[PROPOSAL] Upgrade mainnet tacchain to v1.0.4

[AkKoks]

Overview

This proposal introduces a set of targeted improvements to the TAC network as part of the v1.0.4 upgrade. The changes include activation of a new EVM precompile for ed25519 signature verification and a security fix in the staking precompile's authorization logic.

These are the PRs in the TAC GitHub repositories reflecting the changes:

• EVM, PR #8 — Ed25519 verify precompile
• EVM, PR #11 — Ed25519 gas calculation fix
• EVM, PR #13 — Authz fix in staking precompile

Upgrade timeline

⚠️ Dates and block numbers are approximate and subject to change.

Event	Date (UTC)	Block
Governance proposal submitted	Apr 10, 09:00	~17 305 951
Voting period ends (expedited, 3.5 days)	Apr 13, 21:00	~17 493 777
Upgrade activation height	Apr 14, ~12:00	17530000
Node update deadline	no later than Apr 14, 12:00	—

Updating process

If this discussion will not raise critical doubts from validators and the public audience over the course of the next few days, and there will be a positive outcome from the TAC Foundation, we will submit an on-chain expedited governance proposal on April 10. The validators will have 3.5 days to vote. Validators must update their TAC nodes to v1.0.4 after the network reaches block 17530000(approx. April 14, 12:00 UTC).

Technical implementation

The proposed upgrade includes 2 changes:

1. Ed25519 precompile — activation of a new stateless EVM precompile that exposes on-chain ed25519 signature verification.
2. Authz fix in staking precompile — a security hot-fix that closes a potential low-risk vulnerability in authorization handling within the staking precompile.

Ed25519 Precompile

A new precompile is being activated at address 0x00000000000000000000000000000000000008f3. It allows EVM smart contracts to verify ed25519 signatures directly on-chain, without relying on off-chain proofs or custom Solidity implementations.

Interface

The precompile exposes a single function:

ed25519Verify(bytes32 publicKey, bytes32[2] signature, bytes message) returns (bool isValid)

• publicKey — 32-byte ed25519 public key
• signature — ed25519 signature as a fixed 2-element array of bytes32 (R and S halves)
• message — arbitrary byte payload that was signed
• Returns true if the signature is valid, false otherwise

Benefits

• Enables TAC EVM dApps to verify TON wallet signatures natively on-chain, which is critical for the TON–TAC bridge flows
• No need to deploy and audit custom Solidity cryptographic libraries
• Deterministic, gas-metered execution consistent with other EVM precompiles

Authz Fix in Staking Precompile

A hot-fix is applied to the staking precompile's authorization handling. Previously, a missing or incorrectly scoped authorization check could allow a caller to exercise delegation management rights they had not explicitly been granted.

What was fixed

• The precompile now correctly validates the x/authz grant before executing any state-changing staking operation on behalf of an origin address
• Unauthorized calls now return an explicit error instead of silently proceeding
• The fix closes the vulnerability without any changes to the existing public interface of the staking precompile

Impact

No changes to validator or delegator workflows are required. Existing x/authz grants remain valid. Contracts that relied on the unchecked path will need to obtain a proper grant to continue operating.

[AkKoks]

Proposal was created:

https://explorer.nodestake.org/tac/gov/5