Fedimint 0.11.2

Fedimint v0.11.2 is a maintenance release for the 0.11 line, collecting a range of security fixes across the server, the Lightning modules, and the gateway.

No federation was affected and no funds were lost. The fixes close a path by which a gateway could have lost funds to a malicious counterparty, and harden guardians and gateways against malformed requests that could take them offline. In both cases the protection comes from guardians running the new rules, so upgrading your guardian is the step that matters.

We contacted every federation we know of and all of them have upgraded. If we have not spoken to you, please upgrade now rather than waiting for your next maintenance window.

In more detail: request paths that could previously abort a process now return errors instead, Lightning contracts are bound more strictly to the offers they belong to and can only be funded once, and the on-chain wallet validates peg-ins and peg-out fee rates more conservatively.

The release is backwards compatible across 0.8 through 0.11 and guardians can upgrade one at a time; a few of the stricter consensus rules activate automatically once enough guardians have upgraded.

Upgrading

• Containers: fedimint/fedimintd:v0.11.2 and fedimint/gatewayd:v0.11.2 (amd64 and arm64)
• StartOS: the fedimint-guardian 0.11.2 packages are attached below
• Binaries, .deb and .rpm packages are attached below; crates are on crates.io

The same fixes are available for the 0.10 line in v0.10.1.