Build on
Tezos X

Security

• tx.origin now resolves to the real originator across runtimes. On a cross-interface call, the EVM ORIGIN opcode returns the transaction originator while msg.sender still returns the immediate caller. Previously both returned the immediate caller, so the common EOA-only guard require(tx.origin == msg.sender) could be silently bypassed by routing a call through the Michelson interface. The originator is also preserved across an EVM → Michelson → EVM round-trip — it resolves back to the originating account instead of collapsing onto an internal alias. Direct EOA calls are unchanged (tx.origin == msg.sender as before).

New

• Contracts can now resolve cross-runtime address identity on-chain, through two read-only selectors on the runtime-gateway precompile (0xff…07) — both non-payable, log-free, and STATICCALL-safe, so they're callable from a view. originOf(addr, sourceRuntime) classifies an address as Native (a real account on that runtime), Alias (a forwarder standing in for a foreign caller), or Unknown — so a security gate or admin check can reject a foreign account's alias where it expects a genuine local account, the natural complement to the tx.origin fix above. A code-presence back-stop also recognizes CREATE/CREATE2 contracts and EIP-7702 delegated EOAs as Native. resolveAddress(addr, sourceRuntime, targetRuntime) returns the same identity's address on the other runtime and reports whether that counterpart is already materialized (its account exists) or still only derived (computable but not yet created) — letting a dApp route a cross-runtime payment or call to the correct address and, when needed, materialize the account first via a native atomic call rather than sending value to an address with no account behind it yet.
• A Michelson contract's synthetic cross-interface views are now discoverable through standard contract introspection. The enshrined gateway's staticcall_evm view is surfaced on the synthesized /script, so wallets, indexers, and block explorers find it the same way they find any declared Tezos view.
• Aliases originated as part of a native atomic call now emit dedicated receipts, so indexers can attribute the new account to the call that created it.

Improvements

• The monitor/heads/main RPC now honors the protocol and next_protocol filters and emits the current head immediately as the first element of the stream, matching L1's monitor_heads. Wait-for-head flows no longer block until the next block, and filtered clients no longer receive heads they excluded.
• Michelson/L1 parity: the same Michelson source now behaves identically on L1 and the Michelson interface. PUSH timestamp parses large decimal literals and RFC3339 leap-seconds like L1; UNPACK string rejects carriage returns and other non-permitted bytes; UNPACK rejects non-canonical zarith encodings; LSR bytes handles oversized shift counts without trapping; and big-map ids allocated during CREATE_CONTRACT are assigned in storage source order, like externally originated contracts.
• Same-runtime gateway round-trips no longer launder the caller's identity: when source and target runtimes match and the caller is a native account, the callee now sees the real msg.sender / SENDER instead of a re-derived alias — so msg.sender-based access controls (require(msg.sender == owner) and the like) stay correct even when a call is routed through the gateway within one runtime.

Fixes

• Alias materialization is now atomic. If forwarder initialization fails (revert, halt, or a gas budget below the intrinsic cost), the delegation code_hash write is rolled back. A failed init previously left a half-materialized account that a later call would bless without re-running initialization — permanently bricking the alias.
• Cross-runtime calls now enforce a maximum chain depth (≤ 128). A self-recursive Michelson↔EVM gateway cycle that previously wedged sequencer block production now fails cleanly at the operation level (catchable revert) once the cap is reached, leaving the block intact.
• Several conditions that could previously abort a whole block now surface as catchable, operation-level errors instead: EVM pre-execution validation failures (e.g. a forwarded gas limit below the intrinsic cost) on the cross-runtime and static-call paths, an inbound Michelson X-Tezos-Sender that is an implicit tz1/tz2/tz3 account, and other user-triggerable errors.
• A failed cross-runtime call now always records its receipt, even when the caller's leftover gas is too low to encode the call event — the kernel sponsors that encoding from a dedicated budget. Indexers and call-graph reconstruction no longer go blind on gas-tight failed calls, and a successful call can no longer be misreported as out-of-gas by this bookkeeping.
• Deeply nested Michelson input is now bounded by gas instead of trapping the runtime: (de)serialization, typechecking, interpretation, and the related walks run iteratively rather than recursively, so adversarially deep input fails on gas rather than crashing.
• Fixed transient big-maps allocated by a Michelson callee leaking into — and persisting in — durable storage on the inbound cross-runtime path, where they could collide with real durable big-maps.

Action required

• Re-create your accounts after this upgrade. Addresses and their aliases created before this update may now misbehave. Generate fresh addresses — their new aliases will work correctly. If octez-client aliases you set up earlier are throwing errors, this is why.

New

• Michelson code can now read EVM state synchronously — the mirror of the EVM→Michelson view added in v0.2. A VIEW reaching the cross-interface gateway returns the EVM response with no value transfer, so it works even inside Michelson view bodies, where TRANSFER_TOKENS is forbidden. The view takes (destination, calldata) and returns the EVM response wrapped in Some on success.
• Cross-interface reads now enforce a real static-call contract: the read entry rejects any attached value and refuses any state change. Attempting to write storage, emit a log, deploy, self-destruct, or send value during a static read fails cleanly with a catchable error instead of corrupting the call.

Improvements

• Michelson operations now pay storage burn like Tezos L1: originations, transfers that grow storage, and the first credit to a fresh implicit account each burn tez in proportion to the storage they use. An operation whose source can't cover the burn is cleanly backtracked with no partial state, matching L1 manager-operation semantics. Keep enough tez on your accounts to cover storage.

Fixes

• Internal failures in the Michelson runtime now surface as structured errors instead of opaque aborts, making failed operations easier to diagnose.

Improvements

• Michelson manager-operation receipts now report real storage_size and paid_storage_size_diff. Originations, transfers and updates surface the contract's actual storage footprint instead of zeros, matching the receipt shape produced by Tezos L1.

New

• Deposits targeting a Tezos implicit account (tz1…) now emit a Michelson deposit event of type pair (nat %inbox_level) (nat %inbox_msg_id) on the operation receipt. Indexers can correlate the L2 credit with the exact shared-inbox message that triggered it.
• Deposits to a Tezos implicit account also emit balance updates on the receipt, so TzKT and Tezos wallets attribute the credit to the right account without inferring it from context.