Overview
This is a security release and is recommended for all users.
- It updates the trusted certificates to mitigate the compromised eMudhra certificate authority. See the Cloudflare report.
- It adds options to limit the RPC methods and tracers that a node exposes.
- It fixes various other security issues.
Who should upgrade?
All node operators should upgrade to this release as soon as practical. Upgrading promptly is especially important for nodes that expose RPC publicly.
Node Configuration Changes
Nodes that expose RPC publicly should configure --rpc.disable-js-tracers. With this flag, debug_trace* requests can only use the native tracers (callTracer, prestateTracer, 4byteTracer, flatCallTracer, noopTracerNative).
--http.api and --ws.api now accept single methods (namespace:method) as well as whole namespaces. If you name a method of a namespace, the node rejects all other methods of that namespace. Operators running public-facing RPC nodes should take care not to expose sensitive operations, typically under the debug_ and admin_ namespaces.
Example configuration for a public RPC node (adjust based on your own setup):
--rpc.disable-js-tracers
--http.api "eth,net:version,debug:traceCall,debug:traceTransaction,debug:traceBlockByNumber,debug:traceBlockByHash,scroll:estimateL1DataFee,scroll:getL1MessageByIndex,scroll:getLatestRelayedQueueIndex"
If you expose WebSocket RPC, apply the same list to --ws.api.
Public RPC endpoints should also apply other restrictions, such as timeouts, rate limiting, and load balancing. This is especially important for the tracing APIs.
What's Changed
- Fix/delegated code failed witness missing by @georgehao in #1270
- feat: explicitly reject blob txs in txpool by @Thegaram in #1276
- fix(evm): load delegation code during balance check in CallCode by @Thegaram in #1277
- feat: add additional checks by @Thegaram in #1278
- fix(tracer): disable custom js via cli by @Thegaram in #1282
- feat(rpc): enable rpcs selectively by @Thegaram in #1283
- fix(tests): intermittent failure in TestPrioritizeOverflowTx by @Thegaram in #1285
- feat: bump go version and remove libzkp from prod builds by @Thegaram in #1286
- ci: optimize actions, build, dockerfile by @Thegaram in #1287
- feat: go 1.26.10 by @Thegaram in #1288
Full Changelog: scroll-v5.10.2...scroll-v5.10.11