VDB
Sign up
—

GO-2024-2831

ATX protocol validation problem in github.com/spacemeshos/go-spacemesh

Quick fix

GO-2024-2831 — github.com/spacemeshos/api/release/go: upgrade to the fixed version with the command below.

go get github.com/spacemeshos/api/release/go@v1.37.1

Details

Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/spacemeshos/api/release/go
Introduced in: 0Fixed in: 1.37.1
Fixgo get github.com/spacemeshos/api/release/go@v1.37.1
Go/github.com/spacemeshos/go-spacemesh
Introduced in: 0Fixed in: 1.5.2-hotfix1
Fixgo get github.com/spacemeshos/go-spacemesh@v1.5.2-hotfix1

References