R3E Network has released neox-rs v2.7.0, a new version of the Rust-based Neo X full-node client that merges 185 commits from upstream Reth 2.7.0, resolves nine cargo audit vulnerabilities, and hardens the distributed key generation (DKG) validator lifecycle.

Jimmy Liao, a Neo core developer and founder of R3E Network, announced the release on Oct. 20.

Since its debut in July, the client has moved through three prior releases: an initial pre-release, a first stable version with consensus fixes, and an audit remediation release that closed 11 findings. The version number jumped from v2.5.2 directly to v2.7.0 to stay aligned with Reth's upstream numbering — a lockstep convention that lets node operators trace each neox-rs build to the exact upstream baseline it inherits.

Reth 2.7 upstream merge

The update brings neox-rs up to the Reth 2.7.0 codebase, incorporating 185 commits from the previous baseline while retaining the Neo X-specific protocol layers, including dBFT consensus, DKG threshold encryption, Anti-MEV envelope processing, and custom RPC endpoints. Reth is the Rust execution client for Ethereum developed by Paradigm, and regular upstream merges of this kind allow a derived client to absorb fixes and improvements from its base as the upstream codebase evolves rather than drifting from it.

Alongside the merge, the Neo X Geth oracle was synced to its latest baseline. Both MainNet and TestNet genesis files were verified to match canonical bytes, preserving genesis block hashes. The release ships with Linux and Windows x86_64 binaries, each published with SHA-256 checksums; aarch64 artifacts were not built for this release.

Security remediation

Nine cargo audit vulnerabilities were resolved through dependency updates to quinn-proto 0.11.18 and rustls 0.23.46, and the project now reports zero known vulnerabilities from cargo audit. Cargo audit checks a Rust project's dependency tree against a database of published advisories, so a zero-finding report indicates that no known-vulnerability flags remain in the current dependency set.

The security review was performed by an agent-authorized process rather than an independent third-party audit, a distinction noted in the release as a recorded risk acceptance.

DKG lifecycle hardening

Four changes target reliability in the DKG validator lifecycle, addressing failure modes observed during extended validation runs:

• DKG preparations now survive canonical head advances, preventing previously stranded states.
• Rejected Submit operations restore the validator to Ready state instead of leaving the prepared task orphaned.
• Share matching now uses round and aggregate global key together, eliminating false epoch-mismatch failures during normal block progression.
• Signer shares are no longer re-installed on every block; the system hashes settled canonical inputs instead of the canonical head.

DKG is the threshold-cryptography procedure by which a validator set jointly generates key material such that no single participant holds the complete key — one of the Neo X-specific layers the upstream merge had to preserve. These fixes address edge cases where DKG state could become inconsistent across block boundaries, scenarios that would surface during sustained multi-round validation.

Validation and testing

The release candidate was validated through a 1,402-block G8 gate spanning heights 2,404 to 3,805. The gate confirmed DKG round progression from round one to round two, maintained an identical 128-byte aggregate commitment throughout, and recorded zero reorgs and zero transient RPC errors.

Envelope decryption was verified in both current-epoch and cross-epoch scenarios, with a saved round-one envelope successfully decrypted and mined after the chain advanced to round two. Fault testing included 60-second prover delays, forced process restarts, and missing-receipt share replacement.

All 427 Neo X tests pass, along with clean clippy and formatting checks. Datadir compatibility was also confirmed: a v2.7.0 data directory and DKG keystore opened successfully under v2.5.2, and the release binary loaded an existing MainNet archive datadir — checks relevant to operators, since they show existing chain data and DKG keystores remain usable across version boundaries.

Looking ahead

Full clean-datadir MainNet sync from genesis remains in progress following the release, although peer connection and the headers pipeline have been verified. That sync is the outstanding milestone to watch, with its two prerequisites — peer connectivity and header retrieval — already confirmed as working.

neox-rs continues to serve as an independent Rust implementation of the Neo X protocol, providing client diversity alongside the Go-based Neo X Geth client maintained by Bane Labs. Client diversity — running independent implementations of the same protocol — is a long-standing resilience practice in blockchain networks, since a defect confined to one codebase does not automatically affect the other.

The release page is available at: https://github.com/R3E-Network/neox-rs/releases/tag/neox-v2.7.0