Gravity v1.7.1

What's Changed

• fix(consensus): replay ordered path after recovery by @Lchangliang in #737
• feat(test): add prune e2e test by @AshinGau in #718
• chore(deps): bump gravity-reth to 408ef602 (audit-710 InvalidTransaction filter) + e2e by @nekomoto911 in #753
• chore(deps): bump gravity-reth to 1aec7b75 (audit-715 wipe+recreate state root) by @nekomoto911 in #754

Full Changelog: v1.7.0...v1.7.1

Gravity v1.7.0

What's Changed

• docs: add gravity cli skill by @Lchangliang in #729
• test(e2e): add Prague hardfork (EIP-2935 / EIP-7702) acceptance suite by @nekomoto911 in #734
• docs: update genesis assets by @Lchangliang in #736
• Pick audit 602 consensus fixes by @Lchangliang in #735
• chore(deps): bump gravity-reth to 0adbb4c9 (EIP-7702 self-auth fix) + e2e by @nekomoto911 in #738
• ci(release): switch to v*.. tag trigger and add workflow_dispatch by @nekomoto911 in #739

Full Changelog: gravity-mainnet-v1.6.2...v1.7.0

Gravity Mainnet v1.6.2

What's Changed

• fix(sentinel): switch to patched linemux fork to stop 100% CPU busy spin by @nekomoto911 in #728
• chore(deps): bump gravity-reth to acc45884 (rocksdb durability fix) by @nekomoto911 in #730

Full Changelog: gravity-mainnet-v1.6.1...gravity-mainnet-v1.6.2

Gravity Mainnet v1.6.1

What's Changed

• chore: drop gcp-secret-manager optional cargo feature, revert #713 by @keanji-x in #714
• build: add gravity_cli build target to Makefile by @Stumble in #715
• build(release): vendor openssl in gravity_node so -p builds stay self-contained by @keanji-x in #717
• ci(nightly): drop environment: default from e2e-docker-nightly by @nekomoto911 in #721
• mempool: per-entry TTL + bucket-sharded snapshot + silent-blackhole recovery by @nekomoto911 in #722
• fix(oracle): bump greth to b0ec42c, verified by new e2e cases by @ByteYue in #725

Full Changelog: gravity-mainnet-v1.6.0...gravity-mainnet-v1.6.1

Gravity Mainnet v1.6.0

What's Changed

• fix(consensus): prevent panic in VFN sync when parent blocks are pruned by @Lchangliang in #694
• feat(cluster): support GCP Secret Manager identity for PFN nodes by @Lchangliang in #695
• fix(consensus): use block_number limit in recover_blocks to prevent skipping epoch change by @Lchangliang in #697
• fix(mempool): drop add_txn cache write; simplify TxnCache to single generation by @keanji-x in #699
• fix(consensus): prevent panic on empty ledger_infos in fast_forward_sync_by_epoch by @Lchangliang in #700
• feat: add genesis-alloc-audit agent skill by @nekomoto911 in #703
• feat(cluster): per-node txpool slots and vfn-discovery overrides by @nekomoto911 in #696
• fix(consensus): bound commit_vote_cache by round window + reset validator pipeline after FFsync by @Richard1048576 in #701
• feat(cli): add doctor command for config and connectivity diagnostics by @ByteYue in #665
• chore: gitignore Claude Code harness local state by @keanji-x in #698
• fix(cluster): default genesisTimestampSecs so e2e survives genesis-tool strict mode by @ByteYue in #706
• fix(consensus): harden fast-forward recovery pipeline by @Lchangliang in #704
• Persist fetched quorum store batches to DB by @Lchangliang in #707
• fix(mempool): demote AlreadyImported to info, defer to reth's is_bad_transaction by @nekomoto911 in #705
• feat(regression): pfn_chain stress suite + docker host-binary runtime image by @keanji-x in #709
• ci(release): runner-native release workflow + actionlint by @nekomoto911 in #710
• ci(release): enable gcp-secret-manager feature for gravity_node by @Richard1048576 in #713

Full Changelog: gravity-testnet-v1.5.0...gravity-mainnet-v1.6.0

Gravity Testnet v1.5.0

What's Changed

• feat(cli,genesis): support DNS domain names in validator network addresses by @nekomoto911 in #650
• fix(genesis): align cluster deployment with upstream contract changes by @keanji-x in #651
• refactor(sentinel): make log monitoring optional and run as independent task by @nekomoto911 in #657
• test(e2e): add distinct operator/owner/staker genesis validator cases by @ByteYue in #656
• fix(ci): restore PR-wide dedup in gate workflow by @nekomoto911 in #659
• feat(cli): add --output json support to stake commands and update E2E parsing by @nekomoto911 in #660
• chore(genesis): add gamma/delta/epsilon and consensusAlpha hardfork blocks to testnet genesis by @nekomoto911 in #661
• feat(sentinel): enrich probe failure alerts with reqwest error classification, source chain, and elapsed time by @nekomoto911 in #662
• feat(sentinel): add explorer block-advance monitor by @nekomoto911 in #664
• test(e2e): governance consensus-config lifecycle with genesis-wired owner by @ByteYue in #671
• test(e2e): governance validator-whitelist lifecycle by @ByteYue in #673
• fix: fix bug cause by dummy result (#655) by @Lchangliang in #675
• fix(consensus): drop RSA JWK updates with error log instead of forwarding by @ByteYue in #674
• fix(e2e): adapt staking tests for 2-step timelock role changes and fix cross-platform compat by @Lchangliang in #677
• feat(cluster): make RPC CORS / API / WebSocket settings configurable by @nekomoto911 in #663
• fix(consensus): make send_for_execution idempotent under races by @keanji-x in #676
• feat(docker): binary-only image + compose flows for validator deployment by @keanji-x in #680
• combined: cluster deploy env override + gravity_cli KMS signer + consensus tier-1 audit fixes by @keanji-x in #683
• chore: update greth & gaptos by @Lchangliang in #679
• fix(consensus): prevent 'Parent block not found' panic on sync + rebuild by @nekomoto911 in #681
• feat(consensus): enable VFN to serve BatchRetrieval via consumer-only quorum_store by @nekomoto911 in #685
• fix(docker): export RPC HTTP defaults in render-cluster-config.sh by @keanji-x in #684
• feat(consensus/e2e): support PublicFullnode via NodeType-aware sync paths by @nekomoto911 in #687
• feat(cluster): unify seeds config and role-specific ports by @nekomoto911 in #690
• feat(cluster): support GCP Secret Manager as identity source by @keanji-x in #688
• fix(e2e): unblock CI broken by 50 Gwei min base fee + LOG_DIR default by @keanji-x in #693
• fix(cluster): relax port checks; redesign pfn e2e as 4-node fan-out by @nekomoto911 in #692
• feat(fee): align test and CLI fees with Gravity 50 Gwei min base fee by @AshinGau in #689

Full Changelog: gravity-testnet-v1.4.0...gravity-testnet-v1.5.0

Gravity Testnet v1.4.0

What's Changed

• feat(e2e): add rolling upgrade test by @nekomoto911 in #640
• fix(consensus): address 6 critical audit findings by @keanji-x in #641
• fix(reth): improve error handling in coordinator tasks and block id lookup by @ByteYue in #643
• docs(cli): clarify intent flagged as audit false positives by @nekomoto911 in #644
• feat(cli): improve developer experience with config, completions, output format, status dashboard, and error handling by @ByteYue in #647
• feat(consensus): add failed_proposer_indices and validator performance based leader election by @Lchangliang in #639
• feat(sentinel): add bridge chain monitor for on-chain event surveillance by @ByteYue in #646
• fix(consensus): improve error handling and remove unreachable panics by @Lchangliang in #645
• feat(genesis): passthrough genesisTimestampSecs from TOML to genesis-tool by @nekomoto911 in #649
• feat: non-blocking epoch change and fix deprecated try_next() by @keanji-x in #619
• improve: Add Hardfork and forward-compatible code by @Lchangliang in #654
• fix: fix bug cause by dummy result by @Lchangliang in #655
• chore: bump gravity-testnet-v1.4.0 by @nekomoto911 in #658

Full Changelog: gravity-testnet-v1.3.0...gravity-testnet-v1.4.0

Gravity Testnet v1.3.0

Full Changelog: gravity-testnet-v1.2.0...gravity-testnet-v1.3.0

Related Releases:

• gravity-reth: gravity-testnet-v1.3.0
• gravity_chain_core_contracts: gravity-testnet-v1.3.0

Breaking Changes

Unified Hardfork Framework (gravity-reth)

Introduces a unified hardfork dispatch framework based on the new HardforkUpgrades trait, replacing the ad-hoc per-hardfork glue established in v1.1.1 / v1.2.0. All four Gravity-native hardforks (Alpha, Beta, Gamma, Delta) are now expressed as HardforkUpgrades implementations and dispatched through a single apply_hardfork_upgrades() entry point. A new GravityHardfork enum is added to chainspec, with genesis parsing for alphaBlock, betaBlock, gammaBlock, deltaBlock from extra_fields, and a new batch_storage_patches() method covers the Gamma ReentrancyGuard initialization across all StakePool instances (gravity-reth#307, gravity-reth#309, gravity-reth#312, gravity-reth#318).

Delta Hardfork (gravity-reth + contracts)

Ships the Delta hardfork in lockstep with the gravity_chain_core_contracts v1.3.0 release. Delta upgrades 4 system contracts (StakingConfig, ValidatorManagement, Governance, NativeOracle) and applies the storage migration required by the removal of minimumProposalStake from StakingConfig (packed _initialized bit at slot 1, clearing of stale slots 2/3/6/7). Activation is configured via genesis config.deltaBlock.

StakingConfig Storage Layout Migration (contracts)

The minimumProposalStake parameter is removed from StakingConfig and its PendingConfig struct, causing a non-trivial storage layout shift that must be migrated as part of the Delta hardfork. A __deprecated_minimumProposalStake placeholder is added so that _initialized, _pendingConfig, and hasPendingConfig remain at their original slots (contracts#58, contracts#64).

Deferred Consensus Key Rotation (contracts)

rotateConsensusKey no longer takes effect immediately. Key rotations are now deferred as pending and applied only at the next epoch boundary, fixing both the mid-epoch consensus key desync (Coacker D2-3) and the slashing escape hatch (D2-2) (contracts#55).

What's Changed

Features

• feat(unwind): add unwind operation for sdk&greth by @Lchangliang in #632
  • Adds a full consensus-data unwind path covering ConsensusDB (Block, QC, BlockNumber, LedgerInfo, EpochByBlockNumber, Randomness, LastVote, Highest2ChainTimeoutCert), QuorumStoreDB (batch data + cancelled-epoch BatchId), and on-disk state (secure.json safety rules, rand_db/).
• feat(cli): add epoch status command to monitor epoch running time by @Lchangliang in #623
  • gravity_cli epoch status --rpc-url=... reports current epoch, elapsed running time vs. configured interval, and remaining time.
• feat(cluster): improve deploy script and e2e test runner by @keanji-x in #628
  • Enhances deploy.sh and e2e_test.sh, adds a justfile for cluster shortcuts, refreshes cluster.toml configs across test cases and examples.
• feat(sentinel): add optional tag field to probe configuration for better alert context by @nekomoto911 in #636
• feat(sentinel): add default priority for unmatched alert patterns by @nekomoto911 in #637
• test: add governance e2e by @ByteYue in #626

Security Audit Fixes

• fix: fix critical audit from ag by @Lchangliang in #614
  • Consensus liveness/panic: replaces a panic! in pending_votes.rs with VoteReceptionResult::ErrorAddingVote so a delayed-QC aggregation with insufficient voting power no longer crashes consensus on stale or maliciously delayed votes; adds strict assertions in RotatingProposer initialization to prevent division-by-zero / out-of-bounds.
  • Multithread UB: moves the conditional RUST_BACKTRACE evaluation to the very start of gravity_node::main() before any threads are spawned, mitigating the known UB around std::env::set_var.
  • Block buffer recovery: refactors init_block_buffer_manager so the loop breaks once block_number_to_block_id covers (latest - start + 1), improving boot/sync performance; properly logs silent persist_notifiers channel closures and save_transactions errors during commit_ledger.
  • Genesis underflow: uses checked_sub(1) in block-parent resolution so block_number == 0 falls back to the canonical parent_id instead of underflowing.
• fix: fix (warn/medium/high) audit from AG by @Lchangliang in #613
  • Leader-reputation overflow: replaces direct += 1 with saturating_add(1); widens multiplications to u64 (e.g. cur_failed_proposals as u64 * 100); promotes critical DB/sync failure logs from warn! to error! with explicit "leader election may degrade" wording.
  • Panic-free error handling: removes .unwrap() across gravity_node and reth_coordinator, replacing them with descriptive .expect() / .unwrap_or_else(|| panic!(...)); converts an ignored let _ = ... in consensus_mempool_handler.rs into an if let Err(e) warning log.
  • State-transition ordering: in block-buffer-manager.rs, the BufferState is now stored as EpochChange before the internal state machine prunes older blocks, removing an unsafe intermediate state.
  • General cleanup of leftover println! debugging.

Bug Fixes

• fix(mempool): add TTL-based rotation to TxnCache to fix stale broadcast entries by @keanji-x in #624
  • Critical liveness fix: VFN mempools were accumulating hundreds of pending transactions that never propagated, causing all validators to produce empty blocks despite a full mempool. Root cause: once a tx hash entered TxnCache via read_timeline(), it was never evicted, so any failed/un-ACKed broadcast was permanently filtered out. The cache now rotates on either size overflow or TTL elapse (default 60s, configurable via MEMPOOL_BROADCAST_CACHE_TTL_SECS); after 2 TTL periods stale entries are fully evicted, allowing re-broadcast of uncommitted transactions. Also switches cache.clone() + clear() to std::mem::take().
• fix: only broadcast pending txn by @keanji-x in #633
• chore(deps): update greth & gaptos by @nekomoto911 in #642

Gravity Testnet v1.2.0

Full Changelog: gravity-testnet-v1.1.1...gravity-testnet-v1.2.0

Related Release: gravity-reth gravity-testnet-v1.2.0

Breaking Changes

System Transaction Execution Overhaul (gravity-reth)

This release fundamentally changes how system transactions (mint, BLS PoP, metadata, validator) are executed. Previously, system transactions ran against a temporary in-memory database separate from the executor's own state, requiring manual state bridging that introduced state overwrite bugs and bypassed EVM revert semantics. Now all system transactions execute directly on the executor's internal state through a unified transact_system_txn code path, identical to user-transaction execution (gravity-reth#288).

• Unified execution path: The special-cased increment_balances / commit_changes methods, the PendingMints accumulator, and the temporary database have all been removed.
• Mint precompile rewired: mint_precompile now modifies the EVM journal directly via EvmInternals::load_account, participating correctly in checkpoint/revert semantics.
• Executor trait changes: ParallelExecutor and Executor traits gain a new transact_system_txn(evm_env, precompiles, tx_env) method.

Gamma Hardfork (gravity-reth)

Introduces the Gamma hardfork, extending the Gravity-native hardfork framework established in v1.1.1 (which shipped Alpha and Beta). Gamma adds new hardfork infrastructure and integration test support, configured via genesis config at a specified block number (gravity-reth#292).

Oracle Nonce Type Change (gravity-reth)

The nonce type for PollResult and OracleSourceState has been changed from u64 to u128 (gravity-reth#278). This is a breaking change for any code that interacts with the oracle relayer state.

Pending Config Pattern for StakingConfig (contracts)

Replaces the 4 immediate-apply governance setters (setMinimumStake, setLockupDurationMicros, setUnbondingDelayMicros, setMinimumProposalStake) with a two-phase setForNextEpoch() / applyPendingConfig() pattern. Config changes now take effect at the next epoch boundary instead of immediately (contracts#33).

Staking Reward Withdrawal (contracts)

Adds explicit withdrawRewards() for stakers to claim accumulated rewards and a getRewardBalance() view function. The receive() fallback has been removed since rewards are distributed via direct balance increments (mint precompile). A new RewardsWithdrawn event is added to IStakePool (contracts#37).

StakingConfig Storage Layout Adjustment (contracts)

Adjusts the storage layout of StakingConfig to prevent storage slot conflicts introduced by the pending config pattern. This is a breaking change for any existing on-chain state (contracts#40).

GBridgeReceiver Reverted to v1.0.0 (contracts)

All GBridgeReceiver contract changes made after gravity-testnet-v1.0.0 have been reverted to avoid bridge receiver hardfork complexity in the testnet-v1.2 upgrade (contracts#47).

What's Changed

Features

• feat(sentinel): per-file-path frequency thresholds, multi-probe URLs, connectivity-based health check by @nekomoto911 in #605
• feat(sentinel): add priority-level (P0/P1/P2) webhook routing with per-rule and per-priority rate limiting by @nekomoto911 in #600
• feat(e2e): add VFN transaction forwarding test case by @keanji-x in #591
• feat: add benchmark workflow skill and report generator by @keanji-x in #603
• feat: add agent workflow for build and E2E test instructions by @ByteYue in #594

Security Fixes

• security(cli): read private key from stdin instead of CLI arg by @nekomoto911 in #610
• fix: implement Lightman-accepted Phase 3 security audit fixes by @Lchangliang in #599
• fix: apply some security fixes by @Lchangliang in #589
• fix: batch fix for 15 audited issues by @keanji-x in #606
• security: gate HTTP API server behind debug_assertions in release builds by @Lchangliang in #584
• fix: GSDK-022 add retry logic for commit vote loop, GSDK-024 fix pop_txns gas off-by-one by @keanji-x in #598

Bug Fixes

• fix(consensus): fix BlockTree prune problems by @nekomoto911 in #607
• fix(mempool): enforce nonce ordering in best_txns iterator by @keanji-x in #601
• fix: use tx hash as TxnCache key to guarantee consistency by @keanji-x in #602
• fix: use microseconds for mempool commit notification timestamp by @keanji-x in #615
• fix: Unify all the oracle nonce to use u128 and type name in JWKStruct passed from cl to el by @ByteYue in #596
• fix: use direct get instead of iter+seek for epoch boundary check in consensus recovery by @Lchangliang in #586
• fix(cluster): update genesis to use the latest contract repo by @keanji-x in #593

Improvements

• improve: Add audit from codex by @Lchangliang in #604
• opt(test): add KILL_READY_MAX_GAP to control random kill strategy by @AshinGau in #617
• chore: return err instead panic when no cache poll result by @ByteYue in #588
• chore: fix codex audit for more readability by @ByteYue in #612

Dependencies

• chore(deps): update greth & gaptos by @nekomoto911 in #609
• chore: Update gaptos deps to address empty jwk provider when constructing jwk txns by @ByteYue in #611

Configuration & Deployment

• chore: support custom hardfork block numbers and relayer rpc url in cluster config by @nekomoto911 in #616
• chore: update testnet genesis with alpha and beta blocks by @Lchangliang in #618
• chore: add cluster configuration examples by @keanji-x in #587
• chore: Update the deploy doc for relayer config by @ByteYue in #590
• chore: bump gravity-testnet-v1.2.0 by @nekomoto911 in #620

Hotfixes

• Revert "improve: Add audit from codex (#604)" by @Lchangliang in #625 — reverted because the codex audit changes broke RPC forward compatibility between nodes
• fix(mempool): add TTL-based rotation to TxnCache to fix stale broadcast entries by @nekomoto911 in #629
• feat(test): add rolling upgrade test case by @nekomoto911 in #627

Gravity Testnet v1.1.1

Release: gravity-testnet-v1.1.1

Full Changelog: gravity-testnet-v1.1.0...gravity-testnet-v1.1.1

Related Release: gravity-reth gravity-testnet-v1.1.1

---

Breaking Changes

Alpha + Beta Hardforks — System Contract Bytecode Upgrade

This release introduces two hardforks (Alpha and Beta) that perform hot-swap upgrades of system contract runtime bytecode at specified block heights. This supersedes the withdrawn v1.1.0 and includes a critical fix for the StakePool immutable variable issue.

Alpha Hardfork (System Contract Upgrade)

• Staking Contract: Upgraded runtime bytecode to the latest version (10,867 bytes) from gravity_chain_core_contracts.
• StakePool Contracts: Upgraded runtime bytecode of all 4 existing StakePool contracts (6,824 bytes each).
• Block Reward Minting: Disabled during the PoW phase at the consensus layer.

Beta Hardfork (StakePool Immutable Fix)

• Fix: Resolves the FACTORY immutable variable zeroing issue introduced in Alpha. The forge build output used in v1.1.0 did not include initialized immutable constants, causing all onlyFactory permission checks in StakePool to revert.
• Solution: Beta re-injects the correct runtime bytecode extracted from the live chain via cast code, preserving all immutable variable values.

---

Node Upgrade Guide

⚠️ Upgrade Priority: HIGH

All node operators must upgrade to this version to maintain consensus compatibility.

Step 1: Configuration

Add alphaBlock and betaBlock activation heights to your genesis.json:

{
  "config": {
    "alphaBlock": 8287964,
    "betaBlock": 8344249
  }
}

Step 2: Build & Run

If building from source, ensure the greth dependency in Cargo.toml points to the new release tag:

greth = { git = "https://github.com/Galxe/gravity-reth", tag = "gravity-testnet-v1.1.1" }

Then rebuild with cargo build --release and restart the node binary.

Note: No database wipe is required. The execution layer seamlessly injects the upgraded contracts at the specified block heights.

Step 3: Verification Checklist

After the node restarts and passes the configured activation heights:

• Node starts successfully and processes blocks through both Alpha and Beta activation heights
• Epoch transitions are triggered and completed normally
• Execution layer logs show "System transaction" events during epoch switches

---

What's Changed

Features

• feat: implement Alpha hardfork with system contract bytecode hot-swap
• feat: implement Beta hardfork to fix StakePool FACTORY immutable zeroing
• feat: add Staking contract upgrade (10,867 bytes) at Alpha activation block
• feat: add StakePool contract upgrade for 4 known addresses (6,824 bytes each)
• feat: re-inject correct StakePool bytecode with cast code at Beta activation block
• feat: disable block reward minting during PoW phase

Bug Fixes

• fix: resolve StakePool FACTORY immutable variable being set to address(0) when using forge build bytecode

Infrastructure

• chore: bump gravity testnet v1.1.1