# Klever Blockchain v1.7.22: our most extensive security release yet

**URL:** <https://forum.klever.org/t/klever-blockchain-v1-7-22-our-most-extensive-security-release-yet/4569>\
**Category:** News and Announcements\
**Tags:** kleverchain, validator, security\
**Created:** [October 27, 2026, 5:58pm UTC](https://forum.klever.org/t/klever-blockchain-v1-7-22-our-most-extensive-security-release-yet/4569 "2026-10-27T17:58:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Duka](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.klever.org/duka/32/415_2.png) [@Duka](https://forum.klever.org/u/Duka)\
**Post date:** [October 27, 2026, 5:58pm UTC](https://forum.klever.org/t/klever-blockchain-v1-7-22-our-most-extensive-security-release-yet/4569/1 "2026-10-27T17:58:17Z")

</div>

![image](https://europe1.discourse-cdn.com/flex013/uploads/klever/original/2X/6/61d8462b48697d1cddcde61689ef20e0e0123bc9.jpeg)

Klever Blockchain **v1.7.22** is now available. It is the final release of the version that went live on mainnet as v1.7.22-rc1, whose protocol changes activated at **epoch 6312 on 26 October 2026**. With the network now running under the new rules, we have published the full source on the public [klever-go repository](https://github.com/klever-io/klever-go/tree/v1.7.22) and disclosed the security advisories it addresses.

This release is about one thing above all: making the Klever Blockchain harder to break. It closes **23 security advisories** , fixes **8 further researcher reports** , and completes another round of remediations from our ongoing **CertiK protocol audit**. Together that is **79 commits across 300 files** since v1.7.21.

## **Hardening across the whole protocol**

**Consensus, epoch start and bootstrap**

- A block whose body does not match its signed header is now rejected before it can be cached, stored or relayed.
- Transactions waiting in the pool stay unchanged while a block is processed, so a rejected block can no longer influence how a later block is validated.
- The epoch-start block is accepted only on a quorum of connected peers. A valid block that arrives one slot early is now queued instead of being rolled back.
- Registering or rotating a validator’s BLS key now requires a proof that the owner holds the private key. New tooling for generating that proof ships with this release.
- Node identity can be loaded from a persisted key file, and unknown heartbeat identities are bounded in memory and on disk.

**Klever VM (KVM)**

- Work in VM hooks whose size is chosen by the caller is now bounded and charged before it is done. This covers memory copies, crypto hooks, big-integer shifts, return data, managed vectors and storage loads.
- Timed-out executions are interrupted cleanly, and contract deployment at the timeout boundary is now deterministic.
- Contract storage key length is bounded. Nested calls handle managed values, deleted accounts and failed transfer-and-execute calls correctly.
- Zero-value transfers are no longer reported to contracts as call value.
- The VM executor libraries were upgraded, including fixes for the arm64 instruction path.

**Staking, assets, marketplace and ITO**

- APR claims always stay within an asset’s `MaxSupply`.
- Pause and transfer-limit rules are now enforced on staking deposits, market sales and mints, and ITO purchases.
- Royalty settlement conserves value, pays the current royalty receiver, and honours a stop on royalty changes.
- The fee split between the leader and validators uses exact integer arithmetic.

**APIs, P2P and indexer**

- Node diagnostic endpoints honour the `secured` setting.
- Broadcast and WebSocket goroutines are protected against crashes.
- Account lookups are bounded with a time limit.
- The indexer records account state as of the block being committed.

## **New features**

- **Account Merkle proof API routes** , so applications can prove an account’s state against a block.
- **Shell completion for the operator CLI.**
- The **`fixAuditChangesV6`** activation gate, which carried this release’s consensus changes to mainnet in a coordinated upgrade.

## **Built in the open, with our community**

The numbers in this release are a direct result of the people who look closely at our code.

**23 GitHub Security Advisories** are addressed in v1.7.22, 8 of them rated high. Another **8 reports** were accepted and fixed without needing a separate advisory. Across all releases, **50 advisories** have now been published on the [klever-go security page](https://github.com/klever-io/klever-go/security/advisories).

We want to thank everyone who reported issues through coordinated disclosure, including **@AnubhavDash** , **@destinyae** , **@ibrahimatix0x01** and **@manus-use** , and the **CertiK** team for their continued audit work. Several findings in this release were reported independently by more than one researcher. We read that as a sign of how much attention the community now gives the protocol, and we are grateful for every report.

If you find something, please report it privately through [GitHub’s private vulnerability reporting](https://github.com/klever-io/klever-go/security) for `klever-io/klever-go`, following our security policy. Every report is triaged, and researchers are credited on the advisory.

## **Our commitment**

Our goal is a blockchain that is the most secure, the most robust and the easiest to build on and operate. Security is not one release for us. It is continuous work: independent audits, coordinated disclosure, a transparent advisory record, and fixes shipped behind coordinated upgrades so the network moves forward together. v1.7.22 is another step on that path, and it will not be the last.

## **Upgrading**

- **Running v1.7.22-rc1?** No action is needed: v1.7.22 is the same commit (`9f5d1287`). You can switch to the final image tag at your next restart.
- **Running v1.7.22-rc0 or older?** Upgrade to v1.7.22. Your configuration must be the current mainnet package with `fixAuditChangesV6: 6312`. A node with a different activation epoch will fall out of consensus.
- **Docker:** `kleverapp/klever-go:v1.7.22-0-g9f5d1287`
- **Source:** tag [`v1.7.22`](https://github.com/klever-io/klever-go/tree/v1.7.22). See the step-by-step instructions below.
- No data migration is required. Release candidates are no longer supported now that v1.7.22 has shipped.

## **Upgrade Instructions**

**Important: update the configuration before you update the node.** A node that starts v1.7.22 with an older configuration either refuses to start or falls out of consensus.

### **1. Get the current mainnet configuration**

Every setup uses the same configuration package:

```auto
https://backup.mainnet.klever.org/config.mainnet.108.tar.gz

```

It unpacks into a `config/` folder. Open `config/enableEpochs.yaml` and check it shows:

```auto
fixAuditChangesV5: 6160
fixAuditChangesV6: 6312

```

### **2a. Docker**

1. Download the new configuration:

2. Download the new image:

3. Update directory permissions:

4. Stop and remove your current node:

5. Run your node again:

The `kleverapp/klever-go:v1.7.22-0-g9f5d1287` image contains the full node with every binary. A slimmer validator-only image, `kleverapp/klever-go:val-v1.7.22-0-g9f5d1287`, is also available.

### **2b. Building from source**

1. Clone the release tag and confirm the commit:

2. Build:

3. Install the configuration. The node reads `./config/node/` relative to the folder you start it from. Unpack the package from step 1 and copy the contents of its `config/` folder into `./config/node/`, replacing what is there. Keep your own key files (`validatorKey.pem`, and `p2pKey.pem` if you use one). The `config/node/` files that come with the source code are a development template with every activation epoch set to 0, not the mainnet schedule.

4. Stop your current node and start the new binary from the repository folder:

### **3. Verify your node**

- **Version:** `./bin/validator --version` (or the `starting node` line in the logs) starts with `v1.7.22-0-g9f5d128`. The last field of that string is your machine’s anonymized ID, so it differs from host to host.
- **Sync:** watch the logs right after the restart and confirm the node is syncing. The first start can take longer than usual while the node rebuilds its cache of compiled smart contracts.
- **Proxy (indexer):** if you also run the proxy, check that `external.yaml` has `enable: true` and points to both your node and your Elasticsearch instance.

### **Common problems**

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/klever/original/2X/b/b3475f2ec98839e1e78088fb724c408df30e8355.png)

### Full release notes and the complete list of advisories: [github.com/klever-io/klever-go/releases/tag/v1.7.22](https://github.com/klever-io/klever-go/releases/tag/v1.7.22)

Questions about the upgrade? Ask in our Telegram or Discord, and the team will help.

Thank you for building with us.

**DK**