Shardeum resumes after upgrade absorbs critical Cosmos EVM fix

Shardeum said its mainnet resumed block production on October 13 after a coordinated upgrade moved the network to Shardeum v1.1.0 and Cosmos EVM v0.6.3. The change matters beyond routine maintenance because the upstream software version contains a publicly disclosed critical fix for a state-commit flaw that could, under specified conditions, create native balance without a matching debit.

The network’s completion notice identifies block height 7,927,860 as the upgrade point and describes the event as Shardeum’s first mainnet upgrade approved through onchain governance. It says consensus resumed once enough validator voting power had switched to the new software.

A security fix reaches the full stack

Cosmos EVM maintainers disclosed the underlying vulnerability on September 3. Their advisory says versions from v0.6.0 up to, but not including, v0.6.3 were affected. In the described attack path, a failed cross-chain token refund could leave an attacker credit committed even though the corresponding debit was never written. The patch stages the writes in a temporary context and publishes them only if the entire operation succeeds.

The advisory labels the issue critical, says there was no workaround and identifies v0.6.3 and v0.7.3 as patched releases. Those statements describe the upstream Cosmos EVM package. They do not establish that the flaw was exploited on Shardeum, or that every prerequisite for the published attack path was available on Shardeum before Tuesday’s upgrade.

Shardeum’s signed v1.1.0 release, published October 1, says the chain’s code was resynchronized with Cosmos EVM v0.6.3. It also says the complete upstream security series now supersedes the narrower patch already shipped in Shardeum v1.0.2. That distinction is important: the October 13 event completed a broader state migration and dependency update; it was not the first time Shardeum carried protection for every issue named in the release notes.

The upgrade was deliberately incompatible

The release warns that v1.1.0 required a coordinated onchain upgrade and was not backward-compatible. Nodes running mismatched versions could crash, which explains why the network halted at a predetermined height rather than allowing old and new rules to operate together.

One compatibility break is narrower than the warning may suggest. Cosmos-native transactions that still attach the former dynamic-fee extension type will be rejected from the upgrade height. The release says Ethereum-format transactions are unaffected, as are common JSON-RPC paths used by MetaMask, ethers, viem and Hardhat. Developers using the affected Cosmos-native extension need to adopt the new type identifier or omit the extension under the release’s documented behavior.

What is verified — and what is not

Shardeum’s notice says the network resumed at about 06:40 UTC on October 13 after approximately 25 minutes of planned interruption. Those are operator-reported figures for the upgrade window, not an independently measured availability study. The notice does not provide validator participation data, transaction-success rates, application-level latency or a venue-by-venue record of when SHM deposits and withdrawals resumed.

The project told exchanges and infrastructure providers to verify that their own nodes were upgraded, synchronized and passing operational checks before reopening dependent services. That means a functioning base chain did not automatically prove every wallet, bridge, indexer, custodian or exchange was ready at the same moment.

The primary records establish that the coordinated upgrade was released, activated at the named height and reported complete on October 13. They also establish the software scope and the upstream vulnerability fixed in v0.6.3. They do not prove improved throughput, greater decentralization, an absence of all post-upgrade defects or any market effect.