github.com/celestiaorg/celestia-core

April 6, 2020

This security release fixes:

Denial of Service 1

Tendermint 0.33.2 and earlier does not limit the number of P2P connection requests. For each p2p connection, Tendermint allocates ~0.5MB. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions.

Tendermint 0.33.3, 0.32.10, and 0.31.12 limit the total number of P2P incoming connection requests to to p2p.max_num_inbound_peers + len(p2p.unconditional_peer_ids).

Notes:

• Tendermint does not rate limit P2P connection requests per IP (an attacker can saturate all the inbound slots);
• Tendermint does not rate limit HTTP(S) requests. If you expose any RPC endpoints to the public, please make sure to put in place some protection (https://www.nginx.com/blog/rate-limiting-nginx/). We may implement this in the future (#1696).

Denial of Service 2

Tendermint 0.33.2 and earlier does not reclaim activeID of a peer after it's removed in Mempool reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the Peer is created and added to all reactors. RemovePeer is therefore called before AddPeer, which leads to always growing memory (activeIDs map). The activeIDs map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting Denial of Service 1), which ultimately will lead to the node panicking.

Tendermint 0.33.3, 0.32.10, and 0.31.12 claim activeID for a peer in InitPeer, which is executed before MConnection is started.

Notes:

• InitPeer function was added to all reactors to combat a similar issue - #3338;
• Denial of Service 2 is independent of Denial of Service 1 and can be executed without it.

All clients are recommended to upgrade

Special thanks to fudongbai for finding and reporting this.

Friendly reminder, we have a bug bounty program.

SECURITY:

• [mempool] Reserve IDs in InitPeer instead of AddPeer (@tessr)
• [p2p] Limit the number of incoming connections (@melekes)

October 18, 2019

This security release fixes a vulnerability found in the consensus package, where an attacker could construct a BlockPartMessage message in such a way that it will lead to consensus failure. A few similar issues have been identified and fixed here.

All clients are recommended to upgrade

Special thanks to elvishacker for finding and reporting this.

Friendly reminder, we have a bug bounty program.

BREAKING CHANGES:

• Go API
  • [consensus] Modify WAL#Write and WAL#WriteSync to return an error if they fail to write a message

SECURITY:

• [consensus] Validate incoming messages more throughly

October 8, 2019

The previous patch was insufficient because the attacker could still find a way to submit a nil pubkey by constructing a PubKeyMultisigThreshold pubkey with nil subpubkeys for example.

This release provides multiple fixes, which include recovering from panics when accepting new peers and only allowing ed25519 pubkeys.

All clients are recommended to upgrade

Special thanks to fudongbai for pointing this out.

Friendly reminder, we have a bug bounty program.

SECURITY:

• [p2p] #4030 Only allow ed25519 pubkeys when connecting

September 30, 2019

This release fixes a major security vulnerability found in the p2p package. All clients are recommended to upgrade. See TODO for details.

Special thanks to fudongbai for discovering and reporting this issue.

Friendly reminder, we have a bug bounty program.

SECURITY:

• [p2p] #4030 Fix for panic on nil public key send to a peer

BUG FIXES:

• [node] #3716 Fix a bug where nil is recorded as node's address
• [node] #3741 Fix profiler blocking the entire node

July 29, 2019

This releases fixes one bug in the PEX reactor and adds a recover to the Go's ABCI server, which allows it to properly cleanup.

IMPROVEMENTS:

• [abci] #3809 Recover from application panics in server/socket_server.go to allow socket cleanup (@ruseinov)

BUG FIXES:

• [p2p] #3338 Prevent "sent next PEX request too soon" errors by not calling ensurePeers outside of ensurePeersRoutine

June 3, 2019

This releases fixes a regression in the mempool introduced in v0.31.6. The regression caused the invalid committed txs to be proposed in blocks over and over again.

BUG FIXES:

• [mempool] #3699 Remove all committed txs from the mempool. This reverts the change from v0.31.6 where we only remove valid txs from the mempool. Note this means malicious proposals can cause txs to be dropped from the mempools of other nodes by including them in blocks before they are valid. See #3322.

May 31st, 2019

This release contains many fixes and improvements, primarily for p2p functionality. It also fixes a security issue in the mempool package.

With this release, Tendermint now supports boltdb, although in experimental mode. Feel free to try and report to us any findings/issues. Note also that the build tags for compiling CLevelDB have changed.

Special thanks to external contributors on this release: @guagualvcha, @james-ray, @gregdhill, @climber73, @yutianwu, @carlosflrs, @defunctzombie, @leoluk, @needkane, @CrocdileChan

BREAKING CHANGES:

• Go API
  • [libs/common] Removed deprecated PanicSanity, PanicCrisis, PanicConsensus and PanicQ
  • [mempool, state] #2659 Mempool now an interface that lives in the mempool package. See issue and PR for more details.
  • [p2p] #3346 Reactor#InitPeer method is added to Reactor interface
  • [types] #1648 Commit#VoteSignBytes signature was changed

FEATURES:

• [node] #2659 Add node.Mempool() method, which allows you to access mempool
• [libs/db] #3604 Add experimental support for bolt db (etcd's fork of bolt) (@CrocdileChan)

IMPROVEMENTS:

• [cli] #3585 Add --keep-addr-book option to unsafe_reset_all cmd to not clear the address book (@climber73)
• [cli] #3160 Add --config=<path-to-config> option to testnet cmd (@gregdhill)
• [cli] #3661 Add --hostname-suffix, --hostname and --random-monikers options to testnet cmd for greater peer address/identity generation flexibility.
• [crypto] #3672 Return more info in the AddSignatureFromPubKey error
• [cs/replay] #3460 Check appHash for each block
• [libs/db] #3611 Conditional compilation
  • Use cleveldb tag instead of gcc to compile Tendermint with CLevelDB or use make build_c / make install_c (full instructions can be found at https://tendermint.com/docs/introduction/install.html#compile-with-cleveldb-support)
  • Use boltdb tag to compile Tendermint with bolt db
• [node] #3362 Return an error if persistent_peers list is invalid (except when IP lookup fails)
• [p2p] #3463 Do not log "Can't add peer's address to addrbook" error for a private peer (@guagualvcha)
• [p2p] #3531 Terminate session on nonce wrapping (@climber73)
• [pex] #3647 Dial seeds, if any, instead of crawling peers first (@defunctzombie)
• [rpc] #3534 Add support for batched requests/responses in JSON RPC
• [rpc] #3362 /dial_seeds & /dial_peers return errors if addresses are incorrect (except when IP lookup fails)

BUG FIXES:

• [consensus] #3067 Fix replay from appHeight==0 with validator set changes (@james-ray)
• [consensus] #3304 Create a peer state in consensus reactor before the peer is started (@guagualvcha)
• [lite] #3669 Add context parameter to RPC Handlers in proxy routes (@yutianwu)
• [mempool] #3322 When a block is committed, only remove committed txs from the mempool that were valid (ie. ResponseDeliverTx.Code == 0)
• [p2p] #3338 Ensure RemovePeer is always called before InitPeer (upon a peer reconnecting to our node)
• [p2p] #3532 Limit the number of attempts to connect to a peer in seed mode to 16 (as a result, the node will stop retrying after a 35 hours time window)
• [p2p] #3362 Allow inbound peers to be persistent, including for seed nodes.
• [pex] #3603 Dial seeds when addrbook needs more addresses (@defunctzombie)

OTHERS:

• [networks] fixes ansible integration script (@carlosflrs)

April 16th, 2019

This release fixes a regression from v0.31.4 where, in existing chains that were upgraded, /validators could return an empty validator set. This is true for almost all heights, given the validator set remains the same.

Special thanks to external contributors on this release: @brapse, @guagualvcha, @dongsam, @phucc

IMPROVEMENTS:

• [libs/common] CMap: slight optimization in Keys() and Values() (@phucc)
• [gitignore] gitignore: add .vendor-new (@dongsam)

BUG FIXES:

• [state] #3537 LoadValidators: do not return an empty validator set
• [blockchain] #3457 Fix "peer did not send us anything" in fast_sync mode when under high pressure

April 12th, 2019

This release fixes a regression from v0.31.3 which used the peer's SocketAddr to add the peer to the address book. This swallowed the peer's self-reported port which is important in case of reconnect. It brings back NetAddress() to NodeInfo and uses it instead of SocketAddr for adding peers. Additionally, it improves response time on the /validators or /status RPC endpoints. As a side-effect it makes these RPC endpoint more difficult to DoS and fixes a performance degradation in ExecCommitBlock. Also, it contains an ADR that proposes decoupling the responsibility for peer behaviour from the p2p.Switch (by @brapse).

Special thanks to external contributors on this release: @brapse, @guagualvcha, @mydring

IMPROVEMENTS:

• [p2p] #3463 Do not log "Can't add peer's address to addrbook" error for a private peer
• [p2p] #3547 Fix a couple of annoying typos (@mdyring)

BUG FIXES:

• [docs] #3514 Fix block.Header.Time description (@melekes)
• [p2p] #2716 Check if we're already connected to peer right before dialing it (@melekes)
• [p2p] #3545 Add back NetAddress() to NodeInfo and use it instead of peer's SocketAddr() when adding a peer to the PEXReactor (potential fix for #3532)
• [state] #3438 Persist validators every 100000 blocks even if no changes to the set occurred (@guagualvcha). This
  1. Prevents possible DoS attack using /validators or /status RPC endpoints. Before response time was growing linearly with height if no changes were made to the validator set.
  2. Fixes performance degradation in ExecCommitBlock where we call LoadValidators for each Evidence in the block.

April 1st, 2019

This release includes two security sensitive fixes: it ensures generated private keys are valid, and it prevents certain DNS lookups that would cause the node to panic if the lookup failed.

BREAKING CHANGES:

• Go API
  • [crypto/secp256k1] #3439 The secp256k1.GenPrivKeySecp256k1 function has changed to guarantee that it returns a valid key, which means it will return a different private key than in previous versions for the same secret.

BUG FIXES:

• [crypto/secp256k1] #3439 Ensure generated private keys are valid by randomly sampling until a valid key is found. Previously, it was possible (though rare!) to generate keys that exceeded the curve order. Such keys would lead to invalid signatures.
• [p2p] #3522 Memoize socket address in peer connections to avoid DNS lookups. Previously, failed DNS lookups could cause the node to panic.

March 30th, 2019

This release fixes a regression from v0.31.1 where Tendermint panics under mempool load for external ABCI apps.

Special thanks to external contributors on this release: @guagualvcha

BREAKING CHANGES:

• CLI/RPC/Config

• Apps

• Go API

  • [libs/autofile] #3504 Remove unused code in autofile package. Deleted functions: Group.Search, Group.FindLast, GroupReader.ReadLine, GroupReader.PushLine, MakeSimpleSearchFunc (@guagualvcha)

• Blockchain Protocol

• P2P Protocol

FEATURES:

IMPROVEMENTS:

• [circle] #3497 Move release management to CircleCI

BUG FIXES:

• [mempool] #3512 Fix panic from concurrent access to txsMap, a regression for external ABCI apps introduced in v0.31.1

March 27th, 2019

This release contains a major improvement for the mempool that reduce the amount of sent data by about 30% (see some numbers below). It also fixes a memory leak in the mempool and adds TLS support to the RPC server by providing a certificate and key in the config.

Special thanks to external contributors on this release: @brapse, @guagualvcha, @HaoyangLiu, @needkane, @TraceBundy

BREAKING CHANGES:

• CLI/RPC/Config

• Apps

• Go API

  • [crypto] #3426 Remove Ripemd160 helper method (@needkane)
  • [libs/common] #3429 Remove RepeatTimer (also TimerMaker and Ticker interface)
  • [rpc/client] #3458 Include NetworkClient interface into Client interface
  • [types] #3448 Remove method PB2TM.ConsensusParams

• Blockchain Protocol

• P2P Protocol

FEATURES:

• [rpc] #3419 Start HTTPS server if rpc.tls_cert_file and rpc.tls_key_file are provided in the config (@guagualvcha)

IMPROVEMENTS:

• [docs] #3140 Formalize proposer election algorithm properties
• [docs] #3482 Fix broken links (@brapse)
• [mempool] #2778 No longer send txs back to peers who sent it to you. Also, limit to 65536 active peers. This vastly improves the bandwidth consumption of nodes. For instance, for a 4 node localnet, in a test sending 250byte txs for 120 sec. at 500 txs/sec (total of 15MB):
  • total bytes received from 1st node:
    • before: 42793967 (43MB)
    • after: 30003256 (30MB)
  • total bytes sent to 1st node:
    • before: 30569339 (30MB)
    • after: 19304964 (19MB)
• [p2p] #3475 Simplify GetSelectionWithBias for addressbook (@guagualvcha)
• [rpc/lib/client] #3430 Disable compression for HTTP client to prevent GZIP-bomb DoS attacks (@guagualvcha)

BUG FIXES:

• [blockchain] #2699 Update the maxHeight when a peer is removed
• [mempool] #3478 Fix memory-leak related to broadcastTxRoutine (@HaoyangLiu)

March 16th, 2019

Special thanks to external contributors on this release: @danil-lashin, @guagualvcha, @siburu, @silasdavis, @srmo, @Stumble, @svenstaro

This release is primarily about the new pubsub implementation, dubbed pubsub 2.0, and related changes, like configurable limits on the number of active RPC subscriptions at a time (max_subscription_clients). Pubsub 2.0 is an improved version of the older pubsub that is non-blocking and has a nicer API. Note the improved pubsub API also resulted in some improvements to the HTTPClient interface and the API for WebSocket subscriptions. This release also adds a configurable limit to the mempool size (max_txs_bytes, default 1GB) and a configurable timeout for the /broadcast_tx_commit endpoint.

See the v0.31.0 Milestone for more details.

Friendly reminder, we have a bug bounty program.

BREAKING CHANGES:

• CLI/RPC/Config

  • [config] #2920 Remove consensus.blocktime_iota parameter
  • [rpc] #3227 New PubSub design does not block on clients when publishing messages. Slow clients may miss messages and receive an error, terminating the subscription.
  • [rpc] #3269 Limit number of unique clientIDs with open subscriptions. Configurable via rpc.max_subscription_clients
  • [rpc] #3269 Limit number of unique queries a given client can subscribe to at once. Configurable via rpc.max_subscriptions_per_client.
  • [rpc] #3435 Default ReadTimeout and WriteTimeout changed to 10s. WriteTimeout can increased by setting rpc.timeout_broadcast_tx_commit in the config.
  • [rpc/client] #3269 Update EventsClient interface to reflect new pubsub/eventBus API ADR-33. This includes Subscribe, Unsubscribe, and UnsubscribeAll methods.

• Apps

  • [abci] #3403 Remove time_iota_ms from BlockParams. This is a ConsensusParam but need not be exposed to the app for now.
  • [abci] #2920 Rename consensus_params.block_size to consensus_params.block in ABCI ConsensusParams

• Go API

  • [libs/common] TrapSignal accepts logger as a first parameter and does not block anymore
    • previously it was dumping "captured ..." msg to os.Stdout
    • TrapSignal should not be responsible for blocking thread of execution
  • [libs/db] #3397 Add possibility to Close() Batch to prevent memory leak when using ClevelDB. (@Stumble)
  • [types] #3354 Remove RoundState from EventDataRoundState
  • [rpc] #3435 StartHTTPServer / StartHTTPAndTLSServer now require a Config (use rpcserver.DefaultConfig)

• Blockchain Protocol

• P2P Protocol

FEATURES:

• [config] #3269 New configuration values for controlling RPC subscriptions:
  • rpc.max_subscription_clients sets the maximum number of unique clients with open subscriptions
  • rpc.max_subscriptions_per_clientsets the maximum number of unique subscriptions from a given client
  • rpc.timeout_broadcast_tx_commit sets the time to wait for a tx to be committed during /broadcast_tx_commit
• [types] #2920 Add time_iota_ms to block's consensus parameters (not exposed to the application)
• [lite] #3269 Add /unsubscribe_all endpoint to unsubscribe from all events
• [mempool] #3079 Bound mempool memory usage via the mempool.max_txs_bytes configuration value. Set to 1GB by default. The mempool's current txs_total_bytes is exposed via total_bytes field in /num_unconfirmed_txs and /unconfirmed_txs RPC endpoints.

IMPROVEMENTS:

• [all] #3385, #3386 Various linting improvements
• [crypto] #3371 Copy in secp256k1 package from go-ethereum instead of importing go-ethereum (@silasdavis)
• [deps] #3382 Don't pin repos without releases
• [deps] #3357, #3389, #3392 Update gogo/protobuf, golang/protobuf, levigo, golang.org/x/crypto
• [libs/common] #3238 exit with zero (0) code upon receiving SIGTERM/SIGINT
• [libs/db] #3378 CLevelDB#Stats now returns the following properties:
  • leveldb.num-files-at-level{n}
  • leveldb.stats
  • leveldb.sstables
  • leveldb.blockpool
  • leveldb.cachedblock
  • leveldb.openedtables
  • leveldb.alivesnaps
  • leveldb.aliveiters
• [privval] #3351 First part of larger refactoring that clarifies and separates concerns in the privval package.

BUG FIXES:

• [blockchain] #3358 Fix timer leak in BlockPool (@guagualvcha)
• [cmd] #3408 Fix testnet command's panic when creating non-validator configs (using --n flag) (@srmo)
• [libs/db/remotedb/grpcdb] #3402 Close Iterator/ReverseIterator after use
• [libs/pubsub] #951, #1880 Use non-blocking send when dispatching messages ADR-33
• [lite] #3364 Fix /validators and /abci_query proxy endpoints (@guagualvcha)
• [p2p/conn] #3347 Reject all-zero shared secrets in the Diffie-Hellman step of secret-connection
• [p2p] #3369 Do not panic when filter times out
• [p2p] #3359 Fix reconnecting report duplicate ID error due to race condition between adding peer to peerSet and starting it (@guagualvcha)

March 10th, 2019

This release fixes a CLevelDB memory leak. It was happening because we were not closing the WriteBatch object after use. See levigo's godoc for the Close method. Special thanks goes to @Stumble who both reported an issue in cosmos-sdk and provided a fix here.

BREAKING CHANGES:

• Go API
  • [libs/db] #3842 Add Close() method to Batch interface (@Stumble)

BUG FIXES:

• [libs/db] #3842 Fix CLevelDB memory leak (@Stumble)

February 20th, 2019

This release fixes a consensus halt and a DataCorruptionError after restart discovered in game_of_stakes_6. It also fixes a security issue in the p2p handshake by authenticating the NetAddress.ID of the peer we're dialing.

IMPROVEMENTS:

• [config] #3291 Make config.ResetTestRootWithChainID() create concurrency-safe test directories.

BUG FIXES:

• [consensus] #3295 Flush WAL on stop to prevent data corruption during graceful shutdown.
• [consensus] #3302 Fix possible halt by resetting TriggeredTimeoutPrecommit before starting next height.
• [rpc] #3251 Fix /net_info#peers#remote_ip format. New format spec:
  • dotted decimal ("192.0.2.1"), if ip is an IPv4 or IP4-mapped IPv6 address
  • IPv6 ("2001:db8::1"), if ip is a valid IPv6 address
• [cmd] #3314 Return an error on show_validator when the private validator file does not exist.
• [p2p] #3010 Authenticate a peer against its NetAddress.ID when dialing.

February 8th, 2019

This release fixes yet another issue with the proposer selection algorithm. We hope it's the last one, but we won't be surprised if it's not. We plan to one day expose the selection algorithm more directly to the application (#3285), and even to support randomness (#763). For more, see issues marked proposer-selection.

This release also includes a fix to prevent Tendermint from including the same piece of evidence in more than one block. This issue was reported by @chengwenxi in our bug bounty program.

BREAKING CHANGES:

• Apps

  • [state] #3222 Duplicate updates for the same validator are forbidden. Apps must ensure that a given ResponseEndBlock.ValidatorUpdates contains only one entry per pubkey.

• Go API

  • [types] #3222 Remove Add and Update methods from ValidatorSet in favor of new UpdateWithChangeSet. This allows updates to be applied as a set, instead of one at a time.

• Block Protocol

  • [state] #3286 Blocks that include already committed evidence are invalid.

• P2P Protocol

  • [consensus] #3222 Validator updates are applied as a set, instead of one at a time, thus impacting the proposer priority calculation. This ensures that the proposer selection algorithm does not depend on the order of updates in ResponseEndBlock.ValidatorUpdates.

IMPROVEMENTS:

• [crypto] #3279 Use btcec.S256().N directly instead of hard coding a copy.

BUG FIXES:

• [state] #3222 Fix validator set updates so they are applied as a set, rather than one at a time. This makes the proposer selection algorithm independent of the order of updates in ResponseEndBlock.ValidatorUpdates.
• [evidence] #3286 Don't add committed evidence to evidence pool.

February 7th, 2019

Special thanks to external contributors on this release: @ackratos, @rickyyangz

Note: This release contains security sensitive patches in the p2p and crypto packages:

• p2p:
  • Partial fix for MITM attacks on the p2p connection. MITM conditions may still exist. See #3010.
• crypto:
  • Eliminate our fork of btcd and use the btcd/btcec library directly for native secp256k1 signing. Note we still modify the signature encoding to prevent malleability.
  • Support the libsecp256k1 library via CGo through the go-ethereum/crypto/secp256k1 package.
  • Eliminate MixEntropy functions

BREAKING CHANGES:

• Go API
  • [crypto] #3278 Remove MixEntropy functions
  • [types] #3245 Commit uses type CommitSig Vote instead of Vote directly. In preparation for removing redundant fields from the commit #1648

IMPROVEMENTS:

• [consensus] #3246 Better logging and notes on recovery for corrupted WAL file
• [crypto] #3163 Use ethereum's libsecp256k1 go-wrapper for signatures when cgo is available
• [crypto] #3162 Wrap btcd instead of forking it to keep up with fixes (used if cgo is not available)
• [makefile] #3233 Use golangci-lint instead of go-metalinter
• [tools] #3218 Add go-deadlock tool to help detect deadlocks
• [tools] #3106 Add tm-signer-harness test harness for remote signers
• [tests] #3258 Fixed a bunch of non-deterministic test failures

BUG FIXES:

• [node] #3186 EventBus and indexerService should be started before first block (for replay last block on handshake) execution (@ackratos)
• [p2p] #3232 Fix infinite loop leading to addrbook deadlock for seed nodes
• [p2p] #3247 Fix panic in SeedMode when calling FlushStop and OnStop concurrently
• [p2p] #3040 Fix MITM on secret connection by checking low-order points
• [privval] #3258 Fix race between sign requests and ping requests in socket that was causing messages to be corrupted

January 24, 2019

Special thanks to external contributors on this release: @infinytum, @gauthamzz

This release contains two important fixes: one for p2p layer where we sometimes were not closing connections and one for consensus layer where consensus with no empty blocks (create_empty_blocks = false) could halt.

Friendly reminder, we have a bug bounty program.

IMPROVEMENTS:

• [pex] #3037 Only log "Reached max attempts to dial" once
• [rpc] #3159 Expose triggered_timeout_commit in the /dump_consensus_state

BUG FIXES:

• [consensus] #3199 Fix consensus halt with no empty blocks from not resetting triggeredTimeoutCommit
• [p2p] #2967 Fix file descriptor leak

January 21, 2019

Special thanks to external contributors on this release: @bradyjoestar, @kunaldhariwal, @gauthamzz, @hrharder

This release is primarily about making some breaking changes to the Block protocol version before Cosmos launch, and to fixing more issues in the proposer selection algorithm discovered on Cosmos testnets.

The Block protocol changes include using a standard Merkle tree format (RFC 6962), fixing some inconsistencies between field orders in Vote and Proposal structs, and constraining the hash of the ConsensusParams to include only a few fields.

The proposer selection algorithm saw significant progress, including a formal proof by @cwgoes for the base-case in Idris and a much more detailed specification (still in progress) by @ancazamfir.

Fixes to the proposer selection algorithm include normalizing the proposer priorities to mitigate the effects of large changes to the validator set. That said, we just discovered another bug, which will be fixed in the next breaking release.

While we are trying to stabilize the Block protocol to preserve compatibility with old chains, there may be some final changes yet to come before Cosmos launch as we continue to audit and test the software.

Friendly reminder, we have a bug bounty program.

BREAKING CHANGES:

• CLI/RPC/Config

• Apps

  • [state] #3049 Total voting power of the validator set is upper bounded by MaxInt64 / 8. Apps must ensure they do not return changes to the validator set that cause this maximum to be exceeded.

• Go API

  • [node] #3082 MetricsProvider now requires you to pass a chain ID
  • [types] #2713 Rename TxProof.LeafHash to TxProof.Leaf
  • [crypto/merkle] #2713 SimpleProof.Verify takes a leaf instead of a leafHash and performs the hashing itself

• Blockchain Protocol

  • [crypto/merkle] #2713 Merkle trees now match the RFC 6962 specification
  • [types] #3078 Re-order Timestamp and BlockID in CanonicalVote so it's consistent with CanonicalProposal (BlockID comes first)
  • [types] #3165 Hash of ConsensusParams only includes BlockSize.MaxBytes and BlockSize.MaxGas

• P2P Protocol

  • [consensus] #3049 Normalize priorities to not exceed 2*TotalVotingPower to mitigate unfair proposer selection heavily preferring earlier joined validators in the case of an early bonded large validator unbonding

FEATURES:

IMPROVEMENTS:

• [rpc] #3065 Return maxPerPage (100), not defaultPerPage (30) if per_page is greater than the max 100.
• [instrumentation] #3082 Add chain_id label for all metrics

BUG FIXES:

• [crypto] #3164 Update btcd fork for rare signRFC6979 bug
• [lite] #3171 Fix verifying large validator set changes
• [log] #3125 Fix year format
• [mempool] #3168 Limit tx size to fit in the max reactor msg size
• [scripts] #3147 Fix json2wal for large block parts (@bradyjoestar)

January 18th, 2019

Special thanks to external contributors on this release: @HaoyangLiu

Friendly reminder, we have a bug bounty program.

BUG FIXES:

• [consensus] Fix consensus halt from proposing blocks with too much evidence

January 16th, 2019

Special thanks to external contributors on this release: @fmauricios, @gianfelipe93, @husio, @needkane, @srmo, @yutianwu

This release is primarily about upgrades to the privval system - separating the priv_validator.json into distinct config and data files, and refactoring the socket validator to support reconnections.

Note: Please backup your existing priv_validator.json before using this version.

See UPGRADING.md for more details.

BREAKING CHANGES:

• CLI/RPC/Config

  • [cli] Removed --proxy_app=dummy option. Use kvstore (persistent_kvstore) instead.
  • [cli] Renamed --proxy_app=nilapp to --proxy_app=noop.
  • [config] #2992 allow_duplicate_ip is now set to false
  • [privval] #1181 Split priv_validator.json into immutable (config/priv_validator_key.json) and mutable (data/priv_validator_state.json) parts (@yutianwu)
  • [privval] #2926 Split up PubKeyMsg into PubKeyRequest and PubKeyResponse to be consistent with other message types
  • [privval] #2923 Listen for unix socket connections instead of dialing them

• Apps

• Go API

  • [types] #2981 Remove PrivValidator.GetAddress()

• Blockchain Protocol

• P2P Protocol

FEATURES:

• [rpc] #3052 Include peer's remote IP in /net_info

IMPROVEMENTS:

• [consensus] #3086 Log peerID on ignored votes (@srmo)
• [docs] #3061 Added specification for signing consensus msgs at ./docs/spec/consensus/signing.md
• [privval] #2948 Memoize pubkey so it's only requested once on startup
• [privval] #2923 Retry RemoteSigner connections on error

BUG FIXES:

• [build] #3085 Fix Version field in build scripts (@husio)
• [crypto/multisig] #3102 Fix multisig keys address length
• [crypto/encoding] #3101 Fix PubKeyMultisigThreshold unmarshalling into crypto.PubKey interface
• [p2p/conn] #3111 Make SecretConnection thread safe
• [rpc] #3053 Fix internal error in /tx_search when results are empty (@gianfelipe93)
• [types] #2926 Do not panic if retrieving the privval's public key fails

December 21st, 2018

BUG FIXES:

• [mempool] #3036 Fix LRU cache by popping the least recently used item when the cache is full, not the most recently used one!

December 16th, 2018

BREAKING CHANGES:

• Go API
  • [dep] #3027 Revert to mainline Go crypto library, eliminating the modified bcrypt.GenerateFromPassword

December 16th, 2018

IMPROVEMENTS:

• [node] #3025 Validate NodeInfo addresses on startup.

BUG FIXES:

• [p2p] #3025 Revert to using defers in addrbook. Fixes deadlocks in pex and consensus upon invalid ExternalAddr/ListenAddr configuration.

December 15th, 2018

Special thanks to external contributors on this release: @danil-lashin, @hleb-albau, @james-ray, @leo-xinwang

FEATURES:

• [rpc] #2964 Add UnconfirmedTxs(limit) and NumUnconfirmedTxs() methods to HTTP/Local clients (@danil-lashin)
• [docs] #3004 Enable full-text search on docs pages

IMPROVEMENTS:

• [consensus] #2971 Return error if ValidatorSet is empty after InitChain (@leo-xinwang)
• [ci/cd] #3005 Updated CircleCI job to trigger website build when docs are updated
• [docs] Various updates

BUG FIXES:

• [cmd] #2983 testnet command always sets addr_book_strict = false
• [config] #2980 Fix CORS options formatting
• [kv indexer] #2912 Don't ignore key when executing CONTAINS
• [mempool] #2961 Call notifyTxsAvailable if there're txs left after committing a block, but recheck=false
• [mempool] #2994 Reject txs with negative GasWanted
• [p2p] #2990 Fix a bug where seeds don't disconnect from a peer after 3h
• [consensus] #3006 Save state after InitChain only when stateHeight is also 0 (@james-ray)

December 5th, 2018

Special thanks to external contributors on this release: @danil-lashin, @srmo

Special thanks to @dlguddus for discovering a major issue in the proposer selection algorithm.

Friendly reminder, we have a bug bounty program.

This release is primarily about fixes to the proposer selection algorithm in preparation for the Cosmos Game of Stakes. It also makes use of the ConsensusParams.Validator.PubKeyTypes to restrict the key types that can be used by validators, and removes the Heartbeat consensus message.

BREAKING CHANGES:

• CLI/RPC/Config

  • [rpc] #2932 Rename accum to proposer_priority

• Go API

  • [db] #2913 ReverseIterator API change: start < end, and end is exclusive.
  • [types] #2932 Rename Validator.Accum to Validator.ProposerPriority

• Blockchain Protocol

  • [state] #2714 Validators can now only use pubkeys allowed within ConsensusParams.Validator.PubKeyTypes

• P2P Protocol

  • [consensus] #2871 Remove ProposalHeartbeat message as it serves no real purpose (@srmo)
  • [state] Fixes for proposer selection:
    • #2785 Accum for new validators is -1.125*totalVotingPower instead of 0
    • #2941 val.Accum is preserved during ValidatorSet.Update to avoid being reset to 0

IMPROVEMENTS:

• [state] #2929 Minor refactor of updateState logic (@danil-lashin)
• [node] #2959 Allow node to start even if software's BlockProtocol is different from state's BlockProtocol
• [pex] #2959 Pex reactor logger uses module=pex

BUG FIXES:

• [p2p] #2968 Panic on transport error rather than continuing to run but not accept new connections
• [p2p] #2969 Fix mismatch in peer count between /net_info and the prometheus metrics
• [rpc] #2408 /broadcast_tx_commit: Fix "interface conversion: interface {} in nil, not EventDataTx" panic (could happen if somebody sent a tx using /broadcast_tx_commit while Tendermint was being stopped)
• [state] #2785 Fix accum for new validators to be -1.125*totalVotingPower instead of 0, forcing them to wait before becoming the proposer. Also:
  • do not batch clip
  • keep accums averaged near 0
• [txindex/kv] #2925 Don't return false positives when range searching for a prefix of a tag value
• [types] #2938 Fix regression in v0.26.4 where we panic on empty genDoc.Validators
• [types] #2941 Preserve val.Accum during ValidatorSet.Update to avoid it being reset to 0 every time a validator is updated