MANTRA Chain v8.7.0-pre.1 — Coordinated Security Upgrade

🚨‼️ DO NOT BUILD FROM SOURCE ‼️🚨

📦 BINARY PACKAGE ONLY: TAGGED AS v8.7.0-pre.1 📦

This is a mandatory security release for all validators and full-node operators. It is distributed as prebuilt, verified binaries only as part of a coordinated security response. Source code and full technical details will be published after an internal coordination window closes.

This is a consensus-breaking upgrade recommended for the entire validator set. It delivers security hardening across the chain's state-processing layer, including the embedded Cosmos components, along with associated dependency and module maintenance.

As part of a coordinated security response, the binaries for this release are distributed in prebuilt, signed form and the source is being withheld until the public disclosure window closes. Operators should upgrade using only the official signed binaries and must not build from source. The fix is complete, verified, and has no known regressions; the objective of this proposal is simply to move the network to the patched version at a single agreed height.

Action Required

• DoNOT build from source. Use only the official signed binaries attached below.
• Verify checksums (and signatures) before running — see below.

Verifying the Release

You can verify the integrity of the release artifacts using the following SHA-256 checksums:

eb320b4e41b60e31197f131c7393c83d29c35aa226158dc9b3a4b17c3c846854  mantrachaind-8.7.0-pre.1-linux-amd64
ebc6bb377deb4638b470abdfed1caaf65cca18c3f03933cb04abd4fe62b3df25  mantrachaind-8.7.0-pre.1-linux-amd64.tar.gz
1a23b34a27ddcaeba81c28e165e3bd7bf73d27d71d1b747618345a82280cdb0d  mantrachaind-8.7.0-pre.1-linux-arm64
91a143930aaf483641661eba9f423769d1db5dd30f0f771795d5a4982a2d9cad  mantrachaind-8.7.0-pre.1-linux-arm64.tar.gz

This IS a consensus-breaking change. All validators must be running v8.7.0-pre.1 at the coordinated upgrade height for their network:

• Dukong (Testnet): 16,896,560
• Mainnet: 18,338,888

Verify sha256sum.txt.sig

gpg --recv-keys 7CE02F9E5D2971D8A9579433504367809BC3452F
gpg --verify sha256sum.txt.sig sha256sum.txt

Assets

Located at https://pkg.mantrachain.io/mantrachaind/v8.7.0-pre.1/{binary or tar}

• https://pkg.mantrachain.io/mantrachaind/v8.7.0-pre.1/mantrachaind-8.7.0-pre.1-linux-amd64
• https://pkg.mantrachain.io/mantrachaind/v8.7.0-pre.1/mantrachaind-8.7.0-pre.1-linux-amd64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.7.0-pre.1/mantrachaind-8.7.0-pre.1-linux-arm64
• https://pkg.mantrachain.io/mantrachaind/v8.7.0-pre.1/mantrachaind-8.7.0-pre.1-linux-arm64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.7.0-pre.1/sha256sum.txt.sig
• https://pkg.mantrachain.io/mantrachaind/v8.7.0-pre.1/sha256sum.txt

Docker Container Registry

https://github.com/MANTRA-Chain/mantrachain/pkgs/container/mantrachain?tag=v8.7.0-pre.1

What's Changed

• Problem: updates and further security hardening to wasmd and wasmvm
• Problem: data structure changes in wasm, updating incompatible existing contract data structures