Cosmos SDK 0.42 0.53 on a live chain: the bugs that fail silently

marselzaripov1988 — Mon, 12 Oct 2026 14:44:33 +0000

If your Cosmos SDK chain is still on 0.45 or older, it has been running without security patches for a while. Cosmos Labs dropped the LTS model in favour of release families. Only two are supported right now: 2025.1 (SDK 0.53, CometBFT 0.38) and 2026.1 (SDK 0.55, CometBFT 0.40). Everything below 0.53 is end-of-life.

I recently moved Artery Network from SDK v0.42.6 / Tendermint v0.34 / Go 1.15 to SDK v0.53.8 / CometBFT v0.38. It's a live chain with eight custom modules and roughly 383k accounts on mainnet. It runs its own bank module instead of x/bank and its own delegation model built on a referral tree.

This post is not a rewrite of UPGRADING.md. It covers what the official guides don't: the places where the chain compiles, passes its tests, keeps producing blocks, and is still broken.

All the code is public: github.com/marselzaripov1988/artr. Each hop has its own branch, and every fix commit explains the cause in detail.

Strategy: one hop per branch
It's tempting to bump go.mod straight to 0.53 and fix compile errors until it builds. Don't. You'll get thousands of errors and won't be able to tell a mechanical rename from a change in behaviour.

I went one major version at a time:

Branch SDK Consensus Go What the hop required
master 0.42.6 Tendermint 0.34.11 1.15 starting point
migrate/sdk-0.45 0.45.16 Tendermint 0.34.27 1.19 codec renames, ConsensusVersion, SupplyI and sdk.AddrLen gone
migrate/sdk-0.46 0.46.16 Tendermint 0.34.29 1.19 legacy REST removed, Tendermint → CometBFT in code
migrate/sdk-0.47 0.47.17 CometBFT 0.37 1.19 params moved out of x/params into module stores
migrate/sdk-0.50 0.50.15 CometBFT 0.38 1.22 ABCI 2.0, cosmossdk.io/*, appmodule
migrate/sdk-0.53 0.53.8 CometBFT 0.38 1.23 version bump only
Three rules:

A hop is done when every module test suite is green, not just when it builds.
Keep mechanical changes separate from decisions. Package renames go in one commit. Any place where I had to choose a behaviour gets its own commit that explains the choice.
Replace before it's removed. If the SDK is about to delete something your state format depends on, re-implement it on the previous version, while the original still exists, and test the two against each other.
Rule 3 saved the validator keys. types/bech32/legacybech32 is gone in 0.50, but Artery's validator consensus keys (artrvalconspub...) use it in genesis, in x/noding state and in messages. You can't change the state format of a running network. So on 0.47 I re-implemented the encoding and checked it against the original on 100 random keys. Only after that did I bump the SDK.

The 0.50 → 0.53 hop, by the way, needed zero code changes. All the work was in 0.47 and 0.50.

The three heavy lifts
0.47: params leave x/params
From 0.47 on, each module keeps its own params, and x/params is deprecated. All eight Artery modules read params through x/params subspaces.

Moving them is mechanical. The interesting part came after. Once all eight modules had moved, the x/params store was still mounted, but empty. Since 0.46, CacheMultiStoreWithVersion requires a version from every mounted IAVL tree, and a completely empty tree doesn't have one.

Result: every state query failed, whatever module it was for. The fix was to rip out x/params entirely (keeper, store, transient store, nine subspaces). Index stores that are legitimately empty now get a marker entry in InitGenesis.

0.50: ABCI 2.0, and a judgement call
BeginBlock and EndBlock are folded into FinalizeBlock, and handlers no longer receive the request. Votes and evidence now come through the context: ctx.VoteInfos() and ctx.CometInfo().

That's mostly mechanical, with one exception. Validator liveness used the boolean SignedLastBlock. CometBFT 0.38 replaced it with a three-state BlockIdFlag: committed, voted nil, absent.

// before (Tendermint 0.34)
if vote.SignedLastBlock { ... }

// after (CometBFT 0.38)
if vote.BlockIdFlag != cmtproto.BlockIDFlagAbsent { ... }
This is not a rename. It's a decision: does a nil vote count as a missed block? I count only absent. That matches what the SDK itself does in x/slashing, and it's closer to the old meaning, since in Tendermint 0.34 a nil vote still carried a signature.

0.50: the message signer moves into proto
This one is covered in detail below, because it belongs to the silent category.

Six bugs that left nothing in the logs
This is the useful part. Each of these bugs survived compilation and at least some of the tests. Several survived running devnets.

The upgrade is scheduled, the chain never halts A Cosmos software upgrade works like this: a governance proposal calls ScheduleUpgrade, every node halts at the same height, and operators swap the binary. For a mainnet migration this is critical, because halting at one height gives every node an identical state export.

In 0.50, x/upgrade checks the plan in a new PreBlock phase, not in BeginBlock. The app never called PreBlock. upgrade was still listed first in BeginBlockers, but it no longer has a BeginBlock.

From the outside: the vote passes, the plan is stored, the halt height arrives, and the chain just keeps going. No error, no warning.

A test didn't catch this. A full rehearsal on a test stand did: proposal, vote, plan at height 275, and the nodes went straight past it.

app.mm.SetOrderPreBlockers(
upgradetypes.ModuleName,
authtypes.ModuleName, // x/auth has PreBlock too; the manager panics if any module is missing
)
app.SetPreBlocker(app.PreBlocker)

func (app *ArteryApp) PreBlocker(ctx sdk.Context, _ *abci.RequestFinalizeBlock) (*sdk.ResponsePreBlock, error) {
return app.mm.PreBlock(ctx)
}
After the fix, both stand nodes halted exactly at the planned height.

Takeaway: verify the upgrade path with a rehearsal. A plan sitting in state proves nothing.

Time-based upgrade plans the SDK now rejects The second bug was in the same path. Artery's governance module scheduled upgrades by time: at some point the chain had deprecated height in favour of time. Since 0.47 the SDK goes the other way: Plan.ValidateBasic rejects a non-empty Time and requires a positive height.

The worst part is what the failure would have looked like. The proposal handler logs the error and moves on. The proposal stays in history as passed, everyone believes the halt is scheduled, and the chain doesn't stop.

The fix is to schedule by height. That's also more correct: every node has its own clock, but height is the same for all of them. The subtle part is history. The mainnet export contains old time-based proposals, and you can't declare half the chain's history invalid. So historical validation checks structure only.

The test asserts that "a plan is scheduled", not "no error", because the empty plan was the bug. A mutation check confirmed that the old code fails it.

No transaction can be sent After the 0.53 hop, every artrd tx ... command failed before broadcasting:

no cosmos.msg.v1.signer option found
Since 0.50, x/tx finds the signer through a proto option instead of the GetSigners() method. Artery's protos predate that requirement. Module tests didn't catch it, because they call keepers directly and skip signing.

I annotated all 28 message types across seven modules. Each signer field was taken from the existing GetSigners(), not guessed: the profile module has sender/address pairs where the signer isn't the account the message is about.

message MsgDelegate {
option (cosmos.msg.v1.signer) = "address";
...
}
Verified on testnet: a delegation went through with code 0 at height 91,985. It was the first transaction in 91,985 blocks. The chain had been alive the whole time, and accepting nothing.

Writes and reads on different key prefixes When the params moved, module data went under prefixes, but some keeper paths still used the raw store. Writes went to one place and reads came from another.

In x/noding the validator set came back empty and the node crashed on start. In x/referral tree lookups returned empty records. Neither raised an error, because an empty result isn't one.

Genesis export read past the end of a slice SDK 0.43 removed sdk.AddrLen, since addresses became variable-length. I replaced it with address.Len. But that's 32 bytes, the ADR-028 SHA-256 length, and Artery addresses are 20.

// before: bug
addr := key[:address.Len] // 32

// after
const addrLen = 20
addr := key[:addrLen]
Genesis export split keys at the wrong boundary. The bug went unnoticed through three hops and every devnet run, because devnets never export state. The first export/import test caught it.

The module is wired in but never initialised This one came up while adding IBC. The module manager runs InitGenesis only for modules that have a section in genesis. Neither the test genesis nor the mainnet export has ibc or transfer sections, so why would they.

The chain starts and runs normally. Then the first state export fails with params are not set in store. Exactly the same trap came back later in a CosmWasm trial, this time with wasm.v1.Params.

Why 0.53 and not 0.55
0.55 is newer, but it comes with CometBFT 0.40, which is another consensus-layer change. For a chain that has just been through ABCI 2.0, that's risk you don't need. 0.53 is supported and keeps CometBFT 0.38 as it is. Moving to 0.55 makes sense once 0.53 is proven on mainnet.

Checklist for your own migration
not done
One hop per branch. A hop is done only when every test suite is green.
not done
Rehearse the full upgrade cycle on a stand: proposal → vote → plan → halt. A plan in state proves nothing.
not done
Send a real transaction through the CLI after every hop from 0.50 on. Keeper tests skip signing.
not done
Run a genesis export → import test. Devnets never do it, and you can't move mainnet without it.
not done
Give every new module a genesis section, or it stays uninitialised.
not done
Replace removed constants by meaning, not by name. address.Len is not "the length of your addresses".
not done
An empty store is not a harmless store. A mounted, empty tree breaks queries for every module.
not done
Set up CI before you start. Artery had none, and two breakages were found on the server instead of in checks. Add a check that generated protobuf code matches the .proto files; that's how the signer annotations nearly got lost.
Wrapping up
Five hops, 56 commits, about 150 files changed in app and module code. On top of that: IBC (ibc-go v10, ICS-20), slashing for double-signing, and a CosmWasm trial. The 0.53 build runs on a test stand, and the mainnet switch-over is the next step.

If your chain is stuck on an old SDK version, I take on migrations like this one. Reach me on Telegram (@mars_developer), or see the code on GitHub.

DEV Community: marselzaripov1988

Cosmos SDK 0.42 0.53 on a live chain: the bugs that fail silently