Erigon v3.5.5 — Tidal Tails

v3.5.5 is a bugfix and security release recommended for all users, and especially for block proposers and archive-node operators. It fixes a panic on every Fulu blinded-block submission (#23150), a payload frozen before its slot began under an external consensus layer (#23102), and wrong logIndex values on archive nodes (#22951). It is a drop-in upgrade from 3.5.4 — no re-sync required.

Bugfixes

• cl/beacon: handle an empty Fulu builder response (#23150) by @domiwei — Builder API v2 answers a successful Fulu blinded-block submission with 202 Accepted and no body, so the builder client returned all-nil and publishBlindedBlocks dereferenced the nil payload. The beacon router installs no middleware.Recoverer, so the validator client saw only a dropped connection and nothing reached the Erigon log. Fixes #22598.
• execution: build payloads until the slot they are for (#23102) by @lystopad — the builder's time budget ran from when payload attributes arrived rather than from the payload timestamp, so a consensus layer sending attributes well ahead of the slot got a payload frozen before that slot began. The budget now derives from the timestamp, floored at the old value and capped at two slots. Non-proposing nodes and Caplin are unaffected.
• db/state: route receipt-domain reads through the overlay DomainReader (#22951) by @Sahil-4555 and @mh0lt — a block admitted through the block overlay read its receipt metadata from the committed tx, where a history miss fell back to GetLatest and returned the previous writing block's final log count. The wrong logIndex was then cached in the RPC layer. Affected v3.5.1–v3.5.4. Fixes #22106.
• db/state: roll back receipt domains on an in-RAM reorg unwind (#23064) by @MoonBoi9001 — the in-memory unwind path restored a hand-written list of the four state kinds that existed when it was written and never gained the receipt counters added later, so it left the abandoned blocks' values in place. It now walks every state kind, as the disk path does.
• db/downloader: allow seeding caplin state snapshots with a nil global type (#22980) by @lystopad — a node upgraded in place from a recent release/3.4 build logged nil ptr after parsing file: caplin/…-NextSyncCommittee.seg and silently stopped seeding its caplin state snapshots.

Security

• build: bump golang.org/x/text to v0.39.0 (#23178) by @lystopad — CVE-2026-56852: infinite loop in unicode/norm on invalid UTF-8. Reachable from the downloader's HTTP/3 webseed path, and the only advisory here that govulncheck reports as called.
• build: bump golang.org/x/net to v0.56.0 (#23178) by @lystopad — CVE-2026-46600: panic parsing a malformed SVCB or HTTPS DNS resource record.
• build: bump github.com/quic-go/webtransport-go to v0.11.1 (#23178) by @lystopad — CVE-2026-57497: memory exhaustion from unbounded buffering of unknown capsules. Not reachable in Erigon: no WebTransport libp2p transport is registered.
• build: bump github.com/go-chi/chi/v5 to v5.3.1 (#23178) by @lystopad — CVE-2025-69725 (open redirect in RedirectSlashes) plus three middleware.RealIP IP-spoofing advisories. Not reachable in Erigon: none of chi's middleware is used.

Full Changelog: v3.5.4...v3.5.5

Erigon v3.5.4 — Tidal Tails

v3.5.4 is a bugfix release recommended for all users, and especially for operators running the RPC daemon with response compression enabled — archive nodes and high-traffic RPC endpoints — where a native-memory leak in the gzip path could grow by ~9-15 GiB/day (#22700). It is a drop-in upgrade from 3.5.3 — no re-sync required.

Bugfixes

• node: fix a native (C-allocated) memory leak in the RPC gzip path (#22700) by @AskAlexSharov — the libdeflate.Compressor was pooled in a sync.Pool whose GC-evicted entries never had Close() called, leaking the C context (~9-15 GiB/day on an archive node). Replaced with a bounded channel pool that closes compressors on overflow. Fixes #22672.
• cmd: expand a leading ~/ (or ~\ on Windows) and $VAR in --datadir for the cobra-based binaries (#22785) by @lystopad — rpcdaemon and the other cobra commands previously used the raw path, so a tilde/env-prefixed --datadir was not resolved the way the main erigon binary resolves it. Fixes #14629.

Improvements

• build: update google.golang.org/grpc to v1.82.1 (#22690) by @AskAlexSharov — brings release/3.5 in line with release/3.6 and main.

Full Changelog: v3.5.3...v3.5.4

Erigon v3.5.3 — Tidal Tails

v3.5.3 is a bugfix release recommended for all users. It is a drop-in upgrade from 3.5.2 — no re-sync required.

Bugfixes

• execution/stagedsync: restore log/receipt notifications for mid-block resumed blocks (#22648) by @lupin012 — backports the notification-completeness half of #22235. After the earlier ReceiptDomain fix, both executors still gated RecentReceipts.Add on a stale isPartial/startTxIndex==0 flag, so a block resumed mid-block never emitted a correct receipt/log notification over
  eth_subscribe("logs"/"newReceipts"). Both executors now reconstruct the resumed block's prefix receipts and gate on a receiptsComplete field.
• rpc: return a JSON-RPC error instead of panicking on a null transaction in the trace path (#22668) by @AskAlexSharov - trace_transaction / trace_filter could dereference a nil txn when TxnByIdxInBlock resolves a txIndex whose body hasn't materialized yet at the chain tip. Fixes #22643.
• rpc: fix the handleBatch deadlock (#22459) by @yperbasis — a filtered JSON-RPC batch could wedge on wg.Wait() and time the request out. Fixes #22424.
• types: reject legacy transactions wrapped in a typed (EIP-2718) envelope (#22525) by @taratorio.
• types: reject an empty-string element in RLP transaction-list decoding (#22524) by @taratorio.
• cl/phase1/stages: fix uint64 underflow in the "Downloading Execution History" progress log (#22462) by @lystopad — once the live EL head advanced past the frozen initial progress, the toprocess subtraction wrapped to ~2⁶⁴ and produced a garbage ETA. Fixes #22455.
• cl/phase1/stages: guard the "[Caplin] Forward Sync" progress log against slot under/overflow (#22465) by @lystopad — the same
  unguarded-subtraction / time.Duration-overflow pattern on the forward-sync line.

Improvements

• rpc: make the eth_getLogs per-position address/topic limit configurable via --rpc.logs.querylimit (#22477) by @lupin012 - replaces the hardcoded 1000-entry limit; default 1000 preserves current behaviour, 0 = unlimited.
• cl/phase1/stages: route the history-download and forward-sync progress ETAs through the shared, overflow-safe utils.ETA helper (#22493, #22512) by @lystopad.

Full Changelog: v3.5.2...v3.5.3

Erigon v3.5.2 — Tidal Tails

v3.5.2 is a bugfix release recommended for all users, and especially for anyone running 3.5.1 — it fixes a sync-halting trie-root regression introduced there (#22399). It is a drop-in upgrade from 3.5.1 — no re-sync required.

Bugfixes

• db/state: clear the StateCache on SharedDomains unwind below the reorg window (#22402) by @Sahil-4555 — after the v3.5.1 changeset-isolation backport, a block that failed execution within the reorg window did a disk-noop overlay unwind that left dirty, uncommitted writes in the state cache; on the next run execution read those stale values instead of the database, producing a deterministic trie-root mismatch that halted sync. Closes #22399.
• rpc, node: fix the nil-pointer panic in the gzip batch flush race (#22383) by @lupin012 — a gzipped JSON-RPC batch with two or more streamable methods invoked the shared gzip-streaming flush hook concurrently from per-call goroutines; gzipResponseWriter.Flush is not concurrency-safe, so the calls raced on the underlying gzip writer and could dereference a nil flate compressor, crashing the node. Closes #22334.

Full Changelog: v3.5.1...v3.5.2

Erigon v3.5.1 — Tidal Tails

v3.5.1 is a bugfix release recommended for all users. It is a drop-in upgrade from 3.5.0 — no re-sync required.

Bugfixes

• execution/stagedsync: fix parallel-execution commitment consistency at step boundaries (#22111, #22135, #22147, #22094) by @awskii, @sudeepdino008 — a block straddling a step boundary left that step's commitment inconsistent with the account/storage/code domains, so published snapshots could mis-serve state-read RPCs (eth_getProof, debug_executionWitness) and, on a later run, wedge the Execution stage in a zero-progress loop with nothing logged. Closes #21992, #22101.
• execution/stagedsync: fix log index reset and missing WebSocket notifications in parallel execution (#22155) by @Sahil-4555 — restores logs / newHeads subscription notifications and correct log indexing when executing in parallel.
• execution/stagedsync: fix pruning in stage_custom_trace (#22052) by @sudeepdino008 — regenerated domains were never pruned and accumulated unbounded in the DB. Closes #22013.
• cl/persistence: fix caplin historical state reconstruction loop at the Bellatrix transition (#22370) by @Sahil-4555 — a Caplin node could stop advancing at the Merge (Bellatrix) slot; pre-Merge blocks carry an all-zero execution payload header, and reconstruction now detects the zero block hash and skips the EL transaction lookup. Closes #22337.
• cl/phase1/forkchoice: replace latestMessagesStore interning with a flat per-validator slice (#22355) by @lystopad — the prune scan walked the whole message map on every update and stalled GetHead past the attestation deadline. Closes #22351.
• cl/antiquary: commit reconstructed state in bounded batches (#22348) by @awskii — committing up to 30 minutes of replayed beacon state in a single MDBX transaction could overflow libmdbx and crash on large (100+ GB) archive databases.
• cl: bound caplin archive blob-column backfill so it can't wedge on Fulu (#22318) by @awskii — prevents an archive node from getting stuck while backfilling blob (data-column) sidecars.
• cl, db/snapshotsync: caplin snapshot correctness — don't freeze empty block/state roots (#22323) and remove overlapping state snapshots on retire (#22317) by @awskii.
• cl: allow boundary attestations while head state lags (#22251) by @domiwei — fixes attestation validation at epoch boundaries when the wall-clock slot has advanced but the head state briefly lags behind.
• rpc/jsonrpc: gate debug_executionWitness on keys[] completeness and keep preimages for in-block-deleted accounts (#22320) by @awskii — avoids returning an incomplete witness.
• rpc: remove the state-history check from block-data-only endpoints (#22073) by @Sahil-4555 — endpoints that only need block data no longer error on nodes pruned below the requested block's state history.
• cmd/utils: allow snapshot reset on upgraded datadirs by restricting the table config (#22291) by @Sahil-4555 — snapshot reset failed to resolve the chain name on upgraded datadirs. Closes #22275.

Improvements

• execution: disable gzip compression for the Engine API (#22369) by @taratorio — removes compression overhead on engine_* responses, lowering engine_getPayload / getBlobs latency.
• p2p: re-resolve the STUN external IP at runtime (#22188) by @lystopad — with --nat=stun, a node whose public IP changes while running now re-resolves and re-advertises it instead of keeping the stale startup value.
• db/version: relax the minor-version check in Supports (#22205) by @sudeepdino008 — a newer, backward-readable minor version within a supported major is now accepted, so the binary won't refuse newer minor-versioned files.

Full Changelog: v3.5.0...v3.5.1

Erigon v3.5.0 — Tidal Tails

Erigon 3.5.0 is a major release headlined by parallel block execution becoming the default and initial support for Ethereum's upcoming Glamsterdam hardfork. It is a drop-in upgrade for 3.4.x users — no re-sync required; existing datadirs upgrade their prune configuration automatically (see Breaking Changes).

Key Features

• Parallel block execution, on by default. Erigon now executes EVM transactions across multiple cores by default, using the Block-STM (software transactional memory) design pioneered by Aptos: transactions run optimistically in parallel and are re-validated against a multi-version state, re-executing only on conflict (#21591 by @mh0lt, closes #17630). Revert to serial with EXEC3_PARALLEL=false or --exec.serial.
• Glamsterdam devnet support. Initial implementation of Ethereum's next hardfork: Block-Level Access Lists (EIP-7928), enshrined Proposer-Builder Separation / "Gloas" (EIP-7732) in Caplin, gas repricings (EIP-8037, EIP-7976, EIP-7981), larger contracts (EIP-7954), transfer logs (EIP-7708), and the eth/71 Block Access List wire protocol (EIP-8159). Devnet/testing only — not scheduled on mainnet or any public testnet.
• debug_executionWitness. Stateless execution-witness generation (EIP-7928/8025) with reth-compatible output, for zkEVM and stateless clients (#20205 by @antonis19, #21629 by @awskii).
• More aggressive history pruning by default. --prune.mode=full now follows the EIP-8252 reorg-retention window (~36 days / 262,144 blocks) — see Breaking Changes.
• GraphQL API revival. Broad resolver coverage restored — queries, logs, call, sendRawTransaction, estimateGas, gasPrice, storage, and EIP-4844 fields.

Breaking Changes

--prune.mode=full: EIP-8252 retention window replaces pre-merge history-expiry

Full mode now retains state and block data for the last 262,144 blocks (~36.4 days), matching EIP-8252's REORG_RETENTION_WINDOW (#21342). Previously full mode pruned only pre-merge block data (EIP-4444 history-expiry) and kept the last 100,000 blocks of state history.

What changed:

Migration: existing datadirs upgrade automatically and silently. To keep the old "retain all post-merge block data" behavior, set --prune.distance.blocks=18446744073709551615.

Note: physical deletion of frozen snapshot files is not implemented yet (see #21306), so existing on-disk historical blocks persist for now, though the new cutoff is already recorded at the config level.

In practice, this means only freshly synced full nodes will have a reduced disk footprint.

--prune.mode=blocks: state history retention bumped to 262,144 blocks

--prune.mode=blocks keeps the same shape as before (all block data retained), but its state history retention also bumps from 100,000 to 262,144 blocks. --prune.mode=minimal is unchanged — both block and state history retain the 100,000-block window, deliberately sub-EIP-8252 for disk-constrained operators. See #21342 for details.

Single p2p listener: --p2p.allowed-ports removed, all eth versions multiplex on --port

Erigon now opens a single TCP listener on --port (default 30303) carrying every configured eth protocol version, instead of one listener per protocol on 30303/30304/30305. This fixes a discovery-DHT race that left inbound peers stuck at a fraction of --maxpeers for multi-protocol deployments: per-protocol ENRs collided under one Node ID, so only one survived in the DHT and peers dialed the wrong listener (#21335).

What changed:

Migration:

• Remove --p2p.allowed-ports=... from CLI args / config files; it is no longer recognised.
• Firewall, Kubernetes Service, and monitoring rules that explicitly opened 30304/30305 can drop those entries — only --port is bound now.
• If you previously lowered --maxpeers because you knew the per-protocol multiplication inflated the real ceiling, raise it back to the target total (the cap is now what the flag says).
• First run after upgrade loses the warm peer cache in nodes/eth{68,69,…} — nothing on disk is deleted, the directories are simply no longer read; discovery rebuilds the peer set from bootnodes within a few minutes.

Standalone sentry binary (cmd/sentry) and --sentry.api.addr (remote sentry over gRPC) are unaffected — neither had the bug.

debug_trace* RPC: enableMemory / enableReturnData replace disableMemory / disableReturnData

Aligns Erigon with the execution-apis specification (ethereum/execution-apis#762) and Geth behavior.

What changed:

Both the key and its default changed: disable* → enable*, and memory and return data are now excluded unless explicitly enabled — matching the spec and Geth.

Migration: memory and return data are now excluded by default. To include them, add the new opt-in key (omit it to keep the default):

• Memory: { "enableMemory": true }
• Return data: { "enableReturnData": true }

Affected RPC methods: debug_traceTransaction, debug_traceBlockByHash, debug_traceBlockByNumber, debug_traceCall.

Clique PoA consensus engine removed

The legacy Clique proof-of-authority engine has been removed (#20532 by @yperbasis). --chain=dev now runs on an embedded proof-of-stake consensus instead of Clique (#20451 by @mh0lt), matching how all live networks operate post-Merge. Networks or tooling that still depended on Clique are no longer supported.

Silkworm integration removed

The optional Silkworm C++ execution-backend integration and its --silkworm.* flags have been removed (#19662 by @canepat). Erigon uses its native Go execution engine exclusively.

Glamsterdam (Devnet Support)

3.5.0 adds an initial implementation of Ethereum's next hardfork — Glamsterdam (consensus-layer "Gloas" + execution-layer "Amsterdam") — for devnet testing and validation. It is not scheduled on mainnet or any public testnet, and these code paths are inert on production networks until an activation time is configured.

• EIP-7928 — Block-Level Access Lists (BAL): records every account and storage slot a block touches, enabling deterministic parallel validation. Full builder, validator, and strict-validation support (#19627, #19656, #20602, #20776), plus the eth_getBlockAccessList RPC method (#19929) — by @mh0lt, @yperbasis, @Sahil-4555
• EIP-7732 — Enshrined Proposer-Builder Separation (ePBS / "Gloas"): implemented in Caplin — execution-payload envelope, PTC, and builder payments (#18956) — with follow-up audit and fork-choice fixes (#21248, #21228) — by @domiwei
• Gas repricings: EIP-8037 State Creation Gas Cost Increase (#19596), EIP-7976 calldata floor cost (#20613), EIP-7981 access-list cost (#20671) — by @taratorio
• EIP-7954 — Increase Maximum Contract Size (#19624) — by @yperbasis
• EIP-7843 — slot-number opcode (SLOTNUM), wired into Caplin block production and engine_forkchoiceUpdatedV4 (#20175) — by @yperbasis
• Networking: eth/71 Block Access List exchange (EIP-8159, #20793, #20794, #20795) — by @mh0lt

Added

RPC

• debug_executionWitness: generate stateless execution witnesses (EIP-7928/8025), with legacy and canonical output modes — the legacy format is reth-compatible — for zkEVM and stateless clients (#20205, #21371, #21518, #21629) — by @antonis19, @lupin012, @awskii
• eth_capabilities: report the set of supported RPC methods (#20951) — by @lupin012
• debug_setHead: rewind the chain head (#19577) — by @canepat
• GraphQL substantially revived — transaction, logs, call, sendRawTransaction, estimateGas, gasPrice, and storage resolvers, plus EIP-4844 fields (#20389, #20916, #21219, #21379, #21060) — by @lupin012
• testing_ namespace exposed via --http.api for engine/spec test harnesses (#20482) — by @lupin012
• eth_simulateV1: per-call gas and result limits (#20232) — by @Sahil-4555

CLI & Operations

• --exec.no-prune (disable all DB pruning), --exec.serial (force single-threaded execution), and --exec.* executor-tuning flags (#20915, #20853, #20797) — by @mh0lt
• seg du (snapshot disk-usage analysis, #20104) and seg rm-blocks (remove latest block snapshots, #20554) — by @awskii, @sudeepdino008

Changed

RPC

• WebSocket transport rewritten on coder/websocket, with overload protection, clean close frames, and bounded write timeouts (#20097, #20446, #20788, #20923) — by @lystopad, @lupin012, @Sahil-455...

Erigon v3.4.4 — Splashing Saga

v3.4.4 is a bugfix release recommended for all users.

Bugfixes

• execution/stagedsync: prune in-RAM overlay when execution unwind is a no-op (#21824, #21847) by @JkLondon — third fix for the post-reorg gas used mismatch.
• caplin: serialize uint64 beacon API fields as JSON strings (#21805) by @BitWonka - Per the beacon-APIs spec, Uint64/Gwei fields must be serialized as JSON strings. Several Caplin response types were emitting them as JSON numbers, breaking spec-compliant clients. Fixes #20562.

Full Changelog: v3.4.3...v3.4.4

Erigon v3.4.3 — Splashing Saga

v3.4.3 is a bugfix release recommended for all users.

Bugfixes

• db/state: prune TemporalMemBatch overlay entries past the unwind point (#21538) by @JkLondon — second
  fix for the post-reorg gas used mismatch / state-leak some users still hit on v3.4.2. After a tip reorg
  a stale read in the in-memory overlay could return a write made inside the unwound txNum range,
  flipping an SSTORE from cold to warm gas pricing. Complements the #21157 diffset fix shipped in v3.4.2.
• rpc: match Geth semantics in debug_getModifiedAccountsByHash / debug_getModifiedAccountsByNumber
  (#21507) by @lupin012 — corrects the block-range convention (exclusive start), now also reports contracts
  whose storage changed without an account change, and excludes touched-but-unchanged precompiles and
  self-destructed accounts.
• node/cli: register --rpc.logs.maxresults in DefaultFlags so it takes effect via the CLI (#21389) by
  @lupin012 — the limit was documented in 3.4.0 but never wired into the flag set, so setting it on the
  command line had no effect; it now applies.

Improvements

• execution/p2p, execution/engineapi: fail-fast engine_newPayload backward download when the gap exceeds
  the reorg limit (#21502) by @yperbasis — when a payload's parent is more than MaxReorgDepth blocks from
  the local head, the download short-circuits instead of fetching a header batch every slot, and logs the
  expected gap at INFO instead of WARN. The gap is still closed by the following fork-choice update.

Full Changelog: v3.4.2...v3.4.3

Erigon v3.4.2 — Splashing Saga

v3.4.2 is a bugfix release recommended for all users.

Bugfixes

• execution/stagedsync: find diffset by actually-executed hash on unwind (#21157) by @JkLondon — fixes a
  state-leak bug in unwindExec3 that surfaces as gas used mismatch / Cannot update chain head after
  a tip reorg whose unwound block deployed a contract via CREATE/CREATE2 to a counterfactual address
  (safe-wallets, EIP-1167 clone factories, ERC-4337 accounts, deterministic deployers). The unwind now
  walks every header at the height to find the diffset of the block actually executed, instead of
  assuming the (already-flipped) canonical hash matches.
• rawdb: ignore invalid receipt cache transaction indexes (#21262) by @Sahil-4555

Improvements

• db/state, ethconfig: bound domain merge; add --erigondb.domain.steps-in-frozen-file (#21148) by
  @wmitsuda

Full Changelog: v3.4.1...v3.4.2

Erigon v3.4.1 — Splashing Saga

Bugfixes:

• [r3.4] commitment: segfault fix - caused by branch slice returned by TrieContext.Branch by @awskii in #21044

Full Changelog: v3.4.0...v3.4.1