Erigon v3.8.0 — Watery Whiskers

Erigon 3.8.0 is Glamsterdam-ready, with Glamsterdam on Hoodi, faster commitment and execution, and further RPC performance improvements. It also improves Caplin block production, recovery after restarts, and resilience under heavy RPC and peer traffic.

Highlights

• Glamsterdam-ready. Erigon and Caplin support Amsterdam and Gloas, including block access lists (EIP-7928) and enshrined proposer-builder separation (EIP-7732). Caplin follows consensus-specs v1.7.0-beta.4 for the Hoodi upgrade (#24831) — by @domiwei, @taratorio, @yperbasis
• Glamsterdam on Hoodi. Upgrade Hoodi nodes before 26 October 2026, 17:42:48 UTC. Amsterdam in the execution layer and Gloas in Caplin activate at epoch 132352, with a default gas-limit target of 200 million (#24847) — by @yperbasis
• Faster commitment and execution. Parallel commitment spreads deferred writes across workers and prepares trie updates alongside execution. Trie prefetching now also benefits blocks without block access lists. EVM improvements reduce computation and repeated storage-read costs (#23979, [#24252], [#24479], [#24517], [#22993]) — by @awskii, @AskAlexSharov
• Faster RPC with less memory overhead. Lower eth_getBalance tail latency under load, cheaper transaction-by-index queries, streamed trace output, and restored state caching for embedded RPC at the chain tip (#24795, [#24409], [#24239], [#24347], [#24497]) — by @AskAlexSharov

Breaking Changes

• Batched database syncing is now the default. This reduces disk-flush pauses. A power loss can roll back recent unflushed commits; set --db.safe.nosync=false for per-commit durability (#24249, [#24953]) — by @AskAlexSharov, @awskii
• Caplin QUIC port changes. The default moves from UDP 4001 in v3.7.1 to UDP 4002. Update firewall and container port mappings, or set --caplin.discovery.quicport explicitly (--sentinel.quic.port for standalone Caplin). New --caplin.quic.disable and --sentinel.quic.disable flags disable QUIC while keeping TCP; discovery still needs its UDP port (#24443) — by @lystopad
• Upgrade standalone rpcdaemon together with Erigon. The private ETHBACKEND API is now version 4.2 (#23777) — by @yperbasis
• No cleartext HTTP/2 on the RPC port. The plain HTTP RPC endpoint serves HTTP/1.1; HTTP/2 requires TLS (--https.enabled). Clients and proxies using HTTP/2 with prior knowledge or an h2c upstream must switch to HTTP/1.1 or HTTPS (#24111) — by @AskAlexSharov
• Nonstandard Engine API methods removed. The authenticated endpoint no longer exposes engine_start, engine_setConsuming, engine_setBeaconChainConfig, engine_handleNewPayload, engine_handleForkChoice, or engine_sSZRESTHandler. These methods now return -32601; integrations must use supported Engine API methods (#24163) — by @lupin012
• RPC access controls apply more widely. --rpc.accessList now covers WebSocket, IPC, and subscriptions; allow lists must name the required subscribe methods. WebSocket and IPC batches obey --rpc.batch.concurrency. Browser WebSocket origins now follow --http.corsdomain, and GraphQL follows the HTTP host, CORS, request-size, and concurrency limits. Add your browser origins and GraphQL hostname to --http.corsdomain and --http.vhosts, respectively. Cross-site GET RPC checks depend on browser metadata and do not replace network access controls (#24190, [#24485], [#24487], [#24744]) — by @AskAlexSharov, @Bruce039, @kriss39, @lupin012
• RPC resource limits. The default caps are 10,000 live filters and subscriptions across clients, and 1,024 subscriptions per WebSocket or IPC connection. Requests above these caps return -32005; configure --rpc.subscription.filters.maxsubscriptions and --rpc.subscription.limit, or set either to 0 to disable that cap. A shared request-memory budget can also reject large concurrent requests with HTTP 503 or close their WebSocket connection (#24734, [#24735], [#24737]) — by @yperbasis
• Receipt subscriptions group receipts by block. eth_subscribe("transactionReceipts") now batches matching receipts from one block into the notification's result array. Consumers must process every array element instead of assuming one receipt per notification (#24179) — by @AskAlexSharov
• Pending transaction gas prices. For pool transactions of types 2, 3, and 4, gasPrice now equals maxFeePerGas. eth_getTransactionByHash, txpool_content, and txpool_contentFrom previously reported a projected effective price; full newPendingTransactions notifications omitted the field (#24099) — by @lupin012
• trace_filter defaults and selection. Omitted block bounds now mean latest; specify fromBlock: "earliest" for a query starting at genesis. When both address lists are set, the default is intersection; use mode: "union" for the previous behavior. Block bounds accept numbers or tags; use the new blockHash field to select one canonical block by hash. Invalid modes, unknown fields, reversed ranges, and bounds beyond the head are rejected (#24255, [#24334], [#24341], [#24357], [#24435], [#24706]) — by @banteg, @lupin012
• Tracing uses transaction-like fees and validation. trace_call and trace_callMany now follow eth_call fee handling and the block's gas limit: priced calls charge the sender, while unpriced calls run free. trace_rawTransaction charges gas and validates the transaction against the latest state, including its nonce and balance. A gas limit above --rpc.gascap is rejected with -38026; a cap of 0 disables this limit. Use trace_replayTransaction for already-mined transactions. Failed trace frames use Parity-style error labels, and reverted contract creation returns {gasUsed, output} instead of an address and code (#24330, [#24343], [#24328], [#24329], [#24352], [#24356], [#24355], [#24564]) — by @lupin012, @banteg
• Tracing error codes. trace_block and trace_replayBlockTransactions return -32001 for unknown blocks instead of -32000. Tracing methods that reject pending now return -32602 instead of -32000. Unknown trace types and malformed trace_rawTransaction input also return -32602 instead of -32000. Clients that match these error codes must update (#24598, [#24345], [#24872], [#24768]) — by @lupin012, @banteg
• Stricter call inputs. Call, simulation, and tracing APIs reject differing data and input fields and EIP-1559 fee fields before London. Call and trace methods also reject a chainId that differs from the node's chain (#24336, [#24536], [#24414], [#24351]) — by @banteg, @lupin012
• Caplin peer limits. Connections are capped per IPv4 and IPv6 network range to limit peer concentration. Operators with many peers in one range can configure --caplin.ip-block-limits.trusted-cidrs or --caplin.ip-block-limits.disable (#24815, [#24922]) — by @lystopad
• Beacon health checks. /eth/v1/node/health and / return HTTP 206 while syncing. Health checks that require 200 should accept 206 or use ?syncing_status=200 (#24719) — by @Bruce039
• RPC connectivity checks. net_listening now returns true even when sentries are unreachable. Do not use it alone to check peer connectivity (#24773) — by @lupin012

Added and Changed

RPC

• After Amsterdam, eth_call and other read-only call simulations can use their full RPC gas allowance instead of being capped at 2^24 execution gas. eth_estimateGas, eth_createAccessList, and validated eth_simulateV1 enforce transaction gas rules instead of producing unusable results (#24520) — by @Sahil-4555
• eth_fillTransaction builds blob sidecars, computes missing KZG commitments and proofs, and validates supplied ones. txpool_inspect adds a readable summary of pending and queued non-blob transactions (#24335, [#24738]) — by @lupin012
• The Engine API adds engine_getInclusionListV1 and its REST-SSZ equivalent to build FOCIL inclusion lists from the public mempool (#24693) — by @SoarinSkySagar
• eth_simulateV1 returns blockAccessListHash after Amsterdam and accounts for execution gas and state gas separately. Fixes address lost code and ignored empty-storage overrides between simulated blocks, and historical state-root replay follows the simulated chain instead of later canonical blocks. Simulated blocks advance slotNumber, apply blockOverrides.withdrawals, and avoid duplicate EIP-7708 transfer logs (#24740, [#24276], [#24749], [#24748], [#24402]) — by @MysticRyuujin, @Sahil-4555
• Tracers report EIP-8037 execution and state gas, including negative state-gas costs when storage is cleared (#24240, [#24370]) — by @taratorio
• vmTrace reports only operations that executed, removing synthetic STOP instructions and operations rejected before execution. Operations that halt exceptionally report ex: null (#24344) — by @banteg
• trace_callMany applies state overrides across the bundle, including full storage replacements and moved precompiles. eth_createAccessList and eth_callMany also honor precompile overrides (#24567, [#24739]) — by @lupin012, @pucedoteth
• eth_sendRawTransactionSync finds receipts even when a transaction is mined before its subscription becomes active or during a receipt-stream reconnect, avoiding unnecessary timeouts (#24134, [#24337]) — by @lupin012
• eth_getRawTransactionByHash returns pending transactions from the pool instead of null (#24463) — by @0xShadowX
• Log filters with only wildcard topics now receive matching logs instead of silently receiving nothing (#24459) — by @FlashWayne
• Requests using pending, such as eth_getBalance, eth_estimateGas, and eth_callBundle, now use the latest executed block while a node builds a payload, avoiding block N+1 is not executed errors. RPCs reading committed data also resolve latest against the same view, avoiding missing results while a newer block awaits commit (#24090) — by @Sahil-4555
• ots_hasCode reports code at the end of the requested block, so contracts are visible in their deployment block, matching eth_getCode (#24223) — by @Sahil-4555
• Block transaction counts remain available when transaction payloads are pruned. Witness and Otterscan replay methods check the history they need before attempting execution (#23777) — by @yperbasis

Consensus layer and execution

• Caplin fixes Gloas block and payload publication, restores the served head and payload status after restarts, and avoids restart stalls caused by incorrect finality handling (#24545, [#24548], [#24628]) — by @domiwei
• Caplin validates gossip blocks faster, reducing the delay before new blocks can become the head (#24523) — by @lystopad
• Caplin avoids a deadlock when publishing its own block and reduces payload-build delays from a busy execution layer or late payload preparation (#25019, [#25005], [#25043]) — by @domiwei, @lystopad
• Validator nodes verify and relay aggregates outside their proposal epochs. Attestation and Payload Timeliness Committee (PTC) gossip budgets accommodate expected traffic and vote bursts, preventing valid votes from being dropped. Gossip attestations and aggregates received before their block are kept in bounded queues for about one slot and retried when the block arrives (#25042, [#25000], [#24981], [#24949]) — by @lystopad, @domiwei
• Caplin selects the sync committee using the message or contribution slot, preventing valid messages from being rejected and peers from being banned at period boundaries (#25067) — by @lystopad
• Caplin fixes gossip timing checks that discarded valid late blocks and sync committee messages near slot boundaries. Signature checks for sync committee messages from before a fork use the correct domain after the head crosses the fork, avoiding incorrect peer bans (#24489) — by @lystopad
• Caplin accepts SSZ submissions at POST /eth/v2/validator/aggregate_and_proofs, restoring aggregate publication for Prysm validator clients (#24927) — by @domiwei
• Proposed blocks include locally aggregated attestations and select additional votes by proposer reward, with lower memory use. The aggregation pool counts each committee member's vote once (#24813, [#24566], [#24955], [#24798]) — by @lystopad
• On Gnosis and Chiado, Caplin uses a 1,666 ms pre-Gloas block-timeliness cutoff to determine proposer boost, replacing the effective 2,000 ms cutoff (#24875) — by @domiwei
• Standalone Caplin reconstructs pre-Gloas beacon blocks with the matching execution body, preventing incorrect block responses and peer bans when serving blocks from competing forks (#25021) — by @domiwei
• Fulu column sidecars use the correct inclusion proof layout, including older columns served from disk, avoiding peer rejections and bans. Fulu gossip blocks wait for custody columns before entering fork choice (#24512, [#24546]) — by @domiwei
• Caplin subscribes to persistent attestation subnets and preserves advertised subnet membership across fork transitions, improving attestation gossip reliability (#25052) — by @domiwei
• Transient handshake failures no longer ban incoming peers, Status and Goodbye limits recover more quickly, and fork advertisements use the correct version at BPO upgrades (#24627, [#24406]) — by @domiwei, @MysticRyuujin
• Gloas block production honors the fee recipient in signed proposer preferences. Caplin refuses validator duties on a stale served head and checks selected attestations against the proposal state, preventing invalid proposals after reorgs that change committee assignments (#24937, [#24829], [#24959]) — by @yperbasis, @lystopad
• Duty responses use the correct dependent root after empty slots, preventing false duty-reorg notifications and rejected proposer preferences (#24995) — by @domiwei
• Caplin accepts valid proposer slashings and checks pre-Gloas payload withdrawals before importing or signing blocks. Fork choice uses the target checkpoint's committees for attestations in imported blocks (#24846, [#24803], [#24807]) — by @domiwei, @yperbasis
• Missing custody columns are fetched within the slot instead of waiting over a minute. Parallel blob recovery reduces delays before blocks reach fork choice and execution. Peers returning no columns are briefly skipped to avoid repeated empty requests (#24830, [#24861], [#24996]) — by @lystopad, @domiwei
• Parallel execution fixes balance, nonce, and storage handling after account destruction, recreation, and reverted calls, preventing wrong state roots and rejection of valid blocks. Amsterdam account existence checks remain consistent during parallel execution (#24705, [#24653], [#24654], [#24742], [#24866], [#24701], [#25057]) — by @chfast, @yperbasis
• On chains with a configured burnt-fee recipient, parallel execution credits both the tip and burnt fee when that recipient is also the block beneficiary, preventing wrong state roots (#24879) — by @chfast
• Execution fixes stale commitment reads after reorgs and recovery from invalid blocks. Nodes using external consensus clients resume sync after restarts when invalid-header removal left a gap. Fork-choice updates preserve safe and finalized hashes even when the head does not move (#24731, [#24836], [#24865], [#24032]) — by @Sahil-4555, @AskAlexSharov, @awskii, @yperbasis
• Fixes deadlocks and pruning stalls that could stop block execution (#24591) — by @taratorio
• A rejected transaction replacement no longer removes the original transaction from the pool, including during reorg recovery (#24534) — by @Bruce039

Operations

• Caplin validator nodes subscribed to many attestation subnets may use more CPU because they now verify attestations previously dropped by the gossip limit. Allow CPU headroom for this additional work, especially with --caplin.subscribe-all-topics (#25000) — by @domiwei
• The default RPC block cache limit grows to 512 MiB, from 160 MiB for embedded RPC and remote rpcdaemon, or 32 MiB for rpcdaemon with --datadir. Set RPC_BLOCK_CACHE to adjust the memory budget (#24120) — by @AskAlexSharov
• Memory sizing honors cgroup v1 limits in hybrid cgroup setups instead of sizing caches from host RAM (#24885) — by @AskAlexSharov
• An empty seg rm-state-snapshots --step=N+ range no longer selects every state snapshot for deletion, including when N is the latest available step (#24796) — by @joxerx
• Gnosis and Chiado retain and serve data columns for 16,384 epochs, about 15 days, instead of 4,096 epochs. Operators should allow for roughly four times the column storage. Leave --caplin.columns-keep-slots at 0 to follow this window; an explicit value overrides pruning retention and may delete columns the node still needs to serve (#24720) — by @Bruce039

Security

• Network decoders allocate buffers as data arrives and reject impossible compressed sizes. Tighter bounds on peer queues, transaction packets, and Caplin gossip control messages reduce memory exhaustion risks from hostile traffic (#24374, [#24649], [#24648], [#24392], [#24508], [#24616]) — by @yperbasis, @AskAlexSharov
• RPC rejects oversized transactions before decoding. Caplin bounds SSZ committee vectors and rejects invalid validator and slashing indices, preventing excessive allocations and panics. Invalid block access list indices are rejected before execution. The Engine API rejects null withdrawal entries before hashing or building blocks (#24315, [#24614], [#24615], [#24771], [#24908], [#24650]) — by @yperbasis, @domiwei
• Caplin verifies signatures before forwarding attestations, aggregates, voluntary exits, and BLS-to-execution changes. Attestations and aggregates use the correct fork's signing domain and gossip topic, preventing invalid relays and rejection of valid messages near upgrades (#24629, [#24544]) — by @domiwei
• A peer sending a blob transaction with a bad KZG proof no longer causes valid transactions from other peers in the same batch to be dropped (#24535) — by @FlashWayne, @yperbasis

Full Changelog: https://github.com/erigontech/erigon/compare/v3.7.1...v3.8.0