Merge pull request #332 from iotexproject/release/v2.4.3

Add v2.4.3 release note and bump version

Author: envestcc

CLAUDE.md

@@ -13,7 +13,7 @@ This is the **IoTeX Delegate Manual** repository - configuration and operational
 
 ## Version Alignment
 
-This repository is versioned in sync with [iotex-core](https://github.com/iotexproject/iotex-core). The current release is **v2.4.2**. When iotex-core releases a new version:
+This repository is versioned in sync with [iotex-core](https://github.com/iotexproject/iotex-core). The current release is **v2.4.3**. When iotex-core releases a new version:
 1. Update version references in README.md, config files, and scripts
 2. Add a release note in `changelog/`
 3. Create a PR but do NOT merge until the final release is tagged in iotex-core

README.md

@@ -20,7 +20,7 @@
 
 Here are the software versions we use:
 
-- MainNet: v2.4.2
+- MainNet: v2.4.3
 
 ## <a name="testnet"/>Join TestNet
 To start and run a testnet node, please click [**Join Testnet**](https://github.com/iotexproject/iotex-bootstrap/blob/master/README_testnet.md)
@@ -33,7 +33,7 @@ This is the recommended way to start an IoTeX node
 1. Pull the docker image:
 
 ```
-docker pull iotex/iotex-core:v2.4.2
+docker pull iotex/iotex-core:v2.4.3
 ```
 
 2. Set the environment with the following commands:
@@ -48,9 +48,9 @@ mkdir -p $IOTEX_HOME/data
 mkdir -p $IOTEX_HOME/log
 mkdir -p $IOTEX_HOME/etc
 
-curl https://raw.githubusercontent.com/iotexproject/iotex-bootstrap/v2.4.2/config_mainnet.yaml > $IOTEX_HOME/etc/config.yaml
-curl https://raw.githubusercontent.com/iotexproject/iotex-bootstrap/v2.4.2/genesis_mainnet.yaml > $IOTEX_HOME/etc/genesis.yaml
-curl https://raw.githubusercontent.com/iotexproject/iotex-bootstrap/v2.4.2/trie.db.patch > $IOTEX_HOME/data/trie.db.patch
+curl https://raw.githubusercontent.com/iotexproject/iotex-bootstrap/v2.4.3/config_mainnet.yaml > $IOTEX_HOME/etc/config.yaml
+curl https://raw.githubusercontent.com/iotexproject/iotex-bootstrap/v2.4.3/genesis_mainnet.yaml > $IOTEX_HOME/etc/genesis.yaml
+curl https://raw.githubusercontent.com/iotexproject/iotex-bootstrap/v2.4.3/trie.db.patch > $IOTEX_HOME/data/trie.db.patch
 ```
 
 3. Edit `$IOTEX_HOME/etc/config.yaml`, look for `externalHost` and `producerPrivKey`, uncomment the lines and fill in your external IP and private key. If you leave `producerPrivKey` empty, your node will be assgined with a random key.
@@ -94,7 +94,7 @@ docker run -d --restart on-failure --name iotex \
         -v=$IOTEX_HOME/log:/var/log:rw \
         -v=$IOTEX_HOME/etc/config.yaml:/etc/iotex/config_override.yaml:ro \
         -v=$IOTEX_HOME/etc/genesis.yaml:/etc/iotex/genesis.yaml:ro \
-        iotex/iotex-core:v2.4.2 \
+        iotex/iotex-core:v2.4.3 \
         iotex-server \
         -config-path=/etc/iotex/config_override.yaml \
         -genesis-path=/etc/iotex/genesis.yaml
@@ -115,7 +115,7 @@ docker run -d --restart on-failure --name iotex \
         -v=$IOTEX_HOME/log:/var/log:rw \
         -v=$IOTEX_HOME/etc/config.yaml:/etc/iotex/config_override.yaml:ro \
         -v=$IOTEX_HOME/etc/genesis.yaml:/etc/iotex/genesis.yaml:ro \
-        iotex/iotex-core:v2.4.2 \
+        iotex/iotex-core:v2.4.3 \
         iotex-server \
         -config-path=/etc/iotex/config_override.yaml \
         -genesis-path=/etc/iotex/genesis.yaml \
@@ -139,7 +139,7 @@ Same as [Join MainNet](#mainnet) step 2
 ```
 git clone https://github.com/iotexproject/iotex-core.git
 cd iotex-core
-git checkout v2.4.2
+git checkout v2.4.3
 
 // optional
 export GOPROXY=https://goproxy.io
@@ -301,7 +301,7 @@ The upgrade script supports a non-interactive mode for use with AI agents, CI/CD
 |---|---|
 | `--auto` | Non-interactive mode, skip all prompts |
 | `--home=/path` | Set `$IOTEX_HOME` directory |
-| `--version=v2.4.2` | Target version (default: latest release) |
+| `--version=v2.4.3` | Target version (default: latest release) |
 | `--force` | Reinstall even if already running the same version |
 | `--snapshot` | Download blockchain snapshot (recommended for fresh install) |
 | `--monitor` | Enable monitoring |
@@ -315,7 +315,7 @@ bash setup_fullnode.sh --auto --home=/path/to/iotex-var --snapshot
 bash setup_fullnode.sh --auto --home=/path/to/iotex-var
 
 # Upgrade to a specific version
-bash setup_fullnode.sh --auto --home=/path/to/iotex-var --version=v2.4.2
+bash setup_fullnode.sh --auto --home=/path/to/iotex-var --version=v2.4.3
 ```
 
 **Notes:**

changelog/v2.4.3-release-note.md

@@ -0,0 +1,51 @@
+# v2.4.3 Release Note
+
+## Summary
+
+v2.4.3 is a **recommended** security patch release on top of v2.4.2. It closes a transaction-log integrity issue where a contract could cause the node to record an `IN_CONTRACT_TRANSFER` transaction log for a native-token transfer that never happened, and adds an optional startup-loaded patch mechanism to correct such records in already-synced databases. No hardfork, no genesis change, and no config schema change is required for existing operators; a new optional `chain.patchTransactionLogPath` is available for operators who choose to apply the transaction-log patch.
+
+> Transaction logs are not part of any receipt root or state root, so both the fix and the patch are **consensus-neutral**: block hashes are unchanged and nodes on mixed versions do not fork. On-chain balances were never affected by the issue.
+
+## Changes
+
+### Security
+
+- **Record in-contract transfer logs from MakeTransfer directly** (#4868) — The node records native-token transfers that occur inside contract execution as `IN_CONTRACT_TRANSFER` transaction logs, marked with a reserved log topic. Previously any EVM log carrying that reserved topic was turned into a transaction log, so a contract could emit a crafted `LOG` and have the node record an in-contract transfer with attacker-chosen sender/recipient/amount for a transfer that never occurred. Systems that reconstruct balances from transaction logs (indexers, wallets, exchanges) could be misled by such entries. `MakeTransfer` now records the transfer log directly through a node-only path that a contract cannot reach, and `AddLog` no longer converts the reserved topic into a transaction log. Because such logs were never part of `receipt.Logs`, the change leaves `receipt.Logs`, the receipt root, and the block hash unchanged. The change is not height-gated; forged historical logs are dropped on re-execution.
+
+### Feat
+
+- **Startup-loaded transaction-log patch (`TransactionLogIndexer`)** (#4870) — Adds a read-only, startup-loaded override for block transaction logs, controlled by the new optional `chain.patchTransactionLogPath` config. A node loads a small key-value file keyed by block height that overrides the transaction logs served for a sparse set of heights, letting operators correct already-recorded forged records without re-syncing. Heights that are not in the patch fall through to the main block store; the set of patched heights is preloaded into memory at startup so that queries for unpatched heights (the common case) avoid a database lookup. Only nodes that configure `patchTransactionLogPath` are affected — the default is unset. Patch files are produced with the `tools/txlogpatch` utility in iotex-core.
+
+## Upgrade Priority
+
+v2.4.3 is **recommended** for all node types, in particular API / gateway / archive nodes that serve `GetTransactionLogByActionHash` and `GetTransactionLogByBlockHeight`.
+
+| Node type     | Action            |
+| ------------- | ----------------- |
+| Delegate      | **Recommended**   |
+| Fullnode      | **Recommended**   |
+| API node      | **Recommended**   |
+| Archive node  | **Recommended**   |
+
+No genesis or config schema changes are required; v2.4.3 is Go-only and introduces no new activation heights.
+
+To also correct already-recorded forged transaction logs on API/archive nodes, download the transaction-log patch file and enable it:
+
+```
+curl https://raw.githubusercontent.com/iotexproject/iotex-bootstrap/v2.4.3/txlog.db.patch > $IOTEX_HOME/data/txlog.db.patch
+```
+
+then add to the `chain` section of `config.yaml`:
+
+```yaml
+chain:
+  patchTransactionLogPath: /var/data/txlog.db.patch
+```
+
+and restart the node. Applying the patch is optional and only affects the transaction logs served for the patched heights; it does not change balances, receipts, or block hashes.
+
+> **Important:** only set `patchTransactionLogPath` if the file is present at that path — a node configured with a missing patch file will fail to start. Leave the setting unset (the default) to run without the patch.
+
+## Commits
+
+https://github.com/iotexproject/iotex-core/compare/v2.4.2...v2.4.3