PeggyJV/sommelier v10.0.2

Release 10.0.2

on GitHub

Consensus-breaking release. Requires a governance-approved upgrade at a
coordinated height. Stage this binary before the upgrade height.

Commit: 9788f65d3cb0fcd57d3c13e89e5653fb4292a490

This is the only build to use. v10.0.0 and v10.0.1 are withdrawn.
v10.0.1 halts the chain at the upgrade height; v10.0.0 additionally will not
start on Debian 11 or Ubuntu 20.04. Both are documented on their release
pages.

Verified against mainnet state

This build was exercised by replaying the upgrade on a single-node chain
initialised from a real mainnet export at height 27,355,689:

• upgrade applied at the planned height, chain continued producing blocks
• gravity migrated consensus version 6 to 7
• poa store added, authority set seeded with 4 validators, all confirmed
  bonded and unjailed from live state
• all 38 stranded axelarcork queue entries drained; both legacy queues and
  both per-validator counter prefixes empty afterwards
• cork_authority set in both cork and axelarcork
• the released artifact itself then ran on the upgraded state with 0 panics

What validators must do

1. Download and verify against SHA256SUMS-10.0.2.txt below.
2. Stage it with cosmovisor (or be ready to swap manually) before the upgrade height.
3. Confirm it starts on your host: sommelier version --long should report
   10.0.2 and commit 9788f65d. The binary is statically linked, so it has no
   glibc requirement.

Your cork-scheduling role is removed by this release. See item 2.

Changes

1. PoA power floor (x/poa)

New module guaranteeing an allowlisted authority validator set a minimum
fraction of consensus power. FloorFraction defaults to 0.670000000000000001
— just over 2/3, so the guarantee is a strict supermajority. Governance may
raise the floor but never lower it below that.

The upgrade seeds four authority validators: the existing Sommelier Foundation
validator plus three newly provisioned Foundation-operated nodes. While the
Foundation validator stays bonded its raw share already meets the floor, so the
multiplier is 1 and no power is redistributed. The boost engages only if it
drops out.

Slashing is boost-aware: caller-supplied boosted power is normalized back to raw
stake using the multiplier snapshot at the infraction height, never the live
allowlist. A missing snapshot at or after activation is treated as corruption and
the slash refused rather than applied at multiplier 1.

If the authority set becomes empty the chain enters safe mode, freezing the
value-bearing modules and the affected governance parameters. Recovery is by
unjailing or re-bonding an authority validator; there is deliberately no
governance escape hatch.

2. Cork authority replaces the validator supermajority

Breaking change for validators. The legacy path — validators individually
submitting corks, approved by a >67% power tally — is removed, not deprecated.
Validator cork submission stops functioning at the upgrade height.

It is replaced by a single governance-controlled cork_authority parameter in
x/cork and x/axelarcork, rotatable only by ParameterChangeProposal.

The managed-cellar allowlist is now re-checked at execution, not only at
scheduling, so removing a cellar cancels calls already queued against it.

3. Gravity Bridge security fix (GHSA-4vf2-m5pw-3r3r)

Bumps gravity-bridge to module/v6.1.0. Outgoing-transaction timeout cleanup no
longer reads a height that advances through MsgEthereumHeightVote consensus
independently of event attestation, which could cancel and re-queue transactions
already paid out on Ethereum.

Advisory: GHSA-4vf2-m5pw-3r3r

Reported by Dhruva (sdxdhruva).

Operational note: batch and contract-call timeout cleanup is paused from the
upgrade block until the first Ethereum event is attested afterward, then resumes
normally. This is deliberate and self-resolving.

Verifying

shasum -a 256 -c SHA256SUMS-10.0.2.txt
sommelier version --long   # version 10.0.2, commit 9788f65d...
file $(which sommelier)    # "statically linked"