Starcoin v1.13.21 — Height-gated block permits
Starcoin v1.13.21 — Height-gated block permits
This is an emergency consensus security release for Halley, Barnard, and Main. From each network's fixed activation height, every accepted block must end with a valid Ed25519 block permit signed by that network's configured authorization key. The permit binds the pre-PoW block contents, is committed by the existing block-body and transaction accumulators, and is represented by a deterministic zero-gas transaction result outside VM execution.
Mandatory Main upgrade
All Main nodes, exchanges, explorers, pools, and infrastructure operators must upgrade before block 32,165,300. The height is currently projected near 2026-08-21 23:46 CST (UTC+8); block height, not wall-clock time, is authoritative.
This is an intentional hard fork:
- v1.13.21 rejects Main blocks at or above
32,165,300unless the final transaction is a valid permit. - v1.13.20 and older nodes cannot follow permitted blocks and may remain on an unauthorized legacy fork.
- Do not downgrade a Main node after it has crossed the activation height.
Before the activation height, block creation and validation stay on the existing permit-free path. Supplying a signing key does not add a permit to pre-activation blocks.
Fixed release policy
| Network | Activation height | Compiled authentication key |
|---|---|---|
| Halley | 2,894,400 |
0x157b42a66560e83144deecdb43d5bac70a5e116b0938d277192de7d01617e2ac |
| Barnard | 19,667,300 |
0xca72d0ee15cf78c1232218c8d4c241c87e6cdc6953fea813c7be2191f9388e67 |
| Main | 32,165,300 |
0x6ea544078efcbac81e9d6197090b1a106cd69f2fef83204a2ddecf05980601cd |
The heights and public authentication keys are compiled consensus inputs with no production CLI/TOML override. Private signing keys are not present in this repository, release, or container image.
Barnard remains in its existing historical rollback/recovery state; this release adds no Barnard-specific consensus or database workaround.
Security and compatibility changes
- Enforces permits in verification, save/no-save execution, persisted connect/reuse, and active-head startup checks.
- Adds authorization-generation-aware peer scheduling and locally validated fork choice so an unauthorized higher-total-difficulty branch cannot outrank a valid permitted generation.
- Signs active block templates locally through
--block-permit-private-key-fileand fails closed if the active signer is missing or invalid. - Keeps the legacy block header, database schema, VM, Framework, and RPC schemas unchanged.
- Validates the configured private key against the compiled authentication key during service startup.
- Removes the GitHub Release publication trigger from the Docker build workflow so publishing this release cannot rebuild or overwrite the tested image tag.
Mining template subscriptions and solution submissions must be pinned to the same single Starcoin signer process. Do not place multiple Starcoin nodes behind a load balancer for mining RPC. Main production uses one keyed signer, one exact-ordinal Service endpoint, and manual fail-closed recovery; there is no active/active signer or automatic standby promotion.
Validation evidence
- Targeted block-permit, configuration, miner, chain, network, and sync tests passed; the sync suite passed 47 tests with one existing ignored test.
- A clean release build of
starcoinpassed on the final source. - Halley produced and accepted more than 1,011 consecutive permitted blocks across restart/recovery and an ordinary transaction test.
- In the Halley adversarial test, an unsigned competing branch using roughly 6× the authorized test mining capacity reached higher total difficulty. The upgraded node fetched it, rejected it with
active block is missing its final permit, and did not reorganize. - The final immutable image was redeployed to Halley. Twenty consecutive blocks
2,897,476–2,897,495all contained the expected final Ed25519 permit; the sample included an ordinary transaction block and had no permit-envelope errors. - The final image loaded the Main signing key without error and synchronized on the isolated Main signer. At Main height
32,146,987, its head hash exactly matched an existing production seed node.
Reproducible artifact identity
- Annotated tag:
v1.13.21 - Release commit:
ab47660581d42c3731d79754ed83a34b1b97b5d1 - Source tree:
f6035d9aa269a752bff3927ca3a46fe1b872ab04 - OCI index digest (GHCR and Docker Hub):
sha256:ee6e26556b4f917a4f211f79b72e81c7f0a3d21fbd78732d488b1f280501fcbf - Linux/amd64 manifest digest:
sha256:c324b0b18548a0f1f511c585872ad0768325f569c2aaa25018beeef9a7c652da /starcoin/starcoinSHA-256:b9a54704f9d5e28e7bb6e37b66b25722b8fef962dc467fbbbcf885c96e65b233- Verified runtime version:
starcoin 1.13.21 (build:v1.13.21) - Build evidence: https://github.com/starcoinorg/starcoin/actions/runs/32376701395
Immutable deployment reference:
ghcr.io/starcoinorg/starcoin@sha256:c324b0b18548a0f1f511c585872ad0768325f569c2aaa25018beeef9a7c652da