Rusty Kaspa v2.1.0 — Chunked IBD and Hardened Wire Limits

Rusty Kaspa v2.1.0 is out — a combined feature, security and maintenance release tagged on 22 September by someone235, with GitHub showing nine commits to master since the tag. The headline item is P2P Protocol Version 11 with chunked Initial Block Download, but the release also lowers wire message limits, tightens pruning proof validation, hardens the Stratum bridge used by miners, and extracts the ZK script tooling into a standalone crate. Below is what actually changed in the release, and what it means depending on whether you run a node, point hashrate at a pool, or build on Toccata covenants.

What Changed in One Pass

• P2P Protocol 11: large IBD payloads streamed in 20 MiB chunks, still compatible with Protocol 10 peers.
• Wire limits: P2P_MAX_MESSAGE_SIZE cut from 1 GB to 256 MB, a 2 MB wire cap on blocks, pre-validation size checks on transaction and block messages, immediate rejection of banned inbound peers.
• Consensus pruning bounds: MAX_UNCOMPRESSED_PARENTS at 255 * 2048, and non-genesis parentless headers in pruning proofs now fail with PruningImportError::NonGenesisParentlessHeader.
• Post-Toccata streamlining: activation branches collapsed into unconditional logic, BLOCK_VERSION unified at 2, script units replace legacy sigops accounting.
• Stratum bridge: path-traversal fix, CLOSE_WAIT leak fix, bounded Prometheus cardinality.
• ZK SDK: kaspa-txscript-zk-sdk as a standalone crate.
• Arithmetic safety: clippy::arithmetic_side_effects enforced across production crates under a formal policy in docs/ARITH-SAFETY.md.
• Mempool: coinbase transactions explicitly rejected with RuleError::RejectCoinbase.

Chunked IBD: Sync Without the Framing Bottleneck

Until now, large Initial Block Download payloads — pruning point proofs, header batches, trusted data — had to travel as single messages. That is exactly the kind of traffic that trips message-framing limits and transfer timeouts on slower links or weaker hardware. Protocol Version 11 splits those payloads into 20 MiB chunks: pruning point proofs arrive via PruningPointProofChunkMessage and are terminated by PruningPointProofChunksEndMessage, headers are chunked during sync, and trusted data uses TrustedDataChunkMessage / TrustedDataChunksEndMessage.

Two guardrails matter as much as the chunking itself: an overall 1 GiB safety limit on the transfer, and total transfer timeouts with progress logging, so a stalled peer is visible rather than silent. Crucially, Protocol 11 negotiates down to Protocol 10 with older peers — there is no big-bang upgrade deadline described in the notes.

For node operators, the practical effect is on the part of node ownership people dislike most: the initial sync and the resync. If you run infrastructure — a personal node, a mining node, or a backend node your tooling talks to — the sync path is what determines whether a fresh machine is usable today or next week.

Wire Limits and Consensus Tightening

The second theme is refusing oversized or malformed data earlier. P2P_MAX_MESSAGE_SIZE drops from 1 GB to 256 MB in the connection handler. Transaction and block messages get pre-validation size limits, with the wire block capped at 2 MB. Banned inbound connections are now rejected during initial connection setup rather than after work is done, and relay blocks that trigger IBD are verified not to be processed as trusted data.

Parent handling is bounded too: cumulative uncompressed parent counts across all levels in CompressedParents are capped at MAX_UNCOMPRESSED_PARENTS = 255 * 2048, with CompressedParentsError::SizeExceeded returned on malformed headers. Pruning proof validation now strictly enforces that proof headers without parents must be genesis. Both changes target hashing DoS vectors — work the node should never have been asked to do.

Post-Toccata: The Activation Branches Are Gone

A cluster of PRs (#1082–#1101) collapsed the activation branches into unconditional post-Toccata logic across consensus, mempool and P2P layers. BLOCK_VERSION is consolidated to 2 — TOCCATA_BLOCK_VERSION and the transitional parameters are removed. Legacy sigops accounting is replaced with script units, which makes covenant script verification unconditional, and PSKT extraction is bounded by input committed script units. Toccata was also activated on devnet and the DAG fixtures refreshed.

Read plainly: the codebase is past the transition. Covenants are no longer a flag-dependent path sitting next to legacy logic; they are the normal execution path. That is good news for anyone building on covenants — less conditional code means fewer edges where the old and new worlds disagree — but it also means tools that assumed transitional parameters need to catch up.

Stratum: Fixes Miners Actually Feel

Pools and solo miners running the Stratum bridge get three concrete fixes. First, a path-traversal vulnerability in the web dashboard's static asset serving: non-normal path components are rejected and canonicalized paths are asserted to stay inside the static root directory. Second, CLOSE_WAIT socket leaks — incoming HTTP requests now run in dedicated worker tasks with a 10-second read timeout and explicit Connection: close headers, so long-running bridges stop accumulating half-closed sockets. Third, Prometheus cardinality on /metrics is bounded by stripping ephemeral ports from client IPs, unifying worker/miner labels, and adding a 512-block eviction ring for the mined blocks gauge.

If you have ever watched a monitoring endpoint grow until scraping it becomes expensive, or a bridge slowly exhaust its file descriptors over days of uptime, these are the unglamorous fixes that keep infrastructure boring.

For Builders: A Standalone ZK SDK and Arithmetic Discipline

kaspa-txscript-zk-sdk is now its own crate, holding the RISC Zero Groth16 and STARK proof script-generation logic. It adds Groth16 verifier generation with static or dynamic image IDs (append_r0_groth16_verifier, append_r0_groth16_verifier_with_image_id), bounds Poseidon2 control inclusion proofs against oversized verification work, pins risc0-zkvm-platform, and resolves Windows link issues via risc0-export-syscall.

Separately, the workspace-wide arithmetic overflow audit enforced clippy::arithmetic_side_effects across production crates under a formal policy written up in docs/ARITH-SAFETY.md — hardening counters, retry loops and arithmetic operations throughout the node. Other library fixes: safe Borsh address decoding that no longer panics on invalid payload lengths, corrected output count reporting in txscript errors, and constant-time private key equality in kaspa-bip32.

That last one is worth pausing on. Constant-time comparison of private keys is exactly the kind of detail that separates libraries you can build custody on from libraries you cannot. If your stack compares secrets with a plain equality check, timing side channels are a real, if narrow, attack surface.

Mempool: Coinbase Transactions Are Not Welcome

#1137 makes the mempool explicitly reject submitted coinbase transactions with RuleError::RejectCoinbase, even when non-standard transactions are enabled. It is a small, sharp rule: coinbase outputs are created by miners in blocks, not posted to the mempool like ordinary transactions.

Who Should Upgrade, and Who Can Watch

Operators doing fresh syncs or running anything behind the Stratum bridge get the most immediate value. Builders working with covenants or ZK proof scripts should read the post-Toccata consolidation and the new crate split before assuming old helpers still apply. Everyone else can treat this as the release that finished the Toccata transition in the code — Protocol 11 negotiates down cleanly, so there is no cliff described in the notes.

At Kaspa Forge we care about a specific slice of this: the covenant execution path becoming unconditional, and node software that enforces tight, auditable limits. That is the substrate our contracts run on — you can read more about the design in the Kaspa Forge architecture docs. The node does the consensus; the contract keeps the rules.

What to Check Before You Upgrade

• Read the detailed PR list in the release notes, especially #1136, #1138 and #1137.
• If you run the Stratum bridge web dashboard, verify your deployment picked up the static-asset path fix.
• If you monitor bridges with Prometheus, expect label changes on /metrics.
• If you depend on transitional parameters or TOCCATA_BLOCK_VERSION in tooling, migrate to BLOCK_VERSION 2.