Klever Blockchain v1.7.22: our most extensive security release yet

News and Announcements
, ,
1

image
image1500Ă—844 63.1 KB

Klever Blockchain v1.7.22 is now available. It is the final release of the version that went live on mainnet as v1.7.22-rc1, whose protocol changes activated at epoch 6312 on 26 October 2026. With the network now running under the new rules, we have published the full source on the public klever-go repository and disclosed the security advisories it addresses.

This release is about one thing above all: making the Klever Blockchain harder to break. It closes 23 security advisories, fixes 8 further researcher reports, and completes another round of remediations from our ongoing CertiK protocol audit. Together that is 79 commits across 300 files since v1.7.21.

Hardening across the whole protocol

Consensus, epoch start and bootstrap

  • A block whose body does not match its signed header is now rejected before it can be cached, stored or relayed.
  • Transactions waiting in the pool stay unchanged while a block is processed, so a rejected block can no longer influence how a later block is validated.
  • The epoch-start block is accepted only on a quorum of connected peers. A valid block that arrives one slot early is now queued instead of being rolled back.
  • Registering or rotating a validator’s BLS key now requires a proof that the owner holds the private key. New tooling for generating that proof ships with this release.
  • Node identity can be loaded from a persisted key file, and unknown heartbeat identities are bounded in memory and on disk.

Klever VM (KVM)

  • Work in VM hooks whose size is chosen by the caller is now bounded and charged before it is done. This covers memory copies, crypto hooks, big-integer shifts, return data, managed vectors and storage loads.
  • Timed-out executions are interrupted cleanly, and contract deployment at the timeout boundary is now deterministic.
  • Contract storage key length is bounded. Nested calls handle managed values, deleted accounts and failed transfer-and-execute calls correctly.
  • Zero-value transfers are no longer reported to contracts as call value.
  • The VM executor libraries were upgraded, including fixes for the arm64 instruction path.

Staking, assets, marketplace and ITO

  • APR claims always stay within an asset’s MaxSupply.
  • Pause and transfer-limit rules are now enforced on staking deposits, market sales and mints, and ITO purchases.
  • Royalty settlement conserves value, pays the current royalty receiver, and honours a stop on royalty changes.
  • The fee split between the leader and validators uses exact integer arithmetic.

APIs, P2P and indexer

  • Node diagnostic endpoints honour the secured setting.
  • Broadcast and WebSocket goroutines are protected against crashes.
  • Account lookups are bounded with a time limit.
  • The indexer records account state as of the block being committed.

New features

  • Account Merkle proof API routes, so applications can prove an account’s state against a block.
  • Shell completion for the operator CLI.
  • The fixAuditChangesV6 activation gate, which carried this release’s consensus changes to mainnet in a coordinated upgrade.

Built in the open, with our community

The numbers in this release are a direct result of the people who look closely at our code.

23 GitHub Security Advisories are addressed in v1.7.22, 8 of them rated high. Another 8 reports were accepted and fixed without needing a separate advisory. Across all releases, 50 advisories have now been published on the klever-go security page.

We want to thank everyone who reported issues through coordinated disclosure, including @AnubhavDash, @destinyae, @ibrahimatix0x01 and @manus-use, and the CertiK team for their continued audit work. Several findings in this release were reported independently by more than one researcher. We read that as a sign of how much attention the community now gives the protocol, and we are grateful for every report.

If you find something, please report it privately through GitHub’s private vulnerability reporting for klever-io/klever-go, following our security policy. Every report is triaged, and researchers are credited on the advisory.

Our commitment

Our goal is a blockchain that is the most secure, the most robust and the easiest to build on and operate. Security is not one release for us. It is continuous work: independent audits, coordinated disclosure, a transparent advisory record, and fixes shipped behind coordinated upgrades so the network moves forward together. v1.7.22 is another step on that path, and it will not be the last.

Upgrading

  • Running v1.7.22-rc1? No action is needed: v1.7.22 is the same commit (9f5d1287). You can switch to the final image tag at your next restart.
  • Running v1.7.22-rc0 or older? Upgrade to v1.7.22. Your configuration must be the current mainnet package with fixAuditChangesV6: 6312. A node with a different activation epoch will fall out of consensus.
  • Docker: kleverapp/klever-go:v1.7.22-0-g9f5d1287
  • Source: tag v1.7.22. See the step-by-step instructions below.
  • No data migration is required. Release candidates are no longer supported now that v1.7.22 has shipped.

Upgrade Instructions

Important: update the configuration before you update the node. A node that starts v1.7.22 with an older configuration either refuses to start or falls out of consensus.

1. Get the current mainnet configuration

Every setup uses the same configuration package:

https://backup.mainnet.klever.org/config.mainnet.108.tar.gz

It unpacks into a config/ folder. Open config/enableEpochs.yaml and check it shows:

fixAuditChangesV5: 6160
fixAuditChangesV6: 6312

2a. Docker

  1. Download the new configuration:

    curl -k https://backup.mainnet.klever.org/config.mainnet.108.tar.gz | tar -xz -C ./node

  2. Download the new image:

    docker pull kleverapp/klever-go:v1.7.22-0-g9f5d1287

  3. Update directory permissions:

    chown -R 999 $(pwd)/node/config
chown -R 999 $(pwd)/node/db
chown -R 999 $(pwd)/node/logs

  4. Stop and remove your current node:

    docker stop klever-node && docker rm klever-node

  5. Run your node again:

    docker run -it -d --restart unless-stopped \
    --user "$(id -u):$(id -g)" \
    --name klever-node \
    -v $(pwd)/node/config:/opt/klever-blockchain/config/node \
    -v $(pwd)/node/db:/opt/klever-blockchain/db \
    -v $(pwd)/node/logs:/opt/klever-blockchain/logs \
    --network=host \
    --entrypoint=/usr/local/bin/validator \
    kleverapp/klever-go:v1.7.22-0-g9f5d1287 \
    '--log-save' '--use-log-view' '--rest-api-interface=0.0.0.0:8080'

The kleverapp/klever-go:v1.7.22-0-g9f5d1287 image contains the full node with every binary. A slimmer validator-only image, kleverapp/klever-go:val-v1.7.22-0-g9f5d1287, is also available.

2b. Building from source

  1. Clone the release tag and confirm the commit:

    git clone --branch v1.7.22 https://github.com/klever-io/klever-go.git
cd klever-go
git rev-parse HEAD   # must print 9f5d1287c093c4dc9d48904c72e213523ed0f917

    Clone with git rather than downloading the .zip or .tar.gz from GitHub. The build reads its version from git, and a node built from the archive reports an empty version.

  2. Build:

    make build

    The binaries are written to ./bin/.

  3. Install the configuration. The node reads ./config/node/ relative to the folder you start it from. Unpack the package from step 1 and copy the contents of its config/ folder into ./config/node/, replacing what is there. Keep your own key files (validatorKey.pem, and p2pKey.pem if you use one). The config/node/ files that come with the source code are a development template with every activation epoch set to 0, not the mainnet schedule.

  4. Stop your current node and start the new binary from the repository folder:

    ./bin/validator --log-save --use-log-view --rest-api-interface=0.0.0.0:8080

3. Verify your node

  • Version: ./bin/validator --version (or the starting node line in the logs) starts with v1.7.22-0-g9f5d128. The last field of that string is your machine’s anonymized ID, so it differs from host to host.
  • Sync: watch the logs right after the restart and confirm the node is syncing. The first start can take longer than usual while the node rebuilds its cache of compiled smart contracts.
  • Proxy (indexer): if you also run the proxy, check that external.yaml has enable: true and points to both your node and your Elasticsearch instance.

Common problems

image
image847Ă—311 19.8 KB

Full release notes and the complete list of advisories: github.com/klever-io/klever-go/releases/tag/v1.7.22

Questions about the upgrade? Ask in our Telegram or Discord, and the team will help.

Thank you for building with us.

DK

1 Like