Midnight Share Security Fix wey dey inside Ledger 9.1.0.1

Midnight don publish di source code and release notes for Ledger 9.1.0.1, di version wey dem activate for mainnet during di November 6 network upgrade. Di release list 13 fixes, including changes to how dem dey calculate transaction fee, block limits, and how wallets dey display coins.

According to di release notes, node operators receive di software on November 3. Dem publish di source code and descriptions of di fixes on November 7. Di update still dey reject some transactions wey earlier Ledger 9 builds accept before.

Changes to Transaction Fees and Block Limits

Di ledger na di part of Midnight software wey dey determine whether transactions valid and how much dem go cost. Midnight move go Ledger 9 without di usual advance period for di Preprod test network. Di project explain say dem dey use more controlled release process when security fixes require am.

One issue affect how nodes dey process repeated entries inside shared data structures. According to di release notes, small transaction fit force node to do work wey dey increase exponentially before e go check im fee. Di updated ledger dey reject repeated entries before e calculate di fee and e dey process di data for time wey match di size of di data.

Two other fixes address block limits. Before, transaction fit declare deletions wey e no perform, wey go reduce fees for other parts of di transaction and bypass di limit on net bytes written. Another separate calculation issue allow declared computation time of at least 2⁶³ picoseconds to dey charged as zero. Both types of transaction now dey rejected as invalid.

DUST, Wallets, and the Cardano Bridge

Midnight transaction fees dey paid with DUST, resource wey dey generate from NIGHT holdings. Di release notes describe one issue wey fit make smart contract capture excess fee resource wey dem credit during registration while di registrant still receive di full amount. Contract calls wey dey transfer di fee resource as public input or output now dey rejected.

Another fix concern how wallets dey replay events from di chain. Valid output fit contain encrypted record wey no match im cryptographic commitment. Dis fit cause wallet to display coins wey e no fit spend or overwrite di position of coin wey e already hold. Di release notes talk say di on-chain state no dey affected.

Di update still clear sensitive data wey dem derive from wallet seeds from memory more thoroughly. Some of di fixes wey dem list relate to audit findings, and di release notes point to nine GitHub security advisories wey their pages no dey publicly available on di morning of November 8.

Separate fix apply to di protocol bridge wey dem intend to transfer tokens from Cardano to Midnight. Zero-value claims before fit pass validation without paying fee. Now, claims must meet di required minimum or cover di entire remaining balance. Di bridge dey present inside di Ledger 9 code but e still disable for mainnet until separate governance action enable am.

[NEWSBREAK]

Developer Packages and Remaining Issues

Di release include @midnight-ntwrk/ledger-v9 1.0.1, onchain-runtime-v4 4.0.1, and Proof Server 9.0.1. Proof server na di one wey dey generate di zero-knowledge proofs wey dem dey use for transactions. Midnight mainnet upgrade documentation separately list Proof Server 9.0.0 among di compatible components.

Ledger 9.1.0.1 dey reject transactions wey get duplicate committee signatures or duplicate fee registrations. Contract no suppose contain more than 256 operations, each deployment go pay for im full state, and declared gas must remain inside di block limit.

Several Rust cost calculation functions now dey return error instead of value. Developers wey dey calculate fees directly must account for dat change for their integrations.

Two known issues from version 9.1.0.0 still dey open. One fit cause contract call to dey rejected when dem pay im fee with exactly one DUST spend. Midnight documentation identify say to use two or more DUST spends as workaround while dem plan fix for later release.