Malicious behavior miner

.github/CODEOWNERS

@@ -19,7 +19,7 @@ eth/tracers/                    @s1na
 ethclient/                      @fjl
 ethdb/                          @rjl493456442
 event/                          @fjl
-trie/                           @rjl493456442
+trie/                           @rjl493456442 @gballet
 triedb/                         @rjl493456442
 core/tracing/                   @s1na
 graphql/                        @s1na
@@ -29,5 +29,5 @@ miner/                          @MariusVanDerWijden @fjl @rjl493456442
 node/                           @fjl
 p2p/                            @fjl @zsfelfoldi
 rlp/                            @fjl
-params/                         @fjl @karalabe @gballet @rjl493456442 @zsfelfoldi
+params/                         @fjl @gballet @rjl493456442 @zsfelfoldi
 rpc/                            @fjl

.github/generate_change_log.sh

@@ -6,7 +6,9 @@ change_log_file="./CHANGELOG.md"
 version="## $@"
 version_prefix="## v"
 start=0
+in_meta=0
 CHANGE_LOG=""
+META_INFO=""
 while read line; do
     if [[ $line == *"$version"* ]]; then
         start=1
@@ -16,7 +18,18 @@ while read line; do
         break;
     fi
     if [ $start == 1 ]; then
-        CHANGE_LOG+="$line\n"
+        if [[ $line == "## MetaInfo"* ]]; then
+            in_meta=1
+            continue
+        fi
+        if [[ $line == "## "* ]] && [ $in_meta == 1 ]; then
+            in_meta=0
+        fi
+        if [ $in_meta == 1 ]; then
+            META_INFO+="$line\n"
+        else
+            CHANGE_LOG+="$line\n"
+        fi
     fi
 done < ${change_log_file}
 MAINNET_ZIP_SUM="$(checksum ./mainnet.zip)"
@@ -26,6 +39,8 @@ MAC_BIN_SUM="$(checksum ./macos/geth)"
 WINDOWS_BIN_SUM="$(checksum ./windows/geth.exe)"
 ARM64_BIN_SUM="$(checksum ./arm64/geth-linux-arm64)"
 OUTPUT=$(cat <<-END
+## MetaInfo\n
+${META_INFO}\n
 ## Changelog\n
 ${CHANGE_LOG}\n
 ## Assets\n
@@ -40,4 +55,4 @@ ${CHANGE_LOG}\n
 END
 )
 
-echo -e "${OUTPUT}"
+echo -e "${OUTPUT}"

.github/workflows/build-test.yml

@@ -15,19 +15,19 @@ jobs:
   unit-test:
     strategy:
       matrix:
-        go-version: [1.24.x]
+        go-version: [1.25.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
     - name: Install Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go-version }}
 
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         # In order:
         # * Module download cache

.github/workflows/commit-lint.yml

@@ -19,13 +19,13 @@ jobs:
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.npm

.github/workflows/docker-release.yml

@@ -19,6 +19,9 @@ jobs:
           - os: ubuntu-24.04-arm
             platform_pair: linux-arm64
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      packages: write
     steps:
 
       - name: Checkout
@@ -51,7 +54,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.PACKAGE_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
         id: build
@@ -76,6 +79,9 @@ jobs:
           retention-days: 1
   merge:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs:
       - build
     steps:
@@ -91,7 +97,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.PACKAGE_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

.github/workflows/evm-tests.yml

@@ -15,19 +15,19 @@ jobs:
   evm-test:
     strategy:
       matrix:
-        go-version: [1.24.x]
+        go-version: [1.25.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
     - name: Install Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go-version }}
 
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         # In order:
         # * Module download cache

.github/workflows/integration-test.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Truffle test
       run: |

.github/workflows/lint.yml

@@ -15,19 +15,19 @@ jobs:
   golang-lint:
     strategy:
       matrix:
-        go-version: [1.24.x]
+        go-version: [1.25.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
     - name: Install Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go-version }}
 
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         # In order:
         # * Module download cache

.github/workflows/nancy.yml

@@ -15,15 +15,15 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == github.repository
     strategy:
         matrix:
-          go-version: [1.24.x]
+          go-version: [1.25.x]
           os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out code into the Go module directory
       uses: actions/checkout@v4
 
     - name: Set up Go 1.x in order to write go.list file
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go-version }}
 

.github/workflows/pre-release.yml

@@ -15,19 +15,19 @@ jobs:
     name: Build Release
     strategy:
       matrix:
-        go-version: [1.24.x]
+        go-version: [1.25.x]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go-version }}
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           # In order:
           # * Module download cache
@@ -57,6 +57,11 @@ jobs:
           GIT_COMMIT_DATE=$(git log -n1 --pretty='format:%cd' --date=format:'%Y%m%d')
           GOOS=linux GOARCH=amd64 CGO_ENABLED=1 CC=$(pwd)/x86_64-linux-musl-cross/bin/x86_64-linux-musl-gcc go build -ldflags "-X main.gitCommit=$GIT_COMMIT -X main.gitDate=$GIT_COMMIT_DATE -extldflags=-static" -o ./build/bin/geth -a ./cmd/geth
 
+      - name: Temporary replace BLS for Windows
+        if: matrix.os == 'windows-latest'
+        shell: cmd
+        run: go mod edit -replace=github.com/herumi/bls-eth-go-binary=github.com/herumi/bls-eth-go-binary@v0.0.0-20210917013441-d37c07cfda4e && go mod tidy
+
       - name: Build Binary for ${{matrix.os}}
         if: matrix.os != 'ubuntu-latest'
         run: |
@@ -118,7 +123,7 @@ jobs:
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
 
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # ==============================
       #       Download artifacts
@@ -166,7 +171,7 @@ jobs:
           mv ./windows/geth.exe ./windows/geth_windows.exe
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
         with:

.github/workflows/release.yml

@@ -14,19 +14,19 @@ jobs:
     name: Build Release
     strategy:
       matrix:
-        go-version: [1.24.x]
+        go-version: [1.25.x]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go-version }}
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           # In order:
           # * Module download cache
@@ -56,6 +56,12 @@ jobs:
           GIT_COMMIT_DATE=$(git log -n1 --pretty='format:%cd' --date=format:'%Y%m%d')
           GOOS=linux GOARCH=amd64 CGO_ENABLED=1 CC=$(pwd)/x86_64-linux-musl-cross/bin/x86_64-linux-musl-gcc go build -ldflags "-X main.gitCommit=$GIT_COMMIT -X main.gitDate=$GIT_COMMIT_DATE -extldflags=-static" -o ./build/bin/geth -a ./cmd/geth
 
+      # ==============================
+      - name: Temporary replace BLS for Windows
+        if: matrix.os == 'windows-latest'
+        shell: cmd
+        run: go mod edit -replace=github.com/herumi/bls-eth-go-binary=github.com/herumi/bls-eth-go-binary@v0.0.0-20210917013441-d37c07cfda4e && go mod tidy
+
       - name: Build Binary for ${{matrix.os}}
         if: matrix.os != 'ubuntu-latest'
         run: |
@@ -117,7 +123,7 @@ jobs:
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
 
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # ==============================
       #       Download artifacts
@@ -173,7 +179,7 @@ jobs:
           mv ./windows/geth.exe ./windows/geth_windows.exe
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
         with:

.github/workflows/unit-test.yml

@@ -15,19 +15,19 @@ jobs:
   unit-test:
     strategy:
       matrix:
-        go-version: [1.24.x]
+        go-version: [1.25.x]
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
     - name: Install Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go-version }}
 
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         # In order:
         # * Module download cache

.github/workflows/validate_pr.yml

@@ -0,0 +1,23 @@
+name: PR Format Validation
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+jobs:
+  validate-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR Title Format
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prTitle = context.payload.pull_request.title;
+            const titleRegex = /^([\w\s,{}/.]+): .+/;
+
+            if (!titleRegex.test(prTitle)) {
+              core.setFailed(`PR title "${prTitle}" does not match required format: directory, ...: description`);
+              return;
+            }
+
+            console.log('✅ PR title format is valid');

.gitignore

@@ -60,4 +60,5 @@ cmd/ethkey/ethkey
 cmd/evm/evm
 cmd/geth/geth
 cmd/rlpdump/rlpdump
-cmd/workload/workload
+cmd/workload/workload
+cmd/keeper/keeper

.nancy-ignore

@@ -1,3 +1,4 @@
 CVE-2024-34478 # "CWE-754: Improper Check for Unusual or Exceptional Conditions." This vulnerability is BTC only, BSC does not have the issue.
 CVE-2021-43668 # "CWE-476: NULL Pointer Dereference", the repo: syndtr/goleveldb is not actively maintained, seems there is no fix for this crash yet, BSC used pebbleDB to replaced levelDB, so ignore this vulnerability.
 CVE-2025-47908 # "CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')", This vulnerability is only for RPC nodes which have specifically enabled malicous Cors options, which is unlikely to happen.
+CVE-2025-64702 # "CWE-770: Allocation of Resources Without Limits or Throttling". Attack vector is unreachable as QUIC/HTTP3 is not enabled in BSC's P2P configuration.