Klever Blockchain Mainnet Release v1.7.20

News and Announcements
, ,
1

image
image1500×844 63.1 KB

Dear Validators, Node Maintainers, and Exchange Partners,

This is a MANDATORY and CRITICAL security upgrade.

The Klever Blockchain team has officially released v1.7.20 for the Mainnet. This is a Coordinated Security Release & CertiK Audit Remediation. This release addresses critical vulnerabilities and introduces fork updates necessary for the continued security and consensus of the Klever network.

:warning: URGENCY & SECURITY WARNING :warning:

Failure to upgrade your node prior to Epoch 5911 will result in a hard fork from the main network. Nodes running older versions may fall out of consensus, resulting in validators being jailed and potential loss of rewards. Every node MUST run a config whose fixAuditChangesV3 activation epoch matches the network. We urge all maintainers and exchanges to treat this update with the highest priority to ensure the continued security of the Klever ecosystem.

:hourglass_not_done: Deadline

Saturday, 18 July 2026, 07:00 UTC

(Upgrade strictly before Epoch 5911)

:gear: Detailed Security & Release Highlights (v1.7.20)

This version remediates CertiK protocol audit findings and closes seven coordinated-disclosure security advisories. Key updates include:

  • Critical Fix (GHSA-97cv-x867-6xhm): Patches an account takeover vulnerability via spoofable RecipientAddr in permission updates.

  • High Severity Fixes:

    • CVE-2026-58262: Fixes a vulnerability where padding-bitmap bits could satisfy block-header quorum.

    • Zombie-order theft (native marketplace): Rejects Buy on already-claimed sell orders.

    • Consensus-liveness DoS: Validates the BLS public key on validator registration.

    • Elasticsearch injection: Escapes account names to prevent forged explorer data.

    • Unauthenticated API access: Secures /log and /subscribe endpoints against mutation and exhaustion attacks.

  • CertiK Audit Remediations: Includes multiple KVM and contract-execution hardening measures, such as bounds checking, royalty snapshots, and secure buffer storage handling.

  • Fork Gate (fixAuditChangesV3): Consensus-affecting fixes are gated behind the fixAuditChangesV3 fork flag. On mainnet, this fork is active as of epoch 5911.

  • Operator Tooling & Endpoints: Adds ms sign subcommand for multisig transactions and new network supply endpoints (/network/economics, /network/account-totals).

For a comprehensive technical breakdown of all features, CVEs, and improvements, please review the official release notes:

Klever-go v1.7.20 Release Notes

:hammer_and_wrench: Step-by-Step Upgrade Instructions

CRITICAL: You must update your configuration files prior to updating the node to ensure the fixAuditChangesV3 activation epoch matches the network (mainnet: 5911).

Please carefully execute the following steps:

1. Download the new config:

curl -k https://backup.mainnet.klever.org/config.mainnet.108.tar.gz | tar -xz -C ./node

2. Download the new image version:

docker pull kleverapp/klever-go:v1.7.20-0-g0b70b0f

3. Update the permissions of the database directories:

chown -R 999  $(pwd)/node/config
chown -R 999  $(pwd)/node/db
chown -R 999  $(pwd)/node/logs

4. Stop and remove your current node:

docker stop klever-node && docker rm klever-node

5. Run your node again:

docker run -it -d --restart unless-stopped \
    --user "$(id -u):$(id -g)" \
    --name klever-node \
    -v $(pwd)/node/config:/opt/klever-blockchain/config/node \
    -v $(pwd)/node/db:/opt/klever-blockchain/db \
    -v $(pwd)/node/logs:/opt/klever-blockchain/logs \
    --network=host \
    --entrypoint=/usr/local/bin/validator \
    kleverapp/klever-go:v1.7.20-0-g0b70b0f \
    '--log-save' '--use-log-view' '--rest-api-interface=0.0.0.0:8080'

If you encounter any issues during the upgrade process, please reach out to the Klever developer support channels immediately.

Thank you for securing the Klever Blockchain.