release-453

[UnArbosFive]

Motivation

Release 453 collects runtime hardening fixes for randomness verification, nested proxy authorization, deferred subnet registration, protected coldkey transfers, and beta basket escrow custody.

Changes

• Bind drand Quicknet randomness to SHA-256(signature) before accepting a pulse.
• Preserve inherited origin filters across nested direct and announced proxy calls.
• Reserve queued subnet-registration hotkeys for the paying coldkey and consume registration pricing/rate-limit state when the request is queued.
• Avoid updating registration pricing a second time when a queued registration is finalized.
• Reject stake transfers into the protocol-owned beta basket escrow account.
• Apply the coldkey-swap dispatch guard to the true EVM caller in the balance-transfer precompile.
• Bump the runtime spec_version from 452 to 453.

Files of interest

• pallets/drand/src/verifier.rs
• pallets/proxy/src/lib.rs
• pallets/subtensor/src/subnets/subnet.rs
• pallets/subtensor/src/staking/stake_utils.rs
• precompiles/src/balance_transfer.rs
• runtime/src/lib.rs

Behavioral impact

Invalid drand responses with signature-independent randomness are rejected. Nested proxies cannot gain permissions excluded by an outer proxy. Deferred subnet registrations reserve their hotkeys and affect registration timing/pricing immediately. User stake cannot be transferred into basket escrow without corresponding shares. EVM balance transfers initiated by a coldkey undergoing a protected swap are blocked consistently with native dispatches.

Migration and runtime version

No storage migration is required. This release bumps spec_version to 453.

Validation

Targeted regression tests cover altered drand randomness, nested direct and announced proxies, queued-registration ownership and rate limiting, beta escrow stake-transfer rejection, and precompile guard behavior. Full compilation and test execution are left to CI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
subtensor	Building	Preview	Sep 3, 2026 3:47pm UTC

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: SAFE

VERY HIGH account-age/repository scrutiny, mitigated by admin permission and substantial merged subtensor history; no Gittensor association found. Branch: release-453 → main.

Findings

No findings.

Conclusion

Static review found no malicious behavior or security vulnerability. The changes close randomness binding, nested-proxy authorization, escrow custody, registration, and precompile guard gaps with a matching runtime version bump.

---

🔍 AI Review — Auditor (domain review)

VERDICT: 👍

LIKELY Gittensor-associated; established repository administrator with substantial prior subtensor contributions. No semantic duplicate identified among file-overlapping PRs.

PR body was empty/trivial; the Auditor has auto-filled it. Please review.

The release combines four focused runtime hardening fixes: drand randomness binding, nested proxy-filter preservation, queued subnet-registration correctness, and coldkey-swap enforcement for balance-transfer precompiles. The implementation is consistent with its tests and includes the runtime version bump to 453.

Static review found no actionable correctness issues. No build or test was run because no finding required runtime confirmation. git diff --check passed and the worktree remained clean.

Findings

No findings.

Conclusion

The changes address concrete runtime invariants with targeted regression coverage and no identified domain-level blockers.

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍