SVM Testnet Update: 170K Blocks Reached & v0.0.4.1 Maintenance Release
Hi everyone,
Following up on my previous update, I am pleased to report that the Steem Virtual Machine (SVM) testnet continues to operate with exceptional stability and health.
We have hit another milestone, and we have also rolled out a routine, non-breaking maintenance update to further harden our infrastructure.
Network Health and Current Metrics
The SVM testnet is running smoothly, consistently producing blocks and processing transactions with the v0.0.4 security patches firmly in place.
Current Testnet Statistics:
- Total Blocks Produced: 170,000+
- Total Transactions: 4,738
- Average Block Time: ~5.5 seconds
- Active Validators: 10 / 11
Reaching over 170,000 blocks is a strong indicator of the network's resilience. We are currently operating with 10 out of 11 validators fully updated, synced, and actively participating in both consensus and oracle duties.
New Release: v0.0.4.1 Security Maintenance Update
We have just published a security maintenance rebuild of the SteemVM node and oracle container images: v0.0.4.1.
To be absolutely clear: This is routine dependency hygiene. There is no exploit, no incident, and nothing wrong with the chain.
When we shipped v0.0.4, it was a genuine emergency response to an upstream cosmos/evm vulnerability. This new release is the opposite: proactive maintenance. Container images bundle a Linux base, the Go standard library, and third-party dependencies that accumulate published vulnerabilities over time, even when our own application code never changes.
We audited the published images and rebuilt them against current, patched versions of everything underneath.
The Results (via Docker Scout)
| Image | Before | After |
|---|---|---|
steemvmd (the node) | 12 Critical / 35 High | 0 Critical / 13 High |
steemvm-oracle-js | 2 Critical / 17 High | 0 Critical / 3 High |
steemvm-oracle-go | Not previously scanned | 0 Critical / 6 High |
steemvm-oracle-python | Not previously scanned | 0 Critical / 3 High |
Zero Critical-severity findings remain across all four published images.
Most of the previous critical findings were not in SteemVM's code at all, but rather in cosmovisor (the supervisor process that swaps binaries at upgrade heights), which had drifted out of date. Refreshing it was completely safe, as it is not part of consensus and never touches chain state.
Under the hood changes:
- Go toolchain updated:
1.26.5→1.26.8 - Cosmovisor updated:
v1.7.0→v1.7.3(rebuilt against current cryptography libraries) - SteemVM's own
golang.org/x/cryptoupdated:0.53.0→0.56.0 - JavaScript oracle moved to a Debian 13 base and dropped the bundled
npmCLI it never runs.
🚀 Bonus: Prebuilt Oracle Images Are Now Live!
Until now, running an oracle client meant building it from source on your own machine. All three are now published as prebuilt images, making validator setup even easier. You can now simply pull:
steemblazer/steemvm-oracle-gosteemblazer/steemvm-oracle-pythonsteemblazer/steemvm-oracle-js
Pick whichever language you are most comfortable operating. They are functionally identical, and you should only ever run one at a time.
What Validators Need to Do
Because this is purely a container image refresh with no consensus or state-machine changes, there is no upgrade height, no governance vote, and no coordinated halt.
You can pick up this update whenever convenient. Your keys, stake, and validator identity are completely untouched. Nothing needs re-registering or re-staking.
The procedure is simple:
# Option 1: Manual pull and restart
docker compose pull
docker compose up -d
# Option 2: Use the automated update script (Recommended)
./update.sh
How to Verify the Update
The patched image still reports version 0.0.4 (this is deliberate, so it matches the on-chain upgrade record). To confirm you are on the patched build, run:
docker exec steemvm-node /root/go/bin/steemvmd version --long
If the output shows go1.26.8, you are successfully running the patched build. If it shows go1.26.5, you have not yet pulled the new image.
Next Steps: Sherpa Protocol Deployment
With the validator set nearly fully restored, the v0.0.4 security patches executed, and our container images now hardened to zero critical vulnerabilities, the network is in an excellent, production-ready state.
Our next major milestone will be the deployment and testing of the Sherpa Protocol smart contracts, bringing native decentralized finance (DeFi) capabilities to the Steem Virtual Machine environment. We will share the deployment schedule once the final validator is back online.
Testnet Disclaimer
Important Reminder: The Steem Virtual Machine (SVM) is strictly in its testnet phase. All bonded STEEM, transactions executed, and tokens generated are purely for testing the consensus and EVM execution layers. There is no real-world monetary value attached to this chain or its assets.
Thank you to all validators for your continued dedication to securing the SVM network. Keeping our infrastructure patched and up-to-date is what makes this ecosystem robust and trustworthy.
If you value proactive engineering, rigorous security standards, and transparent development for the STEEM ecosystem, please consider supporting my witness: blaze.apps