MANTRA Chain v8.5.0-pre.1 — Coordinated Security Upgrade

🚨‼️ DO NOT BUILD FROM SOURCE ‼️🚨

📦 BINARY PACKAGE ONLY: TAGGED AS v8.5.0-pre.1 📦

This is a mandatory security release for all validators and full-node operators. It is distributed as prebuilt, verified binaries only as part of a coordinated security response. Source code and full technical details will be published after the coordination window closes.

This is a coordinated, consensus-breaking upgrade recommended for the entire validator set. It delivers security hardening across the chain's state-processing layer, including the embedded Cosmos components, along with associated dependency and module maintenance.

As part of a coordinated security response, the binaries for this release are distributed in prebuilt, signed form and the source is being withheld until the public disclosure window closes. Operators should upgrade using only the official signed binaries and must not build from source. The fix is complete, verified, and has no known regressions; the objective of this proposal is simply to move the network to the patched version at a single agreed height.

Action Required

• Do NOT build from source. Use only the official signed binaries attached below.
• Verify checksums (and signatures) before running — see below.

Verifying the Release

You can verify the integrity of the release artifacts using the following SHA-256 checksums:

b8999c3013e35c9b3baf29e61076869918e6eccad876c7e2e3765913bdcdcf83  mantrachaind-8.5.0-pre.1-darwin-amd64
356512c8dac45eb7b73cb44360934a4df4675f092eec404de7659159f50e0406  mantrachaind-8.5.0-pre.1-darwin-amd64.tar.gz
0c5d45f49332cb8a76ce9da4461ba627bd54448359654d54a302919a7039dbfd  mantrachaind-8.5.0-pre.1-darwin-arm64
a0274823e7a9325c2ddffaf12f65e43d8e3e9f2dc7f4ea9cbb3dbae07e7781f7  mantrachaind-8.5.0-pre.1-darwin-arm64.tar.gz
a9ef3aaf84b4bd3591f5307c81ff54d9ffff497e2a454afdeaa99b97251e1c98  mantrachaind-8.5.0-pre.1-linux-amd64
3a2069b3ea1fc1a426bcf43589024e2d88bc4e004949dbc61f6047ea5efe2543  mantrachaind-8.5.0-pre.1-linux-amd64.tar.gz
30c9c6bb6f2d71bf38789036eb886139cfe54bd92d60726d05b98ee18e4889fa  mantrachaind-8.5.0-pre.1-linux-arm64
8414b211a71c175bebbc775d65241760f64a6a88d168c5a0e0b2f17ba6a74efe  mantrachaind-8.5.0-pre.1-linux-arm64.tar.gz

This IS a consensus-breaking change. All validators must be running v8.5.0-pre.1 at the coordinated upgrade height for their network:

• Dukong (Testnet): 16209087
• Mainnet: 17693888

Verify sha256sum.txt.sig

gpg --recv-keys 7CE02F9E5D2971D8A9579433504367809BC3452F
gpg --verify sha256sum.txt.sig sha256sum.txt

Assets

Located at https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/{binary or tar}

• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-darwin-amd64
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-darwin-amd64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-darwin-arm64
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-darwin-arm64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-linux-amd64
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-linux-amd64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-linux-arm64
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/mantrachaind-8.5.0-pre.1-linux-arm64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/sha256sum.txt.sig
• https://pkg.mantrachain.io/mantrachaind/v8.5.0-pre.1/sha256sum.txt

Docker Container Registry

https://github.com/MANTRA-Chain/mantrachain/pkgs/container/mantrachain?tag=v8.5.0-pre.1

What's Changed

• Problem: cosmos/evm atomic patch for further security hardening due to additional potential security threats