August 4–11, 2026

← Developer Updates

This update covers verified merged pull requests and public releases across Dusk repositories during the previous seven days. Work in private repositories is summarized without linking to private implementation details; public changes are linked alongside their respective projects.

Rusk

Private node, wallet, and VM development focused on safer state transitions, compatibility, and recovery:

• added production-shaped replay, checkpoint reopening, wallet TUI transition coverage, and safer handling of non-UTF-8 key paths;
• bound archive event batches to finalized block hashes, preserved event order, and tightened proposal accounting;
• validated blob sidecars before state transition, introduced metered BlobCall handling behind a disabled feature gate, and updated Piecrust with atomic-failure regressions; and
• hardened wallet amount parsing, chain-ID validation, fee arithmetic, and provisioner-key export reporting.

DuskEVM

Private contracts and adapter development tightened blob submission, bridge routing, fault-proof state, RPC limits, and withdrawal recovery:

• aligned MIPS and preimage behavior with the pinned Optimism and Karst expectations;
• isolated delayed-withdrawal maturity by game and strengthened relay, proof-timestamp, claim-index, and finality boundaries; and
• added bounded RPC decoding, admission, and session paths; canonical blob reconstruction; projected preimage and challenger state; and stricter malformed-event handling.

PLONK

PLONK work strengthened circuit soundness, checked deserialization, and core-only behavior:

• expanded coverage for curve-addition, fixed-base, and logic helper wires (#882, #883, #885, #894, #911);
• prevented malformed point witnesses from reaching panicking projections (#891, #907);
• validated KZG keys, cached vanishing and linear evaluations, point inputs, and reconstructed public parameters before use (#888, #893, #899, #900, #904, #905, #909); and
• rejected trailing compressed-circuit data while making the error API non-exhaustive and usable in core-only builds (#866, #886, #896).

JubJub Schnorr

Secret-key and multisignature handling received several safety improvements:

• secret keys are redacted from debug output (#46);
• variable-time secret-key ordering was removed (#56);
• variable-generator secret keys can no longer be copied implicitly (#57);
• multisignature nonce state is single-use (#47);
• double signatures bind both public keys (#49); and
• share-combination inputs and nonce-reuse diagnostics are explicitly validated and tested (#61, #62).

JubJub ElGamal

Checked RKYV decoding now validates archived ElGamal ciphertext points before constructing live cryptographic values (#30).

Phoenix

Checked deserialization now verifies that archived note openings match their commitments before accepting them (#291).

Merkle

Tree operations now reject inconsistent paths (#112) and out-of-range opening positions (#113) without partially mutating otherwise valid tree state.

Dusk Bytes

Reader-backed decoding now consumes exactly the required number of bytes (#40), and hexadecimal decoding rejects odd-length input before indexing it (#41).

Piecrust

Public runtime maintenance preserved synthetic root ancestry (#495) and hardened top-level call boundaries (#497). The corresponding refinements shipped in 0.32.1 and 0.32.2. Private development continued improving contract-memory finalization.

zk-tools

The new zk-tools project established its workspace structure (#1), moved BLS12-381 support to Dusk curves (#3), decoupled the composer from PLONK (#4), and implemented Groth16 tooling (#8).

Citadel

Citadel migrated to the current Dusk curve stack (#148), repaired the resulting API changes (#149), and updated its zk-tools dependency to 0.2.0 (#151).

Web Wallet

Active DuskEVM bridge flows migrated to the current contracts and published SDK, including versioned encoding for external recipients (#947).

← Back to Developer Updates