Nimiq Core-RS-Albatross Mainnet 1.5.0: Stability and Security Fixes for Multiple Components

Vulnerability Overview The provided screenshot displays the update notes for version of the project. While it mentions several security-related fixes and improvements, it does not explicitly specify any vulnerability names or CVE identifiers. Impact Scope Affected Versions: and earlier versions. Affected Components: Involves multiple components, including but not limited to , , , , , , , , , , , , , , , , , , , , etc. Remediation Remove unused code: Removed unused functions in . Avoid panic: Avoided panics in . Test signers: Correctly tested content signed by . Hardcoded validator slot bandwidth: Hardcoded . Fix web-client validation checks: Fixed web-client validation check issues raised by . Fix inheritance issues in WASM: Fixed inheritance issues in WASM raised by . Restart validity synchronization: Restarted validity synchronization if the request fails. Improve web-client multi-signature commitment checks: Improved multi-signature commitment checks in the web-client as raised by . Fix RPC for retrieving previous penalty slots: Fixed RPC issues for retrieving previous penalty slots as raised by . ES256 returns errors: Returns an error instead of panicking during invalid byte conversion. Rate-limit pending deletions TOCTOU: Addressed TOCTOU (Time-of-check to Time-of-use) issue with rate-limiting pending deletions, as raised by . Move tests: Moved tests to the end of the file. Fix ForkProof VRF seed entropy panic: Fixed panic issues raised by . Fix panic in genesis BatchSet requests: Fixed panic issues in genesis requests raised by . BlockAssembler caching: Cached block header/body in BlockAssembler, as raised by . Fix rebranch state propagation: Fixed rebranch state propagation issues, as raised by . Fix DiscreteDistribution panic: Fixed panic issues, as raised by . Remove unnecessary decompression and re-serialization: Removed unnecessary decompression and re-serialization, as raised by . Reject overflow transaction fee batches: Rejected transaction fee batches causing overflow, as raised by . Reject zero-step vesting transaction builders: Rejected zero-step vesting transaction builders, as raised by . Fix VestingContract::max_cap panic: Fixed panic issues, as raised by . Bind ValidatorRecord timestamp drift: Bound timestamp drift, as raised by . Fix duplicate keys in RequestTreeProof: Fixed duplicate key issues in , as raised by . Fix StakingDataBuilder panic: Fixed panic issues, as raised by . Fix unwrap panic in Transaction.flags getter: Fixed panic in the getter, as raised by . Fix peer_count drift: Fixed drift issues, as raised by . Replace assert_eq! panics: Replaced panics, as raised by . Clamp peer-supplied update_interval upper bound: Clamped the upper bound of supplied by peers, as raised by . MMR: Reject excessively large mmr_size: Rejected excessively large in MMR, as raised by . Network: Protect removed DHT queries: Protected against removed DHT queries, as raised by . Trie: Fix ROOT-keyed items: Fixed ROOT-keyed items in the Trie, as raised by . Consensus: Evict peers returning invalid tree proofs: Evicted peers returning invalid tree proofs, as raised by . web-client: Pin wasm-bindgen version: Pinned the version, as raised by . Dependency Updates build(deps): Upgraded from to . build(deps): Upgraded from to . Bump tracing-fork: Upgraded to . build(deps): Upgraded from to . Contributors Contributors: , , and other contributors. Assets Assets: 3 assets. Summary This version update primarily involves security fixes and improvements across multiple components, aiming to enhance system stability and security. Specific remediation measures include removing unused code, avoiding panics, testing signers, hardcoding validator slot bandwidth, fixing web-client validation checks, resolving WASM inheritance issues, restarting validity synchronization, improving web-client multi-signature commitment checks, fixing RPC retrieval of previous penalty slots, having ES256 return errors, rate-limiting pending deletions TOCTOU, moving tests, fixing ForkProof VRF seed entropy panics, fixing panics in genesis BatchSet requests, caching by the BlockAssembler, fixing rebranch state propagation, fixing DiscreteDistribution panics, removing unnecessary decompression and re-serialization, rejecting overflow transaction fee batches, rejecting zero-step vesting transaction builders, fixing VestingContract::max_cap panics, bounding ValidatorRecord timestamp drift, fixing duplicate keys in RequestTreeProof, fixing StakingDataBuilder panics, fixing unwrap panics in Transaction.flags getter, fixing peer_count drift, replacing assert_eq! panics, clamping peer-supplied update_interval upper bounds, rejecting excessively large mmr_size, protecting removed DHT queries, fixing ROOT-keyed items, and evicting peers that return invalid tree proofs.

Goal Reached Thanks to every supporter — we hit 100%!

Nimiq Core-RS-Albatross Mainnet 1.5.0: Stability and Security Fixes for Multiple Components

More from this source