Skip to content

chore(deps): rebase forked cosmos-sdk onto v0.53.8 (base is v0.53.3, ~5 patch releases behind) #1671

Open @kAIPraxisBot opened 2026-08-28 20:22 UTC 0 comments Updated 2026-08-28 20:22 UTC

Summary

Our forked cosmos-sdk (github.com/gonka-ai/cosmos-sdk, currently v0.53.3-ps19-observability, referenced by both inference-chain and decentralized-api via go.mod replace) is based on upstream v0.53.3 (2025-07-08). The latest upstream release in the v0.53.x line is v0.53.8 (2026-07-27), which upstream marks state-breaking and describes as containing "important security fixes" with a recommendation to upgrade via a coordinated upgrade. We are ~5 patch releases / ~13 months behind.

Current state

  • Fork base: v0.53.3 → v0.53.3-ps19-observability
  • cosmossdk.io/store: base v1.1.2 → v1.1.2-ps1
  • Latest upstream v0.53.x: v0.53.8
  • Intermediate releases we skipped: v0.53.4 (2025-07-25), v0.53.5 (2025-12-12), v0.53.6 (2026-02-10), v0.53.7 (2026-04-14)

Why upgrade — what landed in v0.53.4 → v0.53.8

Everything through the last formal advisory is already in our v0.53.3 base — ISA-2025-005 (GHSA-p22h-3m2v-cmgh, distribution integer-overflow chain-halt) was fixed in v0.53.3. The gap is the post-v0.53.3 patch releases, whose fixes touch modules we run:

  • auth — nil-pointer panic guards in GetSigningTxData (including multisig with nil Multi/BitArray); reject transactions carrying extra SignerInfos in SetPubKeyDecorator
  • crypto — validate the secp256k1 pubkey SEC1 tag byte
  • tx / signing — bound multisig signature & pubkey indexing by slice length; reject transactions with mismatched signer-info / signature counts; bound compact-bit-array index by element length
  • staking — handle redelegation when the unbonded source has been removed
  • distribution — strict + fallback behavior when withdrawing delegator rewards
  • store — isolate the traceContext map across branched stores

Several of these are panic / availability-class (a malformed transaction reaching a nil-pointer path can halt a node) and signature-validation hardening. There is no known exploitation of our deployment, but running ~13 months behind on a security-patched consensus dependency is a standing risk we should close proactively.

Proposed action

  • Rebase our psNN patch set onto upstream v0.53.8 (or cherry-pick the v0.53.4–v0.53.8 fixes if a full rebase is disruptive)
  • Apply the same review to the cosmossdk.io/store fork (v1.1.2-ps1 → latest v1.1.x)
  • Re-run the fork test suite and prepare a coordinated (state-breaking) upgrade plan
  • Add a lightweight process to watch upstream cosmos-sdk patch releases so the fork does not drift again

References

  • Upstream v0.53.8 release: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.53.8
  • Upstream v0.53.x releases: https://github.com/cosmos/cosmos-sdk/releases
  • Cosmos SDK security advisories: https://github.com/cosmos/cosmos-sdk/security/advisories

🔄 Auto-synced from Issue #1671 every hour.