Code Browser

libs/json: accept surrounding JSON whitespace consistently

libs/json: maps with defined string keys cannot round-trip

state/txindex/kv: Prune leaves ~8% of event keys behind (event sequence compared as a string)

state/txindex/kv: Prune leaks a DB iterator per indexed event attribute and never flushes its batch (node OOM)

state/txindex: avoid repeated result decoding for matching events

Reuse transaction proofs within a tx_search result page

consensus/replay: evidence is included again after recovery and triggers a persistent_kvstore panic

example/kvstore: duplicate validator updates for one validator halt consensus and fail replay

Reduce repeated validator scans when checking voting-power updates

pubsub: subscription canceled with ErrOutOfCapacity stays registered, so the client can't resubscribe

New project LIGHTING

p2p: PeerSet.Remove evicts the connected peer when a duplicate connection is stopped, causing a reconnection storm

Consensus Halt via Unbounded `Block.MaxBytes`

Remote signer can panic on missing vote or proposal payloads

privval: static identity key for CometBFT side of the connection

FilePV HRS state can roll back after atomic rename, allowing conflicting validator signatures

Committed evidence can be accepted again after restart if the committed marker write fails

rpc/client/http: unbuffered subscription can stall WebSocket event dispatch

config.toml: bootstrap_peers rendered onto its comment line (trim-marker collapses newline)

Offering a free security review — no strings attached

Evidence `Hash` is 1byte off

Local 4-node testnet fails to peer on macOS 26.4.1 — `chacha20poly1305: message authentication failed`

PoI (Proof-of-Information Consensus)

Bug: idFromInterface overflows int on large JSON-RPC numeric ids

Malicious Peer Can Disrupt Blocksync Synchronization

post-quantum or hybrid signature scheme support

Bug: fatal: make_cache_entry failed for path '.github/workflows/e2e-nightly-38x.yml '

PebbleDB v1.1.5 has 32-bit limitations. PebbleDB v2+ does not

Free Web3 Security Review for Your Repository

Expose WebSocket connection lifecycle events (disconnect/reconnect) in the Go RPC client for reliable event subscriptions