Node 0.4.5 fixes two remote crashes and an unlimited upload endpoint
Testnet and devnet now run Node 0.4.5. Version 0.4.4 remains compatible, but node operators should update because two crashes can be triggered remotely.
By Roberto Capodieci · Published
Node 0.4.5 is live — For those of you adventurers who already run a node... please update
Both fleets are on 0.4.5, testnet and devnet. If you run your own node, update it.
There is no deadline and nothing breaks while you wait: 0.4.4 and 0.4.5 work together on the same chain. But 0.4.4 has two crashes a stranger can trigger from the internet (yes, bugs YOU reported), so sooner is better.
Update — this swaps the binaries and keeps your chain data and your node identity:
curl -fsSL https://zoobc.network/install | bash -s -- --updateCheck what you are running:
curl -s http://localhost:8080/api/v1/node/infoIt should say 0.4.5+7af3fb4f.
What is in it. Five fixes, four of them security. Every one started as a public report on this forum, and all of them were reproduced, argued about and fixed in the open.
- Two remote crashes, no account needed. One through the Ethereum RPC on port 8545, one through an ordinary transaction submit. A node restarts itself, so the result was a node that kept falling over rather than one that stayed down — still a node that is not doing its job.
- The handshake trusted an address the caller made up and then dialled it, and that address then spread to other nodes. A node now records a peer at the address it actually connected from.
- The storage upload endpoint had no limit and nothing cleaned up after it, so anyone could fill a node's disk, and its neighbours' disks.
- Spine blocks were rejected once an hour on every node because a field went missing when a block was broadcast. If you watch your log, that hourly error is gone.
- Transaction lookup now accepts the numeric id as well as the hash, which is what the wallet needed for escrow approve and reject.
Thank you to the testers who found these. If you want to see the work rather than take our word for it, the reports are in the Node and Wallet categories with the payloads, the steps and our replies in the same threads.
One thing coming. The release after this introduces rules that switch on at an announced block height, so future changes to the protocol arrive without restarting the chain. That one will have a deadline: a block number by which your node must be updated. It will be announced here with plenty of warning.