌐 Web3 Extension

  • quavence-vault-extension-v0.1.2.zip (280 KB) — Quavence Vault Chrome / Brave / Edge Web3 Wallet Extension.
    • SHA-256: 3b233e10ad36ec85566e84e6726da4b4c3fa665cccd3cf1b302ee9a49a9d0361

🚀 Quick Start

Linux AppImage (Recommended)

# Make executable and launch:
chmod +x quavence-qt-v15.1.2-x86_64.AppImage
./quavence-qt-v15.1.2-x86_64.AppImage
Assets 15
Loading