Four fixes this week that node and wallet operators should act on
Serguey Asael Shinder2 min readMost crypto security news is about money stolen. This week's more useful list is the fixes that only help if someone upgrades. Four of them, in order of how much damage waiting can do.
xrpl.js 4.x: wallets from bad entropy. On the older 4.x line of the XRP Ledger's JavaScript library, Wallet.fromEntropy turned a string into a wallet derived from 16 zero bytes without complaint, and generateSeed silently truncated long input. The fix has been backported, but the 4.x line, 59% of weekly downloads, has no release with it yet. Who acts: anyone generating wallets from entropy in JavaScript should check what they pass in, today, and upgrade when the release lands. Source: https://github.com/XRPLF/xrpl.js/pull/3487
Eclair: channel opens that crash the node. Two bugs disclosed on 1 October let any peer exhaust a node's memory through the channel-opening flow, one of them persistently, so the node crashed again on every restart. Both are fixed in v0.14.1, out since July. Who acts: Eclair operators still on 0.14.0 or earlier. Source: https://delvingbitcoin.org/t/disclosure-dos-vulnerabilities-fixed-in-eclair-v0-14-1/2928
Jito-Solana: failover that panics. Switching a validator's identity with set-identity during the block creation loop could leave it holding the wrong identity and stop the validator. The fix is merged to the 4.3 and 4.4 branches but was not in the 2 October release. Who acts: operators who use hot failover should take the next release. Source: https://github.com/jito-foundation/jito-solana/pull/1674
AvalancheGo 1.15.1: gas estimates too low. eth_estimateGas ignored the minimum gas the mempool demands for a transaction's size, so large transactions signed with the estimate were rejected. The release is optional. Who acts: operators of API nodes that wallets call for estimates. Source: https://github.com/ava-labs/avalanchego/releases/tag/v1.15.1
The common thread. In each case the code is already fixed and the risk sits in deployed versions. Two of the four were found or confirmed with automated tools, a fuzzer and an LLM-based harness in Eclair's case, which means the gap between a fix and a disclosure anyone can read is getting shorter. Upgrade windows that used to be comfortable no longer are.