EOSIO 1.0.7 Release Notes

The release of v1.0.7 provides non-critical security updates.

Description of the Issues

This release addresses these issues:

System Contract Updates

• Round up fee on RAM sales to ensure a non-zero fee is always paid (#4293)
• Prevent name bids on invalid account names or on account names that do not require bids (#4294)
• Transfers are not allowed when self-delegating; fix bug where tokens could be pulled from the receivers unstaking balance (#4295)

Nodeos Updates

• Added additional calls to msync to better guarantee consistency on successful shutdown of nodeos, should address some cases where the chain log was left in a "dirty" state after shutting nodeos down in Docker (#4316)
• Allow abi_serializer max_serialization_time to be configurable, add option --abi-serializer-max-time-ms (#4339)
• Add additional validation to abi_serializer unpacking of arrays (#4339)
• Check that fetch_block_by_id() returned something valid before dereferencing (#4339)
• Added stricter local set size for functions (#4339)

Cleos Updates

• Add R1 public key option for cleos set account permission (#4242)

Mitigations

• None