envadiv/Passage3D v4.1.0

Passage v4.1.0

on GitHub

Software upgrade for passage-2, plan v4.1.0. Install it only at the upgrade height set by the governance proposal; until then passage-2 runs v4.0.3. Validator instructions: docs/v4.1.0-upgrade/VALIDATORS.md (#218).

Contents

• CosmWasm security update:
  • wasmd v0.50.0 → v0.54.10 and wasmvm v1.5.0 → v2.2.9, which patch CWA-2026-006 (a Wasmer Singlepass sandbox escape) and CWA-2026-005.
  • Cosmos SDK v0.50.15 and ibc-go v8.8.0, as wasmd requires. The upgrade migrates the ibc module from 5 to 6.
• Fixes since v4.0.0 (#217):
  • Ledger and Amino-signed CosmWasm transactions are accepted again.
  • MsgClaim is accepted again.
  • The legacy governance router is restored.
  • The upgrade handler repairs duplicate account numbers. On passage-2 six accounts share account number 0 with its owner: the claim module account and five periodic vesting accounts. They get new account numbers; signatures made for them before the upgrade must be made again.
  • wasm gas register and blocked-multisig ante fixes.
• passage in-place-testnet (#219), the rehearsal tooling. It does not change consensus.
• Commit e5cb0c5, the same as v4.1.0-rc1. Go 1.25.14. The release was built from a clean checkout; each *.provenance.txt records it.

Rehearsal

v4.1.0-rc1, built from this commit, was rehearsed on a copy of passage-2 state at height 21712866 (33 codes, 79 contracts). Every check passes: the handler runs, code and contract state are unchanged, the ibc module migrates, the duplicate account numbers are repaired, transactions and contract queries work, and the node restarts. Report: docs/v4.1.0-upgrade/REHEARSAL.md (#218). Full output: rehearsal-v4.1.0-passage-2.tar.gz on the v4.1.0-rc1 release.

Assets

Per architecture there is a binary, the libwasmvm library it loads, and a bundle with both. Keep the binary and libwasmvm.<arch>.so in the same directory, because the binary loads it via rpath $ORIGIN. It needs glibc 2.35 or newer.

SHA256SUMS.txt:

cad371406cac00cfe6ef99400d8c179f1812743a90fd2ce52db0987fff213885  passage-4.1.0-linux-amd64
bfd7157b96028037eb1bdf82b2b7cbf4ebd38a5ab6b1336f0d35c73cf569c783  libwasmvm.x86_64.so
191c09c11daea1b6ef54d7b01f58d14d6a222595c426d12af23d8abf174a23a2  passage-4.1.0-linux-arm64
248f92469e65eb0d334247287c5d68035873e4c89fb30fe49fe006c3bf4c97b6  libwasmvm.aarch64.so

Bundles (these checksums go in the proposal info):

ba910ea6ce8e9ee9658ec4196a27f42452d671c67e1bdbe7a9c3850cddee0386  passage-4.1.0-linux-amd64.tar.gz
4a80b24ffdcac454f9e2ab185b04040ba4f6a21a77623a3af743f01e292f230b  passage-4.1.0-linux-arm64.tar.gz

Check: ./passage-4.1.0-linux-amd64 version prints v4.1.0, and query wasm libwasmvm-version prints 2.2.9.