core: Merge v1.17.0

.github/workflows/validate_pr.yml

@@ -10,17 +10,77 @@ jobs:
   validate-pr:
     runs-on: ubuntu-latest
     steps:
+      - name: Check for Spam PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prTitle = context.payload.pull_request.title;
+            const spamRegex = /^(feat|chore|fix)(\(.*\))?\s*:/i;
+
+            if (spamRegex.test(prTitle)) {
+              // Leave a comment explaining why
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: `## PR Closed as Spam
+
+            This PR was automatically closed because the title format \`feat:\`, \`fix:\`, or \`chore:\` is commonly associated with spam contributions.
+
+            If this is a legitimate contribution, please:
+            1. Review our contribution guidelines
+            2. Use the correct PR title format: \`directory, ...: description\`
+            3. Open a new PR with the proper title format
+
+            Thank you for your understanding.`
+              });
+
+              // Close the PR
+              await github.rest.pulls.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.payload.pull_request.number,
+                state: 'closed'
+              });
+
+              core.setFailed('PR closed as spam due to suspicious title format');
+              return;
+            }
+
+            console.log('✅ PR passed spam check');
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
       - name: Check PR Title Format
         uses: actions/github-script@v7
         with:
           script: |
+            const fs = require('fs');
+            const path = require('path');
             const prTitle = context.payload.pull_request.title;
             const titleRegex = /^([\w\s,{}/.]+): .+/;
 
             if (!titleRegex.test(prTitle)) {
               core.setFailed(`PR title "${prTitle}" does not match required format: directory, ...: description`);
               return;
             }
+
+            const match = prTitle.match(titleRegex);
+            const dirPart = match[1];
+            const directories = dirPart.split(',').map(d => d.trim());
+            const missingDirs = [];
+            for (const dir of directories) {
+              const fullPath = path.join(process.env.GITHUB_WORKSPACE, dir);
+              if (!fs.existsSync(fullPath)) {
+                missingDirs.push(dir);
+              }
+            }
+
+            if (missingDirs.length > 0) {
+              core.setFailed(`The following directories in the PR title do not exist: ${missingDirs.join(', ')}`);
+              return;
+            }
 
             console.log('✅ PR title format is valid');
 

SECURITY.md

@@ -21,7 +21,6 @@ Audit reports are published in the `docs` folder: https://github.com/ethereum/go
 
 To find out how to disclose a vulnerability in Ethereum visit [https://bounty.ethereum.org](https://bounty.ethereum.org) or email bounty@ethereum.org. Please read the [disclosure page](https://github.com/ethereum/go-ethereum/security/advisories?state=published) for more information about publicly disclosed security vulnerabilities.
 
-Use the built-in `geth version-check` feature to check whether the software is affected by any known vulnerability. This command will fetch the latest [`vulnerabilities.json`](https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities.json) file which contains known security vulnerabilities concerning `geth`, and cross-check the data against its own version number.
 
 The following key may be used to communicate sensitive information to developers.
 

accounts/abi/bind/v2/dep_tree_test.go

@@ -158,10 +158,10 @@ func testLinkCase(tcInput linkTestCaseInput) error {
 		overrideAddrs  = make(map[rune]common.Address)
 	)
 	// generate deterministic addresses for the override set.
-	rand.Seed(42)
+	rng := rand.New(rand.NewSource(42))
 	for contract := range tcInput.overrides {
 		var addr common.Address
-		rand.Read(addr[:])
+		rng.Read(addr[:])
 		overrideAddrs[contract] = addr
 		overridesAddrs[addr] = struct{}{}
 	}

accounts/keystore/keystore.go

@@ -418,6 +418,7 @@ func (ks *KeyStore) Export(a accounts.Account, passphrase, newPassphrase string)
 	if err != nil {
 		return nil, err
 	}
+	defer zeroKey(key.PrivateKey)
 	var N, P int
 	if store, ok := ks.storage.(*keyStorePassphrase); ok {
 		N, P = store.scryptN, store.scryptP
@@ -477,6 +478,7 @@ func (ks *KeyStore) Update(a accounts.Account, passphrase, newPassphrase string)
 	if err != nil {
 		return err
 	}
+	defer zeroKey(key.PrivateKey)
 	return ks.storage.StoreKey(a.URL.Path, key, newPassphrase)
 }
 

accounts/keystore/presale.go

@@ -81,6 +81,9 @@ func decryptPreSaleKey(fileContent []byte, password string) (key *Key, err error
 	*/
 	passBytes := []byte(password)
 	derivedKey := pbkdf2.Key(passBytes, passBytes, 2000, 16, sha256.New)
+	if len(cipherText)%aes.BlockSize != 0 {
+		return nil, errors.New("ciphertext must be a multiple of block size")
+	}
 	plainText, err := aesCBCDecrypt(derivedKey, cipherText, iv)
 	if err != nil {
 		return nil, err

accounts/scwallet/securechannel.go

@@ -300,6 +300,10 @@ func (s *SecureChannelSession) decryptAPDU(data []byte) ([]byte, error) {
 		return nil, err
 	}
 
+	if len(data) == 0 || len(data)%aes.BlockSize != 0 {
+		return nil, fmt.Errorf("invalid ciphertext length: %d", len(data))
+	}
+
 	ret := make([]byte, len(data))
 
 	crypter := cipher.NewCBCDecrypter(a, s.iv)

accounts/usbwallet/hub.go

@@ -43,6 +43,14 @@ const refreshCycle = time.Second
 // trashing.
 const refreshThrottling = 500 * time.Millisecond
 
+const (
+	// deviceUsagePage identifies Ledger devices by HID usage page (0xffa0) on Windows and macOS.
+	// See: https://github.com/LedgerHQ/ledger-live/blob/05a2980e838955a11a1418da638ef8ac3df4fb74/libs/ledgerjs/packages/hw-transport-node-hid-noevents/src/TransportNodeHid.ts
+	deviceUsagePage = 0xffa0
+	// deviceInterface identifies Ledger devices by USB interface number (0) on Linux.
+	deviceInterface = 0
+)
+
 // Hub is a accounts.Backend that can find and handle generic USB hardware wallets.
 type Hub struct {
 	scheme     string                  // Protocol scheme prefixing account and wallet URLs.
@@ -82,14 +90,16 @@ func NewLedgerHub() (*Hub, error) {
 		0x0005, /* Ledger Nano S Plus */
 		0x0006, /* Ledger Nano FTS */
 		0x0007, /* Ledger Flex */
+		0x0008, /* Ledger Nano Gen5 */
 
 		0x0000, /* WebUSB Ledger Blue */
 		0x1000, /* WebUSB Ledger Nano S */
 		0x4000, /* WebUSB Ledger Nano X */
 		0x5000, /* WebUSB Ledger Nano S Plus */
 		0x6000, /* WebUSB Ledger Nano FTS */
 		0x7000, /* WebUSB Ledger Flex */
-	}, 0xffa0, 0, newLedgerDriver)
+		0x8000, /* WebUSB Ledger Nano Gen5 */
+	}, deviceUsagePage, deviceInterface, newLedgerDriver)
 }
 
 // NewTrezorHubWithHID creates a new hardware wallet manager for Trezor devices.

accounts/usbwallet/ledger.go

@@ -184,7 +184,7 @@
 		return nil, accounts.ErrWalletClosed
 	}
 	// Ensure the wallet is capable of signing the given transaction
-	if w.version[0] < 1 && w.version[1] < 5 {
+	if w.version[0] < 1 || (w.version[0] == 1 && w.version[1] < 5) {
 		//lint:ignore ST1005 brand name displayed on the console
 		return nil, fmt.Errorf("Ledger version >= 1.5.0 required for EIP-712 signing (found version v%d.%d.%d)", w.version[0], w.version[1], w.version[2])
 	}
@@ -509,7 +509,7 @@
 //	Optional APDU data       | arbitrary
 func (w *ledgerDriver) ledgerExchange(opcode ledgerOpcode, p1 ledgerParam1, p2 ledgerParam2, data []byte) ([]byte, error) {
 	// Construct the message payload, possibly split into multiple chunks
 	apdu := make([]byte, 2, 7+len(data))
 
 	binary.BigEndian.PutUint16(apdu, uint16(5+len(data)))
 	apdu = append(apdu, []byte{0xe0, byte(opcode), byte(p1), byte(p2), byte(len(data))}...)

accounts/usbwallet/wallet.go

@@ -632,7 +632,7 @@ func (w *wallet) SignTx(account accounts.Account, tx *types.Transaction, chainID
 // data is not supported for Ledger wallets, so this method will always return
 // an error.
 func (w *wallet) SignTextWithPassphrase(account accounts.Account, passphrase string, text []byte) ([]byte, error) {
-	return w.SignText(account, accounts.TextHash(text))
+	return w.SignText(account, text)
 }
 
 // SignTxWithPassphrase implements accounts.Wallet, attempting to sign the given

arbcrypto/keccak.go

@@ -5,9 +5,9 @@ package arbcrypto
 import (
 	"hash"
 
-	"golang.org/x/crypto/sha3"
+	"github.com/ethereum/go-ethereum/crypto/keccak"
 )
 
 func NewLegacyKeccak256() hash.Hash {
-	return sha3.NewLegacyKeccak256()
+	return keccak.NewLegacyKeccak256()
 }

arbitrum/recreatestate.go

@@ -80,7 +80,7 @@ func AdvanceStateByBlock(ctx context.Context, bc *core.BlockChain, state *state.
 	if logFunc != nil {
 		logFunc(block.Header(), true)
 	}
-	result, err := bc.Processor().Process(block, state, vmConfig)
+	result, err := bc.Processor().Process(ctx, block, state, vmConfig)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("failed recreating state for block %d : %w", blockToRecreate, err)
 	}

beacon/blsync/engineclient.go

@@ -101,7 +101,16 @@ func (ec *engineClient) callNewPayload(fork string, event types.ChainHeadEvent)
 		params = []any{execData}
 	)
 	switch fork {
-	case "electra":
+	case "altair", "bellatrix":
+		method = "engine_newPayloadV1"
+	case "capella":
+		method = "engine_newPayloadV2"
+	case "deneb":
+		method = "engine_newPayloadV3"
+		parentBeaconRoot := event.BeaconHead.ParentRoot
+		blobHashes := collectBlobHashes(event.Block)
+		params = append(params, blobHashes, parentBeaconRoot)
+	default: // electra, fulu and above
 		method = "engine_newPayloadV4"
 		parentBeaconRoot := event.BeaconHead.ParentRoot
 		blobHashes := collectBlobHashes(event.Block)
@@ -110,15 +119,6 @@ func (ec *engineClient) callNewPayload(fork string, event types.ChainHeadEvent)
 			hexRequests[i] = hexutil.Bytes(event.ExecRequests[i])
 		}
 		params = append(params, blobHashes, parentBeaconRoot, hexRequests)
-	case "deneb":
-		method = "engine_newPayloadV3"
-		parentBeaconRoot := event.BeaconHead.ParentRoot
-		blobHashes := collectBlobHashes(event.Block)
-		params = append(params, blobHashes, parentBeaconRoot)
-	case "capella":
-		method = "engine_newPayloadV2"
-	default:
-		method = "engine_newPayloadV1"
 	}
 
 	ctx, cancel := context.WithTimeout(ec.rootCtx, time.Second*5)
@@ -145,12 +145,12 @@ func (ec *engineClient) callForkchoiceUpdated(fork string, event types.ChainHead
 
 	var method string
 	switch fork {
-	case "deneb", "electra":
-		method = "engine_forkchoiceUpdatedV3"
+	case "altair", "bellatrix":
+		method = "engine_forkchoiceUpdatedV1"
 	case "capella":
 		method = "engine_forkchoiceUpdatedV2"
-	default:
-		method = "engine_forkchoiceUpdatedV1"
+	default: // deneb, electra, fulu and above
+		method = "engine_forkchoiceUpdatedV3"
 	}
 
 	ctx, cancel := context.WithTimeout(ec.rootCtx, time.Second*5)