casper-network · sacherjj · May 12, 2026 · May 12, 2026 · May 12, 2026 · May 12, 2026
diff --git a/.github/workflows/push-artifacts.yml b/.github/workflows/push-artifacts.yml
@@ -40,7 +40,7 @@ jobs:
           python3 --version
 
       - name: Install cargo deb
-        run: cargo install cargo-deb
+        run: cargo install --git https://github.com/sacherjj/cargo-deb cargo-deb
 
       - name: Build update package
         run: ./ci/build_update_package.sh

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/binary_port/Cargo.toml b/binary_port/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "casper-binary-port"
-version = "1.1.1"
+version = "1.2.0"
 edition = "2018"
 description = "Types for the casper node binary port"
 documentation = "https://docs.rs/casper-binary-port"
@@ -13,7 +13,7 @@ exclude = ["proptest-regressions"]
 [dependencies]
 bincode = "1.3.3"
 bytes = "1.0.1"
-casper-types = { version = "7.0.0", path = "../types", features = ["datasize", "json-schema", "std"] }
+casper-types = { version = "7.1.0", path = "../types", features = ["datasize", "json-schema", "std"] }
 num-derive = { workspace = true }
 num-traits = { workspace = true }
 once_cell = { version = "1.5.2" }

diff --git a/binary_port/src/error_code.rs b/binary_port/src/error_code.rs
@@ -370,6 +370,8 @@ pub enum ErrorCode {
     InvalidDelegationAmount = 116,
     #[error("the transaction invocation target is unsupported under V2 runtime")]
     UnsupportedInvocationTarget = 117,
+    #[error("the transaction contained an invalid initiator")]
+    InvalidInitiator,
 }
 
 impl TryFrom<u16> for ErrorCode {
@@ -454,6 +456,7 @@ impl From<InvalidDeploy> for ErrorCode {
             }
             InvalidDeploy::InvalidPaymentAmount => ErrorCode::InvalidDeployInvalidPaymentAmount,
             InvalidDeploy::PricingModeNotSupported => ErrorCode::PricingModeNotSupported,
+            InvalidDeploy::InvalidInitiator => ErrorCode::InvalidInitiator,
             _ => ErrorCode::InvalidDeployUnspecified,
         }
     }
@@ -571,6 +574,7 @@ impl From<InvalidTransactionV1> for ErrorCode {
             InvalidTransactionV1::UnsupportedInvocationTarget { .. } => {
                 ErrorCode::UnsupportedInvocationTarget
             }
+            InvalidTransactionV1::InvalidInitiator => ErrorCode::InvalidInitiator,
             _other => ErrorCode::InvalidTransactionUnspecified,
         }
     }

diff --git a/execution_engine/Cargo.toml b/execution_engine/Cargo.toml
@@ -18,7 +18,7 @@ blake2 = { version = "0.10.6", default-features = false }
 blake3 = { version = "1.5.0", default-features = false, features = ["pure"] }
 sha2 = { version = "0.10.8", default-features = false }
 casper-storage = { version = "5.0.0", path = "../storage", default-features = true }
-casper-types = { version = "7.0.0", path = "../types", default-features = false, features = ["datasize", "gens", "json-schema", "std"] }
+casper-types = { version = "7.1.0", path = "../types", default-features = false, features = ["datasize", "gens", "json-schema", "std"] }
 casper-wasm = { version = "1.0.0", default-features = false, features = ["sign_ext", "call_indirect_overlong"] }
 casper-wasm-utils = { version = "4.0.0", default-features = false, features = ["sign_ext", "call_indirect_overlong"] }
 casper-wasmi = { version = "1.0.0", features = ["sign_ext", "call_indirect_overlong"] }

diff --git a/execution_engine_testing/test_support/Cargo.toml b/execution_engine_testing/test_support/Cargo.toml
@@ -13,7 +13,7 @@ license = "Apache-2.0"
 [dependencies]
 blake2 = "0.9.0"
 casper-storage = { version = "5.0.0", path = "../../storage" }
-casper-types = { version = "7.0.0", path = "../../types" }
+casper-types = { version = "7.1.0", path = "../../types" }
 env_logger = "0.10.0"
 casper-execution-engine = { version = "9.0.0", path = "../../execution_engine", features = ["test-support"] }
 humantime = "2"
@@ -29,7 +29,7 @@ tempfile = "3.4.0"
 toml = "0.5.6"
 
 [dev-dependencies]
-casper-types = { version = "7.0.0", path = "../../types", features = ["std"] }
+casper-types = { version = "7.1.0", path = "../../types", features = ["std"] }
 version-sync = "0.9.3"
 
 [build-dependencies]

diff --git a/executor/wasm/Cargo.toml b/executor/wasm/Cargo.toml
@@ -17,7 +17,7 @@ casper-executor-wasm-host = { version = "0.1.3", path = "../wasm_host" }
 casper-executor-wasm-interface = { version = "0.1.3", path = "../wasm_interface" }
 casper-executor-wasmer-backend = { version = "0.1.3", path = "../wasmer_backend" }
 casper-storage = { version = "5.0.0", path = "../../storage" }
-casper-types = { version = "7.0.0", path = "../../types", features = ["std"] }
+casper-types = { version = "7.1.0", path = "../../types", features = ["std"] }
 casper-execution-engine = { version = "9.0.0", path = "../../execution_engine", features = [
     "test-support",
 ] }

diff --git a/executor/wasm_host/Cargo.toml b/executor/wasm_host/Cargo.toml
@@ -14,7 +14,7 @@ bytes = "1.10"
 casper-executor-wasm-common = { version = "0.1.3", path = "../wasm_common" }
 casper-executor-wasm-interface = { version = "0.1.3", path = "../wasm_interface" }
 casper-storage = { version = "5.0.0", path = "../../storage" }
-casper-types = { version = "7.0.0", path = "../../types" }
+casper-types = { version = "7.1.0", path = "../../types" }
 either = "1.15"
 num-derive = { workspace = true }
 num-traits = { workspace = true }

diff --git a/executor/wasm_interface/Cargo.toml b/executor/wasm_interface/Cargo.toml
@@ -13,6 +13,6 @@ bytes = "1.10"
 borsh = { version = "1.5", features = ["derive"] }
 casper-executor-wasm-common = { version = "0.1.3", path = "../wasm_common" }
 casper-storage = { version = "5.0.0", path = "../../storage" }
-casper-types = { version = "7.0.0", path = "../../types" }
+casper-types = { version = "7.1.0", path = "../../types" }
 parking_lot = "0.12"
 thiserror = "2"
diff --git a/executor/wasmer_backend/Cargo.toml b/executor/wasmer_backend/Cargo.toml
@@ -15,7 +15,7 @@ casper-executor-wasm-interface = { version = "0.1.3", path = "../wasm_interface"
 casper-executor-wasm-host = { version = "0.1.0", path = "../wasm_host" }
 casper-storage = { version = "5.0.0", path = "../../storage" }
 casper-contract-sdk-sys = { version = "0.1.3", path = "../../smart_contracts/sdk_sys" }
-casper-types = { version = "7.0.0", path = "../../types" }
+casper-types = { version = "7.1.0", path = "../../types" }
 regex = "1.11"
 wasmer = { version = "5.0.4", default-features = false, features = [
     "singlepass",

diff --git a/node/Cargo.toml b/node/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "casper-node"
-version = "2.2.0" # when updating, also update 'html_root_url' in lib.rs
+version = "2.2.1" # when updating, also update 'html_root_url' in lib.rs
 authors = ["Ed Hastings <ed@casper.network>", "Karan Dhareshwar <karan@casper.network>"]
 edition = "2021"
 description = "The Casper blockchain node"
@@ -22,9 +22,9 @@ base16 = "0.2.1"
 base64 = "0.13.0"
 bincode = "1"
 bytes = "1.11.0"
-casper-binary-port = { version = "1.1.1", path = "../binary_port" }
+casper-binary-port = { version = "1.2.0", path = "../binary_port" }
 casper-storage = { version = "5.0.0", path = "../storage" }
-casper-types = { version = "7.0.0", path = "../types", features = ["datasize", "json-schema", "std-fs-io"] }
+casper-types = { version = "7.1.0", path = "../types", features = ["datasize", "json-schema", "std-fs-io"] }
 casper-execution-engine = { version = "9.0.0", path = "../execution_engine" }
 datasize = { version = "0.2.11", features = ["detailed", "fake_clock-types", "futures-types", "smallvec-types"] }
 derive_more = "0.99.7"
@@ -99,7 +99,7 @@ casper-executor-wasm-interface = { version = "0.1.3", path = "../executor/wasm_i
 fs_extra = "1.3.0"
 
 [dev-dependencies]
-casper-binary-port = { version = "1.1.1", path = "../binary_port", features = ["testing"] }
+casper-binary-port = { version = "1.2.0", path = "../binary_port", features = ["testing"] }
 assert-json-diff = "2.0.1"
 assert_matches = "1.5.0"
 casper-types = { path = "../types", features = ["datasize", "json-schema", "std-fs-io", "testing"] }

diff --git a/node/src/components/transaction_acceptor/tests.rs b/node/src/components/transaction_acceptor/tests.rs
@@ -250,6 +250,11 @@ enum TestScenario {
         ContractVersionExistance,
     ),
     VmCasperV2ByPackageHash,
+    // For both these scenarios,
+    // true means use public key
+    // false means use account hash
+    FromPeerWithSystemInitiator(bool),
+    FromClientWithSystemInitiator(bool),
 }
 
 impl TestScenario {
@@ -268,7 +273,8 @@ impl TestScenario {
             | TestScenario::FromPeerCustomPaymentContractPackage(_)
             | TestScenario::FromPeerSessionContract(..)
             | TestScenario::FromPeerSessionContractPackage(..)
-            | TestScenario::InvalidFieldsFromPeer => Source::Peer(NodeId::random(rng)),
+            | TestScenario::InvalidFieldsFromPeer
+            | TestScenario::FromPeerWithSystemInitiator(_) => Source::Peer(NodeId::random(rng)),
             TestScenario::FromClientInvalidTransaction(_)
             | TestScenario::FromClientInvalidTransactionZeroPayment(_)
             | TestScenario::FromClientSlightlyFutureDatedTransaction(_)
@@ -305,7 +311,8 @@ impl TestScenario {
             | TestScenario::RedelegateExceedingMaximumDelegation
             | TestScenario::DelegateExceedingMaximumDelegation
             | TestScenario::VmCasperV2ByPackageHash
-            | TestScenario::V1ByPackage(..) => Source::Client,
+            | TestScenario::V1ByPackage(..)
+            | TestScenario::FromClientWithSystemInitiator(_) => Source::Client,
         }
     }
 
@@ -324,6 +331,28 @@ impl TestScenario {
                 txn.invalidate();
                 Transaction::from(txn)
             }
+            TestScenario::FromPeerWithSystemInitiator(should_use_public_key)
+            | TestScenario::FromClientWithSystemInitiator(should_use_public_key) => {
+                let txn = TransactionV1::random_with_system_initiator(
+                    rng,
+                    *should_use_public_key,
+                    None,
+                    None,
+                );
+                let cloned = txn.clone();
+                if *should_use_public_key {
+                    assert_eq!(
+                        cloned.initiator_addr(),
+                        &InitiatorAddr::PublicKey(PublicKey::System)
+                    )
+                } else {
+                    assert_eq!(
+                        cloned.initiator_addr(),
+                        &InitiatorAddr::AccountHash(PublicKey::System.to_account_hash())
+                    )
+                };
+                Transaction::from(txn)
+            }
             TestScenario::FromClientInvalidTransactionZeroPayment(TxnType::V1) => {
                 let txn = TransactionV1Builder::new_session(
                     false,
@@ -937,6 +966,7 @@ impl TestScenario {
                     HashOrName::Name => true,
                 }
             },
+            TestScenario::FromPeerWithSystemInitiator(_) | TestScenario::FromClientWithSystemInitiator(_) => false,
         }
     }
 
@@ -1756,6 +1786,15 @@ async fn run_transaction_acceptor_without_timeout(
                     )
                 ),
             },
+            TestScenario::FromPeerWithSystemInitiator(_)
+            | TestScenario::FromClientWithSystemInitiator(_) => {
+                matches!(
+                    event,
+                    Event::TransactionAcceptorAnnouncement(
+                        TransactionAcceptorAnnouncement::InvalidTransaction { .. }
+                    )
+                )
+            }
         }
     };
     runner
@@ -3065,3 +3104,57 @@ async fn should_succeed_when_asking_for_active_exact_version() {
     .await;
     assert!(result.is_ok())
 }
+
+#[tokio::test]
+async fn should_reject_txn_with_system_public_key_as_initiator_from_peer() {
+    let scenario = TestScenario::FromPeerWithSystemInitiator(true);
+    let result = run_transaction_acceptor(scenario).await;
+
+    assert!(matches!(
+        result,
+        Err(super::Error::InvalidTransaction(InvalidTransaction::V1(
+            InvalidTransactionV1::InvalidInitiator
+        )))
+    ))
+}
+
+#[tokio::test]
+async fn should_reject_txn_with_system_public_key_as_initiator_from_client() {
+    let scenario = TestScenario::FromClientWithSystemInitiator(true);
+    let result = run_transaction_acceptor(scenario).await;
+
+    assert!(matches!(
+        result,
+        Err(super::Error::Parameters {
+            failure: ParameterFailure::InvalidAssociatedKeys { .. },
+            ..
+        })
+    ))
+}
+
+#[tokio::test]
+async fn should_reject_txn_with_system_account_hash_as_initiator_from_peer() {
+    let scenario = TestScenario::FromPeerWithSystemInitiator(false);
+    let result = run_transaction_acceptor(scenario).await;
+
+    assert!(matches!(
+        result,
+        Err(super::Error::InvalidTransaction(InvalidTransaction::V1(
+            InvalidTransactionV1::InvalidInitiator
+        )))
+    ))
+}
+
+#[tokio::test]
+async fn should_reject_txn_with_system_account_hash_as_initiator_from_client() {
+    let scenario = TestScenario::FromClientWithSystemInitiator(false);
+    let result = run_transaction_acceptor(scenario).await;
+
+    assert!(matches!(
+        result,
+        Err(super::Error::Parameters {
+            failure: ParameterFailure::InvalidAssociatedKeys { .. },
+            ..
+        })
+    ))
+}
diff --git a/node/src/lib.rs b/node/src/lib.rs
@@ -8,7 +8,7 @@
 //! While the [`main`](fn.main.html) function is the central entrypoint for the node application,
 //! its core event loop is found inside the [reactor](reactor/index.html).
 
-#![doc(html_root_url = "https://docs.rs/casper-node/2.2.0")]
+#![doc(html_root_url = "https://docs.rs/casper-node/2.2.1")]
 #![doc(
     html_favicon_url = "https://raw.githubusercontent.com/casper-network/casper-node/blob/dev/images/Casper_Logo_Favicon_48.png",
     html_logo_url = "https://raw.githubusercontent.com/casper-network/casper-node/blob/dev/images/Casper_Logo_Favicon.png",

diff --git a/node/src/types/transaction/meta_transaction/meta_transaction_v1.rs b/node/src/types/transaction/meta_transaction/meta_transaction_v1.rs
@@ -2,8 +2,8 @@ use crate::types::transaction::arg_handling;
 use casper_types::{
     bytesrepr::ToBytes, calculate_transaction_lane, crypto, Approval, Chainspec,
     ContractRuntimeTag, Digest, DisplayIter, Gas, HashAddr, InitiatorAddr, InvalidTransaction,
-    InvalidTransactionV1, PricingHandling, PricingMode, TimeDiff, Timestamp, TransactionArgs,
-    TransactionConfig, TransactionEntryPoint, TransactionInvocationTarget,
+    InvalidTransactionV1, PricingHandling, PricingMode, PublicKey, TimeDiff, Timestamp,
+    TransactionArgs, TransactionConfig, TransactionEntryPoint, TransactionInvocationTarget,
     TransactionRuntimeParams, TransactionScheduling, TransactionTarget, TransactionV1,
     TransactionV1Config, TransactionV1ExcessiveSizeError, TransactionV1Hash, AUCTION_LANE_ID,
     MINT_LANE_ID, U512,
@@ -228,6 +228,19 @@ impl MetaTransactionV1 {
             return Err(InvalidTransactionV1::EmptyApprovals);
         }
 
+        match &self.initiator_addr {
+            InitiatorAddr::PublicKey(public_key) => {
+                if public_key == &PublicKey::System {
+                    return Err(InvalidTransactionV1::InvalidInitiator);
+                }
+            }
+            InitiatorAddr::AccountHash(account_hash) => {
+                if account_hash == &PublicKey::System.to_account_hash() {
+                    return Err(InvalidTransactionV1::InvalidInitiator);
+                }
+            }
+        }
+
         self.has_valid_hash().clone()?;
 
         for (index, approval) in self.approvals.iter().enumerate() {

diff --git a/resources/integration-test/chainspec.toml b/resources/integration-test/chainspec.toml
@@ -1,6 +1,6 @@
 [protocol]
 # Protocol version.
-version = '2.2.2'
+version = '2.2.3'
 # Whether we need to clear latest blocks back to the switch block just before the activation point or not.
 hard_reset = true
 # This protocol version becomes active at this point.
@@ -11,7 +11,7 @@ hard_reset = true
 # in contract-runtime for computing genesis post-state hash.
 #
 # If it is an integer, it represents an era ID, meaning the protocol version becomes active at the start of this era.
-activation_point = 19672
+activation_point = 20430
 
 [network]
 # Human readable name for convenience; the genesis_hash is the true identifier.  The name influences the genesis hash by

diff --git a/resources/mainnet/chainspec.toml b/resources/mainnet/chainspec.toml
@@ -1,6 +1,6 @@
 [protocol]
 # Protocol version.
-version = '2.2.0'
+version = '2.2.1'
 # Whether we need to clear latest blocks back to the switch block just before the activation point or not.
 hard_reset = true
 # This protocol version becomes active at this point.
@@ -11,7 +11,7 @@ hard_reset = true
 # in contract-runtime for computing genesis post-state hash.
 #
 # If it is an integer, it represents an era ID, meaning the protocol version becomes active at the start of this era.
-activation_point = 21742
+activation_point = 22426
 
 [network]
 # Human readable name for convenience; the genesis_hash is the true identifier.  The name influences the genesis hash by

diff --git a/resources/mainnet/global_state.toml b/resources/mainnet/global_state.toml