MANTRA Chain v8.8.0: Coordinated Security Upgrade

📦 RELEASE TAGGED AS v8.8.0 📦

This is a mandatory security release for all validators and full-node operators. It moves cosmos/evm to v0.6.4-v8-mantra-1, which fixes GHSA-p8x8-4gg6-prcc, GHSA-7xxp-gq2c-x47x, GHSA-c6xv-pppp-rjw6 and GHSA-wm4f-qpxp-rch4. The binary is also built with Go 1.26, and dependencies with known vulnerabilities are bumped to patched versions. Some additional restrictions are also added due to Keplr Wallet exploit due to flaw in Web3Auth.

This is a consensus-breaking upgrade recommended for the entire validator set. The objective of this proposal is to move the network to the patched version at a single agreed height.

Verifying the Release

You can verify the integrity of the release artifactsusing the following SHA-256 checksums:

576c9faf2f2adea2c8c7409bc32f174f4343e4a214583634eb68d37e5334e218  mantrachaind-8.8.0-darwin-amd64
45fc3fc278c2b24173d5850d37c7dba03837c597f27a5a28921112511af29aea  mantrachaind-8.8.0-darwin-amd64.tar.gz
d95019260bfa96c7b4e575cc8aad3ee71e9c66a9c18337964ca24097c380510e  mantrachaind-8.8.0-darwin-arm64
d70be327e9641044ab048c2d4358520cffca2ebe31b5b78e755c1a69a75c14dd  mantrachaind-8.8.0-darwin-arm64.tar.gz
08b749dabff11b2e6d0e36742c3e3d95bc3d5b3714c3b4468ae79e54f88a9510  mantrachaind-8.8.0-linux-amd64
a45f89007f9f7360f0a7bb150d2672ed14e40ea6a33137376c96c3aa7e03935e  mantrachaind-8.8.0-linux-amd64.tar.gz
edad2d473ffec2f1cffe4fc76c10fbe3a609c9e7dc597c225d5e4509017e80c7  mantrachaind-8.8.0-linux-arm64
542d44fb6404a14f98b41ab16116cf1cb1b74393f1270f0d38afa7222e1d0b36  mantrachaind-8.8.0-linux-arm64.tar.gz

Verify sha256sum.txt.sig

gpg --recv-keys 7CE02F9E5D2971D8A9579433504367809BC3452F
gpg --verify sha256sum.txt.sig sha256sum.txt

Assets

Located at the GitHub release: https://github.com/MANTRA-Chain/mantrachain/releases/tag/v8.8.0

• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-darwin-amd64
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-darwin-amd64.tar.gz
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-darwin-arm64
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-darwin-arm64.tar.gz
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-linux-amd64
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-linux-amd64.tar.gz
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-linux-arm64
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/mantrachaind-8.8.0-linux-arm64.tar.gz
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/sha256sum.txt.sig
• https://github.com/MANTRA-Chain/mantrachain/releases/download/v8.8.0/sha256sum.txt

Docker Container Registry

https://github.com/MANTRA-Chain/mantrachain/pkgs/container/mantrachain?tag=v8.8.0

Manifest digest: sha256:ad693fa1079d67c71c09ff9c43de3f3ae4002776f155cac8b26bdafc13037e4f

# linux/amd64
docker pull ghcr.io/mantra-chain/mantrachain:v8.8.0@sha256:8700e6f27999114d849a11678351a4607807ffdbc93d79d5f21d67f1e3b47d31

# linux/arm64
docker pull ghcr.io/mantra-chain/mantrachain:v8.8.0@sha256:d201582a934b5c83491ae973d11f006e674053826b4000732bbea9bad8fa7687

What's Changed

• Chore: Integrate v8.7 upgrade (#696)
• Problem: govulncheck fails due to known vulnerabilities (#707)
• Problem: cli can't list registered upgrade handlers (#709)
• Chore: nov-1-2026 patch security patch (#706)
• ci: pin heighliner alpine to 3.22 for go 1.26 builds (#710)

Full Changelog: https://github.com/MANTRA-Chain/mantrachain/compare/release/v8.6.x...v8.8.0