v8.8.0 MAINNET MANTRA Chain Upgrade (Expedited)
MANTRA proposal #41: # MANTRA Chain v8.8.0: Coordinated Security Upgrade ๐ฆ **RELEASE TAGGED AS `v8.8.0`** ๐ฆ This is a mandatory security release for all va...
Yes
100%
No
0%
Abstain
0%
Veto
0%
If passed
Some execution details could not be interpreted. Review the source JSON before voting.
1. Schedule a software upgrade
- Authority
-
- Upgrade plan
- v8.8.0
- Target block
- 19571888
2. Uninterpreted operation
This message type is not supported by the interpreter. Its effects are unknown.
AI Summary
gpt-6-luna - generated 11/10/2026, 2:53:49 AM
v8.8.0 MAINNET MANTRA Chain Upgrade (Expedited)
Proposal 41 calls for a coordinated, consensus-breaking MANTRA mainnet upgrade to v8.8.0 at one agreed height. The release is described as mandatory for validators and full-node operators, primarily to patch multiple security vulnerabilities and add restrictions related to a reported Keplr Wallet exploit involving Web3Auth.
- Upgrade MANTRA Chain to v8.8.0 at a jointly agreed block height.
- The upgrade changes cosmos/evm to v0.6.4-v8-mantra-1 and patches four listed security advisories.
- The release is built with Go 1.26 and updates dependencies with known vulnerabilities to patched versions.
- Additional restrictions are included in response to a Keplr Wallet exploit attributed to a Web3Auth flaw.
- The proposal provides release checksums, a signature-verification command, and Docker image digests.
Voter Impact
A yes vote supports moving the network to v8.8.0 at a coordinated height. Validators and full-node operators are expected to upgrade; because the change is consensus-breaking, coordination is important to avoid network disruption.
Risk Signals
- The upgrade is consensus-breaking and requires coordinated adoption by the validator set.
- The proposal does not state the target upgrade height or timing.
- The Keplr/Web3Auth restrictions and their precise effects are not explained.
- The release asset links and full changelog appear incomplete in the supplied text.
Original Proposal Text
# MANTRA Chain v8.8.0: Coordinated Security Upgrade ๐ฆ **RELEASE TAGGED AS `v8.8.0`** ๐ฆ This is a mandatory security release for all validators and full-node operators. It moves cosmos/evm to `v0.6.4-v8-mantra-1`, which fixes GHSA-p8x8-4gg6-prcc, GHSA-7xxp-gq2c-x47x, GHSA-c6xv-pppp-rjw6 and GHSA-wm4f-qpxp-rch4. The binary is also built with Go 1.26, and dependencies with known vulnerabilities are bumped to patched versions. Some additional restrictions are also added due to Keplr Wallet exploit due to flaw in Web3Auth. This is a consensus-breaking upgrade recommended for the entire validator set. The objective of this proposal is to move the network to the patched version at a single agreed height. ## Verifying the Release You can verify the integrity of the release artifactsusing the following SHA-256 checksums: ``` 576c9faf2f2adea2c8c7409bc32f174f4343e4a214583634eb68d37e5334e218 mantrachaind-8.8.0-darwin-amd64 45fc3fc278c2b24173d5850d37c7dba03837c597f27a5a28921112511af29aea mantrachaind-8.8.0-darwin-amd64.tar.gz d95019260bfa96c7b4e575cc8aad3ee71e9c66a9c18337964ca24097c380510e mantrachaind-8.8.0-darwin-arm64 d70be327e9641044ab048c2d4358520cffca2ebe31b5b78e755c1a69a75c14dd mantrachaind-8.8.0-darwin-arm64.tar.gz 08b749dabff11b2e6d0e36742c3e3d95bc3d5b3714c3b4468ae79e54f88a9510 mantrachaind-8.8.0-linux-amd64 a45f89007f9f7360f0a7bb150d2672ed14e40ea6a33137376c96c3aa7e03935e mantrachaind-8.8.0-linux-amd64.tar.gz edad2d473ffec2f1cffe4fc76c10fbe3a609c9e7dc597c225d5e4509017e80c7 mantrachaind-8.8.0-linux-arm64 542d44fb6404a14f98b41ab16116cf1cb1b74393f1270f0d38afa7222e1d0b36 mantrachaind-8.8.0-linux-arm64.tar.gz ``` ### Verify sha256sum.txt.sig ```bash gpg --recv-keys 7CE02F9E5D2971D8A9579433504367809BC3452F gpg --verify sha256sum.txt.sig sha256sum.txt ``` ## Assets Located at the GitHub release: - - - - - - - - - - ### Docker Container Registry Manifest digest: `sha256:ad693fa1079d67c71c09ff9c43de3f3ae4002776f155cac8b26bdafc13037e4f` ```bash # linux/amd64 docker pull ghcr.io/mantra-chain/mantrachain:v8.8.0@sha256:8700e6f27999114d849a11678351a4607807ffdbc93d79d5f21d67f1e3b47d31 # linux/arm64 docker pull ghcr.io/mantra-chain/mantrachain:v8.8.0@sha256:d201582a934b5c83491ae973d11f006e674053826b4000732bbea9bad8fa7687 ``` ## What's Changed - Chore: Integrate v8.7 upgrade ([#696](https://github.com/MANTRA-Chain/mantrachain/pull/696)) - Problem: govulncheck fails due to known vulnerabilities ([#707](https://github.com/MANTRA-Chain/mantrachain/pull/707)) - Problem: cli can't list registered upgrade handlers ([#709](https://github.com/MANTRA-Chain/mantrachain/pull/709)) - Chore: nov-1-2026 patch security patch ([#706](https://github.com/MANTRA-Chain/mantrachain/pull/706)) - ci: pin heighliner alpine to 3.22 for go 1.26 builds ([#710](https://github.com/MANTRA-Chain/mantrachain/pull/710)) **Full Changelog**: More details: ipfs://CID